3 ms·
> These are all very difficult attacks that require the attacker to have recorded your traffic off the network. The entire premise of encrypting the traffic pa
by zrm 6y ago
> These are all very difficult attacks that require the attacker to have recorded your traffic off the network.
The entire premise of encrypting the traffic passing over the network is that an attacker may have access to your traffic off the network.
> I don't see how forward secrecy would change things for this situation.
Suppose there is an attacker capturing all your network traffic, waiting for an opportunity to decrypt it. You backed up your phone in 2015. Then, today, the machine containing the 2015 backup of your phone is compromised, e.g. because you discarded it without sanitizing it. The attacker now has all of your messages from before 2015, because they're in the backup. But without forward secrecy, they also get all of your messages after 2015, because they could use the long-term key from the backup to decrypt all your captured network traffic. They would also get any messages from before 2015 that you had deleted prior to backing up your phone.
- upofadown 6y ago>...they also get all of your messages after 2015, because they could use the long-term key from the backup to decrypt all your captured network traffic. They would get all your messages after 2015 if they were willing and able to MITM the Diffie-Hellman handshake used in the forward secrecy scheme. Otherwise there would be no point in having long term identity keys in the first place. Your example brings up an interesting point for me. Perhaps forward secrecy is more important in systems that trade off secrecy for convenience by failing to protect the private keys with a strong passphrase. In that case forward secrecy is more valuable due to the larger chance of a private key compromise. I guess the same point would apply to deniability as well. So thanks for the discussion and generated insight.