Using for example ECDH and ephemeral keys, it is possible for two parties to establish a shared key with perfect forward security, i.e. even if the long term keys are lost, it will not be possible to recreate the key generated by the process.

Is there a way of achieving the same result but with one directional messages, for example when sending an email, when only a long term key of the recipient is known?

1 Answer 1


Not with only a long-term key pair to start with

If all the recipient needs to know to read the message is his long-term private key and the ciphertext, then that is also all any attacker will need to read the message in the future. In order for the message to remain secure in the case his long-term private key is compromised, there will need to be some additional information known only to the recipient involved in the encryption (such as the short-term private key normally used in perfect forward secrecy).

However, there might still be a way to achieve perfect forward secrecy without requiring two-way communication at the time the message is sent. One could imagine someone publishing a calendar of public keys for which he holds the private key, rather than a single public key - and then deleting all copies of each private key as its date passes. This would effectively make all of the private keys into short-term keys, which would no longer be open to compromise once their date had passed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .