Re: [saag] Perfect Forward Secrecy vs Forward Secrecy

[Christopher Wood <[e-mail]>]

On 18 Mar 2020, at 9:38, Eric Rescorla wrote:

> I don't feel strongly about this, but would make three points:
>
> 1. RFC 4949 seems to have both terms, with the main
> definition under PFS and FS pointing to PFS and then says:
>
>    Ordinary forward secrecy vs. "perfect" forward secret: Experts
>    disagree about the difference between these two. Some say there is 
> no
>    difference, and some say that the initial naming was unfortunate 
> and
>    suggest dropping the word "perfect". Some suggest using "forward
>    secrecy" for the case where one long-term private key is 
> compromised,
>    and adding "perfect" for when both private keys (or, when the
>    protocol is multi-party, all private keys) are
>
>
> 2. TLS 1.3 explicitly chose to use the term "forward secret" and not
> "perfect forward secret".
>
> 3. One advantage of saying FS and not PFS is that you can then 
> describe
> things as "forward secret" in a way that isn't grammatically awkward,
> as in RFC 8446; S 2.3.
>
>    1.  This data is not forward secret, as it is encrypted solely 
> under
>        keys derived using the offered PSK.

All good points! I based my opinion on the HAC definition, though 
Jon’s response nudged me the other way. (Thanks, Jon!)