In the context of the project we are working on recently, we would like to enable users to "leave a message" to someone on the Internet securely. Our setting is as below:
- ECC key pairs for open ID
- AES-GCM as session for each message
- Suppose Bob wants to leave a secret message to Alice, whose public key is known to the public.
- Alice's key pair is (priv_a, pub_a)
- Bob's key pair is (priv_b, pub_b)
- Bob generates an ephemeral ECC key pair (epriv_b, epub_b)
- Bob computes the shared secret of epriv_b and pub_a
- Bob derives an AES-GCM key from the shared secret and creates (epub_b, sig of epub_b using priv_b, encrypted message using AES-GCM key) as M
- Bob leaves this message somewhere (could either be public or private) so that Alice could see it
- Alice performs the same process to derive the AES-GCM key to decrypt the message and verify Bob
In this scenario, the forward secrecy is not guaranteed. I am curious if we can possibly ensure the forward secrecy under this scenario with only half round of communication (one-sided). If not, is there any alternative that I can adopt to accomplish the goal? Any direction or hint is appreciated.