Skip to main content

Questions tagged [forward-secrecy]

A security property wherein past messages are protected against future compromise of the master keys.

Filter by
Sorted by
Tagged with
3 votes
1 answer
126 views

The weakening of PQC as a result of lack of KEX?

As far as I can tell we don't have any good key exchange post-quantum candidates. SIKE was broken some time ago. It is possible to reach an authenticated shared secret by having the public key holder ...
Squoomsquoom's user avatar
5 votes
1 answer
136 views

Why is forward secrecy needed at X3DH?

In the official documentation of the X3DH Algorithm (link) is made an analysis about the forward secrecy. Forward secrecy would be an uselful property if we would repeat the protocol multiple times. ...
p_1092131280's user avatar
2 votes
2 answers
1k views

How does perfect forward secrecy work for messaging?

I am struggling to understand how messaging protocols (like Signal) are able to use perfect forward secrecy. My understanding is that the server generates temporary keys which are used in combination ...
Randusr's user avatar
  • 45
2 votes
1 answer
69 views

Are there any significant ways in which TLS could still be improved?

With TLS 1.3 supporting only secure, forward-secret cipher suites, are there any significant technological improvements that could still be made to the protocol?
Collin's user avatar
  • 21
3 votes
2 answers
450 views

Forward-Secure AKE based on post-quantum KEM?

I am looking for authenticated key exchange protocols (AKE) based on a generic key encapsulation mechanism (KEM) and providing full/perfect forward secrecy. Optionally, the protocols should offer ...
Felix H.'s user avatar
1 vote
0 answers
109 views

Signal double ratchet only giving "weak" forward secrecy?

I was just watching this video on the Double ratcheting protocol. at around 31:37, the presenter says that the protocol only provides weak forward secrecy. I've only ever heard about a distinction ...
Grazosi's user avatar
  • 131
2 votes
0 answers
83 views

SSL/TLS Forward secrecy with 2 KEM public keys

As we know, NIST PQC project is at its 3rd round, with draft standard expected to arrive in the next (few) year(s). An unfortunate fact is that, we're not seeing many signature schemes general-purpose ...
DannyNiu's user avatar
  • 9,451
1 vote
1 answer
385 views

Does the libsodium sealedbox provide forward secrecy?

I am using sodiumoxide, a Rust binding to libsodium that provides a function named sealedbox that requires the receiver's public key. However, they also mention that the message is encrypted with an ...
undefined's user avatar
2 votes
1 answer
685 views

Why is DH key exchange still useful, if a public key certificate is used?

EDIT: According to Gilles's comments and fgrieu's answer below, I would like to summarize what I have learned, and what's still needs explanation: DHKE is necessary for forward secrecy even when PKI ...
xrfang's user avatar
  • 159
0 votes
1 answer
91 views

When do we redo the Diffie-Hellman Exchange?

I'm planning on making a chat application for fun, in C++. I just have a few questions in order to maintain forward/future secrecy across messages. If one party is offline, but the other isn't, what ...
Jake's user avatar
  • 1
1 vote
1 answer
126 views

what motivated the design decisions of RFC 8291 ("Message Encryption for Web Push")?

Related question here. I'm reading RFC 8291, which describes a protocol to protect web push messages sent between an application server and a user agent (typically a mobile browser or other mobile ...
Shivaram Lingamneni's user avatar
1 vote
0 answers
325 views

Are key evolving signatures (or forward secure signatures) that secure?

Reading this paper Forward-Secure Digital Signature Scheme I discovered the notion of key evolving signatures. The intuition behind these signatures is clear: one uses different private keys to ...
Bean Guy's user avatar
  • 752
0 votes
0 answers
57 views

Is any encryption system that changes keys for each session "forward secure"? [duplicate]

As far as i understand, a encryption system is forward secure if new session keys are generated for each session, which is also part of what wikipedia says about forward secrecy: By generating a ...
goulashsoup's user avatar
4 votes
3 answers
475 views

What does perfect mean within perfect forward secrecy and why do some cryptographers disagree with the term?

In this blog post, Matthew Green says Forward secrecy (usually misnamed “perfect forward secrecy”)... The Wikipedia article on forward secrecy (which the same sentence links to in the blog) says ...
user avatar
1 vote
1 answer
151 views

Forward Security of Symmetric Encryption Schemes with LFSR based PRNG

Forward security can be achieved using symmetric encryption schemes by combining with a pseudo-random number generator (PRNG). Does LFSR based PRNG provide forward security in this case?
Surya's user avatar
  • 91
0 votes
0 answers
237 views

How does DHE-RSA work and why is PFS guaranteed?

