Concepts
Perfect forward secrecy
Protecting past sessions if a long-term key is stolen
How it works
With forward secrecy, each session key comes from an ephemeral key exchange (DHE or ECDHE) whose private values are discarded afterwards. The server's long-term private key only signs the exchange, it never protects the session key directly. Stealing that long-term key later therefore does not let an attacker decrypt recorded past traffic.
Strengths
- Limits the damage of a private key compromise to future sessions
- Mandatory in TLS 1.3
Weaknesses and known attacks
- RSA key transport and static DH provide no forward secrecy.
- Long-lived session tickets or resumption keys can weaken it if not rotated.
Use it for
- Every TLS, VPN and messaging deployment
Don't use it for
- Not applicable: there is no case where you want to disable it
Exam tip
PFS = ephemeral keys (the E in DHE and ECDHE). If a stolen server key would decrypt old captured traffic, PFS was not in use.