I understand that Perfect Forward secrecy is meant to prevent the data sent between the client and server being decrypted in case the private key is leaked some time after the data being sent.

But why do we need something complicated like Diffie-Hellman key exchange to do this? Couldn't we simply use XOR instead, like this:

  1. The client generates a random encryption key, K and a random number of the same length, R1
  2. The client sends K xor R1 to the server
  3. The server generates a random number R2
  4. The server sends K xor R1 xor R2 to the client
  5. The client xors the message with its random number, sending K xor R2 to the server
  6. The server xors the message with its random number too, which results in the key, K, which is then used to encrypt all communications

If a key that isn't generated by only the client/server is needed for some reason, then this process can be repeated again by the server and then the two keys can be xored to get the final key.

Unless the SSL private key is known when this exchange happens, which would allow for a man-in-the-middle to modify messages sent between the client and server, no one will be able to figure out what the key is.

I understand that XOR is vulnerable to known-plaintext attacks, but since both the random numbers and the encryption key are used only once, I don't see why this should matter.

2 Answers 2


Anyone observing the exchange can just trivially calculate K!

K = (K xor R1) xor (K xor R1 xor R2) xor (K xor R2)

This are exactly the three messages which are sent in your protocol...


Perfect Forward Secrecy is not possible using only pure symmetric cryptographic primitives. However, if we relax the conditions (like compromise of the long term secret of just one principal not both) then PFS can be achieved using pure symmetric primitives.

  • 3
    This is an interesting opinion, but do you have anything to back it up? Why is it not possible? In what way can relaxing conditions make it possible? Do you have examples, specifics, explanations?
    – schroeder
    Commented Oct 9, 2017 at 11:30
  • @schroeder There is a website which claims this. However, if we relax the conditions (as mentioned earlier), then PFS is quite achievable using neat cryptographic techniques like combining boot-strapping with one-way ratcheting. It would be a long explanation to fit in a comment but the basic idea is to ''conceal'' the information in such a way that only the non-compromised principal can unwrap the information after compromise of the long term secret of the other party.
    – Azuru
    Commented Oct 10, 2017 at 12:01
  • 1
    Please edit your Answer with these details. There is room enough there.
    – schroeder
    Commented Oct 10, 2017 at 12:05

You must log in to answer this question.