What Is Perfect Forward Secrecy?
Perfect forward secrecy (PFS) is the guarantee that stealing a server’s long-term private key cannot decrypt traffic from the past. Each session is protected by a temporary key that is generated fresh and thrown away afterward, so an attacker who records encrypted traffic today and steals the server key tomorrow still gets nothing. It is a defining feature of modern TLS.
What attack does forward secrecy defeat?#
The “harvest now, decrypt later” attack. Without PFS, if all sessions are encrypted using keys derived from one long-term server key, then capturing that key later unlocks every recorded session — potentially years of traffic at once. Nation-state adversaries are believed to record encrypted traffic specifically in hope of future key compromise. PFS makes that hoard worthless.
How does it work?#
Through ephemeral key exchange, usually ECDHE (Elliptic-Curve Diffie-Hellman Ephemeral):
- For each new session, both sides generate temporary key pairs.
- They use asymmetric cryptography to agree on a shared secret, without ever transmitting it.
- That shared secret encrypts the session, then the temporary keys are destroyed.
The server’s long-term key is used only to authenticate the exchange — to prove identity — never to encrypt data. So compromising it lets an attacker impersonate the server going forward, but never decrypt sessions already recorded.
| Without PFS | With PFS | |
|---|---|---|
| Session keys | Derived from long-term key | Ephemeral, per-session |
| Steal server key later | Decrypts recorded traffic | Past traffic stays safe |
Perfect forward secrecy is why recording encrypted traffic is a losing game for attackers. It builds on ephemeral keys and nonces. More at the Security Fundamentals hub.
Frequently asked questions#
What is perfect forward secrecy?
Perfect forward secrecy (PFS) is a property of secure protocols where compromising a server’s long-term private key does not let an attacker decrypt past sessions. Each session uses a temporary, ephemeral key that is discarded afterward, so recorded traffic stays protected even if the main key is later stolen.
How does forward secrecy work in TLS?
Modern TLS uses ephemeral Diffie-Hellman key exchange (ECDHE): for each session the two parties generate temporary keys, agree on a shared secret, and throw the temporary keys away when done. The server’s long-term key only authenticates the exchange — it never encrypts data — so stealing it cannot decrypt recorded sessions.