Skip to main content
34 votes
Accepted

Creating cryptographic algorithms at runtime

This doesn't add new security as much as it just shifts it. Encryption algorithms are carefully studied. Hmm... I didn't make that emphatic enough. Encryption algorithms are C A R E F U L L Y ...
Cort Ammon's user avatar
  • 3,261
23 votes
Accepted

Is encrypted e-mail sent over TLS 1.3 a form of "forward secrecy" (similar to something like Signal)?

Forward secrecy is a confusing term that should be abandoned, especially the meaningless but value-loaded variant ‘perfect forward secrecy’. It is especially confusing because it is often associated ...
Squeamish Ossifrage's user avatar
19 votes

Creating cryptographic algorithms at runtime

Suppose you have two cryptosystems $A$ and $B$ with $n$-bit keys. Maybe they're both secure at what they aim to do; maybe they aren't. Say they both take about the same cost to implement. You are ...
Squeamish Ossifrage's user avatar
9 votes
Accepted

Definitions of secrecy

In cryptography, forward secrecy = perfect forward secrecy, backward secrecy = future secrecy. First, recall some background. The above terms are often discussed in the setting of secure channel ...
Shan Chen's user avatar
  • 2,725
8 votes
Accepted

Is forward secrecy overhyped or necessary?

Since I am at the source of the original quote, I might as well respond... Technically, forward secrecy is overhyped because it is recommended almost everywhere. In some contexts it makes sense and is ...
Thomas Pornin's user avatar
7 votes

Creating cryptographic algorithms at runtime

Suppose that one of your cipher suites has some weaknesses. Then the adversary can play with your network to force you to select the weak cipher to exploit the weakness. This is highly done in TLS. ...
kelalaka's user avatar
  • 49k
6 votes

Are there benefits for using Static Diffie-Hellman over Ephemeral Diffie-Hellman?

The "advantage" of static DH is that the server doesn't need to compute an exponentiation each time. This advantage is, however, not worth it, in the sense that the static DH problem is easier than ...
Yehuda Lindell's user avatar
6 votes
Accepted

Are there benefits for using Static Diffie-Hellman over Ephemeral Diffie-Hellman?

So why would we still want to use standard DH? Are there any benefits to this? The party / parties with the static key can just pre-compute their public DH key and thus save one scalar multiplication ...
SEJPM's user avatar
  • 46.1k
6 votes
Accepted

How does perfect forward secrecy work for messaging?

I think that you may be confusing encryption of data "in transit" and encryption of persistent data. PFS works mainly and I think was also designed mainly for data in transit. So for ...
Amit's user avatar
  • 432
5 votes

What do people mean when they talk about forward secrecy in ciphers?

What does 'forward secrecy' mean in the context of hash based signatures? Well, what that term means is that we have a hash based signature scheme with an evolving key, that is, the private key is ...
poncho's user avatar
  • 148k
5 votes
Accepted

Secure group chat with large groups

Can we do better? Yes. See: On Ends-to-Ends Encryption: Asynchronous Group Messaging with Strong Security Guarantees. To support significantly larger groups? Our results demonstrate that ART is ...
cypherfox's user avatar
  • 1,422
5 votes

Different ways of building a ChaCha20-based RNG

How often should I replace the key? The SUPERCOP implementation replaces the 32-byte key every 768 bytes. It's a latency/throughput tradeoff. Generating a longer batch of output raises the ...
Squeamish Ossifrage's user avatar
5 votes

The weakening of PQC as a result of lack of KEX?

I don't understand your concern. It sounds like you are assuming that public (and private) keys in lattice-based key exchange are static? I don't believe this is the case though. So if your bank (or ...
Mark Schultz-Wu's user avatar
  • 13.5k
4 votes
Accepted

Perfect Secrecy with 1 Time Complex Secret Cypher

Is it possible to achieve perfect secrecy, unbreakable, unguessable, uncrackable by using a totally secret cypher? There are two different questions: Can you obtain perfect secrecy, and can you ...
Ella Rose's user avatar
  • 19.7k
4 votes

Equivalance Operator - Perfect Secrecy

Actually, for any group operator $\odot$, we see that $x \odot y$ gives perfect security, assuming that $y$ is uniformly random over all possible group members. The $\equiv$ operation is a group ...
poncho's user avatar
  • 148k
4 votes

