Perfect Forward Secrecy Calculator

exposure window = ticket-key rotation interval + ticket lifetime when the key exchange is ephemeral; without PFS it is the whole life of the certificate key. Ephemeral key exchange means the session secret is never written down, so a later private-key theft cannot recover past traffic. Session tickets reintroduce a long-lived secret: whoever holds the ticket-encryption key can recover the resumption secret for every ticket it ever issued, so the real exposure window is the rotation interval plus the ticket lifetime.

Forward secrecy is the only defence against harvest-now-decrypt-later, and it is routinely defeated in practice by TLS terminators that never rotate their session-ticket keys.

This calculator takes 5 inputs: Key exchange, Session-ticket key rotation interval, Session-ticket lifetime offered to clients, Sessions established per hour, Assume an adversary is recording all traffic. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

The handshake does — every TLS 1.3 cipher suite uses ephemeral key exchange. Resumption does not: a PSK derived from a ticket encrypted under a static ticket key is only as forward-secret as that key's rotation schedule.

Every few hours to a day, with old keys retained only long enough to decrypt outstanding tickets. Rotating on restart alone leaves keys live for the entire uptime of the process.