Re: [Lake] Forward Security with PSK-Only LAKE

[Karthik Bhargavan <[e-mail]>]

Yes, I take the point that we should be careful about security guarantees.

Further expanding on Ekr’s comment, one can see that there is room for various AKE modes with different levels of guarantees.
So far, we have mainly been thinking about PSK-ECDHE and SIG-ECDHE modes, since forward security was a core property.
I think  we should also consider a PSK-FS mode that achieves forward security via key derivation.

In practice, we may want devices to e.g.  bootstrap a PSK using SIG-ECDHE and then use PSK-FS for some period of time.
After some period of time, we may want to throw away the PSK and do another SIG-ECDHE from scratch.

-Karthik

> On 18 Jan 2020, at 12:26, Benjamin Beurdouche <[e-mail]> wrote:
> 
> 
>> So, if you tell me that LAKE will provide a mechanism <insert name> (e.g.FS) that enables us to recover secrecy from a
>> passive compromise while most of the time using the PSK rotation for FS, I am willing to say it is ok.
>> Otherwise, if there is no hope to introduce freshness via <insert mechanism> (e.g.FS) and that a compromised session will always
>> remain compromised, I’ll maintain that we cannot claim this to be a secure AKE for protocols we’ll build on top…
> 
> 
> (e.g. FS) -> (e.g. DH) obviously...
>