Re: [saag] Perfect Forward Secrecy vs Forward Secrecy

I don't feel strongly about this, but would make three points:

1. RFC 4949 seems to have both terms, with the main
definition under PFS and FS pointing to PFS and then says:

   Ordinary forward secrecy vs. "perfect" forward secret: Experts
   disagree about the difference between these two. Some say there is no
   difference, and some say that the initial naming was unfortunate and
   suggest dropping the word "perfect". Some suggest using "forward
   secrecy" for the case where one long-term private key is compromised,
   and adding "perfect" for when both private keys (or, when the
   protocol is multi-party, all private keys) are

2. TLS 1.3 explicitly chose to use the term "forward secret" and not
"perfect forward secret".

3. One advantage of saying FS and not PFS is that you can then describe
things as "forward secret" in a way that isn't grammatically awkward,
as in RFC 8446; S 2.3.

   1.  This data is not forward secret, as it is encrypted solely under
       keys derived using the offered PSK.

-Ekr

On Wed, Mar 18, 2020 at 9:30 AM Mark D. Baushke <mdb=
40juniper.net@dmarc.ietf.org> wrote:

> Christopher Wood <caw@heapingbits.net> writes:
>
> > On Wed, Mar 18, 2020, at 7:48 AM, Salz, Rich wrote:
> > > I agree perfect forward secrecy is the term of art and we shouldn't
> > > create a new one.
> >
> > FWIW, +1.
>
> Wikipedia has an entry
>
>   https://en.wikipedia.org/wiki/Forward_secrecy
>
> which begins with a quote from
>
>   Menzies, Alfred; van Oorscot, Paul C.; Vanstone, SCOTT (1997).
>   Handbook of Applied Cryptography. CRC Pres. ISBN 978-0-8493-8523-0.
>
>       In cryptography, forward secrecy (FS), also known as perfect
>       forward secrecy (PFS), is a feature of specific key agreement
>       protocols that gives assurances that session keys will not be
>       compromised even if the private key of the server is compromised.
>
> There is also https://www.perfectforwardsecrecy.com/ which has a paragraph
>
>       Forward Secrecy has been used as a synonym for Perfect Forward
>       Secrecy but there is a subtle difference between the two. Perfect
>       Forward Secrecy has the additional property that an agreed key
>       will not be compromised even if agreed keys derived from the same
>       long-term keying material in a subsequent run are compromised.
>
> along with more justification of differences.
>
> So, I still think that PFS is a term of art and we should not stop using
> it.
>
>         -- Mark
>
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag
>