Perfect Forward Secrecy

Perfect forward secrecy (PFS) protects recorded sessions against later compromise of long-term authentication keys when ephemeral key exchange is used and session secrets are erased. It does not protect against disclosure of those session secrets or endpoint compromise. See TLS 1.3's security analysis.

AES-256 and ChaCha20 are ciphers; forward secrecy depends on key exchange and secret handling. A leaked traffic secret can expose the affected session even with PFS. For a VPN, assess the negotiated protocol and configuration rather than treating a cipher name as a security audit.

For the s4m VPN, check the issued protocol and client configuration. TLS 1.3's PSK-only key exchange lacks forward secrecy, and its 0-RTT data lacks full forward secrecy. A protocol version alone does not verify negotiated key exchange, secret erasure or endpoint security.