Forward Secrecy (Perfect Forward Secrecy (PFS))

Forward secrecy, often called perfect forward secrecy (PFS), means that each connection's keys come from short-lived values that are deleted after use, so they cannot be recomputed later. In TLS it is achieved with ephemeral Diffie-Hellman key exchange (DHE or ECDHE): the certificate's long-term private key only signs the handshake and never protects the session secret itself.

Why it matters

Without forward secrecy, as with TLS 1.2 RSA key transport, an attacker who records encrypted traffic today and obtains the server's private key later, through a breach, a bug such as Heartbleed, or a careless backup, can decrypt every recorded session. With it, a stolen key only allows impersonation going forward. Every full TLS 1.3 handshake is forward secret. Two caveats remain: resumed sessions depend on the server's session ticket encryption key, so a long-lived, unrotated ticket key weakens the guarantee, and TLS 1.3 0-RTT early data and PSK-only resumption are not forward secret with respect to that key.

Example

A TLS 1.2 configuration that only allows forward-secret suites, with session tickets disabled for servers that cannot rotate ticket keys:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_session_tickets off;

Common misconceptions

• "Forward secrecy protects against someone who holds the key now." It protects past sessions. An attacker with the current key can still impersonate the server in new connections until the certificate is revoked and replaced.
• "With TLS 1.3, every byte is forward secret." 0-RTT data and PSK-only resumption depend on ticket keys.
• "A longer RSA key gives forward secrecy." Key size is irrelevant; forward secrecy comes only from ephemeral key exchange.