{"file":"pdf-inputs/sample-technical.pdf","pages":[{"blocks":[{"type":"text","bbox":{"x":152,"y":68,"w":304,"h":42},"lines":[{"wmode":0,"bbox":{"x":187,"y":68,"w":235,"h":22},"font":{"name":"PKRYBV+NimbusSanL-Bold","family":"serif","weight":"bold","style":"normal","size":17},"x":187,"y":85,"text":"Imperfect Forward Secrecy:"},{"wmode":0,"bbox":{"x":152,"y":88,"w":304,"h":22},"font":{"name":"PKRYBV+NimbusSanL-Bold","family":"serif","weight":"bold","style":"normal","size":17},"x":152,"y":105,"text":"How Diffie-Hellman Fails in Practice"}]},{"type":"text","bbox":{"x":65,"y":116,"w":492,"h":43},"lines":[{"wmode":0,"bbox":{"x":65,"y":120,"w":68,"h":14},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":11},"x":65,"y":131,"text":"David Adrian"},{"wmode":0,"bbox":{"x":134,"y":122,"w":4,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":134,"y":127,"text":"¶"},{"wmode":0,"bbox":{"x":138,"y":116,"w":130,"h":18},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":11},"x":138,"y":127,"text":" Karthikeyan Bhargavan"},{"wmode":0,"bbox":{"x":269,"y":122,"w":3,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":269,"y":127,"text":"∗"},{"wmode":0,"bbox":{"x":273,"y":116,"w":93,"h":18},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":11},"x":273,"y":127,"text":" Zakir Durumeric"},{"wmode":0,"bbox":{"x":366,"y":122,"w":4,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":366,"y":127,"text":"¶"},{"wmode":0,"bbox":{"x":371,"y":116,"w":90,"h":18},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":11},"x":371,"y":127,"text":" Pierrick Gaudry"},{"wmode":0,"bbox":{"x":461,"y":122,"w":3,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":461,"y":127,"text":"†"},{"wmode":0,"bbox":{"x":464,"y":116,"w":90,"h":18},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":11},"x":464,"y":127,"text":" Matthew Green"},{"wmode":0,"bbox":{"x":554,"y":122,"w":3,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":554,"y":127,"text":"§"},{"wmode":0,"bbox":{"x":74,"y":132,"w":97,"h":14},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":11},"x":74,"y":143,"text":"J. Alex Halderman"},{"wmode":0,"bbox":{"x":171,"y":135,"w":4,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":171,"y":140,"text":"¶"},{"wmode":0,"bbox":{"x":176,"y":128,"w":90,"h":18},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":11},"x":176,"y":140,"text":" Nadia Heninger"},{"wmode":0,"bbox":{"x":266,"y":135,"w":3,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":266,"y":140,"text":"‡"},{"wmode":0,"bbox":{"x":269,"y":128,"w":86,"h":18},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":11},"x":269,"y":140,"text":" Drew Springall"},{"wmode":0,"bbox":{"x":356,"y":135,"w":4,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":356,"y":140,"text":"¶"},{"wmode":0,"bbox":{"x":360,"y":128,"w":104,"h":18},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":11},"x":360,"y":140,"text":" Emmanuel Thomé"},{"wmode":0,"bbox":{"x":465,"y":135,"w":3,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":465,"y":140,"text":"†"},{"wmode":0,"bbox":{"x":469,"y":128,"w":77,"h":18},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":11},"x":469,"y":140,"text":" Luke Valenta"},{"wmode":0,"bbox":{"x":546,"y":135,"w":3,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":546,"y":140,"text":"‡"},{"wmode":0,"bbox":{"x":77,"y":144,"w":118,"h":14},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":11},"x":77,"y":156,"text":"Benjamin VanderSloot"},{"wmode":0,"bbox":{"x":195,"y":147,"w":4,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":195,"y":152,"text":"¶"},{"wmode":0,"bbox":{"x":200,"y":141,"w":77,"h":18},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":11},"x":200,"y":152,"text":" Eric Wustrow"},{"wmode":0,"bbox":{"x":277,"y":147,"w":4,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":277,"y":152,"text":"¶"},{"wmode":0,"bbox":{"x":282,"y":141,"w":147,"h":18},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":11},"x":282,"y":152,"text":" Santiago Zanella-Béguelin"},{"wmode":0,"bbox":{"x":429,"y":147,"w":3,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":429,"y":152,"text":"∥"},{"wmode":0,"bbox":{"x":433,"y":141,"w":105,"h":18},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":11},"x":433,"y":152,"text":" Paul Zimmermann"},{"wmode":0,"bbox":{"x":539,"y":147,"w":3,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":539,"y":152,"text":"†"}]},{"type":"text","bbox":{"x":87,"y":157,"w":444,"h":26},"lines":[{"wmode":0,"bbox":{"x":105,"y":162,"w":3,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":105,"y":167,"text":"∗"},{"wmode":0,"bbox":{"x":110,"y":161,"w":117,"h":12},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":9},"x":110,"y":170,"text":"INRIA Paris-Rocquencourt"},{"wmode":0,"bbox":{"x":248,"y":162,"w":3,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":248,"y":167,"text":"†"},{"wmode":0,"bbox":{"x":251,"y":157,"w":263,"h":16},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":9},"x":251,"y":167,"text":" INRIA Nancy-Grand Est, CNRS, and Université de Lorraine"},{"wmode":0,"bbox":{"x":87,"y":172,"w":3,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":87,"y":177,"text":"∥"},{"wmode":0,"bbox":{"x":93,"y":171,"w":85,"h":12},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":9},"x":93,"y":181,"text":"Microsoft Research"},{"wmode":0,"bbox":{"x":198,"y":172,"w":3,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":198,"y":177,"text":"‡"},{"wmode":0,"bbox":{"x":202,"y":168,"w":117,"h":16},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":9},"x":202,"y":177,"text":" University of Pennsylvania"},{"wmode":0,"bbox":{"x":339,"y":172,"w":3,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":339,"y":177,"text":"§"},{"wmode":0,"bbox":{"x":343,"y":168,"w":67,"h":16},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":9},"x":343,"y":177,"text":" Johns Hopkins"},{"wmode":0,"bbox":{"x":430,"y":172,"w":4,"h":10},"font":{"name":"HEONCW+LMMathSymbols6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":430,"y":177,"text":"¶"},{"wmode":0,"bbox":{"x":435,"y":171,"w":97,"h":12},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":9},"x":435,"y":181,"text":"University of Michigan"}]},{"type":"text","bbox":{"x":157,"y":189,"w":294,"h":12},"lines":[{"wmode":0,"bbox":{"x":157,"y":189,"w":294,"h":12},"font":{"name":"DOEKLG+NimbusSanL-Regu","family":"serif","weight":"normal","style":"normal","size":9},"x":157,"y":198,"text":"For additional materials and contact information, visit WeakDH.org."}]},{"type":"text","bbox":{"x":53,"y":214,"w":64,"h":15},"lines":[{"wmode":0,"bbox":{"x":53,"y":214,"w":64,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":53,"y":225,"text":"ABSTRACT"}]},{"type":"text","bbox":{"x":53,"y":230,"w":241,"h":253},"lines":[{"wmode":0,"bbox":{"x":53,"y":230,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":240,"text":"We investigate the security of Diffie-Hellman key exchange as"},{"wmode":0,"bbox":{"x":53,"y":240,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":250,"text":"used in popular Internet protocols and find it to be less secure"},{"wmode":0,"bbox":{"x":53,"y":250,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":261,"text":"than widely believed. First, we present Logjam, a novel flaw"},{"wmode":0,"bbox":{"x":53,"y":261,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":271,"text":"in TLS that lets a man-in-the-middle downgrade connections"},{"wmode":0,"bbox":{"x":53,"y":271,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":282,"text":"to “export-grade” Diffie-Hellman. To carry out this attack,"},{"wmode":0,"bbox":{"x":53,"y":282,"w":241,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":292,"text":"we implement the number field sieve discrete log algorithm."},{"wmode":0,"bbox":{"x":53,"y":292,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":302,"text":"After a week-long precomputation for a specified 512-bit"},{"wmode":0,"bbox":{"x":53,"y":303,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":313,"text":"group, we can compute arbitrary discrete logs in that group"},{"wmode":0,"bbox":{"x":53,"y":313,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":323,"text":"in about a minute. We find that 82% of vulnerable servers use"},{"wmode":0,"bbox":{"x":53,"y":324,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":334,"text":"a single 512-bit group, allowing us to compromise connections"},{"wmode":0,"bbox":{"x":53,"y":334,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":344,"text":"to 7% of Alexa Top Million HTTPS sites. In response, major"},{"wmode":0,"bbox":{"x":53,"y":345,"w":203,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":355,"text":"browsers are being changed to reject short groups."},{"wmode":0,"bbox":{"x":62,"y":355,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":365,"text":"We go on to consider Diffie-Hellman with 768- and 1024-bit"},{"wmode":0,"bbox":{"x":53,"y":366,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":376,"text":"groups. We estimate that even in the 1024-bit case, the com-"},{"wmode":0,"bbox":{"x":53,"y":376,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":386,"text":"putations are plausible given nation-state resources. A small"},{"wmode":0,"bbox":{"x":53,"y":386,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":397,"text":"number of fixed or standardized groups are used by millions"},{"wmode":0,"bbox":{"x":53,"y":397,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":407,"text":"of servers; performing precomputation for a single 1024-bit"},{"wmode":0,"bbox":{"x":53,"y":407,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":418,"text":"group would allow passive eavesdropping on 18% of popular"},{"wmode":0,"bbox":{"x":53,"y":418,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":428,"text":"HTTPS sites, and a second group would allow decryption"},{"wmode":0,"bbox":{"x":53,"y":428,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":438,"text":"of traffic to 66% of IPsec VPNs and 26% of SSH servers. A"},{"wmode":0,"bbox":{"x":53,"y":439,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":449,"text":"close reading of published NSA leaks shows that the agency’s"},{"wmode":0,"bbox":{"x":53,"y":449,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":459,"text":"attacks on VPNs are consistent with having achieved such"},{"wmode":0,"bbox":{"x":53,"y":460,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":470,"text":"a break. We conclude that moving to stronger key exchange"},{"wmode":0,"bbox":{"x":53,"y":470,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":480,"text":"methods should be a priority for the Internet community."