Can I do a forward secure half-round ephemeral-static ECDH?

Question

In the context of the project we are working on recently, we would like to enable users to "leave a message" to someone on the Internet securely. Our setting is as below:

• ECC key pairs for open ID
• AES-GCM as session for each message
• Suppose Bob wants to leave a secret message to Alice, whose public key is known to the public.
  1. Alice's key pair is (priv_a, pub_a)
  2. Bob's key pair is (priv_b, pub_b)
  3. Bob generates an ephemeral ECC key pair (epriv_b, epub_b)
  4. Bob computes the shared secret of epriv_b and pub_a
  5. Bob derives an AES-GCM key from the shared secret and creates (epub_b, sig of epub_b using priv_b, encrypted message using AES-GCM key) as M
  6. Bob leaves this message somewhere (could either be public or private) so that Alice could see it
  7. Alice performs the same process to derive the AES-GCM key to decrypt the message and verify Bob

In this scenario, the forward secrecy is not guaranteed. I am curious if we can possibly ensure the forward secrecy under this scenario with only half round of communication (one-sided). If not, is there any alternative that I can adopt to accomplish the goal? Any direction or hint is appreciated.

Answer 1

I am curious if we can possibly ensure the forward secrecy under this scenario with only one round of communication.

I do not believe so; the protocol can be summarized as:

1. Alice publishes her long term key
2. Bob does some work (without having Alice do anything)
3. Alice does some work, and retrieves the message

If, anywhere between points 1 and 2, Alice's state was copied, then the copy of Alice's state would be able to perform step 3 just as well as Alice did, and so you don't get PFS.

Also, terminology correction: you asked whether this can be done with only one round of communication; actually, it can, by having Alice send a message at the start of step 2. Obviously, this doesn't work for your project; what you need is actually a 'half round' exchange.