Forward secrecy

In cryptography, we don't only ask "is this message secret today?", but also "will it stay secret if a key is stolen tomorrow?". Forward secrecy answers this second question.

The dreaded scenario

Imagine an attacker patiently recording, for months, all of your encrypted messages as they travel across the network. They can do nothing with them: they are unreadable. Then, one day, they manage to steal the key stored on your phone.

The question becomes: what can they decrypt with this key?

In a naive system where a single key is used for the entire conversation, the answer is catastrophic: everything. All the past messages they had patiently recorded become readable all at once.

Forward secrecy

Forward secrecy (sometimes perfect forward secrecy) is the property that prevents this:

If a session key is compromised, past messages remain protected.

How is this achieved? Through two complementary actions, repeated continuously:

1. Renew the keys very often — ideally a different key for each message.
2. Erase the old keys as soon as they have been used.

Stealing the current key then grants access only to the present, never to the past: the keys that would have decrypted the old messages no longer exist.

Temps  ->  msg1      msg2      msg3      msg4   (message courant)
Clé :      K1        K2        K3        K4
État :   [effacée] [effacée] [effacée] [active]
                                          ^
                    Un vol ici ne révèle que msg4.
              K1, K2, K3 ont disparu : msg1..3 restent sûrs.

Post-compromise security

There is a twin property, oriented toward the future: post-compromise security (also called self-healing).

It answers a different question: after an attacker has stolen a key, can future messages become safe again?

• Forward secrecy protects the past from a future compromise.
• Post-compromise security protects the future from a past compromise: the system "heals" on its own, provided that fresh new randomness that the attacker does not know is introduced regularly.

Together, the two confine the damage of a key theft to a window of time as narrow as possible, instead of compromising the entire conversation.

In summary

• Forward secrecy guarantees that stealing the current key does not decrypt past messages.
• It is obtained by continually renewing the keys and erasing the old ones.
• Post-compromise security is its twin: it protects the future after a theft, thanks to new randomness injected regularly.