}]},{"type":"text","bbox":{"x":53,"y":496,"w":241,"h":121},"lines":[{"wmode":0,"bbox":{"x":53,"y":496,"w":8,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":53,"y":507,"text":"1."},{"wmode":0,"bbox":{"x":74,"y":496,"w":95,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":74,"y":507,"text":"INTRODUCTION"},{"wmode":0,"bbox":{"x":62,"y":510,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":520,"text":"Diffie-Hellman key exchange is widely used to establish"},{"wmode":0,"bbox":{"x":53,"y":521,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":531,"text":"session keys in Internet protocols. It is the main key exchange"},{"wmode":0,"bbox":{"x":53,"y":531,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":541,"text":"mechanism in SSH and IPsec and a popular option in TLS."},{"wmode":0,"bbox":{"x":53,"y":542,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":552,"text":"We examine how Diffie-Hellman is commonly implemented"},{"wmode":0,"bbox":{"x":53,"y":552,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":562,"text":"and deployed with these protocols and find that, in practice,"},{"wmode":0,"bbox":{"x":53,"y":563,"w":214,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":573,"text":"it frequently offers less security than widely believed."},{"wmode":0,"bbox":{"x":62,"y":573,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":583,"text":"There are two reasons for this. First, a surprising number"},{"wmode":0,"bbox":{"x":53,"y":584,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":594,"text":"of servers use weak Diffie-Hellman parameters or maintain"},{"wmode":0,"bbox":{"x":53,"y":594,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":604,"text":"support for obsolete 1990s-era export-grade crypto. More"},{"wmode":0,"bbox":{"x":53,"y":604,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":615,"text":"critically, the common practice of using standardized, hard-"}]},{"type":"text","bbox":{"x":53,"y":641,"w":239,"h":80},"lines":[{"wmode":0,"bbox":{"x":53,"y":641,"w":239,"h":8},"font":{"name":"CJYOKF+NimbusRomNo9L-Regu","family":"serif","weight":"normal","style":"normal","size":6},"x":53,"y":647,"text":"Permission to make digital or hard copies of part or all of this work for personal or"},{"wmode":0,"bbox":{"x":53,"y":650,"w":239,"h":8},"font":{"name":"CJYOKF+NimbusRomNo9L-Regu","family":"serif","weight":"normal","style":"normal","size":6},"x":53,"y":656,"text":"classroom use is granted without fee provided that copies are not made or distributed"},{"wmode":0,"bbox":{"x":53,"y":659,"w":239,"h":8},"font":{"name":"CJYOKF+NimbusRomNo9L-Regu","family":"serif","weight":"normal","style":"normal","size":6},"x":53,"y":665,"text":"for profit or commercial advantage and that copies bear this notice and the full cita-"},{"wmode":0,"bbox":{"x":53,"y":668,"w":239,"h":8},"font":{"name":"CJYOKF+NimbusRomNo9L-Regu","family":"serif","weight":"normal","style":"normal","size":6},"x":53,"y":674,"text":"tion on the first page. Copyrights for third-party components of this work must be"},{"wmode":0,"bbox":{"x":53,"y":677,"w":239,"h":8},"font":{"name":"CJYOKF+NimbusRomNo9L-Regu","family":"serif","weight":"normal","style":"normal","size":6},"x":53,"y":683,"text":"honored. For all other uses, contact the Owner/Author(s). Copyright is held by the"},{"wmode":0,"bbox":{"x":53,"y":686,"w":46,"h":8},"font":{"name":"CJYOKF+NimbusRomNo9L-Regu","family":"serif","weight":"normal","style":"normal","size":6},"x":53,"y":692,"text":"owner/author(s)."},{"wmode":0,"bbox":{"x":53,"y":695,"w":23,"h":8},"font":{"name":"PGKVNJ+NimbusRomNo9L-ReguItal","family":"serif","weight":"normal","style":"italic","size":6},"x":53,"y":701,"text":"CCS’15,"},{"wmode":0,"bbox":{"x":77,"y":695,"w":132,"h":8},"font":{"name":"CJYOKF+NimbusRomNo9L-Regu","family":"serif","weight":"normal","style":"normal","size":6},"x":77,"y":701,"text":" October 12–16, 2015, Denver, Colorado, USA."},{"wmode":0,"bbox":{"x":53,"y":704,"w":91,"h":8},"font":{"name":"CJYOKF+NimbusRomNo9L-Regu","family":"serif","weight":"normal","style":"normal","size":6},"x":53,"y":710,"text":"ACM 978-1-4503-3832-5/15/10."},{"wmode":0,"bbox":{"x":53,"y":713,"w":140,"h":8},"font":{"name":"CJYOKF+NimbusRomNo9L-Regu","family":"serif","weight":"normal","style":"normal","size":6},"x":53,"y":719,"text":"DOI: http://dx.doi.org/10.1145/2810103.2813707."}]},{"type":"text","bbox":{"x":316,"y":215,"w":241,"h":169},"lines":[{"wmode":0,"bbox":{"x":316,"y":215,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":225,"text":"coded, or widely shared Diffie-Hellman parameters has the"},{"wmode":0,"bbox":{"x":316,"y":226,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":236,"text":"effect of dramatically reducing the cost of large-scale attacks,"},{"wmode":0,"bbox":{"x":316,"y":236,"w":190,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":246,"text":"bringing some within range of feasibility today."},{"wmode":0,"bbox":{"x":325,"y":246,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":257,"text":"The current best technique for attacking Diffie-Hellman"},{"wmode":0,"bbox":{"x":316,"y":257,"w":221,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":267,"text":"relies on compromising one of the private exponents ("},{"wmode":0,"bbox":{"x":538,"y":260,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":538,"y":267,"text":"a"},{"wmode":0,"bbox":{"x":543,"y":257,"w":2,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":543,"y":267,"text":","},{"wmode":0,"bbox":{"x":546,"y":260,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":546,"y":267,"text":" b"},{"wmode":0,"bbox":{"x":553,"y":257,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":553,"y":267,"text":")"},{"wmode":0,"bbox":{"x":316,"y":267,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":278,"text":"by computing the discrete log of the corresponding public"},{"wmode":0,"bbox":{"x":316,"y":278,"w":28,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":288,"text":"value ("},{"wmode":0,"bbox":{"x":344,"y":281,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":344,"y":288,"text":"g"},{"wmode":0,"bbox":{"x":349,"y":280,"w":4,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":349,"y":284,"text":"a"},{"wmode":0,"bbox":{"x":353,"y":274,"w":20,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":353,"y":284,"text":" mod"},{"wmode":0,"bbox":{"x":374,"y":281,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":374,"y":288,"text":" p"},{"wmode":0,"bbox":{"x":381,"y":278,"w":2,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":381,"y":288,"text":","},{"wmode":0,"bbox":{"x":384,"y":281,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":384,"y":288,"text":" g"},{"wmode":0,"bbox":{"x":392,"y":280,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":392,"y":284,"text":"b"},{"wmode":0,"bbox":{"x":395,"y":274,"w":20,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":395,"y":284,"text":" mod"},{"wmode":0,"bbox":{"x":416,"y":281,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":416,"y":288,"text":" p"},{"wmode":0,"bbox":{"x":423,"y":278,"w":132,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":423,"y":288,"text":"). With state-of-the-art number"},{"wmode":0,"bbox":{"x":316,"y":288,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":298,"text":"field sieve algorithms, computing a single discrete log is more"},{"wmode":0,"bbox":{"x":316,"y":299,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":309,"text":"difficult than factoring an RSA modulus of the same size."},{"wmode":0,"bbox":{"x":316,"y":309,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":319,"text":"However, an adversary who performs a large precomputation"},{"wmode":0,"bbox":{"x":316,"y":320,"w":42,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":330,"text":"for a prime"},{"wmode":0,"bbox":{"x":359,"y":323,"w":6,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":359,"y":330,"text":" p"},{"wmode":0,"bbox":{"x":365,"y":320,"w":189,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":365,"y":330,"text":" can then quickly calculate arbitrary discrete logs"},{"wmode":0,"bbox":{"x":316,"y":330,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":340,"text":"in that group, amortizing the cost over all targets that share"},{"wmode":0,"bbox":{"x":316,"y":341,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":351,"text":"this parameter. Although this fact is well known among"},{"wmode":0,"bbox":{"x":316,"y":351,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":361,"text":"mathematical cryptographers, it seems to have been lost"},{"wmode":0,"bbox":{"x":316,"y":362,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":372,"text":"among practitioners deploying cryptosystems. We exploit it"},{"wmode":0,"bbox":{"x":316,"y":372,"w":123,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":382,"text":"to obtain the following results:"}]},{"type":"text","bbox":{"x":316,"y":388,"w":241,"h":295},"lines":[{"wmode":0,"bbox":{"x":316,"y":388,"w":172,"h":12},"font":{"name":"APLFGU+LMRomanSlant9-Regular","family":"serif","weight":"normal","style":"italic","size":9},"x":316,"y":398,"text":"Active attacks on export ciphers in TLS."