What does forward secrecy mean in a modern TLS context?

• A. All data uses a single long-term key
• B. Forward secrecy requires sending plaintext for initial handshake
• C. It guarantees perfect forward secrecy even if random numbers are compromised
• D. Session keys are not derived from the server's private key and are ephemeral

Answer: (D)

Forward secrecy means that each TLS session is protected with its own fresh keys, not with the server’s long-term private key. In modern TLS this is achieved by using an ephemeral key exchange (typically Diffie-Hellman or elliptic-curve Diffie-Hellman, run for that session only). The result is a shared session key derived from ephemeral secrets that are discarded after the handshake. Because those keys are not tied to the server’s private key, even if the server’s private key is later compromised, past conversations remain confidential.

This is why the correct description emphasizes that session keys are ephemeral and not derived from the server’s private key. Other statements don’t fit: using a single long-term key would allow retroactive decryption, sending plaintext during the handshake isn’t how TLS operates, and guaranteeing “perfect” forward secrecy even if random numbers are compromised isn’t accurate in practice because secure randomness is essential for generating the ephemeral keys.