Re: [MLS] Use Cases for avoiding Forward Secrecy

[Phillip Hallam-Baker <[e-mail]>]

On Wed, Feb 28, 2018 at 5:28 PM, Dennis Jackson <[e-mail]>
wrote:

> > If however we are working at the message layer, we will often want to
> > support an asynchronous mode in which one party sends some data and
> > another picks it up later. That does not prevent us working end to
> > end but it does prevent us using PFS.
>
> This is incorrect. You may want to review the design of Signal, or
> indeed the current MLS draft.


​No it is completely correct. The P in PFS stands for Perfect .

If Alice creates a message for Bob using only her knowledge of Bob's public
key then it is not going to be PFS because a compromise of Bob's private
key is a breach.

What Signal is doing is sending messages based on Bob's key plus state from
previous communications that Alice and Bob have stored. Now that is
providing some form of Forward Secrecy but only a marketing person would
claim it was 'Perfect'.

​The cost of this shared state is far from trivial at the protocol level as
both the sending and receiving device have to be in synchronization. What
happens when Alice and Bob have a dozen devices? Then we have 144 sets of
shared state.​