},{"wmode":0,"bbox":{"x":500,"y":388,"w":55,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":500,"y":398,"text":"We introduce"},{"wmode":0,"bbox":{"x":316,"y":398,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":408,"text":"Logjam, a new attack on TLS by which a man-in-the-middle"},{"wmode":0,"bbox":{"x":316,"y":409,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":419,"text":"attacker can downgrade a connection to export-grade cryp-"},{"wmode":0,"bbox":{"x":316,"y":419,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":429,"text":"tography. This attack is reminiscent of the FREAK attack [7]"},{"wmode":0,"bbox":{"x":316,"y":430,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":440,"text":"but applies to the ephemeral Diffie-Hellman ciphersuites and"},{"wmode":0,"bbox":{"x":316,"y":440,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":450,"text":"is a TLS protocol flaw rather than an implementation vulner-"},{"wmode":0,"bbox":{"x":316,"y":450,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":461,"text":"ability. We present measurements that show that this attack"},{"wmode":0,"bbox":{"x":316,"y":461,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":471,"text":"applies to 8.4% of Alexa Top Million HTTPS sites and 3.4%"},{"wmode":0,"bbox":{"x":316,"y":471,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":481,"text":"of all HTTPS servers that have browser-trusted certificates."},{"wmode":0,"bbox":{"x":325,"y":482,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":492,"text":"To exploit this attack, we implemented the number field"},{"wmode":0,"bbox":{"x":316,"y":492,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":502,"text":"sieve discrete log algorithm and carried out precomputation"},{"wmode":0,"bbox":{"x":316,"y":503,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":513,"text":"for two 512-bit Diffie-Hellman groups used by more than"},{"wmode":0,"bbox":{"x":316,"y":513,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":523,"text":"92% of the vulnerable servers. This allows us to compute"},{"wmode":0,"bbox":{"x":316,"y":524,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":534,"text":"individual discrete logs in about a minute. Using our discrete"},{"wmode":0,"bbox":{"x":316,"y":534,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":544,"text":"log oracle, we can compromise connections to over 7% of Top"},{"wmode":0,"bbox":{"x":316,"y":545,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":555,"text":"Million HTTPS sites. Discrete logs over larger groups have"},{"wmode":0,"bbox":{"x":316,"y":555,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":565,"text":"been computed before [8], but, as far as we are aware, this"},{"wmode":0,"bbox":{"x":316,"y":566,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":576,"text":"is the first time they have been exploited to expose concrete"},{"wmode":0,"bbox":{"x":316,"y":576,"w":147,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":586,"text":"vulnerabilities in real-world systems."},{"wmode":0,"bbox":{"x":325,"y":586,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":597,"text":"We were also able to compromise Diffie-Hellman for many"},{"wmode":0,"bbox":{"x":316,"y":597,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":607,"text":"other servers because of design and implementation flaws and"},{"wmode":0,"bbox":{"x":316,"y":607,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":617,"text":"configuration mistakes. These include use of composite-order"},{"wmode":0,"bbox":{"x":316,"y":618,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":628,"text":"subgroups in combination with short exponents, which is"},{"wmode":0,"bbox":{"x":316,"y":628,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":638,"text":"vulnerable to a known attack of van Oorschot and Wiener [51],"},{"wmode":0,"bbox":{"x":316,"y":639,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":649,"text":"and the inability of clients to properly validate Diffie-Hellman"},{"wmode":0,"bbox":{"x":316,"y":649,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":659,"text":"parameters without knowing the subgroup order, which TLS"},{"wmode":0,"bbox":{"x":316,"y":660,"w":144,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":670,"text":"has no provision to communicate."},{"wmode":0,"bbox":{"x":469,"y":660,"w":86,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":469,"y":670,"text":"We implement these"},{"wmode":0,"bbox":{"x":316,"y":670,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":680,"text":"attacks too and discover several vulnerable implementations."}]},{"type":"text","bbox":{"x":316,"y":686,"w":241,"h":33},"lines":[{"wmode":0,"bbox":{"x":316,"y":686,"w":152,"h":12},"font":{"name":"APLFGU+LMRomanSlant9-Regular","family":"serif","weight":"normal","style":"italic","size":9},"x":316,"y":696,"text":"Risks from common 1024-bit groups."},{"wmode":0,"bbox":{"x":478,"y":686,"w":79,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":478,"y":696,"text":"We explore the im-"},{"wmode":0,"bbox":{"x":316,"y":696,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":706,"text":"plications of precomputation attacks for 768- and 1024-bit"},{"wmode":0,"bbox":{"x":316,"y":707,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":717,"text":"groups, which are widely used in practice and still considered"}]}]},{"blocks":[{"type":"text","bbox":{"x":64,"y":111,"w":5,"h":10},"lines":[{"wmode":0,"bbox":{"x":64,"y":111,"w":5,"h":10},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":10},"x":64,"y":119,"text":"p"}]},{"type":"text","bbox":{"x":101,"y":59,"w":52,"h":27},"lines":[{"wmode":0,"bbox":{"x":101,"y":59,"w":52,"h":14},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":10},"x":101,"y":71,"text":"polynomial"},{"wmode":0,"bbox":{"x":107,"y":72,"w":40,"h":14},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":10},"x":107,"y":84,"text":"selection"}]},{"type":"text","bbox":{"x":199,"y":58,"w":120,"h":27},"lines":[{"wmode":0,"bbox":{"x":199,"y":61,"w":32,"h":14},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":10},"x":199,"y":73,"text":"sieving"},{"wmode":0,"bbox":{"x":289,"y":58,"w":26,"h":14},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":10},"x":289,"y":70,"text":"linear"},{"wmode":0,"bbox":{"x":285,"y":71,"w":34,"h":14},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":10},"x":285,"y":83,"text":"algebra"}]},{"type":"text","bbox":{"x":350,"y":108,"w":29,"h":14},"lines":[{"wmode":0,"bbox":{"x":350,"y":108,"w":29,"h":14},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":10},"x":350,"y":120,"text":"log db"}]},{"type":"text","bbox":{"x":171,"y":142,"w":86,"h":15},"lines":[{"wmode":0,"bbox":{"x":171,"y":142,"w":86,"h":15},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":10},"x":171,"y":154,"text":"precomputation"}]},{"type":"text","bbox":{"x":426,"y":65,"w":83,"h":19},"lines":[{"wmode":0,"bbox":{"x":426,"y":74,"w":15,"h":10},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":10},"x":426,"y":82,"text":"y, g"},{"wmode":0,"bbox":{"x":474,"y":65,"w":34,"h":14},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":10},"x":474,"y":77,"text":"descent"}]},{"type":"text","bbox":{"x":538,"y":112,"w":6,"h":10},"lines":[{"wmode":0,"bbox":{"x":538,"y":112,"w":6,"h":10},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":10},"x":538,"y":120,"text":"x"}]},{"type":"text","bbox":{"x":454,"y":142,"w":74,"h":15},"lines":[{"wmode":0,"bbox":{"x":454,"y":142,"w":74,"h":15},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":10},"x":454,"y":154,"text":"individual log"}]},{"type":"text","bbox":{"x":53,"y":172,"w":502,"h":33},"lines":[{"wmode":0,"bbox":{"x":53,"y":172,"w":36,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":182,"text":"Figure 1:"},{"wmode":0,"bbox":{"x":90,"y":172,"w":231,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":90,"y":182,"text":" The number field sieve algorithm for discrete log"},{"wmode":0,"bbox":{"x":322,"y":172,"w":233,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":322,"y":182,"text":" consists of a precomputation stage that depends only on"},{"wmode":0,"bbox":{"x":53,"y":183,"w":38,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":193,"text":"the prime"},{"wmode":0,"bbox":{"x":92,"y":186,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":92,"y":193,"text":" p"},{"wmode":0,"bbox":{"x":99,"y":183,"w":456,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":99,"y":193,"text":" and a descent stage that computes individual logs. With sufficient precomputation, an attacker can quickly break"},{"wmode":0,"bbox":{"x":53,"y":193,"w":201,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":203,"text":"any Diffie-Hellman instances that use a particular"},{"wmode":0,"bbox":{"x":254,"y":196,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":254,"y":203,"text":" p"},{"wmode":0,"bbox":{"x":262,"y":193,"w":2,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":262,"y":203,"text":"."