English
Menu

What is Forward secrecy?

The property that even if a long-term private key leaks later, previously recorded communications cannot be decrypted. Also called perfect forward secrecy (PFS). It is achieved with DHE or ECDHE, which run the key exchange with throwaway values for each connection; because those values are discarded after use, the keys of past sessions cannot be recomputed later. The method of encrypting key material with the server's RSA public key lacks this property, and TLS 1.3 removed it.

Japanese name: 前方秘匿性

Forward secrecy appears in 4 practice questions across 2 topics, including Applied Cryptography, Wireless Communication Basics.

Field: Applied Cryptography

Try it: questions about Forward secrecy

In TLS, which of the following key exchange methods provides the property that previously recorded communications cannot be decrypted even if the private key of the server certificate leaks later (forward secrecy)?

  1. AKey exchange such as ECDHE, which uses throwaway values created for each connection
  2. BA method in which the client encrypts the key material it created with the RSA public key of the server certificate and sends it
  3. CA method in which the server and client keep using the same symmetric key, agreed in advance, for every connection
Show answer and explanation

Answer: A. Key exchange such as ECDHE, which uses throwaway values created for each connection

The final E in ECDHE stands for ephemeral (throwaway): a new secret value is used for the key exchange of each connection and discarded afterwards. The private key of the certificate is used only for signing, so even if it leaks later, the shared secrets of past connections cannot be computed. By contrast, with the method of sending key material encrypted with the server's RSA public key, the recorded traffic plus a later-leaked private key allows all past communications to be decrypted. TLS 1.3 removed that method, and key exchange is now based on (EC)DHE with forward secrecy (except when a connection is resumed with a pre-shared key alone).

Forward secrecy in the explanations

Questions that mention Forward secrecy (4)

  1. In TLS, which of the following key exchange methods provides the property that previously recorded communications cannot be decrypted even if the private key of the server certificate leaks later (forward secrecy)?
  2. In the personal mode of the WPA3 wireless LAN security standard, which authentication and key exchange method replaced WPA2's pre-shared key (PSK) method and makes the password hard to guess by offline dictionary attack even if the traffic is intercepted?
  3. Which of the following correctly describes a change from TLS 1.2 in TLS 1.3 (RFC 8446)?
  4. Which of the following is a correct caution about 0-RTT in TLS 1.3 (sending "early data" together with the first message, using a pre-shared key obtained in an earlier connection)?

Books on Applied Cryptography Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

TLS Diffie–Hellman key exchange RSA cryptosystem Authenticated encryption (AEAD) Block cipher mode of operation AES (Advanced Encryption Standard) Birthday attack Certificate authority Crypto agility Elliptic-curve cryptography

Back to the glossary