Archivecryptography
Forward Secrecy Is About Key Deletion, Not Math
A session stays secret after a server compromise only if the ephemeral private key is actually gone.
- Published
- Reading time
- 1 min read
Forward secrecy means that compromising long-term keys tomorrow does not decrypt traffic captured today. It requires ephemeral key agreement — and, crucially, destruction of the ephemeral secrets.
How TLS 1.3 does it
Every handshake uses fresh X25519 (or similar) key pairs. Session keys come from HKDF over the shared secret. The server's long-term key only signs the handshake, so it cannot derive past session keys.
Where it leaks
- Session tickets: resumption keys encrypt state for future connections. If tickets are stored forever, a stolen ticket key erases forward secrecy.
- Crash dumps and swap: ephemeral private keys can persist in memory images long after the handshake.
- Logging: some libraries log derived secrets at debug level.
- Key escrow: enterprise middleboxes that store session keys defeat the property by design.
Takeaway: forward secrecy is an operational property. Rotate ticket keys, avoid escrow, and zero ephemeral material when the handshake completes.