Questions tagged [forward-secrecy]

A security property wherein past messages are protected against future compromise of the master keys.

Filter by
Sorted by
Tagged with
0
votes
0answers
12 views

Forward secrecy in Merkle trees vs. hash chains

Say we have a one-time password authentication system that uses a Merkle tree. Assume that the secret keys are of the form {sk0, sk1, ..., sk7}, and at time ...
5
votes
4answers
191 views

What does perfect mean within perfect forward secrecy and why do some cryptographers disagree with the term?

In this blog post, Matthew Green says Forward secrecy (usually misnamed “perfect forward secrecy”)... The Wikipedia article on forward secrecy (which the same sentence links to in the blog) says ...
1
vote
1answer
45 views

Forward Security of Symmetric Encryption Schemes with LFSR based PRNG

Forward security can be achieved using symmetric encryption schemes by combining with a pseudo-random number generator (PRNG). Does LFSR based PRNG provide forward security in this case?
0
votes
0answers
64 views

How does DHE-RSA work and why is PFS guaranteed?

How does it work and why is forward secrecy guaranteed? I understood that it is not susceptible to a man-in-the-middle attack by using certificates in the beginning.
17
votes
4answers
9k views

Creating cryptographic algorithms at runtime

Would it be possible to create a program with which to create a cryptographic algorithm (i.e. encryption or hash) using well-known elements of other algorithms in the same way that algorithms "reuse" ...
6
votes
4answers
3k views

Is encrypted e-mail sent over TLS 1.3 a form of “forward secrecy” (similar to something like Signal)?

One common complaint about GPG-encrypted e-mail is that it doesn't provide forward secrecy; however with opportunistic TLS becoming increasingly common in both IMAP and SMTP, it's not unreasonable to ...
1
vote
0answers
65 views

Perfect Forward Secrecy Stream Cipher based on Block Cipher

I'm thinking about ways to encrypt an endless stream of data (e.g. a video or audio feed) in a way, where a compromise of the current internal state of the encryption (e.g. a RAM dump) does not ...
3
votes
1answer
233 views

Providing forward secrecy with RSA

Forward secrecy with RSA is asked here: Is perfect-forward secrecy achieved with RSA? and fgrieu gave an answer based on creating temporary RSA keys and signing them. And, in the end, he mentions ...
0
votes
1answer
163 views

Different ways of building a ChaCha20-based RNG

Let's say you're building RNG with ChaCha20 and the fast key erasure technique. There seem to be a few ways to do it. The reference implementation in the SUPERCOP benchmarking toolkit looks like ...
3
votes
3answers
214 views

Struggling to understand Perfect Forward Secrecy

From the definition on Wikipedia: In cryptography, forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that ...
1
vote
1answer
74 views

Secure Communication

Focus: I have to design a secure keep alive communication protocol and was wondering if it was necessary to sign the ciphertext after the session key has been generated as an attacker will not know ...
0
votes
2answers
507 views

What is the difference between forward secrecy and key freshness?

Is all random private key that generating a unique session key is both forward secrecy and key freshness?
6
votes
1answer
519 views

Is forward secrecy overhyped or necessary?

Forward Secrecy, also perfect forward secrecy, gives assurance about session keys even the private key is compromised. This is achieved by generating a random key per session without using a ...
0
votes
1answer
111 views

Does Off-The-Record protocol provide future (backward) secrecy?

I know Signal provides future (backward) secrecy, and that it is based on Off-The-Record protocol. However, does OTR by itself also provide future secrecy?
3
votes
1answer
181 views

Can perfect forward secrecy introduce vulnerabilities?

Is it always a win or could PFS algorithms introduce new attack vectors or weaken the level of secrecy vs not being used?
0
votes
1answer
92 views

Hash ratchets with truncating hash function

I'm working on a forward secret messaging system that relies on hash ratchet. I'm using BLAKE2b as the one-way function, which by default produces 512-bit digests. These digests are truncated by my ...
2
votes
0answers
88 views

Proving the lack of Perfect Forward Secrecy

In specific regarding the NSA's Key Exchange Algorithm, I read in an analysis of the protocol that perfect forward secrecy cannot be provided. Is there any way to prove or justify this? I couldn't ...
1
vote
0answers
86 views

Is there hierarchical key generation that completely tolerates leakage?

