Understanding Forward Secrecy
certificate, cryptography, private-key
Solution
In Forward Secrecy, there are still long-term keys. The only implication is, that the compromisation of a long-term key will not allow an attacker to compromise temporary session keys, when the long-term key has changed. This means that a long-term key must not be derived from another (older) key.
Here is a good survey on this topic.
According to Wikipedia:
- PFS is an optional feature in IPsec (RFC 2412).
- SSH.
- Off-the-Record Messaging, a cryptography protocol and library for many instant messaging clients, provides perfect forward secrecy as well as deniable encryption.
- In theory, Transport Layer Security can choose appropriate ciphers since SSLv3, but in everyday practice many implementations refuse to offer PFS or only provide it with very low encryption grade.
Problem
Recently, I was pointed to a post from 2011 by a friend, which described Google's move towards forward secrecy. From what I understand, the essence of forward secrecy seems to lie in the fact that the private keys are not kept in persistant storage. I have various doubts about how something like this could be implemented. - What if the server goes down without warning - do the key pairs have to be regenerated? Does the public key have to be signed again to create another certificate? - Could someone point me to posts/pdfs where the implementation of something like this is described. Suggested reading resources? - Are you aware of anyone else that has implemented forward secrecy? Have you tried something similar at your workplace? Thanks!