Questions tagged [forward-secrecy]
A security property wherein past messages are protected against future compromise of the master keys.
75
questions
5
votes
1
answer
105
views
Why is forward secrecy needed at X3DH?
In the official documentation of the X3DH Algorithm (link) is made an analysis about the forward secrecy. Forward secrecy would be an uselful property if we would repeat the protocol multiple times. ...
- 308
2
votes
2
answers
957
views
How does perfect forward secrecy work for messaging?
I am struggling to understand how messaging protocols (like Signal) are able to use perfect forward secrecy. My understanding is that the server generates temporary keys which are used in combination ...
- 45
2
votes
1
answer
67
views
Are there any significant ways in which TLS could still be improved?
With TLS 1.3 supporting only secure, forward-secret cipher suites, are there any significant technological improvements that could still be made to the protocol?
- 21
1
vote
1
answer
121
views
Forward-Secure AKE based on post-quantum KEM?
I am looking for authenticated key exchange protocols (AKE) based on a generic key encapsulation mechanism (KEM) and providing full/perfect forward secrecy. Optionally, the protocols should offer ...
- 11
1
vote
0
answers
77
views
Signal double ratchet only giving "weak" forward secrecy?
I was just watching this video on the Double ratcheting protocol.
at around 31:37, the presenter says that the protocol only provides weak forward secrecy.
I've only ever heard about a distinction ...
- 131
2
votes
0
answers
67
views
SSL/TLS Forward secrecy with 2 KEM public keys
As we know, NIST PQC project is at its 3rd round, with draft standard expected to arrive in the next (few) year(s).
An unfortunate fact is that, we're not seeing many signature schemes general-purpose ...
- 8,291
1
vote
1
answer
294
views
Does the libsodium sealedbox provide forward secrecy?
I am using sodiumoxide, a Rust binding to libsodium that provides a function named sealedbox that requires the receiver's public key. However, they also mention that the message is encrypted with an ...
- 13
1
vote
1
answer
379
views
Why is DH key exchange still useful, if a public key certificate is used?
EDIT:
According to Gilles's comments and fgrieu's answer below, I would like to summarize what I have learned, and what's still needs explanation:
DHKE is necessary for forward secrecy even when PKI ...
- 139
0
votes
1
answer
89
views
When do we redo the Diffie-Hellman Exchange?
I'm planning on making a chat application for fun, in C++. I just have a few questions in order to maintain forward/future secrecy across messages.
If one party is offline, but the other isn't, what ...
- 1
1
vote
1
answer
102
views
what motivated the design decisions of RFC 8291 ("Message Encryption for Web Push")?
Related question here.
I'm reading RFC 8291, which describes a protocol to protect web push messages sent between an application server and a user agent (typically a mobile browser or other mobile ...
1
vote
0
answers
256
views
Are key evolving signatures (or forward secure signatures) that secure?
Reading this paper Forward-Secure Digital Signature Scheme I discovered the notion of key evolving signatures. The intuition behind these signatures is clear: one uses different private keys to ...
- 712
0
votes
0
answers
56
views
Is any encryption system that changes keys for each session "forward secure"? [duplicate]
As far as i understand, a encryption system is forward secure if new session keys are generated for each session, which is also part of what wikipedia says about forward secrecy:
By generating a ...
- 101
5
votes
4
answers
388
views
What does perfect mean within perfect forward secrecy and why do some cryptographers disagree with the term?
In this blog post, Matthew Green says
Forward secrecy (usually misnamed “perfect forward secrecy”)...
The Wikipedia article on forward secrecy (which the same sentence links to in the blog) says
...
user80567
1
vote
1
answer
124
views
Forward Security of Symmetric Encryption Schemes with LFSR based PRNG
Forward security can be achieved using symmetric encryption schemes by combining with a pseudo-random number generator (PRNG). Does LFSR based PRNG provide forward security in this case?
- 81
0
votes
0
answers
172
views
How does DHE-RSA work and why is PFS guaranteed?
How does it work and why is forward secrecy guaranteed? I understood that it is not susceptible to a man-in-the-middle attack by using certificates in the beginning.
- 153
17
votes
4
answers
9k
views
Creating cryptographic algorithms at runtime
Would it be possible to create a program with which to create a cryptographic algorithm (i.e. encryption or hash) using well-known elements of other algorithms in the same way that algorithms "reuse" ...
- 189
7
votes
4
answers
3k
views
Is encrypted e-mail sent over TLS 1.3 a form of "forward secrecy" (similar to something like Signal)?
