SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-tls13-forward-secrecy

What did TLS 1.3 change about key exchange?

Forward secrecy for every key exchange, static RSA is gone.

Start playing free

  1. Static RSA key exchange became required
  2. Key exchange moved to symmetric keys only
  3. Every public-key key exchange now provides forward secrecy ✔

Why: With forward secrecy, a stolen server key cannot decrypt past recorded sessions, because each session uses fresh ephemeral keys. TLS 1.3 removed static RSA and static Diffie-Hellman.

Huh, didn't know that: In TLS 1.3 all handshake messages after the ServerHello are encrypted.

The dad joke
Forward secrecy means yesterday's secrets stay secret, even if today's key is stolen.
Like this card?
Play the game

References

Answer: Every public-key key exchange now provides forward secrecy. With forward secrecy, a stolen server key cannot decrypt past recorded sessions, because each session uses fresh ephemeral keys. TLS 1.3 removed static RSA and static Diffie-Hellman.

  1. RFC 8446, TLS Protocol Version 1.3 www.rfc-editor.org/rfc/rfc8446
    Static RSA and Diffie-Hellman cipher suites have been removed; all public-key based key exchange mechanisms now provide forward secrecy.
    Checked 2026-10-10.
  2. RFC 8446, TLS Protocol Version 1.3 www.rfc-editor.org/rfc/rfc8446
    All handshake messages after the ServerHello are now encrypted.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyA wildcard certificate for *.example.com is presented. Which name does it match?Security & PrivacyEncrypting a laptop's files mainly protects which part of the CIA triad?Security & PrivacyA file's hash value no longer matches after someone edits the file. Which CIA property was affected?

That's stuff everyone should know.