Can I do a forward secure half-round ephemeral-static ECDH? In the context of the project we are working on recently, we would like to enable users to "leave a message" to someone on the Internet securely. Our setting is as below:


ECC key pairs for open ID
AES-GCM as session for each message
Suppose Bob wants to leave a secret message to Alice, whose public key is known to the public.


Alice's key pair is (priv_a, pub_a)
Bob's key pair is (priv_b, pub_b)
Bob generates an ephemeral ECC key pair (epriv_b, epub_b)
Bob computes the shared secret of epriv_b and pub_a
Bob derives an AES-GCM key from the shared secret and creates (epub_b, sig of epub_b using priv_b, encrypted message using AES-GCM key) as M
Bob leaves this message somewhere (could either be public or private) so that Alice could see it
Alice performs the same process to derive the AES-GCM key to decrypt the message and verify Bob



In this scenario, the forward secrecy is not guaranteed. I am curious if we can possibly ensure the forward secrecy under this scenario with only half round of communication (one-sided). If not, is there any alternative that I can adopt to accomplish the goal? Any direction or hint is appreciated.
I am curious if we can possibly ensure the forward secrecy under this scenario with only one round of communication.


I do not believe so; the protocol can be summarized as:


Alice publishes her long term key
Bob does some work (without having Alice do anything)
Alice does some work, and retrieves the message


If, anywhere between points 1 and 2, Alice's state was copied, then the copy of Alice's state would be able to perform step 3 just as well as Alice did, and so you don't get PFS.

Also, terminology correction: you asked whether this can be done with only one round of communication; actually, it can, by having Alice send a message at the start of step 2.  Obviously, this doesn't work for your project; what you need is actually a 'half round' exchange.