Akamai's Legacy SSL/TLS Cipher Profiles

Question

I'm conducting a research regarding CDN security, and have noticed that in the following document https://community.akamai.com/docs/DOC-5175 A cipher suite named "ak-akamai-pfs-supported" includes the following:

ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES256-SHA384
ECDHE-ECDSA-AES128-SHA256
ECDHE-RSA-AES256-SHA384
ECDHE-RSA-AES256-SHA
ECDHE-RSA-AES128-SHA256
ECDHE-RSA-AES128-SHA
AES256-GCM-SHA384
AES128-GCM-SHA256
AES256-SHA256
AES128-SHA256
AES128-SHA
DES-CBC3-SHA

My questions is, do the following ciphers from the mentioned above list do support Perfect Forward Secrecy?

AES256-GCM-SHA384
AES128-GCM-SHA256
AES256-SHA256
AES128-SHA256
AES128-SHA
DES-CBC3-SHA

Answer 1

The few cipher suites you mention don't have PFS since they all use RSA as key exchange. Only the ECDHE ciphers from the list have PFS since they use ECDH as key exchange.

Answer 2

Those ciphersuites you mention seem to use the OpenSSL name instead of the name from the RFC. You can find a table mapping one to the other here. Note that RSA based ciphersuites certainly don't offer PFS. You'd need DHE or ECDHE (ephemeral-ephemeral key agreement) to have Perfect Forward Secrecy.

In general the OpenSSL name should contain EDH, DHE or ECDHE to provide PFS and neither of the ciphersuites you mention do contain that sequence. So therefore the answer is no, no PFS.