Re: [saag] Perfect Forward Secrecy vs Forward Secrecy

[Nico Williams <[e-mail]>]

On Wed, Mar 18, 2020 at 09:26:34AM -0700, Mark D. Baushke wrote:
>   Menzies, Alfred; van Oorscot, Paul C.; Vanstone, SCOTT (1997).
>   Handbook of Applied Cryptography. CRC Pres. ISBN 978-0-8493-8523-0.
> 
>       In cryptography, forward secrecy (FS), also known as perfect
>       forward secrecy (PFS), is a feature of specific key agreement
>       protocols that gives assurances that session keys will not be
>       compromised even if the private key of the server is compromised.
> 
> There is also https://www.perfectforwardsecrecy.com/ which has a paragraph
> 
>       Forward Secrecy has been used as a synonym for Perfect Forward
>       Secrecy but there is a subtle difference between the two. Perfect
>       Forward Secrecy has the additional property that an agreed key
>       will not be compromised even if agreed keys derived from the same
>       long-term keying material in a subsequent run are compromised.
> 
> along with more justification of differences.

Are there examples in Internet protocols of FS key agreement protocols
that aren't also PFS?  I'm not denying that it's possible to construct an
FS-but-not-PFS key agreement protocols, but I'm wondering whether we
need a name for those when we wouldn't want to have any of them.

Nico
--