Property of secure communication protocols in which compromise of long-term keys does not compromise past session keys.