# Is This Perfect Forward Secrecy?

I have a textbook that contains the following problem:

In practice, one master key, KM, is exchanged in a secure way (e.g. Diffie-Hellman key exchange) between the involved parties. Afterwards, session keys, kx, are regularly updated by using key derivation. Consider the following three different methods of key derivation:

a. k0 = KM; ki+1 = ki+1

b. k0 = H(KM); ki+1 = H(ki)

c. k0 = H(KM); ki+1 = h(KM || i || ki)

where H() represents a secure hash function, and ki is the ith session key.

The question goes on to ask which method(s) provide Perfect Forward Secrecy (PFS), with the answer key stating that b and c do.

As I understand it, a requirement of PFS is that past sessions are secure even if the long-term secret is compromised [1]. However, in this case, if KM (the long-term secret) is compromised, then all session keys can be computed.

Do any of these key derivation schemes provide PFS? Does the particular wording of the problem, ...exchanged in a secure way..., remove my assumption that KM could be compromised? Is KM not a long-term secret in the context of PFS?

• It's very hard to see how (c) could be a correct answer. Km is without question a long term secret in this case, as it is needed for the derivation of every session key in the sequence. But, if Km is compromised at any point in time, then this is all the attacker would need to derive all the session keys up to that point. This is exactly what PFS aims to prevent, as explained in the first paragraph of the Wikipedia article that you referenced. Commented Dec 1, 2023 at 20:42