Formal definition of (perfect) forward security/secrecy In recent weeks the concept of (perfect) forward security/secrecy has
been mentioned a lot, primarily in the context of the shocking
revelations about NSA eavesdropping. As far as I'm aware, this concept
was introduced by C. G. Günther in [1].  Unfortunately [1] only sketches
the concept but does not give a security definition.  The survey [2]
gives a formal security definition only for forward secure
pseudo-random generators. The textbooks [3, 4, 5, 6] all don't even
mention the concept, and the relevant Wikipedia article is near
unreadable.

Could somebody please point me towards a formal definition of
(perfect) forward security/secrecy?


C. G. Günther, "An Identity-based Key-exchange Protocol".
G. Itkis, "Forward Security: Adaptive Cryptography: Time Evolution".
J. Katz, Y.   Lindell, "Introductin to Modern Cryptography".
O. Goldreich, "Foundations of Cryptography".
J. Hoffstein, J. Pipher, J.   H. Silverma, "An Introduction to Mathematical Cryptography".
D. R. Stinson, "Cryptography: Theory and Practise".
Do you have a specific application domain in mind?
I do not know of any formal definition that spans multiple application domains.

A formal definition of Perfect Forward Secrecy for the domain of key exchange protocols is included in this paper:

Beyond eCK: Perfect Forward Secrecy under Actor Compromise and Ephemeral-Key Reveal