PFS and openconnect

[Nikos Mavrogiannopoulos]

On Wed, Feb 25, 2015 at 11:32 AM, Björn JACKE <bj at sernet.de> wrote:
> Hi,
> openconnect works great for me with PFS. However it would be nice if the usage
> of PFS would be visible from the log output. For example I see this in the log
> output:
> Established DTLS connection (using GnuTLS). Ciphersuite (DTLS0.9)-(RSA)-(AES-256-CBC)-(SHA1).

You can ignore the DTLS session information with regards to PFS.
Although it uses a DTLS ciphersuite, it is using a key that was
generated during the CSTP exchange. The TLS ciphersuite is the
important here, but indeed, it is not printed.

regards,
Nikos