Perfect Forward Secrecy (PFS)
Definition
Property of a key exchange where compromise of a long-term private key does not let the attacker decrypt past sessions. Achieved by ephemeral Diffie-Hellman (DHE or ECDHE).
- Protects against
- Retroactive decryption after long-term key compromise
- Achieved via
- Ephemeral Diffie-Hellman exchange
- Variants
- DHE and ECDHE
- Field
- Cryptographic key exchange analysis
Common questions
How does DHE differ from ECDHE in practice?+
Both generate a fresh, temporary shared secret per session, but ECDHE uses elliptic curve mathematics for smaller keys and faster computation, which is why it largely replaced classical DHE in modern deployments.
Why would a forensic analyst check whether a captured session used PFS?+
It determines whether recovering a server's private key from a seized device would let investigators decrypt archived traffic from that session, or whether the session's confidentiality is permanently out of reach without the ephemeral key.
Can an attacker who records ciphertext today defeat PFS in the future?+
Not through key compromise alone. Barring a break in the underlying Diffie-Hellman problem itself or capture of the ephemeral key while still resident in memory, recorded PFS-protected ciphertext resists later decryption.
Related terms
- Brute Force
- Exhaustive search over the key space. The benchmark every other attack must beat. AES-128 brute force is computationally infeasible on classical hardware;...
- Cryptanalysis
- The study of breaking cryptographic systems. Complement to cryptography. Goals include recovering the key, recovering the plaintext, or distinguishing a cipher's output...
- Diffie-Hellman
- Key exchange protocol by Diffie, Hellman and Merkle (1976) that lets two parties agree on a shared secret over a public channel....
- Padding Oracle
- An attack that uses an error-message distinction (or a timing distinction) between 'padding invalid' and 'authentication invalid' to recover plaintext from CBC-mode...
- Post-Quantum Cryptography (PQC)
- Algorithms designed to resist attacks by sufficiently capable quantum computers. NIST standardised CRYSTALS-Kyber as ML-KEM and CRYSTALS-Dilithium as ML-DSA in 2024.
- Side-Channel Attack
- Attack that exploits information leaked by a correct implementation: timing, power consumption, electromagnetic emanation, cache state, acoustic noise. Independent of the algebra...