How does it work and why is forward secrecy guaranteed? I understood that it is not susceptible to a man-in-the-middle attack by using certificates in the beginning.
NightRain23's user avatar
17 votes
4 answers
9k views

Creating cryptographic algorithms at runtime

Would it be possible to create a program with which to create a cryptographic algorithm (i.e. encryption or hash) using well-known elements of other algorithms in the same way that algorithms "reuse" ...
Arget's user avatar
  • 189
7 votes
4 answers
3k views

Is encrypted e-mail sent over TLS 1.3 a form of "forward secrecy" (similar to something like Signal)?

One common complaint about GPG-encrypted e-mail is that it doesn't provide forward secrecy; however with opportunistic TLS becoming increasingly common in both IMAP and SMTP, it's not unreasonable to ...
philomathic_life's user avatar
1 vote
0 answers
138 views

Perfect Forward Secrecy Stream Cipher based on Block Cipher

I'm thinking about ways to encrypt an endless stream of data (e.g. a video or audio feed) in a way, where a compromise of the current internal state of the encryption (e.g. a RAM dump) does not ...
phi1010's user avatar
  • 111
3 votes
1 answer
814 views

Providing forward secrecy with RSA

Forward secrecy with RSA is asked here: Is perfect-forward secrecy achieved with RSA? and fgrieu gave an answer based on creating temporary RSA keys and signing them. And, in the end, he mentions ...
kelalaka's user avatar
  • 49k
2 votes
1 answer
1k views

Different ways of building a ChaCha20-based RNG

Let's say you're building RNG with ChaCha20 and the fast key erasure technique. There seem to be a few ways to do it. The reference implementation in the SUPERCOP benchmarking toolkit looks like ...
Kannan Goundan's user avatar
3 votes
3 answers
799 views

Struggling to understand Perfect Forward Secrecy

From the definition on Wikipedia: In cryptography, forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that ...
pfsconfusor's user avatar
1 vote
1 answer
91 views

Secure Communication

Focus: I have to design a secure keep alive communication protocol and was wondering if it was necessary to sign the ciphertext after the session key has been generated as an attacker will not know ...
X3Gamma's user avatar
  • 13
1 vote
2 answers
2k views

What is the difference between forward secrecy and key freshness?

Is all random private key that generating a unique session key is both forward secrecy and key freshness?
Wei Wen's user avatar
  • 305
6 votes
1 answer
1k views

Is forward secrecy overhyped or necessary?

Forward Secrecy, also perfect forward secrecy, gives assurance about session keys even the private key is compromised. This is achieved by generating a random key per session without using a ...
kelalaka's user avatar
  • 49k
0 votes
1 answer
197 views

Does Off-The-Record protocol provide future (backward) secrecy?

I know Signal provides future (backward) secrecy, and that it is based on Off-The-Record protocol. However, does OTR by itself also provide future secrecy?
fraiser's user avatar
  • 438
3 votes
1 answer
285 views

Can perfect forward secrecy introduce vulnerabilities?

Is it always a win or could PFS algorithms introduce new attack vectors or weaken the level of secrecy vs not being used?
akvadrako's user avatar
  • 131
0 votes
1 answer
154 views

Hash ratchets with truncating hash function

I'm working on a forward secret messaging system that relies on hash ratchet. I'm using BLAKE2b as the one-way function, which by default produces 512-bit digests. These digests are truncated by my ...
maqp's user avatar
  • 61
2 votes
0 answers
114 views

Proving the lack of Perfect Forward Secrecy

In specific regarding the NSA's Key Exchange Algorithm, I read in an analysis of the protocol that perfect forward secrecy cannot be provided. Is there any way to prove or justify this? I couldn't ...
Nick Ryan's user avatar
1 vote
0 answers
111 views

Is there hierarchical key generation that completely tolerates leakage?

Is there a hierarchical key construction algorithm that achieves forward/backward privacy with any (unlimited) leakage of private non-master keys? What I mean is that if there's an unbounded number ...
Some Guy's user avatar
  • 153
2 votes
2 answers
204 views

What do people mean when they talk about forward secrecy in ciphers?

I've heard several people and websites talk about ciphers that have forward secrecy. I know about forward secrecy in key agreement protocols, e.g. RLWE, (EC/SI)DH, QKD, etc. This could be what they're ...
user245903's user avatar
6 votes
2 answers
3k views

Are there benefits for using Static Diffie-Hellman over Ephemeral Diffie-Hellman?

TL;DR - Are there any benefits to using static DH over ephemeral DH? I'm reading about the differences between static DH & ephemeral DH and I am trying to think of one logical reason to use ...
user avatar
2 votes
1 answer
475 views

Post-quantum authenticated key exchange with forward secrecy

Are there any post-quantum, forward-secure, hybrid, optionally authenticated key exchange protocols? Specifically, I am looking for one that can be deployed in a hybrid with X25519 + EdDSA.
Demi's user avatar
  • 4,793
4 votes
2 answers
735 views

Questions about the double ratchet mechanism in Signal

I am trying to understand the threats the double ratchet system is trying to prevent against. The threats mentioned in the paper do not quite make sense to me. May be someone can explain where I am ...
SFlow's user avatar
  • 465
8 votes
1 answer
2k views

Secure group chat with large groups

I was reading in Whatsapp group chat the sender encrypts a key individually for each memeber. And everyone invalidates their key whenever anyone leaves the group. Whatsapp also limits group size to ...
Meir Maor's user avatar
  • 11.8k
3 votes
1 answer
2k views

Is it possible to implement the Signal Protocol without a server?

