3 ms·

Is this trying to show that Duck Duck Go just enabled PFS (perfect forward secrecy)?

• shdon 13y ago
  Yes, pretty much.
  • lucb1e 13y ago
    Trying my own domain, it says the same. I never touched anything. Are they sure this is working?
    • nknighthb 13y ago
      It's working. "Perfect forward secrecy" is not a specific feature you turn on, it's actually an implicit consequence of certain ways key exchange can be implemented. Chrome says, for the blog mentioned in your profile: "The connection is encrypted using AES_256_CBC, with SHA1 for message authentication and ECDHE_RSA as the key exchange mechanism." "ECDHE" means elliptic curve Diffie-Hellman exchange. This means your server, whatever it is, is configured to support perfect forward secrecy. If you're running your own server, you're probably using some recent distribution or Apache release that defaults to enabling ECDHE. Otherwise, your host may have done such configuration themselves.
      • lucb1e 13y ago
        Okay, thanks for all the info! It's indeed about my blog, and I host it myself on a fairly recent version of Apache.
      • danbruc 13y ago
        The last E stands for ephemeral because ephemeral keys are used.