Forward-Security in Private-Key Cryptography

By Mihir Bellare, Bennet S. Yee. The Cryptographer's Track at RSA Conference, 2003

349 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Vanish: Increasing Data Privacy with Self-Destructing Data (2009, background): “A potential alternative to standard encryption might be to use forward-secure encryption [6, 13], yet our goal is strictly stronger than forward secrecy.”
Duplexing the sponge: single-pass authenticated encryption and other applications (2011, background): “Finally, some applications require a pseudo-random bit sequence generator to support forward security: The compromise of the current state does not enable the a(cid:308)acker to determine the previously generated pseudo-random bits [6,17].”
A Formal Security Analysis of the Signal Messaging Protocol (2017, background): “…of Signal’s “Double Ratchet”, which effectively combines ideas from OTR’s asymmetric ratchet and a symmetric ratchet (which applies a symmetric key derivation function to create a new key, but does not incorporate fresh DH material, similar to so-called “forward-secure” symmetric encryption [11]).”
XMSS - A Practical Forward Secure Signature Scheme based on Minimal Security Assumptions (2011, background): “In [6] it is shown that if F (n) is a pseudorandom function family, then InSec (FsGen; t), the maximum success probability of any adversary running in time ≤ t, attacking the forward security of FsGen is: InSec (FsGen; t) = 2ñ · InSec (F (n); (t+ 2ñ), 2)”