Weak DH Key Exchange Supported (PCI DSS)
Medium Nessus Plugin ID 106459
SynopsisA service on the remote host supports a weak key exchange mechanism
DescriptionAt least one of the services on the remote host supports a Diffie-Hellman key exchange using a public modulus smaller than 2048 bits.
Diffie-Hellman key exchanges with keys smaller than 2048 bits do not meet the PCI definition of strong cryptography as specified by NIST Special Publication 800-57 Part 1.
Diffie-Hellman moduli of up to 1024 bits are considered practically breakable by an attacker with very significant resources.
SolutionConsult the software's manual and reconfigure the service to use at least 2048-bit DH parameters. Alternatively, disable DH and use only Elliptic-curve Diffie-Hellman (ECDH) instead.