Perfect Forward Secrecy (PFS)
Perfect Forward Secrecy guarantees that compromise of long-term keys does not decrypt past sessions. PFS requires ephemeral key exchange (DHE/ECDHE) – each session uses unique keys that are destroyed after use. If the server's private key is stolen tomorrow, previously captured traffic remains encrypted. TLS 1.3 mandates PFS.
Definition
Perfect Forward Secrecy means that session keys cannot be derived from the server's long-term private key. Each TLS session generates fresh ephemeral Diffie-Hellman keys for key exchange. Even if an attacker records years of encrypted traffic and later obtains the server's RSA/ECDSA private key (via theft, court order, or vulnerability), they cannot decrypt the recorded sessions because the ephemeral keys were discarded. Without PFS (static RSA key exchange), the server's private key directly decrypts the pre-master secret in every session – one key compromise exposes all past and future traffic until the key is rotated. TLS 1.3 mandates PFS by removing static RSA key exchange entirely. In TLS 1.2, PFS requires cipher suites beginning with ECDHE_ or DHE_.
Examples
- –TLS 1.3: all suites use ephemeral ECDHE – PFS is mandatory
- –Nginx: ssl_prefer_server_ciphers on; ssl_ciphers 'ECDHE+AESGCM'; (enforces PFS)
- –openssl s_client -connect host:443 | grep 'Server Temp Key' (confirms ephemeral key)
Related Protocols
Related Terms
Cipher Suite
A cipher suite is the combination of algorithms negotiated during a TLS handshake: key exchange (ECDHE), authentication (RSA/ECDSA), bulk encryption (AES-256-GCM), and integrity (SHA-384). TLS 1.3 simplified suites to just AEAD cipher + hash, removing key exchange from the suite name since ECDHE is mandatory.
Key Exchange
Key exchange is the process of establishing a shared secret between client and server over an insecure channel. TLS uses ephemeral Diffie-Hellman (DHE/ECDHE) – both parties contribute randomness, and eavesdroppers cannot derive the shared key. ECDHE with Curve25519 or P-256 is the modern standard. Static RSA key exchange has no forward secrecy.