Subject: [TLS] bikeshed: Forward Security or Secrecy?

From: Dave Garrett <[email-masked]>
Date: Mon, 30 Nov 2015 16:27:27 -0500

Which do we like better: "Forward Security" or "Forward Secrecy"? The TLS 1.3 draft uses both interchangeably. The term is clearly in a state of flux, seeing as we've seemingly collectively agreed to drop the word "perfect" from the term, already. Personally, I prefer "security" because "secrecy" is a less used word, and to "forward secure" something is grammatically OK but to "forward secret" something is not. (e.g. the doc says 0RTT data is not "forward secure" but "forward secret" isn't really the right phrase here) Everything could be rephrased to use either, but I'd like to change all our use to just "forward secure" and stick a note somewhere on the terminology.

Dave

---

From: Hugo Krawczyk <[email-masked]>
Date: Mon, 30 Nov 2015 23:09:41 -0500

The more common term is "forward secrecy" - indeed, the normal definition
[1] refers specifically to the secrecy of session keys or ephemeral key
material after being deleted. Other elements of security such as
authentication and integrity are irrelevant so "secrecy" seems to be the
more appropriate term. There are other notions in cryptography that use the
term "forward secure", see
http://www.cs.bu.edu/~itkis/pap/forward-secure-survey.pdf.

[1] "the compromise of long-term keys does not compromise past session
keys"

Hugo

On Mon, Nov 30, 2015 at 4:27 PM, Dave Garrett <[email-masked]>
wrote:

> Which do we like better: "Forward Security" or "Forward Secrecy"? The TLS
> 1.3 draft uses both interchangeably. The term is clearly in a state of
> flux, seeing as we've seemingly collectively agreed to drop the word
> "perfect" from the term, already. Personally, I prefer "security" because
> "secrecy" is a less used word, and to "forward secure" something is
> grammatically OK but to "forward secret" something is not. (e.g. the doc
> says 0RTT data is not "forward secure" but "forward secret" isn't really
> the right phrase here) Everything could be rephrased to use either, but I'd
> like to change all our use to just "forward secure" and stick a note
> somewhere on the terminology.
>
>
> Dave
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Tony Arcieri <[email-masked]>
Date: Mon, 30 Nov 2015 20:19:52 -0800

On Mon, Nov 30, 2015 at 8:09 PM, Hugo Krawczyk <[email-masked]>
wrote:

> The more common term is "forward secrecy"
>

I'd second this. I'm also a fan of Dan Bernstein's recommended term: "key
erasure"

-- 
Tony Arcieri

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 30 Nov 2015 20:22:19 -0800

I have filed issue 353 for this so we don't lose it.

https://github.com/tlswg/tls13-spec/issues/353

Thanks.
-Ekr