Re: [saag] Perfect Forward Secrecy vs Forward Secrecy

[Nico Williams <[e-mail]>]

On Wed, Mar 18, 2020 at 10:17:35AM -0700, Eric Rescorla wrote:
> On Wed, Mar 18, 2020 at 9:47 AM Nico Williams <[e-mail]> wrote:
> > On Wed, Mar 18, 2020 at 09:26:34AM -0700, Mark D. Baushke wrote:
> > > There is also https://www.perfectforwardsecrecy.com/ which has a
> > > paragraph
> > >
> > >       Forward Secrecy has been used as a synonym for Perfect Forward
> > >       Secrecy but there is a subtle difference between the two. Perfect
> > >       Forward Secrecy has the additional property that an agreed key
> > >       will not be compromised even if agreed keys derived from the same
> > >       long-term keying material in a subsequent run are compromised.
> >
> > Are there examples in Internet protocols of FS key agreement protocols
> > that aren't also PFS?  I'm not denying that it's possible to construct an
> > FS-but-not-PFS key agreement protocols, but I'm wondering whether we
> > need a name for those when we wouldn't want to have any of them.
> 
> I've honestly never seen this particular distinction of FS vs. PFS drawn
> and I'm not quite sure it's that useful.

+1.  Calling this just FS and not PFS is fine with me, even if fear of
misunderstanding "perfect" strikes anyone as silly.

> Consider the case of a typical SIGMA-based AKE like TLS. The handshake
> protocol typically spits out one piece of shared entropy (e.g., the TLS 1.2
> master secret) which is then key expanded into multiple working (traffic)
> keys. Assuming a strong KDF, then generally working key A cannot be used to
> derive working key B. However, the MS can be used to derive A or B. So is
> this PFS or just FS? Depends on where you draw the line for "agreed key",
> right?

+1

> ISTM that using "perfect" or not doesn't convey enough info and we should
> instead talk about protocols being forward secure with respect to certain
> attacks (as is the case in MLS). See for instance:
> https://tools.ietf.org/rfcmarkup?doc=8446#section-8.1

+1.