- RFC 10015 deprecates Diffie-Hellman (DH) over finite fields and RSA key exchanges in (D)TLS 1.2, and discourages static Elliptic Curve Diffie-Hellman (ECDH) cipher suites.
- Non-ephemeral DH algorithms lack forward secrecy and are vulnerable to attacks like Raccoon (timing side channel) and invalid curve attacks due to key reuse.
- Ephemeral FFDHE in (D)TLS 1.2 has interoperability issues, small subgroups, weak 1024-bit groups, and Raccoon vulnerability, with no mechanism for secure fallback.
- RSA key exchange is deprecated in (D)TLS 1.2 due to lack of forward secrecy and vulnerability to Bleichenbacher attacks, which are difficult to mitigate.