Definitions of secrecy

Forward secrecy: When a node (user) leaves the network, it must not read any future messages after its departure. Backward secrecy: When a new node (user) joins in the network, it must not read any ...
Shobhan Mandal's user avatar
4 votes
Accepted

Providing forward secrecy with RSA

Some limitations of the proposed protocol: It only applies when both parties have a private key, not in the common browser-connects-to-server scenario. As noted by others, it is not true Forward ...
fgrieu's user avatar
  • 142k
3 votes
Accepted

Post-quantum authenticated key exchange with forward secrecy

Key exchange and authentication are typically done by separate algorithms. However, there are post-quantum key exchange algorithms that also provide forward secrecy. For example: SIDH - Supersingular ...
forest's user avatar
  • 15.3k
3 votes
Accepted

What do people mean when they talk about forward secrecy in ciphers?

In this whitepaper (Perfect) Forward Security (or Secrecy) is defined as a characteristic of an authenticated key exchange protocol which ensures that the disclosure of a long term identity key (...
M-elman's user avatar
  • 1,248
3 votes

Struggling to understand Perfect Forward Secrecy

But I read a question here that PFS can be achieved by deriving session keys with a hash of an old session key. But if I were to know the master key (the pre-shared key?), I could easily calculate all ...
SEJPM's user avatar
  • 46.1k
3 votes
Accepted

Does the libsodium sealedbox provide forward secrecy?

Basically, you have forward secrecy if all the used key pairs are ephemeral and that the private keys (NaCl calls these "secret keys") are destroyed dutifully after (one-time) usage. In the ...
Maarten Bodewes's user avatar
  • 93.2k
3 votes

Forward-Secure AKE based on post-quantum KEM?

It is possible to generically add FS to any AKE. BN11 describes a compiler. The caveat is that if you permit ephemeral key revelation in your security model (as is usually permitted in the Canetti-...
rozbb's user avatar
  • 430
2 votes

Akamai's Legacy SSL/TLS Cipher Profiles

The few cipher suites you mention don't have PFS since they all use RSA as key exchange. Only the ECDHE ciphers from the list have PFS since they use ECDH as key exchange.
Steffen Ullrich's user avatar
2 votes

Does NTRU provide Perfect Forward Secrecy?

Yes. I'm not sure why others are saying "no". Forward secrecy is usually done by simply creating ephemeral keys for each connection. Thus, you will simply require a different NTRU keypair for each ...
Jay Sullivan's user avatar
2 votes
Accepted

What order should these HTTPS ciphers go in to maximize security?

In short, don't bother getting 100 in "Cipher Strength" or "Key Exchange". It is possible to get 100 in "cipher strength" by only allowing 256-bit ciphers, however, this will break compatibility with ...
zzq1015's user avatar
  • 36
2 votes
Accepted

Role of long-term asymmetric keys in a forward secrecy instant messaging protocol?

I don't think you are wrong on any of the points. "Perfect forward secrecy" is a confusing name. Indeed it means that somebody who gets hold of one of the keys cannot use it to decrypt messages from ...
Elias's user avatar
  • 4,923
2 votes
Accepted

Questions about the double ratchet mechanism in Signal

An eavesdropper who briefly compromises one of the parties might learn the value of a current ratchet private key, but that private key will eventually be replaced with an uncompromised one. At that ...
FreshPeter's user avatar
2 votes
Accepted

How can I ensure forward secrecy when storing encrypted messages in a public blockchain?

As long as you use a post-quantum secure encryption scheme the fact that your messages are on the blockchain is not a problem. Traditionally adversaries are assumed to be capable of recording the ...
Elias's user avatar
  • 4,923
2 votes

What is the difference between forward secrecy and key freshness?

Forward secrecy is about protecting previous sessions if long-term secrets are later compromised. A random session key does not necessarily provide forward secrecy. An example of this is the "...
Peter Green's user avatar
  • 1,594
2 votes
Accepted

Secure Communication

I ... was wondering if it was necessary to sign the ciphertext No, there is no need to sign the ciphertext. The secret key is already derived by the key agreement protocol, and that is secure because ...
Maarten Bodewes's user avatar
  • 93.2k

Only top scored, non community-wiki answers of a minimum length are eligible