Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice

By David Adrian, Karthikeyan Bhargavan, Zakir Durumeric, P. Gaudry, Matthew D. Green, J. Alex Halderman, Nadia Heninger, Drew Springall, Emmanuel Thomé, Luke Valenta and 4 more. Conference on Computer and Communications Security, 2015

510 citations recorded by the source corpus.

We investigate the security of Diffie-Hellman key exchange as used in popular Internet protocols and find it to be less secure than widely believed. First, we present Logjam, a novel flaw in TLS that lets a man-in-the-middle downgrade connections to "export-grade" Diffie-Hellman. To carry out this attack, we implement the number field sieve discrete log algorithm. After a week-long precomputation for a specified 512-bit group, we can compute arbitrary discrete logs in that group in about a minute. We find that 82% of vulnerable servers use a single 512-bit group, allowing us to compromise connections to 7% of Alexa Top Million HTTPS sites. In response, major browsers are being changed to reject short groups. We go on to consider Diffie-Hellman with 768- and 1024-bit groups. We estimate that even in the 1024-bit case, the computations are plausible given nation-state resources. A small number of fixed or standardized groups are used by millions of servers; performing precomputation for a single 1024-bit group would allow passive eavesdropping on 18% of popular HTTPS sites, and a second group would allow decryption of traffic to 66% of IPsec VPNs and 26% of SSH servers. A close reading of published NSA leaks shows that the agency's attacks on VPNs are consistent with having achieved such a break. We conclude that moving to stronger key exchange methods should be a priority for the Internet community.

Subfields: Artificial Intelligence, Electrical and Electronic Engineering

View Paper: https://www.semanticscholar.org/paper/89737e769729c28681a6c245e37c60ff31b9e30c

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Electrical and Electronic Engineering

Citations in the corpus

A Search Engine Backed by Internet-Wide Scanning (2015, background): “There have been a large number of research studies over the past several years that have been based on Internet-wide scanning [1,7–11,13,14,18,19,24–29,38], which encouraged us to develop Censys.”
Post-quantum Key Exchange - A New Hope (2016, background): “One of the recommended mitigations by the authors of [1] is to avoid fixed primes.”
SoK: Security Evaluation of Home-Based IoT Deployments (2019, background): “[60] and DROWN [62] illustrated the difficulty of implementing secure communication protocols.”