Is the CECPQ2 key exchange, as deployed by Google[1] and Cloudflare[2] in TLS 1.3 forward secure against quantum computers?

I know that it is using HRSS+SKY as the post-quantum part of the key exchange, but the papers I could find that were describing it do not speak of forward secrecy (either as a present or an absent property).

I do know that the CECPQ2b variant is based on SIKE, and that one has a Diffie-Hellman like operation[3], so it can provide forward secure operation.

I'm mostly interested in how the post-quantum algorithms can provide forward secrecy and at the same time not require use of either HelloRetryRequest handshake in TLS 1.3 or out of band server key distribution.


Forward security (a protocol level feature) and key exchange schemes are indeed two orthogonal topics.

Forward security says the break of a current key does not allow the attacker to learn any communication in the past. To this end, any protocol that uses ephemeral key exchange scheme (i.e., use new keys for new sessions) is forward secure. The only requirement the protocol may have on the key exchange scheme is that the public/secret key pairs can be generated fairly efficiently. (This was not true for RSA, and hence, all the fuss about forward security.) For NTRU-HRSS-SKY this is indeed true. So you will have forward secrecy if you use fresh NTRU keys for every new sessions.

| improve this answer | |
  • $\begingroup$ That does not answer the last section in the question: yes, I know you can have ephemeral and thus forward secret key exchange with RSA, but it's not something that can be done in just 1 RTT... or is the client providing a raw key to the server and then the server is encrypting the key exchange secret with it? $\endgroup$ – Hubert Kario Sep 21 '19 at 20:42
  • $\begingroup$ Yes, I believe that is the common usage of the scheme - using KEM to encapsulate the actual session key, presumably an AES key. $\endgroup$ – zhenfei zhang Sep 24 '19 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.