}]},{"type":"text","bbox":{"x":53,"y":224,"w":241,"h":235},"lines":[{"wmode":0,"bbox":{"x":53,"y":224,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":234,"text":"secure. We provide new estimates for the computational re-"},{"wmode":0,"bbox":{"x":53,"y":235,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":245,"text":"sources necessary to compute discrete logs in groups of these"},{"wmode":0,"bbox":{"x":53,"y":245,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":255,"text":"sizes, concluding that 768-bit groups are within range of aca-"},{"wmode":0,"bbox":{"x":53,"y":255,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":266,"text":"demic teams, and 1024-bit groups may plausibly be within"},{"wmode":0,"bbox":{"x":53,"y":266,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":276,"text":"range of state-level attackers. In both cases, individual logs"},{"wmode":0,"bbox":{"x":53,"y":276,"w":234,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":287,"text":"can be quickly computed after the initial precomputation."},{"wmode":0,"bbox":{"x":62,"y":287,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":297,"text":"We then examine evidence from published Snowden docu-"},{"wmode":0,"bbox":{"x":53,"y":297,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":307,"text":"ments that suggests NSA may already be exploiting 1024-bit"},{"wmode":0,"bbox":{"x":53,"y":308,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":318,"text":"Diffie-Hellman to decrypt VPN traffic. We perform measure-"},{"wmode":0,"bbox":{"x":53,"y":318,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":328,"text":"ments to understand the implications of such an attack for"},{"wmode":0,"bbox":{"x":53,"y":329,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":339,"text":"popular protocols, finding that an attacker who could perform"},{"wmode":0,"bbox":{"x":53,"y":339,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":349,"text":"precomputations for ten 1024-bit groups could passively de-"},{"wmode":0,"bbox":{"x":53,"y":350,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":360,"text":"crypt traffic to about 66% of IKE VPNs, 26% of SSH servers,"},{"wmode":0,"bbox":{"x":53,"y":360,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":370,"text":"16% of SMTP servers, and 24% of popular HTTPS sites."},{"wmode":0,"bbox":{"x":53,"y":374,"w":98,"h":12},"font":{"name":"APLFGU+LMRomanSlant9-Regular","family":"serif","weight":"normal","style":"italic","size":9},"x":53,"y":384,"text":"Mitigations and lessons."},{"wmode":0,"bbox":{"x":160,"y":374,"w":132,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":160,"y":384,"text":"As a short-term countermeasure"},{"wmode":0,"bbox":{"x":53,"y":384,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":394,"text":"in response to the Logjam attack, all mainstream browsers"},{"wmode":0,"bbox":{"x":53,"y":395,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":405,"text":"are implementing a more restrictive policy on the size of"},{"wmode":0,"bbox":{"x":53,"y":405,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":415,"text":"Diffie-Hellman groups they accept. We further recommend"},{"wmode":0,"bbox":{"x":53,"y":415,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":426,"text":"that TLS servers disable export-grade cryptography and"},{"wmode":0,"bbox":{"x":53,"y":426,"w":205,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":436,"text":"carefully vet the Diffie-Hellman groups they use."},{"wmode":0,"bbox":{"x":267,"y":426,"w":25,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":267,"y":436,"text":"In the"},{"wmode":0,"bbox":{"x":53,"y":436,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":446,"text":"longer term, we advocate that protocols migrate to stronger"},{"wmode":0,"bbox":{"x":53,"y":447,"w":235,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":457,"text":"Diffie-Hellman groups, such as those based on elliptic curves."}]},{"type":"text","bbox":{"x":53,"y":470,"w":241,"h":204},"lines":[{"wmode":0,"bbox":{"x":53,"y":470,"w":8,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":53,"y":481,"text":"2."},{"wmode":0,"bbox":{"x":74,"y":470,"w":208,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":74,"y":481,"text":"DIFFIE-HELLMAN CRYPTANALYSIS"},{"wmode":0,"bbox":{"x":62,"y":484,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":494,"text":"Diffie-Hellman key exchange was the first published public-"},{"wmode":0,"bbox":{"x":53,"y":494,"w":79,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":505,"text":"key algorithm [14]."},{"wmode":0,"bbox":{"x":141,"y":494,"w":152,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":141,"y":505,"text":"In the simple case of prime groups,"},{"wmode":0,"bbox":{"x":53,"y":505,"w":133,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":515,"text":"Alice and Bob agree on a prime"},{"wmode":0,"bbox":{"x":187,"y":508,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":187,"y":515,"text":" p"},{"wmode":0,"bbox":{"x":195,"y":505,"w":69,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":195,"y":515,"text":" and a generator"},{"wmode":0,"bbox":{"x":264,"y":508,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":264,"y":515,"text":" g"},{"wmode":0,"bbox":{"x":273,"y":505,"w":19,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":273,"y":515,"text":" of a"},{"wmode":0,"bbox":{"x":53,"y":515,"w":132,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":525,"text":"multiplicative subgroup modulo"},{"wmode":0,"bbox":{"x":186,"y":519,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":186,"y":525,"text":" p"},{"wmode":0,"bbox":{"x":194,"y":515,"w":56,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":194,"y":525,"text":". Alice sends"},{"wmode":0,"bbox":{"x":250,"y":519,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":250,"y":525,"text":" g"},{"wmode":0,"bbox":{"x":259,"y":517,"w":4,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":259,"y":522,"text":"a"},{"wmode":0,"bbox":{"x":263,"y":512,"w":20,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":263,"y":522,"text":" mod"},{"wmode":0,"bbox":{"x":284,"y":519,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":284,"y":525,"text":" p"},{"wmode":0,"bbox":{"x":291,"y":515,"w":2,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":291,"y":525,"text":","},{"wmode":0,"bbox":{"x":53,"y":526,"w":42,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":536,"text":"Bob sends"},{"wmode":0,"bbox":{"x":96,"y":529,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":96,"y":536,"text":" g"},{"wmode":0,"bbox":{"x":105,"y":528,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":105,"y":532,"text":"b"},{"wmode":0,"bbox":{"x":109,"y":522,"w":20,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":109,"y":532,"text":" mod"},{"wmode":0,"bbox":{"x":129,"y":529,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":129,"y":536,"text":" p"},{"wmode":0,"bbox":{"x":137,"y":526,"w":156,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":137,"y":536,"text":", and each computes a shared secret"},{"wmode":0,"bbox":{"x":53,"y":540,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":53,"y":546,"text":"g"},{"wmode":0,"bbox":{"x":58,"y":538,"w":7,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":58,"y":543,"text":"ab"},{"wmode":0,"bbox":{"x":65,"y":532,"w":20,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":65,"y":543,"text":" mod"},{"wmode":0,"bbox":{"x":86,"y":540,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":86,"y":546,"text":" p"},{"wmode":0,"bbox":{"x":93,"y":536,"w":199,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":93,"y":546,"text":". While there is also a Diffie-Hellman exchange"},{"wmode":0,"bbox":{"x":53,"y":547,"w":207,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":557,"text":"over elliptic curve groups, we address only the “mod"},{"wmode":0,"bbox":{"x":261,"y":550,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":261,"y":557,"text":" p"},{"wmode":0,"bbox":{"x":268,"y":547,"w":25,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":268,"y":557,"text":"” case."},{"wmode":0,"bbox":{"x":62,"y":557,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":567,"text":"The security of Diffie-Hellman is not known to be equiva-"},{"wmode":0,"bbox":{"x":53,"y":568,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":578,"text":"lent to the discrete log problem (except in certain groups [13,"},{"wmode":0,"bbox":{"x":53,"y":578,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":588,"text":"33,34]), but computing discrete logs remains the best known"},{"wmode":0,"bbox":{"x":53,"y":589,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":599,"text":"cryptanalytic attack. An attacker who can find the discrete"},{"wmode":0,"bbox":{"x":53,"y":599,"w":11,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":609,"text":"log"},{"wmode":0,"bbox":{"x":65,"y":602,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":65,"y":609,"text":" x"},{"wmode":0,"bbox":{"x":73,"y":599,"w":21,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":73,"y":609,"text":" from"},{"wmode":0,"bbox":{"x":95,"y":602,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":95,"y":609,"text":" y"},{"wmode":0,"bbox":{"x":103,"y":599,"w":10,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":103,"y":609,"text":" ="},{"wmode":0,"bbox":{"x":113,"y":602,"w":6,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":113,"y":609,"text":" g"},{"wmode":0,"bbox":{"x":120,"y":601,"w":4,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":120,"y":605,"text":"x"},{"wmode":0,"bbox":{"x":124,"y":595,"w":20,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":124,"y":605,"text":" mod"},{"wmode":0,"bbox":{"x":145,"y":602,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":145,"y":609,"text":" p"},{"wmode":0,"bbox":{"x":152,"y":599,"w":134,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":152,"y":609,"text":" can easily find the shared secret."