{"id":367,"date":"2019-07-30T21:32:03","date_gmt":"2019-07-30T21:32:03","guid":{"rendered":"https:\/\/www.rapidsslonline.com\/ssl\/?p=367"},"modified":"2019-09-06T07:03:21","modified_gmt":"2019-09-06T07:03:21","slug":"what-is-ssl-tls-perfect-forward-secrecy","status":"publish","type":"post","link":"https:\/\/www.rapidsslonline.com\/ssl\/what-is-ssl-tls-perfect-forward-secrecy\/","title":{"rendered":"What is SSL or TLS Perfect Forward Secrecy?"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">A look at perfect forward secrecy in SSL with TLS 1.3 <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you\u2019re here because you want to understand what \u201cforward secrecy SSL\u201d or \u201cSSL perfect forward secrecy\u201d means, then you\u2019ve come to the right place. Perfect forward secrecy is a now-mandatory component of SSL\/TLS. Starting in <a href=\"https:\/\/www.rapidsslonline.com\/blog\/introducing-tls-1-3-future-encryption\/\">TLS 1.3<\/a>, all key exchange methods must be ephemeral Diffie-Hellman families \u2014 not RSA, which doesn\u2019t support perfect forward secrecy.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is Forward Secrecy in SSL \/ TLS and How Does It Work?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">So, what is perfect forward secrecy? First, let\u2019s talk about\nkey exchange. Historically, key exchange has been performed using RSA\nasymmetric encryption. This method had a number of problems \u2014 hence its removal\nin TLS 1.3 \u2014 including Oracle padding attacks and something called\nBleichenbacher\u2019s CAT (don\u2019t ask). The biggest may be its lack of ephemerality,\nthough.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An ephemeral key exchange is one that allows for the regular\nrotation of the session keys. This is necessary for perfect forward secrecy and\nis impossible with RSA. That\u2019s owed to the fact that RSA uses massive keys and\ntransacts in huge prime numbers that are expensive to compute. The toll it takes\non a website\u2019s servers make ephemeral RSA schemes impractical at best (also,\nimpossible). <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Diffie-Hellman key exchange, specifically its elliptic curve-based\nvariants, is much easier to compute and allows for regular key rotation. It\nalso facilitates SSL perfect forward secrecy, which is incumbent upon regular\nkey rotation and ensures that even if the <a href=\"https:\/\/www.rapidsslonline.com\/blog\/public-key-private-key-encryption\/\">private\nkey<\/a> associated with that site\u2019s <a href=\"https:\/\/www.rapidsslonline.com\/ssl-types.aspx\">SSL certificate<\/a> \u2014 and\nthe private key plays a role in the generation of those session keys \u2014 is ever\ncompromised, the session keys cannot be deciphered.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Normally, when your private key is compromised, it means\nthat everything is compromised. The attacker will have no problem deriving keys\nfrom previous sessions and decrypting the information. SSL\/TLS perfect forward secrecy\nprevents that, adding an additional layer of security to each session key\nbeyond the computational hardness provided by the private key. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">When Does SSL Perfect Forward Secrecy Become Effective?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Starting TLS 1.3, all SSL\/TLS implementations will use perfect forward secrecy. It\u2019s also advised that you stop using RSA key exchange and switch to an ephemeral Diffie-Hellman family in TLS 1.2 to enable forward secrecy there, too. If you\u2019re running on a server that doesn\u2019t currently support it, try updating your SSL\/TLS software library to see if that helps. If not, it may be time to change servers.  <\/p>\n\n\n\n<div class=\"graysection\"><h2>Save Up to 80% on DV SSL Certificates<\/h2>\n<p>Protect a website in a few minutes with DV SSL or Domain Validated SSL Certificate.