5
$\begingroup$

In this blog post, Matthew Green says

Forward secrecy (usually misnamed “perfect forward secrecy”)...

The Wikipedia article on forward secrecy (which the same sentence links to in the blog) says

forward secrecy (FS), also known as perfect forward secrecy (PFS)...

which implies that they are the same thing and nullifies Matthew Green's statement.

Apparently Professor Green's statement is simply a personal disagreement with the term perfect

I'd be interested in knowing how forward secrecy is/isn't 'perfect',(why cryptographers disagree with perfect) and why was the term was originally attached to forward secrecy?

$\endgroup$
5
  • $\begingroup$ They are same What is Perfect forward secrecy?. Do you know the meaning of misnamed? $\endgroup$ – kelalaka Jul 5 '20 at 16:37
  • $\begingroup$ @kelalaka Yeah I do. Its just that lots of people use words like these ambiguously. So I couldn't really be sure if he disagreed with the terminology or he meant that people often used 'perfect forward secrecy' when they mean 'forward secrecy' because their was a subtle distinction between them that they weren't aware of. Thanks anyways. $\endgroup$ – Giving Up Jul 5 '20 at 16:47
  • 2
    $\begingroup$ I guess it is still interesting to know how the "perfect" part came into being. I disagree with it as well as it seems to indicate that the secrecy itself is perfect, which it obviously isn't. Both the DH scheme as the encryption itself can still be attacked. It's pretty far removed from a "perfect cipher" for sure. $\endgroup$ – Maarten Bodewes Jul 5 '20 at 17:22
  • $\begingroup$ @MaartenBodewes I have edited the question as you recommended. Feel free to further edit and improve it if you think I haven't phrased it well or something $\endgroup$ – Giving Up Jul 5 '20 at 18:51
  • $\begingroup$ Wikipedia's articles first edit gave IEEE 1363-2000: IEEE Standard Specifications For Public Key Cryptography. Institute of Electrical and Electronics Engineers, 2000. standards.ieee.org as the source of PFS is also known as forward secrecy. This may indicate FPS was earlier. I've no free access to this document... $\endgroup$ – kelalaka Jul 5 '20 at 19:49
1
$\begingroup$

Forward secrecy of key-establishment (KE) protocol means, that compromising of long-term keys of parties doesn't affect secrecy of established keys in the past.

Example to clarify what PFS means. Say parties A and B have private keys $s_B$ and $s_B$. Today they run KE and establish a key $k_1$. They use this key during a session, and then destroy this key. During this session, attacker eavesdropped all the messages and remembers the transcript $T$ of the session. Obviously, $T$ includes messages of KE, and subsequent "data" messages, encrypted with key $k_1$. Tomorrow, attacker somehow gets keys $s_A$ and $s_B$, but not $k_1$ (because $k_1$ was destroyed and forgotten by $A$ and $B$). And here comes PFS property of KE: even having $T$, $s_A$ and $s_B$, attacker is unable to find $k_1$ and decrypt messages hidden in $T$.

Then answering your question, why in PFS word "perfect" is ambiguous. It's an opinion of M.Green obviously, but I will try to guess what he means. Actually I feel pretty the same regarding this term. "Perfect" is ambiguous here. E.g., we don't use "perfectly secure signature scheme", we just use "secure". Moreover, in cryptography word "perfect" appears sometimes in order to describe that some property (usually some sort of secrecy) is based not on computational assumptions, but it's perfect - i.e., unconditional and doesn't require any assumptions/hypotheses. Examples:

So, in cryptography "perfect" is usually a synonym to https://en.wikipedia.org/wiki/Information-theoretic_security. But for some stupid reason - not in this case (in case of KE).

So, more clear would be to have a term "Forward Secrecy", and then, additional "Perfect" would mean that it doesn't require any assumptions and it's unconditional. But for some historic reason, in literature PFS is used for regular forward secrecy.

$\endgroup$
1
$\begingroup$

Why was the term (perfect) originally attached to forward secrecy

No reason is given by Christoph G. Günther in An Identity-Based Key-Exchange Protocol (in proceedings of Eurocrypt 1989), which is the earliest use on record and claims the notion:

  • This modification restores a property of the Diffie-Hellman scheme, which we could call perfect forward secrecy. If Alice and Bob are not impersonated, when the protocol is run, finding the key $\zeta$ is as difficult as breaking the Diffie-Hellman scheme for every third party.

At least, it is clear that perfect does not mean that even a computationally unbounded adversary can't break the scheme.

So my opinion is that perfect is there because it sounds good, and makes a Three Letter Acronym that caught.

$\endgroup$
0
$\begingroup$

The blog post by Matthew Green is an Op-Ed (Opinion Editorial) and is his opinion based on facts.

Further in the paragraph, Green says, "Many online messaging systems like off-the-record messaging use PFS by default, essentially deriving a new key with each message volley sent."

Green clearly identified forward secrecy as PFS (Private Forward Secrecy) the same as the wiki post, regardless of his opinion that FS is "misnamed" as PFS.

Both articles are saying the same thing and Green used an example of PFS. Also, my college says to never cite wiki as a reliable source (Research further, read the footnote sources).

I hope this helps.

$\endgroup$
0
$\begingroup$

The way I understand this:

  • Two parties benefit from forward secrecy e.g. when they use key exchange like DH to establish shared secret periodically, which is then used to derive separate symmetric encryption key for every message they send, e.g. using KDF. Between the key exchanges ke1 and ke2 they send each other n >= 0 messages. Hence if the key gets compromised, all the messages exchanged between that point in time and the next key exchange could get decrypted, which is down to the nature of KDF. However, prior messages could not get decrypted. In other words:

    DH -> KDF -> exchange 1 message -> KDF -> exchange 1 message -> ... -> DH -> ... .

  • Two parties benefit from perfect forward secrecy e.g. when they use key exchange like DHE (ephemeral DH) to establish new shared secret AND then they derive a symmetric encryption key separately for every message they send, e.g. using KDF. Between the key exchanges ke1 and ke2 they send each other 1 >= n >= 0 messages. Hence if the key gets compromised, at most a single message could be decrypted by the attacker. In other words:

    DH -> KDF -> exchange 1 message -> DH -> KDF -> ... .

That's my understanding, you can find other sources which understand it in a similar way, e.g. this blog post, or that F5 DevCentral video (which is in line with their BIG-IP manual). However, like with nonce vs IV (and sometimes even vs salt) questions, I believe different people will have different opinions.

EDIT

One more link.

$\endgroup$
2
  • $\begingroup$ I don't agree with the link. If the keys are dependent then once a key is compromised the rest also can. Forward secrecy already implicitly requires this. We would rather see the first use to see the real reason. Today, if we say there is no difference, then yesterday, in the initial definition of PFS and FS there should be a difference that the definers are not aware that they are equal. DH in the first hand defined Ephemerally in the original paper. People abused it. $\endgroup$ – kelalaka Jul 6 '20 at 12:57
  • $\begingroup$ "Today, if we say there is no difference, then yesterday, in the initial definition of PFS and FS there should be a difference that the definers are not aware that they are equal. DH in the first hand defined Ephemerally in the original paper." - That's interesting. Would you be able to share link to the original paper you are referrign to? I'm keen to read up on it. $\endgroup$ – automatictester Jul 11 '20 at 9:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.