I've recently been looking at how to do perfect forward secrecy on a unidirectional connection (server can only push messages to client, client cannot respond).
What I've come up with is the idea of using a random shared key as a starting place and using this as a symmetric cipher key for the first pushed message. Once this message is pushed, the key is hashed, the result of this hash is the key for the second message. This continues to function as a sort of hash tree, ie:
$$ \begin{aligned} K_0 &= R && \\ K_1 &= H(K_0) &&= H(R) \\ K_2 &= H(K_1)&&= H(H(R)) \\ \vdots &\qquad\vdots && \qquad\vdots \\ K_n &= H(K_{n-1}) &&= H^n(R) \end{aligned} $$
If this is implemented correctly and the previous key is always destroyed fully (perhaps kept only in RAM) then I believe this could offer perfect forward secrecy assuming client and server can exchange the initial random value securely (the idea is that these be exchanged via QR code or similar mechanism).
The only disadvantage that I'm aware of to this approach compared to interactive Diffie-Hellman would be that if a server or client was compromised in this system, using the information within could allow a passive attack instead of an interactive (MITM) attack.
I doubt this is a new or unique idea at all, but just looking for some people to bounce this idea off before I attempt an implementation. I'm wondering if anyone has any thoughts on additional things to look out for that I may have missed or if I am catastrophically wrong and this won't work at all.