<\/p>\n<p><a class=\"more-link floatnone\" style=\"text-decoration: none;\" href=\"https:\/\/www.rapidsslonline.com\/ssl-types\/domain-validation-ssl-certificates.aspx\">Get a DV SSL certificate, starting at $12.42\/year<\/a><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>A look at perfect forward secrecy in SSL with TLS 1.3 If you\u2019re here because you want to understand what \u201cforward secrecy SSL\u201d or \u201cSSL perfect forward secrecy\u201d means, then<\/p>\n<div class=\"article-wpr-button\"><a href=\"https:\/\/www.rapidsslonline.com\/ssl\/what-is-ssl-tls-perfect-forward-secrecy\/\" class=\"btn btn-green\">Read More<\/a><\/p>\n<div>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[30,31,12],"class_list":["post-367","post","type-post","status-publish","format-standard","category-ssl-advanced","tag-perfect-forward-secrecy","tag-ssl","tag-tls"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>What is SSL or TLS Perfect Forward Secrecy? SSL\/TLS Certificates<\/title>\n<meta name=\"description\" content=\"Perfect forward secrecy is required in SSL\/TLS. Here&#039;s what that means for your website &amp; what you need to do to achieve SSL or TLS perfect forward secrecy.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.rapidsslonline.com\/ssl\/what-is-ssl-tls-perfect-forward-secrecy\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What is SSL or TLS Perfect Forward Secrecy? SSL\/TLS Certificates\" \/>\n<meta property=\"og:description\" content=\"Perfect forward secrecy is required in SSL\/TLS. Here&#039;s what that means for your website &amp; what you need to do to achieve SSL or TLS perfect forward secrecy.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.rapidsslonline.com\/ssl\/what-is-ssl-tls-perfect-forward-secrecy\/\" \/>\n<meta property=\"og:site_name\" content=\"SSL\/TLS Certificates\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/rsosslcertificates\/\" \/>\n<meta property=\"article:published_time\" content=\"2019-07-30T21:32:03+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-09-06T07:03:21+00:00\" \/>\n<meta name=\"author\" content=\"Casey Crane\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@RSOSSL\" \/>\n<meta name=\"twitter:site\" content=\"@RSOSSL\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Casey Crane\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What is SSL or TLS Perfect Forward Secrecy? SSL\/TLS Certificates","description":"Perfect forward secrecy is required in SSL\/TLS. Here's what that means for your website & what you need to do to achieve SSL or TLS perfect forward secrecy.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.rapidsslonline.com\/ssl\/what-is-ssl-tls-perfect-forward-secrecy\/","og_locale":"en_US","og_type":"article","og_title":"What is SSL or TLS Perfect Forward Secrecy? SSL\/TLS Certificates","og_description":"Perfect forward secrecy is required in SSL\/TLS. Here's what that means for your website & what you need to do to achieve SSL or TLS perfect forward secrecy.","og_url":"https:\/\/www.rapidsslonline.com\/ssl\/what-is-ssl-tls-perfect-forward-secrecy\/","og_site_name":"SSL\/TLS Certificates","article_publisher":"https:\/\/www.facebook.com\/rsosslcertificates\/","article_published_time":"2019-07-30T21:32:03+00:00","article_modified_time":"2019-09-06T07:03:21+00:00","author":"Casey Crane","twitter_card":"summary_large_image","twitter_creator":"@RSOSSL","twitter_site":"@RSOSSL","twitter_misc":{"Written by":"Casey Crane","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.rapidsslonline.com\/ssl\/what-is-ssl-tls-perfect-forward-secrecy\/#article","isPartOf":{"@id":"https:\/\/www.rapidsslonline.com\/ssl\/what-is-ssl-tls-perfect-forward-secrecy\/"},"author":{"name":"Casey Crane","@id":"https:\/\/www.rapidsslonline.com\/ssl\/#\/schema\/person\/24349032d0b90283d4682ad113e46d4d"},"headline":"What is SSL or TLS Perfect Forward Secrecy?","datePublished":"2019-07-30T21:32:03+00:00","dateModified":"2019-09-06T07:03:21+00:00","mainEntityOfPage":{"@id":"https:\/\/www.rapidsslonline.com\/ssl\/what-is-ssl-tls-perfect-forward-secrecy\/"},"wordCount":447,"commentCount":0,"publisher":{"@id":"https:\/\/www.rapidsslonline.com\/ssl\/#organization"},"keywords":["perfect