},{"wmode":0,"bbox":{"x":62,"y":609,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":620,"text":"Textbook descriptions of discrete log can be misleading"},{"wmode":0,"bbox":{"x":53,"y":620,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":630,"text":"about the computational tradeoffs, for example by balancing"},{"wmode":0,"bbox":{"x":53,"y":630,"w":212,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":641,"text":"parameters to minimize overall time to compute a"},{"wmode":0,"bbox":{"x":265,"y":630,"w":26,"h":12},"font":{"name":"DEEZDF+LMRoman9-Italic","family":"serif","weight":"normal","style":"italic","size":9},"x":265,"y":641,"text":" single"},{"wmode":0,"bbox":{"x":53,"y":641,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":651,"text":"discrete log. In fact, as illustrated in Figure 1, a single large"},{"wmode":0,"bbox":{"x":53,"y":651,"w":78,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":661,"text":"precomputation on"},{"wmode":0,"bbox":{"x":132,"y":655,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":132,"y":661,"text":" p"},{"wmode":0,"bbox":{"x":141,"y":651,"w":136,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":141,"y":661,"text":" can be used to efficiently break"},{"wmode":0,"bbox":{"x":278,"y":651,"w":14,"h":12},"font":{"name":"DEEZDF+LMRoman9-Italic","family":"serif","weight":"normal","style":"italic","size":9},"x":278,"y":661,"text":" all"},{"wmode":0,"bbox":{"x":53,"y":662,"w":195,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":672,"text":"Diffie-Hellman exchanges made with that prime."}]},{"type":"text","bbox":{"x":52,"y":675,"w":240,"h":44},"lines":[{"wmode":0,"bbox":{"x":53,"y":675,"w":73,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":53,"y":685,"text":"The typical case"},{"wmode":0,"bbox":{"x":138,"y":675,"w":154,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":138,"y":685,"text":"Diffie-Hellman is typically implemented"},{"wmode":0,"bbox":{"x":53,"y":686,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":696,"text":"with prime fields and large group orders. In this case, the"},{"wmode":0,"bbox":{"x":53,"y":696,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":706,"text":"most efficient discrete log algorithm is the number field sieve"},{"wmode":0,"bbox":{"x":52,"y":707,"w":72,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":52,"y":717,"text":"(NFS) [21,24,43]."},{"wmode":0,"bbox":{"x":125,"y":706,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":125,"y":713,"text":"1"},{"wmode":0,"bbox":{"x":129,"y":703,"w":163,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":129,"y":713,"text":" There is a closely related number field"}]},{"type":"text","bbox":{"x":316,"y":224,"w":241,"h":441},"lines":[{"wmode":0,"bbox":{"x":316,"y":224,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":234,"text":"sieve algorithm for factoring [12,31], and in fact many parts of"},{"wmode":0,"bbox":{"x":316,"y":235,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":245,"text":"the implementations can be shared. The general technique is"},{"wmode":0,"bbox":{"x":316,"y":245,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":255,"text":"called index calculus and has four stages with different compu-"},{"wmode":0,"bbox":{"x":316,"y":255,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":266,"text":"tational properties. The first three steps are only dependent"},{"wmode":0,"bbox":{"x":316,"y":266,"w":51,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":276,"text":"on the prime"},{"wmode":0,"bbox":{"x":368,"y":269,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":368,"y":276,"text":" p"},{"wmode":0,"bbox":{"x":376,"y":266,"w":161,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":376,"y":276,"text":" and comprise most of the computation."},{"wmode":0,"bbox":{"x":325,"y":276,"w":28,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":287,"text":"First is"},{"wmode":0,"bbox":{"x":354,"y":276,"w":83,"h":12},"font":{"name":"DEEZDF+LMRoman9-Italic","family":"serif","weight":"normal","style":"italic","size":8},"x":354,"y":287,"text":" polynomial selection"},{"wmode":0,"bbox":{"x":437,"y":276,"w":119,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":437,"y":287,"text":", in which one finds a polyno-"},{"wmode":0,"bbox":{"x":316,"y":287,"w":17,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":297,"text":"mial"},{"wmode":0,"bbox":{"x":333,"y":290,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":333,"y":297,"text":" f"},{"wmode":0,"bbox":{"x":341,"y":287,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":341,"y":297,"text":"("},{"wmode":0,"bbox":{"x":345,"y":290,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":345,"y":297,"text":"z"},{"wmode":0,"bbox":{"x":350,"y":287,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":350,"y":297,"text":")"},{"wmode":0,"bbox":{"x":353,"y":287,"w":92,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":353,"y":297,"text":" defining a number field"},{"wmode":0,"bbox":{"x":446,"y":289,"w":9,"h":12},"font":{"name":"OAKMXN+MSBM10","family":"serif","weight":"normal","style":"normal","size":8},"x":446,"y":297,"text":" Q"},{"wmode":0,"bbox":{"x":455,"y":287,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":455,"y":297,"text":"("},{"wmode":0,"bbox":{"x":459,"y":290,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":459,"y":297,"text":"z"},{"wmode":0,"bbox":{"x":463,"y":287,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":463,"y":297,"text":")"},{"wmode":0,"bbox":{"x":467,"y":290,"w":9,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":467,"y":297,"text":"/f"},{"wmode":0,"bbox":{"x":477,"y":287,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":477,"y":297,"text":"("},{"wmode":0,"bbox":{"x":480,"y":290,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":480,"y":297,"text":"z"},{"wmode":0,"bbox":{"x":485,"y":287,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":485,"y":297,"text":")"},{"wmode":0,"bbox":{"x":489,"y":287,"w":68,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":489,"y":297,"text":" for the computa-"},{"wmode":0,"bbox":{"x":316,"y":297,"w":81,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":307,"text":"tion. (For our cases,"},{"wmode":0,"bbox":{"x":398,"y":301,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":398,"y":307,"text":" f"},{"wmode":0,"bbox":{"x":406,"y":297,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":406,"y":307,"text":"("},{"wmode":0,"bbox":{"x":410,"y":301,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":410,"y":307,"text":"z"},{"wmode":0,"bbox":{"x":415,"y":297,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":415,"y":307,"text":")"},{"wmode":0,"bbox":{"x":418,"y":297,"w":137,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":418,"y":307,"text":" typically has degree 5 or 6.) This"},{"wmode":0,"bbox":{"x":316,"y":308,"w":238,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":318,"text":"parallelizes well and is only a small portion of the runtime."},{"wmode":0,"bbox":{"x":325,"y":318,"w":79,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":328,"text":"In the second stage,"},{"wmode":0,"bbox":{"x":404,"y":318,"w":29,"h":12},"font":{"name":"DEEZDF+LMRoman9-Italic","family":"serif","weight":"normal","style":"italic","size":8},"x":404,"y":328,"text":" sieving"},{"wmode":0,"bbox":{"x":434,"y":318,"w":121,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":434,"y":328,"text":", one factors ranges of integers"},{"wmode":0,"bbox":{"x":316,"y":329,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":339,"text":"and number field elements in batches to find many relations of"},{"wmode":0,"bbox":{"x":316,"y":339,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":349,"text":"elements, all of whose prime factors are less than some bound"},{"wmode":0,"bbox":{"x":316,"y":353,"w":6,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":316,"y":360,"text":"B"},{"wmode":0,"bbox":{"x":323,"y":350,"w":29,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":323,"y":360,"text":" (called"},{"wmode":0,"bbox":{"x":353,"y":353,"w":9,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":353,"y":360,"text":" B"},{"wmode":0,"bbox":{"x":363,"y":350,"w":156,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":363,"y":360,"text":"-smooth). Modern implementations use"},{"wmode":0,"bbox":{"x":519,"y":350,"w":31,"h":12},"font":{"name":"DEEZDF+LMRoman9-Italic","family":"serif","weight":"normal","style":"italic","size":8},"x":519,"y":360,"text":" special-"},{"wmode":0,"bbox":{"x":551,"y":353,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":551,"y":360,"text":"q"},{"wmode":0,"bbox":{"x":316,"y":360,"w":154,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":370,"text":"lattice sieving, which for each special"},{"wmode":0,"bbox":{"x":471,"y":363,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":471,"y":370,"text":" q"},{"wmode":0,"bbox":{"x":479,"y":360,"w":76,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":479,"y":370,"text":" explores a sieving"},{"wmode":0,"bbox":{"x":316,"y":371,"w":36,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":381,"text":"region of"},{"wmode":0,"bbox":{"x":353,"y":371,"w":8,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":353,"y":381,"text":" 2"},{"wmode":0,"bbox":{"x":361,"y":370,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":361,"y":377,"text":"2"},{"wmode":0,"bbox":{"x":364,"y":372,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":364,"y":377,"text":"I"},{"wmode":0,"bbox":{"x":368,"y":367,"w":78,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":368,"y":377,"text":" candidates, where"},{"wmode":0,"bbox":{"x":446,"y":374,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":446,"y":381,"text":" I"},{"wmode":0,"bbox":{"x":454,"y":371,"w":101,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":454,"y":381,"text":" is a parameter. Sieving"},{"wmode":0,"bbox":{"x":316,"y":381,"w":131,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":391,"text":"parallelizes well since each special"},{"wmode":0,"bbox":{"x":448,"y":384,"w":6,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":448,"y":391,"text":" q"},{"wmode":0,"bbox":{"x":455,"y":381,"w":100,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":455,"y":391,"text":" is handled independently"},{"wmode":0,"bbox":{"x":316,"y":391,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":402,"text":"of the others, but is computationally expensive, because we"},{"wmode":0,"bbox":{"x":316,"y":402,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":412,"text":"must search through and attempt to factor many elements."