# What Is Forward Secrecy (Perfect Forward Secrecy (PFS))?

> Forward secrecy is a property of key exchange whereby compromise of a server's long-term private key does not expose the session keys of past connections.

Source: https://ssl.sh/glossary/forward-secrecy/
Last updated: 2026-11-10

Forward secrecy, often called perfect forward secrecy (PFS), means that each connection's keys come from short-lived values that are deleted after use, so they cannot be recomputed later. In TLS it is achieved with ephemeral [Diffie-Hellman](https://ssl.sh/glossary/diffie-hellman/) key exchange (DHE or [ECDHE](https://ssl.sh/glossary/ecdhe/)): the certificate's long-term private key only signs the handshake and never protects the session secret itself.

## Why it matters
Without forward secrecy, as with TLS 1.2 RSA key transport, an attacker who records encrypted traffic today and obtains the server's private key later, through a breach, a bug such as [Heartbleed](https://ssl.sh/glossary/heartbleed/), or a careless backup, can decrypt every recorded session. With it, a stolen key only allows impersonation going forward. Every full [TLS 1.3](https://ssl.sh/glossary/tls-1-3/) handshake is forward secret. Two caveats remain: resumed sessions depend on the server's session ticket encryption key, so a long-lived, unrotated ticket key weakens the guarantee, and TLS 1.3 0-RTT early data and PSK-only resumption are not forward secret with respect to that key.

## Example
A TLS 1.2 configuration that only allows forward-secret suites, with session tickets disabled for servers that cannot rotate ticket keys:

```nginx
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_session_tickets off;
```

## Common misconceptions
- **"Forward secrecy protects against someone who holds the key now."** It protects past sessions. An attacker with the current key can still impersonate the server in new connections until the certificate is revoked and replaced.
- **"With TLS 1.3, every byte is forward secret."** 0-RTT data and PSK-only resumption depend on ticket keys.
- **"A longer RSA key gives forward secrecy."** Key size is irrelevant; forward secrecy comes only from ephemeral key exchange.

## Related terms

- [ECDHE](https://ssl.sh/zh/glossary/ecdhe/): ECDHE 是椭圆曲线上的临时 Diffie-Hellman 密钥交换，TLS 双方每次握手都生成新的椭圆曲线密钥对，并据此协商出共享密钥。
- [Diffie-Hellman](https://ssl.sh/zh/glossary/diffie-hellman/): Diffie-Hellman 是 1976 年提出的密钥协商方法，让通信双方在公开信道上各自算出相同的共享秘密，而无需传输这个秘密本身。
- [密钥交换](https://ssl.sh/zh/glossary/key-exchange/): 密钥交换是 TLS 握手中客户端与服务器建立共享秘密的步骤，保护连接的对称密钥都由这个共享秘密派生而来。
- [Session Ticket](https://ssl.sh/zh/glossary/session-ticket/): Session Ticket 是服务器交给客户端保管的加密会话状态，客户端下次连接时出示它即可恢复会话，服务器无需保存任何状态。
- [TLS 1.3](https://ssl.sh/zh/glossary/tls-1-3/): TLS 1.3 是当前最新的传输层安全协议版本（2018 年的 RFC 8446，现行规范为 RFC 9846），完整握手只需一个往返，且只保留 AEAD 加密算法。
- [私钥](https://ssl.sh/zh/glossary/private-key/): 私钥是非对称密钥对中保密的那一半，TLS 服务器用它证明自己拥有证书里的那把公钥。
- [Heartbleed](https://ssl.sh/zh/glossary/heartbleed/): Heartbleed 是 2014 年公开的 OpenSSL 漏洞（CVE-2014-0160），出在 TLS 心跳扩展上，任何人都能借此读取服务器内存片段，甚至包括私钥。