Is CECPQ2 forward secure?

Question

Is the CECPQ2 key exchange, as deployed by Google[1] and Cloudflare[2] in TLS 1.3 forward secure against quantum computers?

I know that it is using HRSS+SKY as the post-quantum part of the key exchange, but the papers I could find that were describing it do not speak of forward secrecy (either as a present or an absent property).

I do know that the CECPQ2b variant is based on SIKE, and that one has a Diffie-Hellman like operation[3], so it can provide forward secure operation.

I'm mostly interested in how the post-quantum algorithms can provide forward secrecy and at the same time not require use of either HelloRetryRequest handshake in TLS 1.3 or out of band server key distribution.

Answer 1

Forward security (a protocol level feature) and key exchange schemes are indeed two orthogonal topics.

Forward security says the break of a current key does not allow the attacker to learn any communication in the past. To this end, any protocol that uses ephemeral key exchange scheme (i.e., use new keys for new sessions) is forward secure. The only requirement the protocol may have on the key exchange scheme is that the public/secret key pairs can be generated fairly efficiently. (This was not true for RSA, and hence, all the fuss about forward security.) For NTRU-HRSS-SKY this is indeed true. So you will have forward secrecy if you use fresh NTRU keys for every new sessions.