Perfect forward secrecy

Encryption keeps your data secret until the time the secret key remains safe.

If the key is stolen, both the past encrypted messages and the future messages can easily be compromised.

To solve this problem, security researchers have come up with a new implementation called Perfect Forward Secrecy (PFS).

In PFS, we constantly keep changing keys for a new set of conversation and at the end of the conversation, the keys are generally deleted.

In the case where PFS is implemented, even if the latest key gets stolen, it can only decrypt the latest messages, but not the previous ones.

Implementation of perfect forward secrecy in nginx

PFS is a property of elliptical curve Diffie-Hellman. So, instead of using RSA, switch to the ECDHE key exchange.

Ideally, ECDHE should be the most preferred cipher. This is my current configuration:

ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384
  EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA
  !aNULL...