Work out perfect forward secrecy benefit instantly with clear inputs, formula shown and shareable results.
Without forward secrecy, every session key is derivable from the server's long-term private key, so one key compromise retroactively decrypts all captured traffic. Ephemeral Diffie-Hellman generates a fresh key pair per session and discards it, so the exposure collapses from every recorded session in the capture window to only those whose ephemeral secret is still in memory.
Retrospective exposure
sessions at risk = sessions per day x capture window in days x recorded share; with PFS this reduces to sessions with live ephemeral state
Yes for the initial handshake, since only ephemeral key exchange is defined. Session resumption via pre-shared keys weakens it unless the PSK is combined with a fresh ECDHE exchange.
They can. A long-lived ticket-encryption key that is never rotated lets an attacker who steals it decrypt resumed sessions, so rotate ticket keys frequently.