My question is regarding the Signal Protocol[1]. Is it possible to implement the protocol securely, without a server? (I have no particular motivation for the question other than to understand better ...
Andrew Peace's user avatar
3 votes
2 answers
274 views

Role of long-term asymmetric keys in a forward secrecy instant messaging protocol?

I am trying to understand how forward secrecy works in general, using a simple instant messaging protocol as an example. Tell me if I have this process right or not: 1) Alice and Bob each generate a ...
steevven1's user avatar
2 votes
1 answer
165 views

Mitigating the damage when a signing key is stolen

Let's say we have a server whose job is to sign documents using a private key. Let's say that there's a bug in the software and the private key gets stolen. I'm interested in mechanisms to mitigate ...
jyelon's user avatar
  • 106
0 votes
1 answer
647 views

What order should these HTTPS ciphers go in to maximize security?

I want to set up a very secure-from-MITM-attacks server. I have these algorithms enabled in my nginx and I'm getting an A+ on ssllabs.com but it's complaining that my cipher strength isn't 100% and ...
zachaysan's user avatar
  • 103
1 vote
1 answer
348 views

One way communication with forward secrecy?

Is it possible to achieve forward secrecy using a one way communication channel with pre-shared secret? I have a setup where I need to send some information across a unsafe channel between server A ...
user avatar
2 votes
1 answer
543 views

How can I ensure forward secrecy when storing encrypted messages in a public blockchain?

I want to store encrypted sensitive messages in the blockchain. I was thinking of using public-key cryptography to achieve this, but as the encrypted data will be stored forever in the blockchain and ...
Brendan Rius's user avatar
1 vote
1 answer
54 views

Equivalance Operator - Perfect Secrecy

The equivalance operator is the inverse of the XOR operator, it's symmetric. Would this mean that it would also provide theoretical perfect secrecy just like XOR? XOR ...
cryptonoob400's user avatar
0 votes
3 answers
180 views

Perfect Secrecy with 1 Time Complex Secret Cypher

Is it possible to achieve perfect secrecy, unbreakable, unguessable, uncrackable by using a totally secret cypher? The following conditions must apply: Using the secret cypher only 1 time, so that ...
cryptonoob400's user avatar
0 votes
0 answers
54 views

Availability of C(2e,1s) KE protocol

For a specific need with embedded system (key establishment with unilateral authentication and pfs) i am looking for a standard c (2e, 1s) key agreement protocol. Unfortunatly it doesn't exist in nist ...
william_fr's user avatar
1 vote
1 answer
185 views

Generating two secret keys from a physical analog signal: Crypto HASH analogous to time varying signal

Can we generate two secret keys from same source? The idea is we have time varying signal. We capture a window of say few milliseconds,$t$. I can chop values of signals at a rate $N_S$ and get $tN_S/...
Jay's user avatar
  • 195
0 votes
2 answers
379 views

Akamai's Legacy SSL/TLS Cipher Profiles

I'm conducting a research regarding CDN security, and have noticed that in the following document https://community.akamai.com/docs/DOC-5175 A cipher suite named "ak-akamai-pfs-supported" includes the ...
JustAStudentResearching's user avatar
12 votes
2 answers
8k views

Definitions of secrecy

I found terms like "forward secrecy", "future secrecy", "backwards secrecy" and "perfect forward secrecy" and I would like to know their definitions and to understand the differences among them. I ...
M-elman's user avatar
  • 1,248
3 votes
1 answer
662 views

Forward Secrecy when using non-ephemeral DH

In context SSL/TLS, reading up on various sites, I find forward secrecy in DH key exchange being linked to its ephemeral use i.e. DHE. I don't fully understand this link, where does following ...
Eve Mallory's user avatar
11 votes
1 answer
4k views

When/why is RSA (hybrid) encryption used rather than alternatives?

I've read that RSA is not meant for encrypting large plaintext because: (Are these also true for other public-key encryptions like ElGamal?) It is slow. Padding makes the ciphertext blocks much ...
Myath's user avatar
  • 845
3 votes
1 answer
3k views

Perfect Forward Secrecy in PGP/asynchronous email

Looking at the RFC for PGP email/asynchronous chat with PFS here https://datatracker.ietf.org/doc/html/draft-brown-pgp-pfs-03 can anyone tell me why the following scheme is no good? Alice and Bob ...
user29550's user avatar