},{"wmode":0,"bbox":{"x":316,"y":412,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":423,"text":"The time for this step depends on heuristic estimates of"},{"wmode":0,"bbox":{"x":316,"y":423,"w":127,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":433,"text":"the probability of encountering"},{"wmode":0,"bbox":{"x":444,"y":426,"w":10,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":444,"y":433,"text":" B"},{"wmode":0,"bbox":{"x":455,"y":423,"w":100,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":455,"y":433,"text":"-smooth numbers in this"},{"wmode":0,"bbox":{"x":316,"y":433,"w":103,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":443,"text":"search; it also depends on"},{"wmode":0,"bbox":{"x":420,"y":437,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":420,"y":443,"text":" I"},{"wmode":0,"bbox":{"x":427,"y":433,"w":121,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":427,"y":443,"text":" and on the number of special"},{"wmode":0,"bbox":{"x":548,"y":437,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":548,"y":443,"text":" q"},{"wmode":0,"bbox":{"x":316,"y":444,"w":173,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":454,"text":"to consider before having enough relations."},{"wmode":0,"bbox":{"x":325,"y":454,"w":77,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":464,"text":"In the third stage,"},{"wmode":0,"bbox":{"x":403,"y":454,"w":59,"h":12},"font":{"name":"DEEZDF+LMRoman9-Italic","family":"serif","weight":"normal","style":"italic","size":9},"x":403,"y":464,"text":" linear algebra"},{"wmode":0,"bbox":{"x":462,"y":454,"w":94,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":462,"y":464,"text":", we construct a large,"},{"wmode":0,"bbox":{"x":316,"y":465,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":475,"text":"sparse matrix consisting of the coefficient vectors of prime"},{"wmode":0,"bbox":{"x":316,"y":475,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":485,"text":"factorizations we have found. A nonzero kernel vector of the"},{"wmode":0,"bbox":{"x":316,"y":486,"w":100,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":496,"text":"matrix modulo the order"},{"wmode":0,"bbox":{"x":417,"y":489,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":417,"y":496,"text":" q"},{"wmode":0,"bbox":{"x":424,"y":486,"w":131,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":424,"y":496,"text":" of the group will give us logs of"},{"wmode":0,"bbox":{"x":316,"y":496,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":506,"text":"many small elements. This database of logs serves as input"},{"wmode":0,"bbox":{"x":316,"y":507,"w":171,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":517,"text":"to the final stage. The difficulty depends on"},{"wmode":0,"bbox":{"x":488,"y":510,"w":6,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":488,"y":517,"text":" q"},{"wmode":0,"bbox":{"x":494,"y":507,"w":61,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":494,"y":517,"text":" and the matrix"},{"wmode":0,"bbox":{"x":316,"y":517,"w":194,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":527,"text":"size and can be parallelized in a limited fashion."},{"wmode":0,"bbox":{"x":325,"y":527,"w":62,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":538,"text":"The final stage,"},{"wmode":0,"bbox":{"x":388,"y":527,"w":31,"h":12},"font":{"name":"DEEZDF+LMRoman9-Italic","family":"serif","weight":"normal","style":"italic","size":8},"x":388,"y":538,"text":" descent"},{"wmode":0,"bbox":{"x":419,"y":527,"w":136,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":419,"y":538,"text":", actually deduces the discrete log"},{"wmode":0,"bbox":{"x":316,"y":538,"w":48,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":548,"text":"of the target"},{"wmode":0,"bbox":{"x":365,"y":541,"w":6,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":365,"y":548,"text":" y"},{"wmode":0,"bbox":{"x":372,"y":538,"w":183,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":372,"y":548,"text":". We re-sieve until we can find a set of relations"},{"wmode":0,"bbox":{"x":316,"y":548,"w":125,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":559,"text":"that allow us to write the log of"},{"wmode":0,"bbox":{"x":442,"y":552,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":442,"y":559,"text":" y"},{"wmode":0,"bbox":{"x":450,"y":548,"w":105,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":450,"y":559,"text":" in terms of the logs in the"},{"wmode":0,"bbox":{"x":316,"y":559,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":569,"text":"precomputed database. This step is accomplished in three"},{"wmode":0,"bbox":{"x":316,"y":569,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":579,"text":"phases: an initialization phase, which tries to write the target"},{"wmode":0,"bbox":{"x":316,"y":580,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":590,"text":"in terms of medium-sized primes, a middle phase, in which"},{"wmode":0,"bbox":{"x":316,"y":590,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":600,"text":"these medium-sized primes are further sieved until they can"},{"wmode":0,"bbox":{"x":316,"y":601,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":611,"text":"be represented by elements in the database of known logs,"},{"wmode":0,"bbox":{"x":316,"y":611,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":621,"text":"and a final phase that actually reconstructs the target using"},{"wmode":0,"bbox":{"x":316,"y":622,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":632,"text":"the log database. Crucially, descent is the only NFS stage"},{"wmode":0,"bbox":{"x":316,"y":632,"w":51,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":642,"text":"that involves"},{"wmode":0,"bbox":{"x":368,"y":635,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":368,"y":642,"text":" y"},{"wmode":0,"bbox":{"x":376,"y":632,"w":15,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":376,"y":642,"text":" (or"},{"wmode":0,"bbox":{"x":391,"y":635,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":391,"y":642,"text":" g"},{"wmode":0,"bbox":{"x":399,"y":632,"w":156,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":399,"y":642,"text":"), so polynomial selection, sieving, and"},{"wmode":0,"bbox":{"x":316,"y":643,"w":173,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":653,"text":"linear algebra can be done once for a prime"},{"wmode":0,"bbox":{"x":490,"y":646,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":490,"y":653,"text":" p"},{"wmode":0,"bbox":{"x":498,"y":643,"w":57,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":498,"y":653,"text":" and reused to"},{"wmode":0,"bbox":{"x":316,"y":653,"w":171,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":663,"text":"compute the discrete logs of many targets."}]},{"type":"text","bbox":{"x":316,"y":679,"w":240,"h":40},"lines":[{"wmode":0,"bbox":{"x":317,"y":679,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":317,"y":686,"text":"1"},{"wmode":0,"bbox":{"x":321,"y":680,"w":234,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":321,"y":690,"text":"Recent spectacular advances in discrete log algorithms"},{"wmode":0,"bbox":{"x":316,"y":689,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":699,"text":"have resulted in a quasi-polynomial algorithm for small-"},{"wmode":0,"bbox":{"x":316,"y":698,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":708,"text":"characteristic fields [3], but these advances are not known to"},{"wmode":0,"bbox":{"x":316,"y":707,"w":168,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":717,"text":"apply to the prime fields used in practice."