Re: [saag] Perfect Forward Secrecy vs Forward Secrecy

[Jon Callas <[e-mail]>]

> On Mar 18, 2020, at 7:36 AM, Robert Moskowitz <[e-mail]> wrote:
> 
> I have been asked to change all uses of the term:
> 
> Perfect Forward Secrecy to Forward Secrecy
> 
> What is the 'feel' about this.
> 

Please. +2^n. This is one of my peeves. Forward secrecy is a much better term. Saying "perfect" forward secrecy is kinda like "military-grade" encryption in the way it's misused, and often a shibboleth showing trying to puff things up.

In the face of "perfection" though, let me talk a bit out of the other side of my mouth. The word "perfect" its most distilled form, means something that can't be made better. Colloquially, we use it to mean something like "flawless" but its most basic form is more like "best." 

Most uses of Perfect Forward Secrecy meet neither of those. It's neither flawless nor best.

If one wants to rigorously define what "perfect" forward secrecy might look like, "information-theoretic" security is pretty close to what perfection is. It's not only rigorous, but it's got a lot of the qualities you'd want in something "perfect."

Well, we don't do that. We don't go to information-theoretic security. The reason we don't, if you'll forgive the small hand wave is that we've decided that 2^128 is a big number and moreover that it's big enough. At the same time, for people who disagree, we offer them the number of 2^256, and that's also a big enough number.

We don't do "perfect" security in our fundamentals, because, as the unnamed AD said, it's hard to achieve.

If we look at a communications system, let me idealize something like TLS into one, we do a key exchange of some object we turn into a key, and then bulk encrypt with that key. The "PFS" systems we use could be "better" (for some reasonable definition of better). Here's a sketch:

There's nothing magic about forward secrecy. It only means you throw keys away. We use one key for the whole session/transaction, and then throw it away. (And yes, I am indeed burying a lot of detail.) Well, could we make that better? If we can, then the existing system is not perfect.

It's easy to make it better -- negotiate two keys. Halfway through the session, (hand wave, hand wave) negotiate a new key so that if a key is compromised on one half, it doesn't compromise the other one. Take our idealized handshake and just do it again.

Can we do better than two keys? Sure! Four keys! Can we do better than that? Yes. If you do a full handshake for every bit you transmit, then *that* is the most forwardly-secret thing you can do. True Perfect Forward Secrecy does a full handshake for every bit.

We don't do that because it's hard, and also because it's kinda -- well, gilding the lily is the kindest way to put it. This is where notions of information-theoretic security come in.

If you're doing a handshake with 2^128 bits of security, you can safely transmit 128 bits under that handshake. You don't get more security by sending only a single bit -- it's *better* but it's a difference without distinction (cryptographically, it's a betterment without a distingusher, hahaha). Thus, while True Perfect Forward secrecy does a handshake for every bit, Operationally Perfect Forward Secrecy sends as many bits as the security level of the handshake and no more.

(From this, we can also note that Truest Operationally Perfect Forward Secrecy would do a handshake with a security level of a number of bits that's the whole of the session, so you can send the whole thing in one handshake. Note that when you do this, you don't actually need to have a bulk cipher -- instead of doing "key exchange" we can just do "message exchange.")

We don't do anything like this. We don't because we have a collective, unstated hunch that it's okay to use a key and send a lot. We even have guidance and work on how big "a lot" should be. This is where birthday-bounds issues, nonce issues, and so on all come in. (As usual, yes, GCM, I'm looking at you.)

Summing up, I kinda agree with the AD that "perfection is hard to achieve" while going further that perfection is *undesirable* because it carries with it a lot of baggage that we don't want to carry -- like the baggage of doing handshakes.

Most importantly and relevant, we should stop saying "perfect" because it's false. At no point where we're doing forward secrecy are we perfect. We could do better. We make the engineering decision to do Good Enough Forward Secrecy. 

Yes, yes, drop "Perfect." It should be just "Forward Secrecy" with no editorializing, especially when it's just not true and even downright misleading.

	Jon