Skip to content
ENExplore Calculators

Perfect Forward Secrecy Benefit Calculator

Work out perfect forward secrecy benefit instantly with clear inputs, formula shown and shareable results.

About Perfect Forward Secrecy Benefit Calculator

Without forward secrecy, every session key is derivable from the server's long-term private key, so one key compromise retroactively decrypts all captured traffic. Ephemeral Diffie-Hellman generates a fresh key pair per session and discards it, so the exposure collapses from every recorded session in the capture window to only those whose ephemeral secret is still in memory.

Formula

Retrospective exposure

sessions at risk = sessions per day x capture window in days x recorded share; with PFS this reduces to sessions with live ephemeral state

Worked example

With the default values below, Perfect Forward Secrecy Benefit Calculator returns Sessions forward secrecy protects of 73,000,000. Change any input above and every figure here is recalculated in your browser.

Inputs used

Sessions per dayminimum 1
2,000,000
Days of traffic an attacker has capturedminimum 1
365
Share of traffic the attacker recordedaccepts 0.01–100 %
10 %

Results

Sessions forward secrecy protects
73,000,000
Sessions decryptable without forward secrecy
73,000,000
Retrospective exposure window
365 days
Residual risk with forward secrecy
With ephemeral key exchange only sessions still holding their ephemeral secret in memory are at risk, typically seconds to minutes rather than 365 days

Step by step

  1. 1Values used
  2. 2Retrospective exposure
  3. 3Sessions forward secrecy protects= 73,000,000
  4. 4Sessions decryptable without forward secrecy= 73,000,000
  5. 5Retrospective exposure window= 365 days
  6. 6Residual risk with forward secrecy= With ephemeral key exchange only sessions still holding their ephemeral secret in memory are at risk, typically seconds to minutes rather than 365 days

Assumptions and limits

  • The result is derived only from the 3 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Does TLS 1.3 always give forward secrecy?

Yes for the initial handshake, since only ephemeral key exchange is defined. Session resumption via pre-shared keys weakens it unless the PSK is combined with a fresh ECDHE exchange.

Do session-ticket keys undermine forward secrecy?

They can. A long-lived ticket-encryption key that is never rotated lets an attacker who steals it decrypt resumed sessions, so rotate ticket keys frequently.

Related Calculators

Perfect Forward Secrecy Benefit Calculator | Calcrivo