Forward secrecy

As explained in Real-World Cryptography

Message-level forward secrecy is the property that compromise of a current message key does not reveal previously protected messages, assuming those messages are no longer available in cleartext.

Imagine an attacker stealing a current message key after recording an old conversation. Forward secrecy means that compromise does not unlock those earlier messages, provided their cleartext is no longer available. section 10.3.1 section 10.4.3

A message-level protocol builds this protection in stages:

• Start with a shared session secret, such as the output of X3DH, rather than using one permanent key for every message. section 10.4.3
• Derive separate sending and receiving chains with a key derivation function (KDF). section 10.4.3
• Pass each chain key through a one-way function to produce the next chain key and the individual message key. section 10.4.3
• Erase or stop relying on earlier keys so that compromising a current sending or receiving key does not recover previous ones. section 10.4.3

PGP’s missing safety net

PGP encrypts earlier emails under a long-lived private key. If that private key is later compromised, recorded emails encrypted under it can be decrypted. Changing the key can restore forward secrecy, but the process is inconvenient, so it is not enabled by default. section 10.3.1

Figure 10.15 Building on figure 10.14, forward secrecy can be introduced in the post-X3DH protocol by ratcheting (passing into a KDF) a chain key every time one needs to send a message, and ratcheting another chain key every time one receives a message. Thus, the compromise of a sending or receiving chain key does not allow an attacker to recover previous ones.

The ratcheting diagram shows how advancing a sending or receiving chain through a KDF prevents a compromised chain key from revealing earlier keys. section 10.4.3

How Real-World Cryptography covers it

How deep it goes

Explains directional chains, KDF-based key evolution, and Double Ratchet integration, while stopping short of implementation detail.

Examples

Uses Signal conversations, Alice-and-Bob message chains, PGP email, and PRNG state compromise as concrete examples.

What you can do after

Evaluate whether a messaging design limits historical exposure after current-key compromise.

How it connects

Connects forward secrecy to X3DH, KDFs, symmetric ratchets, DH ratchets, and post-compromise security.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Hacking CryptographyForward secrecy is the property that compromise of long-term or current secret keying material does not reveal previously established session secrets.

Compare how 2 books explain forward secrecy →

Related concepts

• MQV key exchange algorithmproduced by · An authenticated key-agreement protocol that combines static and ephemeral key pairs to derive a shared secret.
• PGPcontrasts with · PGP is a cryptographic standard for protecting messages and files with public-key encryption, digital signatures, and key management.
• RC4contrasts with · RC4 is a stream-cipher algorithm that generates a pseudorandom keystream from a variable-length secret key using a permutation-based internal state.
• symmetric ratchetaddressed by · A symmetric ratchet is a key-evolution mechanism that derives successive chain keys and message-encryption keys from a one-way key update.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.