Which approach achieves perfect forward secrecy in TLS?

• A. Ephemeral Diffie-Hellman (DHE) or Elliptic Curve Diffie-Hellman (ECDHE).
• B. Static RSA with long-lived keys.
• C. DES.
• D. MD5.

Answer: (A)

Perfect forward secrecy in TLS comes from generating fresh session keys through an ephemeral key exchange, not from using a long-term server key. Ephemeral Diffie-Hellman (DHE) or Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) create new key pairs for each connection and compute a shared secret that is then used to derive the session’s symmetric keys. Because the server’s long-term private key isn’t involved in backstopping those session keys, even if that private key is later compromised, past communications remain protected.

Using static RSA with long-lived keys ties the session keys to the server’s permanent key, so a later compromise can expose previously captured traffic. DES is an outdated symmetric cipher and doesn’t address how keys are exchanged, while MD5 is a hash function and likewise doesn’t establish forward secrecy.