概念概述
前向保密（Forward Secrecy）指的是：前向保密为每条连接派生唯一会话密钥，使日后长期密钥泄露也无法解密此前录制的流量，是 TLS 配置的基线属性。
从更严格的定义看，Forward secrecy is a property of a key exchange in which the session keys are derived from ephemeral secrets that are discarded, so compromise of a long-term private key does not expose earlier sessions. 该概念在工程实践中的价值，在于它能帮助团队用统一的语言描述一个具体的质量属性或设计约束，从而在评审与协作中减少歧义。
为什么需要它
It is a baseline for TLS configuration and for any protocol that records traffic an adversary might store and decrypt later. 它与 Key Derivation Functions、Public Key Infrastructure、XML External Entity Injection 等概念经常一起出现，用于解决相近的工程问题。理解它的适用场景，有助于在多种备选方案之间做出有依据的取舍，而不是凭直觉选择技术方案。
常见误解
- forward secrecy protects data after the session key leaks
- any TLS version provides it automatically
需要避免的反模式
- prioritising static key exchange ciphers for compatibility without reason
- assuming forward secrecy covers the endpoint’s session memory
实践要点
- Ephemeral Diffie-Hellman exchanges generate a fresh key pair per session and delete the secret after use, which breaks the link between the long-term identity key and the derived session keys.
- If the server’s long-term key is later stolen, previously recorded ciphertext remains undecryptable, which is why modern TLS suites default to ephemeral key agreement.
- The property protects recorded traffic only, so it must be paired with protections for live endpoints and with key rotation for anything cached or stored.