I have a textbook that contains the following problem:

In practice, one master key, KM, is exchanged in a secure way (e.g. Diffie-Hellman key exchange) between the involved parties. Afterwards, session keys, kx, are regularly updated by using key derivation. Consider the following three different methods of key derivation:

a. k0 = KM; ki+1 = ki+1

b. k0 = H(KM); ki+1 = H(ki)

c. k0 = H(KM); ki+1 = h(KM || i || ki)

where H() represents a secure hash function, and ki is the ith session key.

The question goes on to ask which method(s) provide Perfect Forward Secrecy (PFS), with the answer key stating that b and c do.

As I understand it, a requirement of PFS is that past sessions are secure even if the long-term secret is compromised [1]. However, in this case, if KM (the long-term secret) is compromised, then all session keys can be computed.

Do any of these key derivation schemes provide PFS? Does the particular wording of the problem, ...exchanged in a secure way..., remove my assumption that KM could be compromised? Is KM not a long-term secret in the context of PFS?

  • It's very hard to see how (c) could be a correct answer. Km is without question a long term secret in this case, as it is needed for the derivation of every session key in the sequence. But, if Km is compromised at any point in time, then this is all the attacker would need to derive all the session keys up to that point. This is exactly what PFS aims to prevent, as explained in the first paragraph of the Wikipedia article that you referenced.
    – mti2935
    Commented Dec 1, 2023 at 20:42

1 Answer 1


If K100 is compromised, are K1 to K99 also compromised? If you used a hash, then no.

Same as with a CSPRNG, if attacker gets current internal state, can they compute all the values returned by the CSPRNG since it was last seeded?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .