Forward secrecy

In cryptography, forward secrecy (also known as perfect forward secrecy or PFS^[1]) is a property of key-agreement protocols that ensures that a session key derived from a set of long-term keys will not be compromised if one of the long-term keys is compromised in the future. The key used to protect transmission of data must not be used to derive any additional keys, and if the key used to protect transmission of data was derived from some other keying material, that material must not be used to derive any more keys. Thus, compromise of a single key will permit access only to data protected by a single key.

More specifically :

• Forward secrecy is obtained by generating new key material for each session, that is generating an ephemeral key to be used for all messages of a conversation (e.g. by using a Diffie–Hellman key exchange): in a worst-case scenario (such as arrest with live forensics performed on the device to retrieve the current ephemeral key in-memory), an adversary could only retroactively decode the ciphertext for the messages exchanged during that conversation, but none from the previous conversations.
• Perfect forward secrecy is obtained by continuously ratcheting the key material during each session, that is generating a new ephemeral key for each message of a conversation (e.g. by piggy-backing new Diffie–Hellman key exchanges on them): in the same worst-case scenario, an adversary could retroactively decode only the two last messages exchanged during that conversation, and still none from the previous conversations.

History

Forward secrecy was originally introduced by Whitfield Diffie, Paul van Oorschot, and Michael James Wiener. It used to describe a property of the Station-to-Station protocol (STS), where the long-term secrets are private keys.^[2]

Forward secrecy has also been used to describe the analogous property of password-authenticated key agreement protocols where the long-term secret is a (shared) password.^[3]

Annex D.5.1 of IEEE 1363-2000 discusses the related one-party and two-party forward secrecy properties of various standard key agreement schemes.

Perfect Forward Secrecy

Public-key systems which generate random public keys per session for the purposes of key agreement which are not based on any sort of deterministic algorithm demonstrate a property referred to as perfect forward secrecy. This means that the compromise of one message cannot lead to the compromise of others, and also that there is not a single secret value which can lead to the compromise of multiple messages.

This is not to be confused with the concept of perfect secrecy demonstrated by one-time pads, where the ciphertext reveals no information whatsoever and appears completely random.

Attacks

Forward secrecy is designed to prevent the compromise of a long-term secret key from affecting the confidentiality of past conversations. However, forward secrecy (including perfect forward secrecy) cannot defend against a successful cryptanalysis of the underlying ciphers being used, since a cryptanalysis consists of finding a way to decrypt an encrypted message without the key, and that forward secrecy only protects keys, not the ciphers themselves. A patient attacker can capture a conversation whose confidentiality is protected through the use of public-key cryptography and wait until the underlying cipher is broken (e.g. large quantum computers could be created which allow the discrete logarithm problem to be computed quickly). This would allow the recovery of old plaintexts even in a system employing forward secrecy. It should be noted that such attacks are purely theoretical.

Protocols

• Forward secrecy is an optional feature in IPsec (RFC 2412).
• SSH
• Off-the-Record Messaging, a cryptography protocol and library for many instant messaging clients, provides forward secrecy as well as deniable encryption.
• In theory, Transport Layer Security (TLS) can choose appropriate ciphers since SSLv3, but in everyday practice many implementations have refused to offer forward secrecy or only provide it with very low encryption grade.^[4] OpenSSL supports forward secrecy using elliptic curve Diffie–Hellman since version 1.0,^[5] with a computational overhead of approximately 15%.^[6]

Use

Forward secrecy is seen as an important security feature by several large Internet information providers. Since late 2011, Google has provided forward secrecy with TLS by default to users of its Gmail service, along with Google Docs and encrypted search among other services.^[7] Since November of 2013, Twitter has provided forward secrecy with TLS to users of its service.^[8] As of February 2014, 5.3% of TLS-enabled websites are configured to use cipher suites that provide forward secrecy to web browsers.^[9]

See also

• Forward anonymity
• Diffie–Hellman key exchange

Notes

External links

• RFC 2412 IETF, H. Orman. The OAKLEY Key Determination Protocol
• Forward-secure-survey An overview
• Forward Secrecy can block the NSA from secure web pages, but no one uses it Computerworld June 21, 2013
• SSL: Intercepted today, decrypted tomorrow Netcraft June 25, 2013
• Deploying Forward Secrecy SSL Labs June 25, 2013