Weak DH Key Exchange Supported (PCI DSS)
Medium Nessus Plugin ID 106459
SynopsisA service on the remote host supports a weak key exchange mechanism
DescriptionAt least one of the services on the remote host supports a
Diffie-Hellman key exchange using a public modulus smaller than 2048
Diffie-Hellman key exchanges with keys smaller than 2048 bits do not
meet the PCI definition of strong cryptography as specified by
NIST Special Publication 800-57 Part 1.
Diffie-Hellman moduli of up to 1024 bits are considered practically
breakable by an attacker with very significant resources.
SolutionConsult the software's manual and reconfigure the service to use at
least 2048-bit DH parameters. Alternatively, disable DH and use only
Elliptic-curve Diffie-Hellman (ECDH) instead.