> PGP's lack of forward secrecy PFS doesn't really exist in the case of emails, it makes more sense in the context of a real-time conversation. In the context

> PGP's lack of forward secrecy PFS doesn't really exist in the case of emails, it makes more sense in the context of a real-time conversation. In the context of a conversation you typically create a session that is symmetrically agreed upon by both parties and lives until one of the parties quit. This agreement includes a "session encryption key" that is completely random in the case of PFS (so it can't be used to infer other session's encryption keys, that's the point). You then use this key for the whole duration of the session (with careful re-keying at some point otherwise it's pointless) PGP goes even beyond: there's no session, and each message is encrypted with a different key. If you had to draw a parallel, it would be as if only one party is enough to decide the parameters of a session, and all parameters would still be changing every time. Also, each session is only ever used for 1 message. If you really want to draw the parallel, then PGP is the ultimate PFS. > I actually wonder why we can't just use Axolotl for an email interface, and call it a day?! Because the number 1 problem in cryptography for a decentralized end-user product is not the cipher or the algorithms or do we use Elliptic Curves or whatever, it is the distribution of keys. The Axolotl ratchet is awesome, but it's only a ratchet. PGP has some stuff related to key distribution and verification, TLS has some. If we are to implement global scale email cryptography, it will more likely be on top of PGP or TLS than anything else.