Key Exchange with Tight (Full) Forward Secrecy via Key Confirmation

ePrint Report: Key Exchange with Tight (Full) Forward Secrecy via Key Confirmation

Jiaxin Pan, Doreen Riepel, Runzhi Zeng

Weak forward secrecy (wFS) of authenticated key exchange (AKE) protocols is a passive variant of (full) forward secrecy (FS). A natural mechanism to upgrade from wFS to FS is the use of key confirmation messages which compute a message authentication code (MAC) over the transcript. Unfortunately, Gellert, Gjøsteen, Jacobson and Jager (GGJJ, CRYPTO 2023) show that this mechanism inherently incurs a loss …

eprint report exchange forward key mechanism natural pan passive protocols report secrecy upgrade