Is it possible to use PFS with a PGP message?

$ gpg2 --encrypt --armor --something? --something? -r [email protected]

PFS with GPG probably isn't possible -- otherwise everyone would be using it already, right? But I thought I'd ask anyway.

  • 5
    PFS makes it so that someone that managed to obtain the private key cannot decrypt past messages. For emails, you do need to be able to decrypt past messages, and most people also expects to be able to read and send messages from multiple devices. This expectation contradicts the point of PFS.
    – Lie Ryan
    Commented Apr 6, 2017 at 2:04
  • @LieRyan Careful with assumptions, although messaging systems like email is the primary use-case for PGP, it is not the only use-case. Commented Apr 7, 2017 at 15:31

1 Answer 1


Forward secrecy occurs when you delete all copies of a key that exist anywhere in the world, thereby converting all past communications encrypted with that key into opaque garbage (until such a time when algorithms/computers are able to crack the key). Forward secrecy requires you to set up temporary keys that are impossible for anyone (including yourself) to find later on.

If you want to do forward secrecy with GPG, here are a couple of options:

  • Option 1: Release short-lived subkeys publicly, say, once every two weeks. People who want to send you encrypted stuff have to use the most recent one.
  • Option 2: Only publish a signing key, so people have to ask "Hey I want to send you something encrypted, what is your encryption key?". You then reply with a one-time-use public key (you sign this with your identity key to avoid MitM attack).

In each case you set up a finite time window (can be very short in the latter case) during which time you can read the message. Afterwards, you discard the key and your forward secrecy begins.

It is essential that you make the private key unrecoverable. This requires some care. Ideally your temporary key only stays in your computer's RAM or on a flammable piece of paper, because once it hits harddrive, it's very difficult to ensure all copies are wiped out. Unfortunately, GPG software typically requires secret keys to be stored on a secring file. Either A) create a temporary GPG keyring on a ramfs, or B) save on your drive but use a very strong randomized passphrase that you will discard. (don't store this phrase in a text editor; don't use tmpfs -- their memory may be swapped to harddrive)

If the message is very sensitive, you should take similar precautions to wipe out all copies of the cleartext or remove incriminating parts, after you decrypt it. If you want deniable authentication, that is a separate topic and requires some care.

If neither of the options above sounds like perfect forward secrecy, too bad --- that's as good as it gets in any protocol! Forward secrecy requires you to have full trust in your hardware and software for the entire time when your temporary key is live. It only guarantees that you are protected if you delete your key before your setup is compromised.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .