In the context of the project we are working on recently, we would like to enable users to "leave a message" to someone on the Internet securely. Our setting is as below:

  • ECC key pairs for open ID
  • AES-GCM as session for each message
  • Suppose Bob wants to leave a secret message to Alice, whose public key is known to the public.
    1. Alice's key pair is (priv_a, pub_a)
    2. Bob's key pair is (priv_b, pub_b)
    3. Bob generates an ephemeral ECC key pair (epriv_b, epub_b)
    4. Bob computes the shared secret of epriv_b and pub_a
    5. Bob derives an AES-GCM key from the shared secret and creates (epub_b, sig of epub_b using priv_b, encrypted message using AES-GCM key) as M
    6. Bob leaves this message somewhere (could either be public or private) so that Alice could see it
    7. Alice performs the same process to derive the AES-GCM key to decrypt the message and verify Bob

In this scenario, the forward secrecy is not guaranteed. I am curious if we can possibly ensure the forward secrecy under this scenario with only half round of communication (one-sided). If not, is there any alternative that I can adopt to accomplish the goal? Any direction or hint is appreciated.

  • $\begingroup$ I am using ECDH in the whole process as shown in computing the shared secret in step 4 and 7 $\endgroup$
    – yisiliu
    Apr 19, 2019 at 12:02
  • $\begingroup$ What you mean that forward secrecy is not guaranteed? $\endgroup$
    – kelalaka
    Apr 19, 2019 at 12:04
  • $\begingroup$ I don't think you can guarantee forward security if you still need to decrypt the ciphertext by definition. Kind of obviously you need to maintain a private key to decrypt after all. $\endgroup$
    – Maarten Bodewes
    Apr 19, 2019 at 12:05
  • $\begingroup$ @kelalaka since here only one party is generating an ephemeral key pair for ECDH $\endgroup$
    – yisiliu
    Apr 19, 2019 at 12:06
  • $\begingroup$ @MaartenBodewes Yes, I understand that so I am actually looking for some alternatives here. Do you have any suggestions if some of the conditions can be relaxed? $\endgroup$
    – yisiliu
    Apr 19, 2019 at 12:07

1 Answer 1


I am curious if we can possibly ensure the forward secrecy under this scenario with only one round of communication.

I do not believe so; the protocol can be summarized as:

  1. Alice publishes her long term key
  2. Bob does some work (without having Alice do anything)
  3. Alice does some work, and retrieves the message

If, anywhere between points 1 and 2, Alice's state was copied, then the copy of Alice's state would be able to perform step 3 just as well as Alice did, and so you don't get PFS.

Also, terminology correction: you asked whether this can be done with only one round of communication; actually, it can, by having Alice send a message at the start of step 2. Obviously, this doesn't work for your project; what you need is actually a 'half round' exchange.

  • $\begingroup$ Thanks for the correction! I've just modified it. $\endgroup$
    – yisiliu
    Apr 19, 2019 at 12:12
  • $\begingroup$ I am wondering if anyone has done any similar work before for this type of scenario? $\endgroup$
    – yisiliu
    Apr 19, 2019 at 12:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.