EXERCISE 3 — "Harvest now, decrypt later" and forward secrecy
=============================================================

THE ATTACK (one paragraph):
  A patient attacker who can observe network traffic records large volumes
  of encrypted TLS sessions today and simply stores them, even though they
  can't read them yet. They are betting that at some future point they will
  obtain the server's private key — by breaking in, by subpoena/coercion,
  by a future cryptographic break, or by the key simply leaking. The moment
  they get that key, every recorded session that the key can unlock becomes
  readable in retrospect. The defence is to make sure that no single
  long-lived key is capable of unlocking past sessions — which is exactly
  what forward secrecy provides.

WHY RSA KEY TRANSPORT IS VULNERABLE:
  - KEY STOLEN: the server's long-term RSA private key (the one in its
    certificate).
  - In RSA key transport, the client encrypted each session's pre-master
    secret directly to the server's RSA PUBLIC key. So the matching PRIVATE
    key can decrypt that pre-master secret.
  - Because the SAME long-term key was used for every session, stealing it
    once lets the attacker decrypt the pre-master secret of EVERY recorded
    session, derive each session's symmetric key, and read all the traffic.
  - One key compromise -> the entire recorded archive falls. No forward
    secrecy.

WHY EPHEMERAL ECDHE IS NOT VULNERABLE:
  - KEY STOLEN: again the server's long-term key from the certificate.
  - But with ECDHE that long-term key was used ONLY TO SIGN the handshake
    (to prove the server's identity) — it was NEVER used to encrypt or
    derive the session secret.
  - The session secret came from EPHEMERAL Diffie-Hellman values that both
    sides generated for that one session and DELETED afterwards.
  - So the stolen long-term key unlocks nothing in the recorded traffic:
    the ephemeral private values that actually protected each session no
    longer exist anywhere, and can't be recovered from what was sent on the
    wire (discrete-log hardness, see Exercise 2).
  - Result: past sessions stay confidential even after a future key
    compromise. That is forward secrecy.

ONE-LINE CONTRAST:
  RSA transport: long-term key = decrypts sessions  -> steal it, read the past.
  ECDHE:         long-term key = only signs          -> steal it, the past stays sealed.