Is there a hierarchical key construction algorithm that achieves forward/backward privacy with any (unlimited) leakage of private non-master keys? What I mean is that if there's an unbounded number ...
2
votes
2answers
156 views

What do people mean when they talk about forward secrecy in ciphers?

I've heard several people and websites talk about ciphers that have forward secrecy. I know about forward secrecy in key agreement protocols, e.g. RLWE, (EC/SI)DH, QKD, etc. This could be what they're ...
3
votes
2answers
1k views

Are there benefits for using Static Diffie-Hellman over Ephemeral Diffie-Hellman?

TL;DR - Are there any benefits to using static DH over ephemeral DH? I'm reading about the differences between static DH & ephemeral DH and I am trying to think of one logical reason to use ...
2
votes
1answer
268 views

Post-quantum authenticated key exchange with forward secrecy

Are there any post-quantum, forward-secure, hybrid, optionally authenticated key exchange protocols? Specifically, I am looking for one that can be deployed in a hybrid with X25519 + EdDSA.
3
votes
2answers
326 views

Questions about the double ratchet mechanism in Signal

I am trying to understand the threats the double ratchet system is trying to prevent against. The threats mentioned in the paper do not quite make sense to me. May be someone can explain where I am ...
7
votes
1answer
1k views

Secure group chat with large groups

I was reading in Whatsapp group chat the sender encrypts a key individually for each memeber. And everyone invalidates their key whenever anyone leaves the group. Whatsapp also limits group size to ...
2
votes
1answer
1k views

Is it possible to implement the Signal Protocol without a server?

My question is regarding the Signal Protocol[1]. Is it possible to implement the protocol securely, without a server? (I have no particular motivation for the question other than to understand better ...
3
votes
2answers
135 views

Role of long-term asymmetric keys in a forward secrecy instant messaging protocol?

I am trying to understand how forward secrecy works in general, using a simple instant messaging protocol as an example. Tell me if I have this process right or not: 1) Alice and Bob each generate a ...
2
votes
1answer
96 views

Mitigating the damage when a signing key is stolen

Let's say we have a server whose job is to sign documents using a private key. Let's say that there's a bug in the software and the private key gets stolen. I'm interested in mechanisms to mitigate ...
0
votes
1answer
431 views

What order should these HTTPS ciphers go in to maximize security?

I want to set up a very secure-from-MITM-attacks server. I have these algorithms enabled in my nginx and I'm getting an A+ on ssllabs.com but it's complaining that my cipher strength isn't 100% and ...
1
vote
1answer
274 views

One way communication with forward secrecy?

Is it possible to achieve forward secrecy using a one way communication channel with pre-shared secret? I have a setup where I need to send some information across a unsafe channel between server A ...
2
votes
1answer
429 views

How can I ensure forward secrecy when storing encrypted messages in a public blockchain?

I want to store encrypted sensitive messages in the blockchain. I was thinking of using public-key cryptography to achieve this, but as the encrypted data will be stored forever in the blockchain and ...
1
vote
1answer
49 views

Equivalance Operator - Perfect Secrecy

The equivalance operator is the inverse of the XOR operator, it's symmetric. Would this mean that it would also provide theoretical perfect secrecy just like XOR? XOR ...
0
votes
3answers
149 views

Perfect Secrecy with 1 Time Complex Secret Cypher

Is it possible to achieve perfect secrecy, unbreakable, unguessable, uncrackable by using a totally secret cypher? The following conditions must apply: Using the secret cypher only 1 time, so that ...
0
votes
0answers
36 views

Availability of C(2e,1s) KE protocol

For a specific need with embedded system (key establishment with unilateral authentication and pfs) i am looking for a standard c (2e, 1s) key agreement protocol. Unfortunatly it doesn't exist in nist ...
0
votes
1answer
108 views

Generating two secret keys from a physical analog signal: Crypto HASH analogous to time varying signal

Can we generate two secret keys from same source? The idea is we have time varying signal. We capture a window of say few milliseconds,$t$. I can chop values of signals at a rate $N_S$ and get $tN_S/...
0
votes
2answers
186 views

Akamai's Legacy SSL/TLS Cipher Profiles

I'm conducting a research regarding CDN security, and have noticed that in the following document https://community.akamai.com/docs/DOC-5175 A cipher suite named "ak-akamai-pfs-supported" includes the ...
9
votes
2answers
3k views

Definitions of secrecy

I found terms like "forward secrecy", "future secrecy", "backwards secrecy" and "perfect forward secrecy" and I would like to know their definitions and to understand the differences among them. I ...
3
votes
1answer
510 views

Forward Secrecy when using non-ephemeral DH

In context SSL/TLS, reading up on various sites, I find forward secrecy in DH key exchange being linked to its ephemeral use i.e. DHE. I don't fully understand this link, where does following ...
10
votes
1answer
3k views

When/why is RSA (hybrid) encryption used rather than alternatives?