One common complaint about GPG-encrypted e-mail is that it doesn't provide forward secrecy; however with opportunistic TLS becoming increasingly common in both IMAP and SMTP, it's not unreasonable to ...
- 181
1
vote
0
answers
120
views
Perfect Forward Secrecy Stream Cipher based on Block Cipher
I'm thinking about ways to encrypt an endless stream of data (e.g. a video or audio feed) in a way, where a compromise of the current internal state of the encryption (e.g. a RAM dump) does not ...
- 111
3
votes
1
answer
707
views
Providing forward secrecy with RSA
Forward secrecy with RSA is asked here:
Is perfect-forward secrecy achieved with RSA? and fgrieu gave an answer based on creating temporary RSA keys and signing them. And, in the end, he mentions
...
- 46k
0
votes
1
answer
767
views
Different ways of building a ChaCha20-based RNG
Let's say you're building RNG with ChaCha20 and the fast key erasure technique. There seem to be a few ways to do it.
The reference implementation in the SUPERCOP benchmarking toolkit looks like ...
- 331
3
votes
3
answers
555
views
Struggling to understand Perfect Forward Secrecy
From the definition on Wikipedia:
In cryptography, forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that ...
- 31
1
vote
1
answer
85
views
Secure Communication
Focus:
I have to design a secure keep alive communication protocol and was wondering if it was necessary to sign the ciphertext after the session key has been generated as an attacker will not know ...
- 13
1
vote
2
answers
1k
views
What is the difference between forward secrecy and key freshness?
Is all random private key that generating a unique session key is both forward secrecy and key freshness?
- 305
6
votes
1
answer
1k
views
Is forward secrecy overhyped or necessary?
Forward Secrecy, also perfect forward secrecy, gives assurance about session keys even the private key is compromised. This is achieved by generating a random key per session without using a ...
- 46k
0
votes
1
answer
190
views
Does Off-The-Record protocol provide future (backward) secrecy?
I know Signal provides future (backward) secrecy, and that it is based on Off-The-Record protocol. However, does OTR by itself also provide future secrecy?
- 438
3
votes
1
answer
276
views
Can perfect forward secrecy introduce vulnerabilities?
Is it always a win or could PFS algorithms introduce new attack vectors or weaken the level of secrecy vs not being used?
- 131
0
votes
1
answer
141
views
Hash ratchets with truncating hash function
I'm working on a forward secret messaging system that relies on hash ratchet. I'm using BLAKE2b as the one-way function, which by default produces 512-bit digests. These digests are truncated by my ...
- 61
2
votes
0
answers
113
views
Proving the lack of Perfect Forward Secrecy
In specific regarding the NSA's Key Exchange Algorithm, I read in an analysis of the protocol that perfect forward secrecy cannot be provided.
Is there any way to prove or justify this? I couldn't ...
- 21
1
vote
0
answers
104
views
Is there hierarchical key generation that completely tolerates leakage?
Is there a hierarchical key construction algorithm that achieves forward/backward privacy with any (unlimited) leakage of private non-master keys?
What I mean is that if there's an unbounded number ...
- 153
2
votes
2
answers
190
views
What do people mean when they talk about forward secrecy in ciphers?
I've heard several people and websites talk about ciphers that have forward secrecy. I know about forward secrecy in key agreement protocols, e.g. RLWE, (EC/SI)DH, QKD, etc. This could be what they're ...
- 53
6
votes
2
answers
2k
views
Are there benefits for using Static Diffie-Hellman over Ephemeral Diffie-Hellman?
TL;DR - Are there any benefits to using static DH over ephemeral DH?
I'm reading about the differences between static DH & ephemeral DH and I am trying to think of one logical reason to use ...
user58434
2
votes
1
answer
450
views
Post-quantum authenticated key exchange with forward secrecy
Are there any post-quantum, forward-secure, hybrid, optionally authenticated key exchange protocols? Specifically, I am looking for one that can be deployed in a hybrid with X25519 + EdDSA.
- 4,763
4
votes
2
answers
614
views
Questions about the double ratchet mechanism in Signal
I am trying to understand the threats the double ratchet system is trying to prevent against.
The threats mentioned in the paper do not quite make sense to me. May be someone can explain where I am ...
- 465
8
votes
1
answer
2k
views
Secure group chat with large groups
I was reading in Whatsapp group chat the sender encrypts a key individually for each memeber. And everyone invalidates their key whenever anyone leaves the group.
Whatsapp also limits group size to ...