}]},{"type":"text","bbox":{"x":302,"y":737,"w":4,"h":12},"lines":[{"wmode":0,"bbox":{"x":302,"y":737,"w":4,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":302,"y":747,"text":"2"}]}]},{"blocks":[{"type":"text","bbox":{"x":53,"y":53,"w":240,"h":212},"lines":[{"wmode":0,"bbox":{"x":62,"y":53,"w":145,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":63,"text":"The running time of this algorithm is"},{"wmode":0,"bbox":{"x":208,"y":57,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":208,"y":63,"text":" L"},{"wmode":0,"bbox":{"x":217,"y":60,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":217,"y":64,"text":"p"},{"wmode":0,"bbox":{"x":221,"y":53,"w":8,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":221,"y":63,"text":"(1"},{"wmode":0,"bbox":{"x":229,"y":57,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":229,"y":63,"text":"/"},{"wmode":0,"bbox":{"x":234,"y":53,"w":4,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":234,"y":63,"text":"3"},{"wmode":0,"bbox":{"x":238,"y":57,"w":2,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":238,"y":63,"text":","},{"wmode":0,"bbox":{"x":241,"y":53,"w":14,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":241,"y":63,"text":" (64"},{"wmode":0,"bbox":{"x":255,"y":57,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":255,"y":63,"text":"/"},{"wmode":0,"bbox":{"x":260,"y":53,"w":8,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":260,"y":63,"text":"9)"},{"wmode":0,"bbox":{"x":268,"y":53,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":268,"y":59,"text":"1"},{"wmode":0,"bbox":{"x":271,"y":55,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":271,"y":59,"text":"/"},{"wmode":0,"bbox":{"x":275,"y":53,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":275,"y":59,"text":"3"},{"wmode":0,"bbox":{"x":279,"y":53,"w":13,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":279,"y":63,"text":") ="},{"wmode":0,"bbox":{"x":53,"y":65,"w":14,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":75,"text":"exp"},{"wmode":0,"bbox":{"x":67,"y":59,"w":6,"h":45},"font":{"name":"ITXTHR+LMMathExtension10-Regula","family":"serif","weight":"normal","style":"normal","size":9},"x":67,"y":75,"text":" �"},{"wmode":0,"bbox":{"x":73,"y":65,"w":8,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":73,"y":75,"text":"(1"},{"wmode":0,"bbox":{"x":82,"y":68,"w":2,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":82,"y":75,"text":"."},{"wmode":0,"bbox":{"x":84,"y":65,"w":23,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":84,"y":75,"text":"923 +"},{"wmode":0,"bbox":{"x":107,"y":68,"w":6,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":107,"y":75,"text":" o"},{"wmode":0,"bbox":{"x":114,"y":65,"w":30,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":114,"y":75,"text":"(1))(log"},{"wmode":0,"bbox":{"x":145,"y":68,"w":6,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":145,"y":75,"text":" p"},{"wmode":0,"bbox":{"x":151,"y":65,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":151,"y":75,"text":")"},{"wmode":0,"bbox":{"x":154,"y":64,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":154,"y":71,"text":"1"},{"wmode":0,"bbox":{"x":158,"y":66,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":158,"y":71,"text":"/"},{"wmode":0,"bbox":{"x":162,"y":64,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":162,"y":71,"text":"3"},{"wmode":0,"bbox":{"x":166,"y":65,"w":28,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":166,"y":75,"text":"(log log"},{"wmode":0,"bbox":{"x":195,"y":68,"w":6,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":195,"y":75,"text":" p"},{"wmode":0,"bbox":{"x":201,"y":65,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":201,"y":75,"text":")"},{"wmode":0,"bbox":{"x":205,"y":64,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":205,"y":71,"text":"2"},{"wmode":0,"bbox":{"x":208,"y":66,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":208,"y":71,"text":"/"},{"wmode":0,"bbox":{"x":212,"y":64,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":212,"y":71,"text":"3"},{"wmode":0,"bbox":{"x":216,"y":59,"w":4,"h":37},"font":{"name":"ITXTHR+LMMathExtension10-Regula","family":"serif","weight":"normal","style":"normal","size":9},"x":216,"y":67,"text":"�"},{"wmode":0,"bbox":{"x":221,"y":65,"w":71,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":221,"y":75,"text":". This is obtained"},{"wmode":0,"bbox":{"x":53,"y":75,"w":211,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":85,"text":"by tuning many parameters, including the degree of"},{"wmode":0,"bbox":{"x":265,"y":79,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":265,"y":85,"text":" f"},{"wmode":0,"bbox":{"x":274,"y":75,"w":18,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":274,"y":85,"text":", the"},{"wmode":0,"bbox":{"x":53,"y":86,"w":104,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":96,"text":"sieving region parameter"},{"wmode":0,"bbox":{"x":158,"y":89,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":158,"y":96,"text":" I"},{"wmode":0,"bbox":{"x":168,"y":86,"w":124,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":168,"y":96,"text":", and, most importantly, the"},{"wmode":0,"bbox":{"x":53,"y":96,"w":74,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":106,"text":"smoothness bound"},{"wmode":0,"bbox":{"x":128,"y":99,"w":10,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":128,"y":106,"text":" B"},{"wmode":0,"bbox":{"x":138,"y":96,"w":153,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":138,"y":106,"text":". Early articles (e.g. [21]) encountered"},{"wmode":0,"bbox":{"x":53,"y":107,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":117,"text":"technical difficulties with descent and reported that the com-"},{"wmode":0,"bbox":{"x":53,"y":117,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":127,"text":"plexity of this step would equal that of the precomputation;"},{"wmode":0,"bbox":{"x":53,"y":127,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":138,"text":"this may have contributed to misconceptions about the perfor-"},{"wmode":0,"bbox":{"x":53,"y":138,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":148,"text":"mance of the NFS for discrete logs. More recent analyses have"},{"wmode":0,"bbox":{"x":53,"y":148,"w":158,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":158,"text":"improved the complexity of descent to"},{"wmode":0,"bbox":{"x":212,"y":152,"w":9,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":212,"y":158,"text":" L"},{"wmode":0,"bbox":{"x":222,"y":155,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":222,"y":159,"text":"p"},{"wmode":0,"bbox":{"x":226,"y":148,"w":8,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":226,"y":158,"text":"(1"},{"wmode":0,"bbox":{"x":235,"y":152,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":235,"y":158,"text":"/"},{"wmode":0,"bbox":{"x":239,"y":148,"w":4,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":239,"y":158,"text":"3"},{"wmode":0,"bbox":{"x":244,"y":152,"w":2,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":244,"y":158,"text":","},{"wmode":0,"bbox":{"x":246,"y":148,"w":6,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":246,"y":158,"text":" 1"},{"wmode":0,"bbox":{"x":253,"y":152,"w":2,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":253,"y":158,"text":"."},{"wmode":0,"bbox":{"x":255,"y":148,"w":17,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":255,"y":158,"text":"442)"},{"wmode":0,"bbox":{"x":273,"y":148,"w":20,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":273,"y":158,"text":" [10],"},{"wmode":0,"bbox":{"x":53,"y":159,"w":47,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":169,"text":"and later to"},{"wmode":0,"bbox":{"x":101,"y":162,"w":9,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":101,"y":169,"text":" L"},{"wmode":0,"bbox":{"x":110,"y":165,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":110,"y":170,"text":"p"},{"wmode":0,"bbox":{"x":115,"y":159,"w":8,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":115,"y":169,"text":"(1"},{"wmode":0,"bbox":{"x":123,"y":162,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":123,"y":169,"text":"/"},{"wmode":0,"bbox":{"x":128,"y":159,"w":4,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":128,"y":169,"text":"3"},{"wmode":0,"bbox":{"x":132,"y":162,"w":2,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":132,"y":169,"text":","},{"wmode":0,"bbox":{"x":135,"y":159,"w":6,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":135,"y":169,"text":" 1"},{"wmode":0,"bbox":{"x":141,"y":162,"w":2,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":141,"y":169,"text":"."},{"wmode":0,"bbox":{"x":144,"y":159,"w":17,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":144,"y":169,"text":"232)"},{"wmode":0,"bbox":{"x":161,"y":159,"w":131,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":161,"y":169,"text":" [2], which is much cheaper than"},{"wmode":0,"bbox":{"x":53,"y":169,"w":127,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":179,"text":"the precomputation in practice."},{"wmode":0,"bbox":{"x":62,"y":180,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":190,"text":"The numerous parameters of the algorithm allow some"},{"wmode":0,"bbox":{"x":53,"y":190,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":200,"text":"flexibility to reduce time on some computational steps at the"},{"wmode":0,"bbox":{"x":53,"y":201,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":211,"text":"expense of others. For example, sieving more will result in"},{"wmode":0,"bbox":{"x":53,"y":211,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":221,"text":"a smaller matrix, making linear algebra cheaper, and doing"},{"wmode":0,"bbox":{"x":53,"y":222,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":232,"text":"more work in the precomputation makes the final descent"},{"wmode":0,"bbox":{"x":53,"y":232,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":242,"text":"step easier. In §3.3, we show how exploiting these tradeoffs"},{"wmode":0,"bbox":{"x":53,"y":243,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":253,"text":"allows us to quickly compute 512-bit discrete logs in order"},{"wmode":0,"bbox":{"x":53,"y":253,"w":232,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":263,"text":"to perform an effective man-in-the-middle attack on TLS."