4
$\begingroup$

In recent weeks the concept of (perfect) forward security/secrecy has been mentioned a lot, primarily in the context of the shocking revelations about NSA eavesdropping. As far as I'm aware, this concept was introduced by C. G. Günther in [1]. Unfortunately [1] only sketches the concept but does not give a security definition. The survey [2] gives a formal security definition only for forward secure pseudo-random generators. The textbooks [3, 4, 5, 6] all don't even mention the concept, and the relevant Wikipedia article is near unreadable.

Could somebody please point me towards a formal definition of (perfect) forward security/secrecy?

  1. C. G. Günther, "An Identity-based Key-exchange Protocol".
  2. G. Itkis, "Forward Security: Adaptive Cryptography: Time Evolution".
  3. J. Katz, Y. Lindell, "Introductin to Modern Cryptography".
  4. O. Goldreich, "Foundations of Cryptography".
  5. J. Hoffstein, J. Pipher, J. H. Silverma, "An Introduction to Mathematical Cryptography".
  6. D. R. Stinson, "Cryptography: Theory and Practise".
| improve this question | |
$\endgroup$
2
$\begingroup$

Do you have a specific application domain in mind? I do not know of any formal definition that spans multiple application domains.

A formal definition of Perfect Forward Secrecy for the domain of key exchange protocols is included in this paper:

Beyond eCK: Perfect Forward Secrecy under Actor Compromise and Ephemeral-Key Reveal

| improve this answer | |
$\endgroup$
  • $\begingroup$ Thank you. My application is quite simple, I want to understand precisely what it means that e.g. Google is using perfectly forward secure encryption of my communications. I suspect that it does not mean much given the requirements of various legislations to store relevant meta-data. $\endgroup$ – Martin Berger Jun 28 '13 at 13:33
  • $\begingroup$ I agree, and I doubt that the formal definitions you will find will have any relation to the claims made by such companies. $\endgroup$ – user4621 Jun 28 '13 at 13:46
  • 1
    $\begingroup$ Possibly they mean shielding the communications from adversaries on the network; but of course on their servers your communication is in plaintext. Legislations for storing data/wiretapping are a very different threat model. I would guess that their statement simply means that they're using SSL/TLS in a Diffie-Hellman mode. $\endgroup$ – user4621 Jun 28 '13 at 13:48
  • $\begingroup$ Legisation has a direct effect on the applicability of the threat model. For example if session key have to be stored, as I belive they would have to in the UK, then a threat-model that assumes adversaries cannot get hold of ephemeral key material would be inappropriate. $\endgroup$ – Martin Berger Jun 30 '13 at 10:26
  • 1
    $\begingroup$ If the protocol stores the session key for law enforcement (or, say, encrypts it with the public key of law enforcement agencies and includes this in a transmission) then of course perfect forward secrecy is not satisfied wrt those agencies. $\endgroup$ – user4621 Jun 30 '13 at 12:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.