Forward secrecy
A property where stealing a long-term key later does not let an attacker decrypt past sessions.
With forward secrecy each session's keys come from an ephemeral key exchange (ECDHE) whose private values are discarded afterwards. The server's long-term key only signs the handshake. Steal that key next year and recorded traffic stays sealed, because the ephemeral secrets no longer exist.
TLS 1.3 requires it for every full handshake by removing static RSA key exchange; TLS 1.2 had it only with (EC)DHE suites. Messaging protocols go further: the Signal double ratchet gives forward secrecy per message and post-compromise security as keys heal.
Gotchas: TLS session tickets encrypted with a long-lived ticket key undo forward secrecy for resumed sessions until that key rotates, and PSK-only resumption without DHE has none. Forward secrecy does not protect against harvest-now-decrypt-later; a quantum computer breaks the ephemeral exchange itself.