Forward secrecy
An eavesdropper records three sessions and steals the server key years later. With RSA key transport every session opens; with ephemeral Diffie–Hellman none does.
Client ⇄ ServerEve’s recording
Session 1
Session 2
Session 3
Server long-term keyRSA decryption key d (secret)
1 / 7
The server has a long-term RSA key pair (toy: n = 3233, e = 17). Eve records everything on the wire. Press play.
What to notice
- With RSA key transport the session key travels encrypted under the server's long-term key. Whoever gets that key later can open every recording.
- With ephemeral Diffie–Hellman the session key comes from secrets that are deleted after the handshake. The long-term key only signs, so stealing it does not help with the past.
- This is why TLS 1.3 removed RSA key transport: every handshake uses (EC)DHE.