Struggling to understand Perfect Forward Secrecy From the definition on Wikipedia:


  In cryptography, forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that session keys will not be compromised even if the private key of the server is compromised.


So, if I am understanding this right, a protocol establishes PFS if the leak of the master key does not enable a calculation of already-used session keys.

But I read a question here that PFS can be achieved by deriving session keys with a hash of an old session key. But if I were to know the master key (the pre-shared key?), I could easily calculate all session keys or am I misunderstanding something?
But I read a question here that PFS can be achieved by deriving session keys with a hash of an old session key. But if I were to know the master key (the pre-shared key?), I could easily calculate all session keys or am I misunderstanding something?


So the idea of PFS is that if the entire (secret) state of an entity at a time point $x$ is leaked and there exists at least one previous session, then there is a time point $x'&lt;x$ where before that you lack knowledge to recover information from ciphertexts.

If we use this more formal definition and the participants do indeed erase old keys upon a key-update, then the scheme from the other question provides forward secrecy. If the initial key is now leaked, the first condition is violated as there is no previous session and the definition doesn't claim post-compromise security (where if you leak state at one point it will recover from passive adversaries). Now if you leak the state at a later point then obviously you cannot recover the key from a previous session because the hash is one-way.