3
$\begingroup$

After reading these papers on Post-Compromise Security:

  • Post Compromise Security
  • Asynchronous Ratcheting Trees

    My understanding is the following: it is possible for a key-agreement protocol to offer post-compromise security if the protocol offers a key update process and if the adversary is passive.

    Therefore, can a key-agreement such as ECDH-RSA can be updated to provide Post-Compromise security?
    And is my understanding of Post-Compromise security correct?
$\endgroup$
1
  • $\begingroup$ I think a "key update process" in this context means that you fully restore pre-compromise security claims if the adversary is passive for some time after the compromise. ECDH-RSA doesn't offer this naturally, but you could probably construct a stateful scheme similar to it that would update the RSA keys to achieve this. $\endgroup$
    – SEJPM
    Apr 20 '20 at 7:54
1
$\begingroup$

Post-compromise security secures future messages if the key for present messages is compromised. It repairs itself by using key update process. Key update process derives new key for future messages by using assymetric key exchange like DHE and chain of key derivation function.

If your present key is compromised by external sources, anytime when next DHE will happen, it will derive new key from that point. So the compromised key cannot be used to decrypt future messages. Whereas in key derivation chain, if it outputs separate key for each message, compromising one key will not compromise future keys but with a condition that the key that goes into the chain as input shouldn't be compromised because it acts as seed.

Based on how frequently DHE happens during the session, the attacker can compromise only subset of messages. But as DHE can itself be compromised by MITM, it only works in a condition if the attacker is passively listening the communication and relies on external sources to compromise keys.

Signal protocol does that by exchanging new key using DHE with every incoming message and derives new key for each message from symmetric ratchet.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.