forward secrecy","SSL","TLS"],"articleSection":["SSL Advanced"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.rapidsslonline.com\/ssl\/what-is-ssl-tls-perfect-forward-secrecy\/","url":"https:\/\/www.rapidsslonline.com\/ssl\/what-is-ssl-tls-perfect-forward-secrecy\/","name":"What is SSL or TLS Perfect Forward Secrecy? SSL\/TLS Certificates","isPartOf":{"@id":"https:\/\/www.rapidsslonline.com\/ssl\/#website"},"datePublished":"2019-07-30T21:32:03+00:00","dateModified":"2019-09-06T07:03:21+00:00","description":"Perfect forward secrecy is required in SSL\/TLS. Here's what that means for your website & what you need to do to achieve SSL or TLS perfect forward secrecy.","breadcrumb":{"@id":"https:\/\/www.rapidsslonline.com\/ssl\/what-is-ssl-tls-perfect-forward-secrecy\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.rapidsslonline.com\/ssl\/what-is-ssl-tls-perfect-forward-secrecy\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.rapidsslonline.com\/ssl\/what-is-ssl-tls-perfect-forward-secrecy\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"SSL Resources","item":"https:\/\/www.rapidsslonline.com\/ssl\/"},{"@type":"ListItem","position":2,"name":"SSL Advanced","item":"https:\/\/www.rapidsslonline.com\/ssl\/ssl-advanced\/"},{"@type":"ListItem","position":3,"name":"What is SSL or TLS Perfect Forward Secrecy?"}]},{"@type":"WebSite","@id":"https:\/\/www.rapidsslonline.com\/ssl\/#website","url":"https:\/\/www.rapidsslonline.com\/ssl\/","name":"SSL\/TLS Certificates","description":"Secure a website in few minutes with Trusted SSL Certificate","publisher":{"@id":"https:\/\/www.rapidsslonline.com\/ssl\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.rapidsslonline.com\/ssl\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.rapidsslonline.com\/ssl\/#organization","name":"RapidSSLOnline","url":"https:\/\/www.rapidsslonline.com\/ssl\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.rapidsslonline.com\/ssl\/#\/schema\/logo\/image\/","url":"https:\/\/www.rapidsslonline.com\/ssl\/wp-content\/uploads\/2019\/10\/rapidsslonline-logo.png","contentUrl":"https:\/\/www.rapidsslonline.com\/ssl\/wp-content\/uploads\/2019\/10\/rapidsslonline-logo.png","width":266,"height":39,"caption":"RapidSSLOnline"},"image":{"@id":"https:\/\/www.rapidsslonline.com\/ssl\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/rsosslcertificates\/","https:\/\/x.com\/RSOSSL","https:\/\/in.linkedin.com\/company\/rapidsslonline-com"]},{"@type":"Person","@id":"https:\/\/www.rapidsslonline.com\/ssl\/#\/schema\/person\/24349032d0b90283d4682ad113e46d4d","name":"Casey Crane","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/c18d819d34a1995e91a4aa7518e9048df7856f336a1ede2262a572db7b1c2506?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/c18d819d34a1995e91a4aa7518e9048df7856f336a1ede2262a572db7b1c2506?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c18d819d34a1995e91a4aa7518e9048df7856f336a1ede2262a572db7b1c2506?s=96&d=mm&r=g","caption":"Casey Crane"}}]}},"_links":{"self":[{"href":"https:\/\/www.rapidsslonline.com\/ssl\/wp-json\/wp\/v2\/posts\/367","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rapidsslonline.com\/ssl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rapidsslonline.com\/ssl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rapidsslonline.com\/ssl\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rapidsslonline.com\/ssl\/wp-json\/wp\/v2\/comments?post=367"}],"version-history":[{"count":0,"href":"https:\/\/www.rapidsslonline.com\/ssl\/wp-json\/wp\/v2\/posts\/367\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.rapidsslonline.com\/ssl\/wp-json\/wp\/v2\/media?parent=367"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rapidsslonline.com\/ssl\/wp-json\/wp\/v2\/categories?post=367"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rapidsslonline.com\/ssl\/wp-json\/wp\/v2\/tags?post=367"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}