Perfect forward secrecy using XOR

Question

I understand that Perfect Forward secrecy is meant to prevent the data sent between the client and server being decrypted in case the private key is leaked some time after the data being sent.

But why do we need something complicated like Diffie-Hellman key exchange to do this? Couldn't we simply use XOR instead, like this:

1. The client generates a random encryption key, K and a random number of the same length, R1
2. The client sends K xor R1 to the server
3. The server generates a random number R2
4. The server sends K xor R1 xor R2 to the client
5. The client xors the message with its random number, sending K xor R2 to the server
6. The server xors the message with its random number too, which results in the key, K, which is then used to encrypt all communications

If a key that isn't generated by only the client/server is needed for some reason, then this process can be repeated again by the server and then the two keys can be xored to get the final key.

Unless the SSL private key is known when this exchange happens, which would allow for a man-in-the-middle to modify messages sent between the client and server, no one will be able to figure out what the key is.

I understand that XOR is vulnerable to known-plaintext attacks, but since both the random numbers and the encryption key are used only once, I don't see why this should matter.

Answer 1

Anyone observing the exchange can just trivially calculate K!

K = (K xor R1) xor (K xor R1 xor R2) xor (K xor R2)

This are exactly the three messages which are sent in your protocol...

Answer 2

Perfect Forward Secrecy is not possible using only pure symmetric cryptographic primitives. However, if we relax the conditions (like compromise of the long term secret of just one principal not both) then PFS can be achieved using pure symmetric primitives.