Cryptology Academy · Lesson

Forward Secrecy & Ephemeral Key Exchange

Understand PFS, DHE vs ECDHE, and why ephemeral keys matter.

Lesson 4 of 413 steps

Forward Secrecy & Ephemeral Key Exchange is a free Cryptology Academy lesson on CoddyKit. This is lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, and your progress syncs across the web and the CoddyKit app. The Cryptology Academy course includes 4 lessons in total.

Welcome

Forward secrecy ensures that even if long-term keys are compromised, past sessions remain secure. It is now required by most security standards.

What Is Forward Secrecy?

Perfect Forward Secrecy (PFS): compromise of long-term keys does NOT allow decryption of previously recorded traffic. Each session uses fresh ephemeral keys that are destroyed after use.

Why TLS 1.2 Without PFS Is Dangerous

TLS 1.2 RSA key exchange: attacker records encrypted traffic for years. Later steals server's RSA private key. Can now decrypt ALL stored sessions retroactively. NSA's PRISM program stored traffic for this reason.

Ephemeral Diffie-Hellman (DHE)

DHE: each party generates fresh DH keys for each session. The session key is derived and used. Both parties delete their ephemeral private keys after handshake. The long-term key only authenticates.

ECDHE: Elliptic Curve DHE

ECDHE = ephemeral ECDH. Each TLS session: generate fresh EC key pair → exchange → derive session keys → delete private key. Dominant in TLS 1.3. ~10× faster than DHE at same security.

TLS 1.3 Mandatory PFS

TLS 1.3 requires ephemeral key exchange. All cipher suites use ECDHE or DHE. RSA key exchange was removed entirely. 0-RTT (early data) is the only PFS exception.

0-RTT and Its Trade-offs

TLS 1.3 0-RTT sends data before the handshake completes. It uses a pre-shared session ticket — resumption without fresh key exchange. This sacrifices replay protection and strict forward secrecy for one-round latency.

Forward Secrecy in SSH

SSH uses ephemeral DH/ECDH during key exchange (kex). The host key authenticates the server. Session keys are derived from the ephemeral exchange and discarded after session. PFS is built-in.

Double Ratchet Algorithm

Signal Protocol uses the Double Ratchet: after initial ECDH, each message advances the ratchet, deriving new keys. Forward secrecy and break-in recovery (future secrecy) per message.

HSM and Long-Term Key Protection

Even with PFS, protecting long-term authentication keys matters. They're used for server identity, not encryption. HSMs ensure private keys cannot be exported even if the server OS is compromised.

Verify PFS on Your Server

Check with OpenSSL: openssl s_client -connect yoursite.com:443 -cipher 'ECDHE' Or online: Qualys SSL Labs (ssllabs.com/ssltest) grades your TLS configuration and specifically tests for forward secrecy.

Quick Check

What makes ECDHE provide forward secrecy where static RSA key exchange does not?

Answer it in the interactive lesson

Recap

Forward secrecy is essential for modern security. Next we dive deep into RSA security — textbook vulnerabilities and padding schemes.

Free to start

Learn Cryptology Academy with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses: 67
Lessons: 261

Start learning free View the full course

Frequently Asked Questions

Is the “Forward Secrecy & Ephemeral Key Exchange” lesson free?

Yes — the full text of “Forward Secrecy & Ephemeral Key Exchange” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO. The Cryptology Academy course includes 4 lessons in total.

What will I learn in “Forward Secrecy & Ephemeral Key Exchange”?

Understand PFS, DHE vs ECDHE, and why ephemeral keys matter. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 4 of 4.

How long does the “Forward Secrecy & Ephemeral Key Exchange” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

The Key Distribution Problem
Diffie-Hellman Key Exchange Math
ECDH: Elliptic Curves for Key Exchange
Forward Secrecy & Ephemeral Key Exchange

← Back to Cryptology Academy