[42661] in Cypherpunks
Re: Perfect Forward Secrecy - is it worth it?
daemon@ATHENA.MIT.EDU (Perry E. Metzger)
Wed Nov 1 11:30:25 1995
To: Simon Spero <ses@tipper.oit.unc.edu>
Cc: cypherpunks@toad.com
In-Reply-To: Your message of "Tue, 31 Oct 1995 14:30:04 PST."
<Pine.SOL.3.91.951031141506.1151H-100000@chivalry>
Reply-To: perry@piermont.com
Date: Wed, 01 Nov 1995 11:19:04 -0500
From: "Perry E. Metzger" <perry@piermont.com>
Simon Spero writes:
> Quick survey; how important is perfect forward secrecy to you?
Very. It makes one's life far easier. It makes protecting historical
traffic easy. Its a wonderful feature for a cryptosystem.
> In general, schemes offering PFS require a extra PK-op, and an extra
> round-trip when compared to non-PFS schemes. This cost is incurred once
> per "session", but can add on the order of seconds to startup times.
Well, things aren't that bad if you use eliptic curve variants on D-H,
or if you are very careful. See Phil Karn's work on this for Photuris...
Perry
