Forward Secrecy
Forward secrecy, also known as “perfect forward secrecy” (PFS), protects data or communications encrypted in the past against compromises of secret keys or passwords in the future. Without forward secrecy, a patient attacker could capture an encrypted communication, and then obtain the private key for that communication at a later date. With forward secrecy, a stolen private key or password does not allow decrypting the communication in the future. It remains private. This does not mean that the encryption cannot be broken in other ways, it just prevents the private key from being a weak point.
Public-key and TLS Forward Secrecy
Public-key communications can have forward secrecy if they use the Diffie-Hellman technique for key exchange. The client and server use their public and private keys to establish a temporary key (a “shared secret”). Then the temporary key is used to encrypt and decrypt the communication. Once the communication is complete, the temporary key disappears and is forgotten. It is said to be “ephemeral”. Neither the client nor the server’s public or private keys can be used to decrypt the communication—not now, not in the future. An attacker who later obtains the long-term keys would not be able to use them to decrypt a previously captured encrypted message.
TLS uses public keys to establish a connection. Every TLS 1.3 handshake based on certificates provides forward secrecy as a property of the protocol — RFC 8446 removed the static-RSA and static-Diffie-Hellman cipher suites, so “all public-key based key exchange mechanisms now provide forward secrecy”. The documented exceptions are PSK-only handshakes (§2.2) and 0-RTT early data (§2.3), which reuse a pre-shared key and are not forward-secret in the same sense — RFC 8446 §2.3 states of 0-RTT that “this data is not forward secret”. For TLS 1.2 servers, forward secrecy is configuration-dependent: require an ephemeral Diffie-Hellman key exchange (DHE, or preferably the faster ECDHE) and disable any static-RSA cipher suites. TLS 1.2 is the minimum acceptable floor; TLS 1.3 is the current preferred standard.