Perfect forward secrecy

What it means

Perfect forward secrecy, often called forward secrecy, means that each connection uses its own temporary key, which is thrown away afterwards. If the server's long-term private key is stolen later, the stolen key cannot unlock earlier recorded sessions. The setting is usually a few lines of server configuration.

Without it, the same long-term key can protect many sessions. An attacker who records encrypted traffic today, and gets the key next year, reads everything. With it, each recording is locked with a key that no longer exists anywhere. That is the point of the word forward.

Why it matters

Traffic can be recorded by anyone on the path and stored cheaply. Forward secrecy turns a future key leak, a court order or a breach of your server from a disaster for all past customers into a problem for new traffic only.

It is also the sensible direction given long-term worries. It does not stop quantum computers, so see quantum-safe cryptography for that, but it limits how much old traffic a single stolen key can expose. Auditors and scanners flag its absence.

How it shows up

It comes from using an ephemeral Diffie-Hellman key exchange in TLS. TLS 1.3 removed the older static RSA key exchange, so its normal handshakes provide forward secrecy. In TLS 1.2, you choose it by picking cipher suites whose names contain DHE or ECDHE.

Check your configuration. Old suites without it may still be enabled for compatibility. Session tickets are a quieter risk: if the key that encrypts tickets lives for weeks and is shared across servers, it can undo the benefit, so rotate it often. Test the server with an online scanner or a command-line tool that lists accepted suites.