Struggling to understand Perfect Forward Secrecy

Question

From the definition on Wikipedia:

In cryptography, forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that session keys will not be compromised even if the private key of the server is compromised.

So, if I am understanding this right, a protocol establishes PFS if the leak of the master key does not enable a calculation of already-used session keys.

But I read a question here that PFS can be achieved by deriving session keys with a hash of an old session key. But if I were to know the master key (the pre-shared key?), I could easily calculate all session keys or am I misunderstanding something?

Answer 1

But I read a question here that PFS can be achieved by deriving session keys with a hash of an old session key. But if I were to know the master key (the pre-shared key?), I could easily calculate all session keys or am I misunderstanding something?

So the idea of PFS is that if the entire (secret) state of an entity at a time point $x$ is leaked and there exists at least one previous session, then there is a time point $x'<x$ where before that you lack knowledge to recover information from ciphertexts.

If we use this more formal definition and the participants do indeed erase old keys upon a key-update, then the scheme from the other question provides forward secrecy. If the initial key is now leaked, the first condition is violated as there is no previous session and the definition doesn't claim post-compromise security (where if you leak state at one point it will recover from passive adversaries). Now if you leak the state at a later point then obviously you cannot recover the key from a previous session because the hash is one-way.

Answer 2

Perfect forward secrecy usually involves a ratchet so it's helpful to visualize it as such.

Strictly for PFS, without state compromise recovery, you do not require an asymmetric cryptographic scheme at all. Solely symmetric suffices.

The way it works is that you have a state (reached either through a pre-shared key or an asymmetric key exchange) which yields (it can be part or even the full state but for security hygiene an additional hash is usually used - it also allows you to keep some past keys cached for asynchronous communications risking only what those keys encrypt and not the state) a symmetric key used for encryption and communication. The state is then ratcheted forward usually using a hash function - the previous state becomes impossible to reach after it's destroyed.

Compromise of the state allows compromise of encryption up until the state has last been ratcheted, going past that point is not possible if the implementation is correct and the relevant information was properly destroyed. Note that after such a compromise the adversary can ratchet along with you and compromise all future communications. PFS protects the past not the future.

If you add to this an asymmetric ratchet as well (good instant messaging protocols do this) whereby in addition to ratcheting the symmetric state you also mix in a new state from an ephemeral key exchange, then a compromise (assuming it does not endure) will only compromise the information between the last symmetric ratcheting and the next asymmetric ratcheting.

Answer 3

A short a intuitive answer would be that;

Perfect forward secrecy would be a cryptographic mechanism where by;

If I stole the current private keys a group is using for securing their communications, I would only be able to decrypt the current cipher text.

I would however fail to decrypt past & future cipher texts

This is because the cryptographic keys are constantly regenerated.

i.e each session of communication is encrypted with a different/unique private key.

Hence, theft of encryption keys limits the damage to one epoch/session of communication.