Perfect Forward Secrecy
Definition
A property where compromise of a long-term key does not retroactively break past sessions, because each session used an ephemeral key (typically ECDHE) that was discarded after use. TLS 1.3 mandates PFS.
- Protects
- Past session content after long-term key compromise
- Mechanism
- Ephemeral session keys discarded after use
- Common algorithm
- ECDHE
- Protocol requirement
- Mandated in TLS 1.3
Common questions
Why does TLS 1.3 mandate PFS while earlier TLS versions did not?+
TLS 1.3 dropped static RSA key exchange, which let an attacker who later obtained the server's private key decrypt previously captured traffic, and required ephemeral Diffie-Hellman exchanges instead, closing that retroactive-decryption risk.
What forensic implication does PFS have for network capture evidence?+
Encrypted traffic captured today generally cannot be decrypted later even if investigators eventually obtain the server's private key, so lawful interception or decryption of PFS-protected sessions must happen at or near capture time.
Does PFS protect against compromise of the session key itself?+
No. PFS only protects other sessions if the long-term key is compromised; if an individual session's ephemeral key is captured while still in use, that specific session remains exposed.
Related terms
- Asymmetric Key Pair
- Mathematically linked public and private keys. The public key encrypts or verifies, the private key decrypts or signs. Two to three orders...
- CIAN
- Confidentiality, Integrity, Authentication, Non-repudiation. The four properties a cryptosystem can deliver, usually not all at once with a single primitive. Bulk encryption...
- Confusion and Diffusion
- Shannon's 1949 design principles. Confusion makes the relationship between key and ciphertext as complex as possible; diffusion spreads each plaintext bit's influence...
- Hybrid Encryption
- The pattern every real protocol uses: asymmetric crypto exchanges a fresh symmetric session key, then the symmetric primitive does the heavy lifting...
- Symmetric Key
- One shared secret used to both encrypt and decrypt. Fast (AES-128 on AES-NI runs at multiple GB/s) but solves nothing if the...