Perfect Forward Secrecy

Perfect Forward Secrecy is an encryption style that produces temporary private key exchanges between servers and clients. It is mostly used by calling apps, web pages, and messaging apps where users’ privacy is of utmost importance. Whenever the user takes an action, a new session key is generated because of which the data is not compromised, and is safe from the attackers, which is separate from the special key. 

In case the session key is compromised, the data from any other sessions will not be compromised because a new session key will again be generated each time a session is initiated by the user or the client. The data within the previous sessions remain safe from attacks in the future. 

The basic idea behind the Perfect Forward Secrecy technique is to generate new encryption keys every time the user initiates a session so that if the encryption key is compromised only, that conversation would be leaked and if the user’s special key is compromised, the conversation would still be safe and secure from the attacker because of the encryption key that Perfect Forward Secrecy generates. It basically gives double-layer protection from the attackers.

Encryption:

 Encryption is done to avoid attackers from eavesdropping on the information. The messages or data are basically converted into codes (ciphertext) so that the true meaning is hidden. The data to be encrypted is called the plaintext and the coded data or encrypted data is called the ciphertext. A particular formula or algorithm is required to decrypt the information from the ciphertext, it is called ciphers or encryption algorithms.

How does Perfect Forward Secrecy work?

Assume that there’s a client (C) and a server (S). The client sends a “client hello” which is the beginning of the TLS Handshake.  The server sends back a “certificate” that has the public key that the server has. It offers a public key to everybody because it’s public. Then the client is going to compute a “pre-master secret” and encrypt it using the public key that was included in the certificate which it sends back to the server. The server then uses its private key to decrypt the pre-master key.

From the pre-master secret the client and the server are going to generate the master key or the session key that is used for bulk encryption, which is mostly AES. The AES Encryption algorithm (also known as the Rijndael algorithm) is a symmetric block cipher algorithm. AES is implemented in software and hardware throughout the world to encrypt sensitive data. 

The problems arise when the private key gets compromised. because the pre-master secret and the master secret are encrypted by this private key and hence is all the communication.

To overcome this problem, the Diffie-Hellman ephemeral key exchange cipher suite is used. Here, after the client sends a message, the server generates a prime number, modulo, and a random integer and calculates a value, say A, and sends it back to the client. Now the client, too, generates a value, say B, using the same prime number and modulo but the random integer is picked on its own. The value B is sent back to the server. Using these values and really complex mathematics, they generate the same pre-master secret, and then the master key is generated. 

So, we arrived at the same result as we did earlier just with a different approach but by never having to deal with the private key. Therefore, there’s no way for it to get compromised. The random value (A and B, as taken as examples) are re-generated at every session that the client initiates, so if these random values are compromised somehow, only that session’s conversation will be compromised and as soon as a new session is initiated, there’s new pre-master keys and master keys, etc generated therefore making it extremely difficult for the attackers to capture the information. 

Advantages:

Perfect Forward Secrecy is a highly efficient encryption style and is now used by various websites and applications. The encryption key is changed upon every text message received and sent, phone call made, or even page refresh. Even though Brute Force attacks can eventually penetrate very secure systems given enough time and computation resources, a server protected by Perfect Forward Secrecy guarantees that the Brute Force attacks won’t be successful. Therefore, a server protected by Perfect Forward Secrecy is much less appealing to the attackers since it requires lots of effort to crack into.

Uses of Perfect Forward Secrecy:

This encryption style is used where the user’s privacy is of high concern, such as in banking organizations, Twitter, Gmail, WhatsApp, Facebook Messenger, etc. It is used so that minimal information is compromised if the system is hacked so that not a lot of damage is caused.