What attacks does future secrecy protect against? Consider messaging between 2 parties. A sequence of messages are exchanged between the parties using encryption. We consider an attacker that has at a minimum a log of all the (encrypted) messages sent between the two parties.

Forward Secrecy: encryption keys are constantly updated in a non-reversible way, this means that if the attacker gains key $K_i$ they can derive $K_{i+1}$, $K_{i+2}$ and so on and decrypt message $M_i, M_{i+1}, M_{i+2}$ but they cannot decrypt any previous messages.

Future Secrecy: Like the Axolotl double ratchet, both sides constantly generate new public/private key pairs and only the public parts are exchanged over the communication channel. This means that if the attacker gains private keys $AK_i$ and/or $BK_i$ they can decrypt a finite number of messages $M_i$ or maybe $M_i, M_{i+1}$ but they cannot decrypt any further messages. They also can't decrypt previous messages.

What I don't understand is the security value of future secrecy.


  What kind of attack situation would future secrecy protect against?


It seems like an attacker would have to have exploited one of the messaging devices and read those temporary private keys from its memory - but then couldn't it just read the decrypted messages from memory and not bother with a cryptographic attack?
It seems like an attacker would have to have exploited one of the messaging devices and read those temporary private keys from its memory - but then couldn't it just read the decrypted messages from memory and not bother with a cryptographic attack?


It is assumed that the messaging devices erase the decrypted messages (and expired private keys) from memory, hence there's nothing to read.