0Pricing
Cryptology Academy · Lesson

Forward Secrecy & Ephemeral Key Exchange

Understand PFS, DHE vs ECDHE, and why ephemeral keys matter.

Forward Secrecy & Ephemeral Key Exchange is a free Cryptology Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Welcome

Forward secrecy ensures that even if long-term keys are compromised, past sessions remain secure. It is now required by most security standards.

What Is Forward Secrecy?

Perfect Forward Secrecy (PFS): compromise of long-term keys does NOT allow decryption of previously recorded traffic. Each session uses fresh ephemeral keys that are destroyed after use.

Why TLS 1.2 Without PFS Is Dangerous

TLS 1.2 RSA key exchange: attacker records encrypted traffic for years. Later steals server's RSA private key. Can now decrypt ALL stored sessions retroactively. NSA's PRISM program stored traffic for this reason.

Ephemeral Diffie-Hellman (DHE)

DHE: each party generates fresh DH keys for each session. The session key is derived and used. Both parties delete their ephemeral private keys after handshake. The long-term key only authenticates.

ECDHE: Elliptic Curve DHE

ECDHE = ephemeral ECDH. Each TLS session: generate fresh EC key pair → exchange → derive session keys → delete private key. Dominant in TLS 1.3. ~10× faster than DHE at same security.

TLS 1.3 Mandatory PFS

TLS 1.3 requires ephemeral key exchange. All cipher suites use ECDHE or DHE. RSA key exchange was removed entirely. 0-RTT (early data) is the only PFS exception.

0-RTT and Its Trade-offs

TLS 1.3 0-RTT sends data before the handshake completes. It uses a pre-shared session ticket — resumption without fresh key exchange. This sacrifices replay protection and strict forward secrecy for one-round latency.

Forward Secrecy in SSH

SSH uses ephemeral DH/ECDH during key exchange (kex). The host key authenticates the server. Session keys are derived from the ephemeral exchange and discarded after session. PFS is built-in.

Double Ratchet Algorithm

Signal Protocol uses the Double Ratchet: after initial ECDH, each message advances the ratchet, deriving new keys. Forward secrecy and break-in recovery (future secrecy) per message.

HSM and Long-Term Key Protection

Even with PFS, protecting long-term authentication keys matters. They're used for server identity, not encryption. HSMs ensure private keys cannot be exported even if the server OS is compromised.

Verify PFS on Your Server

Check with OpenSSL: openssl s_client -connect yoursite.com:443 -cipher 'ECDHE' Or online: Qualys SSL Labs (ssllabs.com/ssltest) grades your TLS configuration and specifically tests for forward secrecy.

Quick Check

What makes ECDHE provide forward secrecy where static RSA key exchange does not?

Recap

Forward secrecy is essential for modern security. Next we dive deep into RSA security — textbook vulnerabilities and padding schemes.

Frequently asked questions

Is the “Forward Secrecy & Ephemeral Key Exchange” lesson free?

Yes — the full text of “Forward Secrecy & Ephemeral Key Exchange” is free to read here on the web, and the Cryptology Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO.

What will I learn in “Forward Secrecy & Ephemeral Key Exchange”?

Understand PFS, DHE vs ECDHE, and why ephemeral keys matter. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Forward Secrecy & Ephemeral Key Exchange” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. The Key Distribution Problem
  2. Diffie-Hellman Key Exchange Math
  3. ECDH: Elliptic Curves for Key Exchange
  4. Forward Secrecy & Ephemeral Key Exchange
← Back to Cryptology Academy