I've read that RSA is not meant for encrypting large plaintext because: (Are these also true for other public-key encryptions like ElGamal?) It is slow. Padding makes the ciphertext blocks much ...
3
votes
1answer
2k views

Perfect Forward Secrecy in PGP/asynchronous email

Looking at the RFC for PGP email/asynchronous chat with PFS here https://tools.ietf.org/html/draft-brown-pgp-pfs-03 can anyone tell me why the following scheme is no good? Alice and Bob retrieve each ...
4
votes
1answer
425 views

If a PRG is constructed by iterating a PRF, is it backtracking-resistant?

Say we construct a pseudo-random generator from a pseudo-random function $f$ (using some constant key $k$ and some initial value $v_0$). We do this by feeding the output block of the PRF back into the ...
8
votes
3answers
4k views

Can an ephemeral RSA key give forward secrecy?

Suppose party A generates an ephemeral RSA key and sends the public key to B. Party B then generates a symmetric key, encrypts it with Party A's public key and sends the Ciphertext to Party A. Party ...
0
votes
1answer
233 views

TLS_PSK and perfect forward secrecy

My question is about how difficult is for someone having compromised the PSK and sniff all (DT)LS handshake, (so getting the NONCE), to get the encryption keys? I understand : getting the pre-master ...
5
votes
1answer
2k views

Forward-secure static-ephemeral ECDH key agreement protocol

The question is whether the following simple key agreement protocol design has good security properties, and how it can or should be improved. Assumptions Alice is a persistent entity with a static ...
3
votes
1answer
209 views

Is there an existing AE protocol with forward secrecy for embedded devices?

I'm working on an embedded device that is connected to a computer over an untrusted channel. According to my threat model I need authentication and encryption on the wire with perfect forward secrecy. ...
3
votes
1answer
467 views

Implementing forward secrecy in OpenPGP with public key authentication

I am trying to consider the feasibility of implementing an encrypted file sharing system, which both provides forward secrecy but also allows public key verification. I am stuck on the marriage ...
0
votes
2answers
221 views

Why does spiped use both nonces and ephemeral keys?

Colin Percival's spiped utility uses a pre-shared key and Diffie-Hellman with ephemeral keys to provide forward secrecy. The protocol is summarized in the project'...
2
votes
0answers
164 views

Standards/RFCs for non-Diffie-Hellman perfect forward secrecy?

Some time has passed since PFS introduction and we now have secure&proven asymmetric ciphers that can generate strong keys very efficiently (elliptic RSA variants and/or QD-Mceliece can generate ...
0
votes
1answer
106 views

Workaround to implementing Forward Secrecy

In the case where I am self-signing my digital certificates, if I just change my certificate (generate a new one) every week or month, will this have (sort of similar to) the same effect as ...
2
votes
0answers
356 views

What are the well known protocols that offer perfect forward secrecy? [closed]

As far as I know these are the well known protocols that offer PFS TLS/SSL (with DHE-RSA, DHE-DSS, ECDHE-RSA or ECDHE-ECDSA) SSH (RFC4253) OTR (Protocol Version 3 Spec) IPsec (with IKEv1 and IKEv2) (...
2
votes
2answers
251 views

Does key derivation with known parameters add any security?

First up: this is a question about a concept that I try to wrap my head around; it is not about the specific implementation. Anyway… I have the following scenario (simplified to show the problem I ...
1
vote
0answers
94 views

Forward Secrecy with pseudorandom functions

Let $H_1$, $H_2$ be keyed hash functions (e.g. $H_i(x) = SHA_{256}(s_i||x)$ for pseudorandom $s_1$, $s_2$). Let $s_n = H_1^k(s_0)$, $k_n = H_2(s_n)$, where $s_0$ is a secret (pseudorandomly chosen ...