Definition
Perfect Forward Secrecy, sometimes simply Forward Secrecy, is a security property where the compromise of long-term keys does not enable an attacker to decrypt past recorded sessions. It is achieved by generating a fresh, ephemeral key pair for each session — typically through Ephemeral Diffie-Hellman or its elliptic-curve variant — using it to encrypt the session, and then discarding it when the session ends.
Why It Matters
Without PFS, an adversary can record encrypted traffic today and decrypt it years later if they ever obtain the long-term server key — by hacking, compelled disclosure, or quantum computing breaking the underlying asymmetric cryptography. With PFS, even total compromise of the long-term key reveals nothing about past sessions because the actual session keys have been deleted and cannot be reconstructed. This is the textbook 'record now, decrypt later' threat model.
Status in Protocols
TLS 1.3 mandates Forward Secrecy — non-PFS cipher suites were removed from the standard. WireGuard provides PFS by design through its handshake. OpenVPN supports it when configured with TLS-DHE or ECDHE cipher suites, which is now the default. Older protocols (PPTP, L2TP without modern crypto, and certain legacy IPSec configurations) often lack PFS, which is one reason they are deprecated.