- 11.6k
3
votes
1
answer
2k
views
Is it possible to implement the Signal Protocol without a server?
My question is regarding the Signal Protocol[1]. Is it possible to implement the protocol securely, without a server?
(I have no particular motivation for the question other than to understand better ...
- 33
3
votes
2
answers
235
views
Role of long-term asymmetric keys in a forward secrecy instant messaging protocol?
I am trying to understand how forward secrecy works in general, using a simple instant messaging protocol as an example. Tell me if I have this process right or not:
1) Alice and Bob each generate a ...
- 33
2
votes
1
answer
153
views
Mitigating the damage when a signing key is stolen
Let's say we have a server whose job is to sign documents using a private key. Let's say that there's a bug in the software and the private key gets stolen. I'm interested in mechanisms to mitigate ...
- 106
0
votes
1
answer
628
views
What order should these HTTPS ciphers go in to maximize security?
I want to set up a very secure-from-MITM-attacks server. I have these algorithms enabled in my nginx and I'm getting an A+ on ssllabs.com but it's complaining that my cipher strength isn't 100% and ...
- 103
1
vote
1
answer
325
views
One way communication with forward secrecy?
Is it possible to achieve forward secrecy using a one way communication channel with pre-shared secret?
I have a setup where I need to send some information across a unsafe channel between server A ...
CodeMonkey
2
votes
1
answer
522
views
How can I ensure forward secrecy when storing encrypted messages in a public blockchain?
I want to store encrypted sensitive messages in the blockchain.
I was thinking of using public-key cryptography to achieve this, but as the encrypted data will be stored forever in the blockchain and ...
- 123
1
vote
1
answer
53
views
Equivalance Operator - Perfect Secrecy
The equivalance operator is the inverse of the XOR operator, it's symmetric. Would this mean that it would also provide theoretical perfect secrecy just like XOR?
XOR
...
- 533
0
votes
3
answers
173
views
Perfect Secrecy with 1 Time Complex Secret Cypher
Is it possible to achieve perfect secrecy, unbreakable, unguessable, uncrackable by using a totally secret cypher?
The following conditions must apply:
Using the secret cypher only 1 time, so that ...
- 533
0
votes
0
answers
45
views
Availability of C(2e,1s) KE protocol
For a specific need with embedded system (key establishment with unilateral authentication and pfs) i am looking for a standard c (2e, 1s) key agreement protocol.
Unfortunatly it doesn't exist in nist ...
- 653
0
votes
1
answer
170
views
Generating two secret keys from a physical analog signal: Crypto HASH analogous to time varying signal
Can we generate two secret keys from same source?
The idea is we have time varying signal. We capture a window of say few milliseconds,$t$. I can chop values of signals at a rate $N_S$ and get $tN_S/...
- 185
0
votes
2
answers
341
views
Akamai's Legacy SSL/TLS Cipher Profiles
I'm conducting a research regarding CDN security, and have noticed that in the following document https://community.akamai.com/docs/DOC-5175
A cipher suite named "ak-akamai-pfs-supported" includes the ...
12
votes
2
answers
7k
views
Definitions of secrecy
I found terms like "forward secrecy", "future secrecy", "backwards secrecy" and "perfect forward secrecy" and I would like to know their definitions and to understand the differences among them.
I ...
- 1,218
3
votes
1
answer
634
views
Forward Secrecy when using non-ephemeral DH
In context SSL/TLS, reading up on various sites, I find forward secrecy in DH key exchange being linked to its ephemeral use i.e. DHE. I don't fully understand this link, where does following ...
- 31
11
votes
1
answer
4k
views
When/why is RSA (hybrid) encryption used rather than alternatives?
I've read that RSA is not meant for encrypting large plaintext because:
(Are these also true for other public-key encryptions like ElGamal?)
It is slow.
Padding makes the ciphertext blocks much ...
- 835
3
votes
1
answer
3k
views
Perfect Forward Secrecy in PGP/asynchronous email
Looking at the RFC for PGP email/asynchronous chat with PFS here https://datatracker.ietf.org/doc/html/draft-brown-pgp-pfs-03 can anyone tell me why the following scheme is no good?
Alice and Bob ...
- 31
4
votes
1
answer
538
views
If a PRG is constructed by iterating a PRF, is it backtracking-resistant?
Say we construct a pseudo-random generator from a pseudo-random function $f$ (using some constant key $k$ and some initial value $v_0$). We do this by feeding the output block of the PRF back into the ...
- 41