4 ms·
This is an odd twist on perfect forward secrecy. PFS is the assertion that even with one of the private keys, a passive attacker cannot decrypt the stream. With
by Scaevolus 13y ago
This is an odd twist on perfect forward secrecy. PFS is the assertion that even with one of the private keys, a passive attacker cannot decrypt the stream. With this system knowledge of the initiator's private key and the prekey is enough to decrypt the stream.
Getting that prekey is almost certainly easier than getting both private keys, so the security guarantee isn't equivalent to PFS.
- moxie 13y agoI think you might be misunderstanding what's happening here. The prekey is nothing but a public signed ECDH message. An attacker would need to compromise that message's corresponding private key in order to decrypt any ciphertext that was encrypted with it. It is only used once to start a conversation and then destroyed, so the attacker would have a very small window in which to compromise the private key. Just as if it were a synchronous conversation. This is identical to a situation where a client initiates secure sessions with 100 different people who happen to be offline. When they come online, they respond with their key exchange message and continue.