[ig1]

My understanding is that if they're using Perfect Forward Security it doesn't matter, because unless you're modifying the traffic in flow (which is much harder to do secretly) then it doesn't matter if someone-else has the private key, they won't be able to decrypt the data in any case.

[Hello71]

How do you expect to get the nonce across the network without the NSA getting it?

[ig1]

I'm no expert in PFS in TLS, but there are various key-agreement protocols that allows parties to establish a secure key over an insecure channel.

I believe the way PFS works is that it uses RSA to verify identity and then Diffie-Hellman to establish keys.

If you're only able to passively intercept data (i.e. you can't impersonate the server and MITM) then you're unable to discover what the key established by DH is.

(incidentally nonces are generally only relevant for preventing replay attacks; the nonce doesn't play a part in passive defence)

[eps]

> I believe the way PFS works is that it uses RSA to verify identity and then Diffie-Hellman to establish keys.

It's the other way around. First you do the DH and then use RSA to authenticate (a hash of) DH parameters.

[spellboots]

This article may help explain how: http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-se...