papers/lux-hybrid-pq-architecture/sections/05-forward-secrecy.tex

\section{Forward Secrecy}

\label{sec:forward-secrecy}

Classical forward secrecy relies on ephemeral Diffie-Hellman: even if long-term keys
are compromised, past session keys remain secret. Quantum adversaries break this
guarantee because they can recover ephemeral DH secrets from recorded transcripts.

The hybrid construction restores forward secrecy against transitional adversaries:

\begin{enumerate}[leftmargin=2em]
  \item Each session generates ephemeral X25519 \emph{and} ephemeral ML-KEM key pairs.
  \item The session key is derived from both ephemeral shared secrets via HKDF.
  \item After the session, both ephemeral private keys are destroyed.
\end{enumerate}

A future quantum adversary who records the session transcript can recover the X25519
ephemeral secret but \emph{cannot} recover the ML-KEM ephemeral secret (ML-KEM
decapsulation requires the private key, which was destroyed). The session key remains
secret because it depends on $ss_M$, which the adversary cannot compute.

\begin{proposition}[Hybrid forward secrecy]
If ephemeral ML-KEM private keys are securely erased after each session, the hybrid
key exchange provides forward secrecy against quantum adversaries.
\end{proposition}

This is the strongest forward secrecy guarantee available during the transition
period: it does not require trusting that X25519 is secure (it is not, against
quantum), only that ML-KEM is secure and ephemeral keys are erased.

%% ========================================================================
%%  6. IMPLEMENTATION
%% ========================================================================