Forward secrecy ensures that if any of the user’s keys are compromised (including long-term identity keys and ephemeral keys), these keys cannot be used to go back and decrypt past messages.
Future secrecy ensures that if any of the user’s ephemeral chain keys are compromised, these keys cannot be used to decrypt future messages.
*Note: Future secrecy does not apply to the user’s long term identity keys. From Advanced Cryptographic Ratcheting: If, for whatever reason, any individual ephemeral key is compromised or otherwise found to be weak at any time, the ratchet will heal itself. We call this “future secrecy.” (emphasis mine)
In addition to the above, Signal protocol can be used in an asynchronous environment, meaning that the protocol maintains state even if one or both parties are offline, or one party sends a message to the other party while the other party is offline.
However, if the two parties are communicating in a synchronous environment, then does Signal offer any security benefits that can’t be achieved with a modern implementation of TLS?
Consider a scenario where Bob and Alice wish to communicate in a synchronous environment with end-to-end encryption, with forward secrecy and future secrecy. Both Alice and Bob are running TLS servers, with modern versions of TLS that offer forward secrecy. When Alice wishes to send a message to Bob, Alice connects using her client certificate to Bob’s TLS server, the TLS session commences, Alice authenticates Bob’s TLS server certificate, Bob authenticates Alice’s TLS client certificate, then Alice sends the message to Bob’s server through the TLS tunnel. Bob uses the inverse process to send a message to Alice. After each message is transmitted, the TLS session is torn-down, and all ephemeral keys are discarded. Brand new TLS sessions are created for each message transmitted, without using any session material from previous sessions.
It is well established that modern versions of TLS provide forward secrecy. It would seem that the above system would offer future secrecy as well - being that ephemeral session keys are never re-used, so earlier session keys, if compromised, cannot be used to decrypt future messages.
In light of all of the above: In a synchronous environment (and putting aside the practicalities of Alice and Bob each having to run a TLS server), does Signal offer any security benefits that can’t be achieved with a modern version of TLS?