Question: Does fastd implement perfect forward secrecy?

neocturne / fastd

Fast and Secure Tunnelling Daemon

Other

115 stars 16 forks source link

Question: Does fastd implement perfect forward secrecy? #35

Closed marek22k closed 8 months ago

marek22k commented 8 months ago

Hello,

I would like to know which encryption variants offers PFS in fastd?

Unfortunately I haven't found a forum or anything similar, so I'm posting my question here as an issue. If this is the wrong place for it, I'm sorry.

marek22k commented 8 months ago

I think I found the answer in the documentation:

The modified algorithm FHMQV-C specified in the same document also provides Perfect Forward Secrecy (PFS), which isn’t the case for the simple FHMQV algorithm.

neocturne commented 8 months ago

@marek22k Right, you already found the relevant information - as fastd always uses FHMQV-C for its key exchange, it generally provides PFS. Session keys are rotated every 1 hour.