Re: [saag] Perfect Forward Secrecy vs Forward Secrecy

[John Mattsson <[e-mail]>]

Hi,

I see that I am six months late to this discussion.

I agree that it is good to stop using the term PFS. PFS have been used in so many different meanings that you basically need to define the term if you want to use it. The term "forward secrecy" is less muddled.

But as PFS has been used to mean so many different things, I think it is problematic and dangerous to just say that we shall now use the term "forward secrecy" instead of PFS.

Examples from the discussion in RFC 4949:

"given some of the session keys derived from those protocol
  runs, you cannot derive unknown past session keys or future
  session keys."

"There also is the idea that compromise of a single key will
  compromise only the data protected by the single key."

PFS is quite often used to mean frequently rerunning Diffie-Hellman:

NIST SP 800-77r1 (2020):

  "Perfect Forward Secrecy (PFS). IPsec endpoints create session
    keys that are changed frequently, typically once an hour."

ANSSI DAT-NT-003-EN (2015):

"It is recommended to force the periodic renewal of the keys,
   e.g. every hour and every 100 GB of data, in order to limit the
   impact of a key compromise.

The property "forward secrecy" does not imply that an attacker has to do "dynamic key exfiltration" [RFC 7624]. If symmetric cryptography is used to achieve "forward secrecy" an attacker can still do "static key exfiltration" [RFC 7624].

Frequently rerunning Diffie-Hellman forces an attacker to do "dynamic key exfiltration" (or content exfiltration). Every protocol does not need to enforce "dynamic key exfiltration" by itself but I think most systems should, unless they are constrained IoT where rerunning Diffie-Hellman every few hours is not realistic.

It is sad to see that RFC 7624 has so few citations. I think it is an excellent and very useful document, especially the discussion and definition of various types of key exfiltration. I think most work in the security area should consider if an attacker can get away with static key exfiltration and if it is possible to add mechanisms or guidance to force attackers to do dynamic key exfiltration.

Cheers,
John

From: saag <[e-mail]> on behalf of Robert Moskowitz <[e-mail]>
Date: Monday, 23 March 2020 at 19:01
To: Benjamin Kaduk <[e-mail]>, [e-mail] <[e-mail]>
Subject: Re: [saag] Perfect Forward Secrecy vs Forward Secrecy


On 3/22/20 9:19 PM, Benjamin Kaduk wrote:
> On Wed, Mar 18, 2020 at 09:38:07AM -0700, Jon Callas wrote:
>> We don't do "perfect" security in our fundamentals, because, as the unnamed AD said, it's hard to achieve.
> For what little it's worth, the AD doesn't have to be unnamed; I'm happy to
> own up to making the request of Bob.  I just haven't gotten fully caught up
> on mail yet.

And draft 17 reflects this view of Forward Secrecy.

Thanks, Ben.


_______________________________________________
saag mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/saag