Insecure Transport: Missing Perfect Forward Secrecy

The target application does not support a cipher suite that implements Perfect Forward Secrecy (PFS).

Perfect Forward Secrecy (PFS) preserves the secrecy of previous encrypted communications between two parties over a secure communication channel, even if the private key necessary to decrypt communications for a given session is compromised. It is implemented via a function of key exchange protocols used to establish a shared secret between the client and server. [1] In public key encryption schemes without PFS, as message decryption operations are performed using a static long-term private key, if that private key is compromised at a given point in time, all previous communications can be decrypted. Vulnerabilities such as "Heartbleed" (CVE-2014-0160) [5] in the OpenSSL library [6] that can allow an attacker to steal a server's static long-term private key demonstrate the danger in using cipher suites that do not implement PFS.

PFS mitigates this issue by only using a static long-term private key for authentication, while random short-term private keys are used for session data encryption. PFS is commonly implemented using a Diffie-Hellman key exchange in ephemeral-static mode (DHE) or an Elliptic Curve Diffie-Hellman key exchange scheme with ephemeral keys (ECDHE). [2, 3, 4] For every TLS session established with DHE or ECDHE as the key exchange algorithm for a given cipher suite, the server is required to use a new Diffie-Hellman public/private key for the generation of the TLS master secret. [7] The server then signs this Diffie-Hellman public key using its static long-term private key to guarantee its authenticity. The server's static long-term private key is not used for the encryption of session data.

While a stolen ephemeral private key can enable an attacker to decipher some encrypted communications, the scope of the compromise is limited to the specific session for which the ephemeral key is associated. As such, do not log ephemeral keys.