Forward secrecy
In an authenticated key-agreement protocol that uses public key cryptography, perfect forward secrecy (or PFS) is the property that ensures that a session key derived from a set of long-term public and private keys will not be compromised if one of the (long-term) private keys is compromised in the future.
Forward secrecy has been used as a synonym for perfect forward secrecy [1], since the term perfect has been controversial in this context. However, at least one reference [2] distinguishes perfect forward secrecy from forward secrecy with the additional property that an agreed key will not be compromised even if agreed keys derived from the same long-term keying material in a subsequent run are compromised.
Perfect Forward Secrecy (PFS) refers to the notion that compromise of a single key will permit access to only data protected by a single key. For PFS to exist the key used to protect transmission of data MUST NOT be used to derive any additional keys, and if the key used to protect transmission of data was derived from some other keying material, that material MUST NOT be used to derive any more keys.
History
PFS was originally introduced [3] by Diffie, van Oorschot, and Wiener and used to describe a property of the Station-to-Station protocol (STS), where the long-term secrets are private keys. PFS requires the use of public key cryptography, and cannot be achieved with symmetric cryptography alone. (citation required)
PFS has also been used [4] to describe the analogous property of password-authenticated key agreement protocols where the long-term secret is a (shared) password.
Annex D.5.1 of IEEE 1363-2000 discusses the related one-party and two-party forward secrecy properties of various standard key agreement schemes.
Protocols
- PFS is an optional feature in IPsec (RFC 2412).
- SSH.
- Off-the-Record Messaging, a cryptography protocol and library for many instant messaging clients, provides perfect forward secrecy as well as deniable encryption.
- In theory, Transport Layer Security can choose appropriate ciphers since SSLv3, but in everyday practice many implementations refuse to offer PFS or only provide it with very low encryption grade. [5]
See also
- Diffie-Hellman key exchange is a cryptographic protocol that provides perfect forward secrecy.
- Forward anonymity
Notes
- ^ IEEE 1363-2000: IEEE Standard Specifications For Public Key Cryptography. Institute of Electrical and Electronics Engineers, 2000. http://grouper.ieee.org/groups/1363/
- ^ Telecom Glossary 2000, T1 523-2001, Alliance for Telecommunications Industry Solutions (ATIS) Committee T1A1. http://www.atis.org/tg2k/_perfect_forward_secrecy.html
- ^ Diffie, Whitfield (1992). "Authentication and Authenticated Key Exchanges". Designs, Codes and Cryptography. 2 (2): 107. doi:10.1007/BF00124891. Retrieved 2008-02-11.
{{cite journal}}: Unknown parameter|coauthors=ignored (|author=suggested) (help); Unknown parameter|month=ignored (help); Unknown parameter|volumes=ignored (help) - ^ Jablon, David P. (1996). "Strong Password-Only Authenticated Key Exchange". ACM Computer Communication Review. 26 (5): 5–26. doi:10.1145/242896.242897. Retrieved 2008-02-11.
{{cite journal}}: Unknown parameter|month=ignored (help) - ^ Discussion on the TLS mailing list in October 2007
References
- H. Orman. The OAKLEY Key Determination Protocol. IETF RFC 2412.
 | This cryptography-related article is a stub. You can help Wikipedia by expanding it. |