}]},{"type":"text","bbox":{"x":52,"y":267,"w":241,"h":138},"lines":[{"wmode":0,"bbox":{"x":53,"y":267,"w":138,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":53,"y":277,"text":"Improperly generated groups"},{"wmode":0,"bbox":{"x":205,"y":267,"w":87,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":205,"y":277,"text":"A different family of"},{"wmode":0,"bbox":{"x":53,"y":277,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":287,"text":"algorithms runs in time exponential in group order, and they"},{"wmode":0,"bbox":{"x":53,"y":288,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":298,"text":"are practical even for large primes when the group order is"},{"wmode":0,"bbox":{"x":53,"y":298,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":308,"text":"small or has many small prime factors. To avoid this, most"},{"wmode":0,"bbox":{"x":53,"y":309,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":319,"text":"implementations use “safe” primes, which have the property"},{"wmode":0,"bbox":{"x":53,"y":319,"w":17,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":329,"text":"that"},{"wmode":0,"bbox":{"x":70,"y":323,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":70,"y":329,"text":" p"},{"wmode":0,"bbox":{"x":78,"y":322,"w":9,"h":15},"font":{"name":"BIPZIA+LMMathSymbols9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":78,"y":329,"text":" −"},{"wmode":0,"bbox":{"x":87,"y":319,"w":23,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":87,"y":329,"text":" 1 = 2"},{"wmode":0,"bbox":{"x":111,"y":323,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":111,"y":329,"text":"q"},{"wmode":0,"bbox":{"x":115,"y":319,"w":64,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":115,"y":329,"text":" for some prime"},{"wmode":0,"bbox":{"x":179,"y":323,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":179,"y":329,"text":" q"},{"wmode":0,"bbox":{"x":187,"y":319,"w":105,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":187,"y":329,"text":", so that the only possible"},{"wmode":0,"bbox":{"x":53,"y":330,"w":88,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":340,"text":"subgroups have order"},{"wmode":0,"bbox":{"x":141,"y":330,"w":8,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":141,"y":340,"text":" 2"},{"wmode":0,"bbox":{"x":149,"y":330,"w":2,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":149,"y":340,"text":","},{"wmode":0,"bbox":{"x":152,"y":333,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":152,"y":340,"text":" q"},{"wmode":0,"bbox":{"x":160,"y":330,"w":14,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":160,"y":340,"text":", or"},{"wmode":0,"bbox":{"x":174,"y":330,"w":8,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":174,"y":340,"text":" 2"},{"wmode":0,"bbox":{"x":182,"y":333,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":182,"y":340,"text":"q"},{"wmode":0,"bbox":{"x":187,"y":330,"w":105,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":187,"y":340,"text":". However, as we show in"},{"wmode":0,"bbox":{"x":53,"y":340,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":350,"text":"§3.5, improperly generated groups are sometimes used in"},{"wmode":0,"bbox":{"x":53,"y":351,"w":138,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":361,"text":"practice and susceptible to attack."},{"wmode":0,"bbox":{"x":62,"y":361,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":371,"text":"The baby-step giant-step [45] and Pollard rho [42] algo-"},{"wmode":0,"bbox":{"x":53,"y":372,"w":68,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":382,"text":"rithms both take"},{"wmode":0,"bbox":{"x":122,"y":369,"w":10,"h":21},"font":{"name":"BIPZIA+LMMathSymbols9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":122,"y":382,"text":" √"},{"wmode":0,"bbox":{"x":133,"y":375,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":133,"y":382,"text":"q"},{"wmode":0,"bbox":{"x":137,"y":372,"w":155,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":137,"y":382,"text":" time to compute a discrete log in any"},{"wmode":0,"bbox":{"x":52,"y":382,"w":81,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":52,"y":392,"text":"(sub)group of order"},{"wmode":0,"bbox":{"x":134,"y":385,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":134,"y":392,"text":" q"},{"wmode":0,"bbox":{"x":142,"y":382,"w":150,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":142,"y":392,"text":", while Pollard lambda [42] can find"},{"wmode":0,"bbox":{"x":53,"y":396,"w":21,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":53,"y":403,"text":"x < t"},{"wmode":0,"bbox":{"x":75,"y":392,"w":32,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":75,"y":403,"text":" in time"},{"wmode":0,"bbox":{"x":112,"y":388,"w":7,"h":15},"font":{"name":"BIPZIA+LMMathSymbols9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":112,"y":395,"text":"√"}]},{"type":"text","bbox":{"x":53,"y":392,"w":240,"h":102},"lines":[{"wmode":0,"bbox":{"x":119,"y":396,"w":3,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":119,"y":403,"text":"t"},{"wmode":0,"bbox":{"x":123,"y":392,"w":171,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":123,"y":403,"text":". These parallelize well [50], and precom-"},{"wmode":0,"bbox":{"x":53,"y":403,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":413,"text":"putation can speed up individual log calculations. If the"},{"wmode":0,"bbox":{"x":53,"y":413,"w":148,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":423,"text":"factorization of the subgroup order"},{"wmode":0,"bbox":{"x":202,"y":417,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":202,"y":423,"text":" q"},{"wmode":0,"bbox":{"x":210,"y":413,"w":81,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":210,"y":423,"text":" is known, one can"},{"wmode":0,"bbox":{"x":53,"y":424,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":434,"text":"use any of the above algorithms to compute the discrete"},{"wmode":0,"bbox":{"x":53,"y":434,"w":122,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":444,"text":"log in each subgroup of order"},{"wmode":0,"bbox":{"x":176,"y":438,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":176,"y":444,"text":" q"},{"wmode":0,"bbox":{"x":184,"y":436,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":184,"y":440,"text":"e"},{"wmode":0,"bbox":{"x":184,"y":431,"w":6,"h":18},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":184,"y":447,"text":"i i"},{"wmode":0,"bbox":{"x":195,"y":434,"w":33,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":195,"y":444,"text":"dividing"},{"wmode":0,"bbox":{"x":228,"y":438,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":228,"y":444,"text":" q"},{"wmode":0,"bbox":{"x":236,"y":434,"w":57,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":236,"y":444,"text":", and then re-"},{"wmode":0,"bbox":{"x":53,"y":445,"w":21,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":455,"text":"cover"},{"wmode":0,"bbox":{"x":74,"y":448,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":74,"y":455,"text":" x"},{"wmode":0,"bbox":{"x":83,"y":445,"w":209,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":83,"y":455,"text":" using the Chinese remainder theorem. This is the"},{"wmode":0,"bbox":{"x":53,"y":455,"w":174,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":465,"text":"Pohlig-Hellman algorithm [41], which costs"},{"wmode":0,"bbox":{"x":227,"y":450,"w":13,"h":44},"font":{"name":"ITXTHR+LMMathExtension10-Regula","family":"serif","weight":"normal","style":"normal","size":9},"x":227,"y":465,"text":" �"}]},{"type":"text","bbox":{"x":53,"y":453,"w":239,"h":25},"lines":[{"wmode":0,"bbox":{"x":241,"y":464,"w":2,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":241,"y":469,"text":"i"},{"wmode":0,"bbox":{"x":244,"y":459,"w":6,"h":12},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":244,"y":469,"text":" e"},{"wmode":0,"bbox":{"x":250,"y":462,"w":2,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":250,"y":466,"text":"i"},{"wmode":0,"bbox":{"x":253,"y":453,"w":7,"h":15},"font":{"name":"BIPZIA+LMMathSymbols9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":253,"y":460,"text":"√"},{"wmode":0,"bbox":{"x":261,"y":459,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":261,"y":465,"text":"q"},{"wmode":0,"bbox":{"x":265,"y":462,"w":2,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":265,"y":466,"text":"i"},{"wmode":0,"bbox":{"x":268,"y":455,"w":24,"h":13},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":268,"y":466,"text":" using"},{"wmode":0,"bbox":{"x":53,"y":466,"w":144,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":476,"text":"baby-step giant-step or Pollard rho."}]},{"type":"text","bbox":{"x":52,"y":480,"w":242,"h":148},"lines":[{"wmode":0,"bbox":{"x":53,"y":480,"w":76,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":53,"y":490,"text":"Standard primes"},{"wmode":0,"bbox":{"x":141,"y":480,"w":152,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":141,"y":490,"text":"Generating primes with special proper-"},{"wmode":0,"bbox":{"x":53,"y":490,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":500,"text":"ties can be computationally burdensome, so many implemen-"},{"wmode":0,"bbox":{"x":53,"y":501,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":511,"text":"tations use fixed or standardized Diffie-Hellman parameters."},{"wmode":0,"bbox":{"x":53,"y":511,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":521,"text":"A prominent example is the Oakley groups [40], which give"},{"wmode":0,"bbox":{"x":52,"y":521,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":52,"y":532,"text":"“safe” primes of length 768 (Oakley Group 1), 1024 (Oakley"},{"wmode":0,"bbox":{"x":53,"y":532,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":542,"text":"Group 2), and 1536 (Oakley Group 5). These groups were"},{"wmode":0,"bbox":{"x":53,"y":542,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":552,"text":"published in 1998 and have been used for many applications"},{"wmode":0,"bbox":{"x":53,"y":553,"w":171,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":563,"text":"since, including IKE, SSH, Tor, and OTR."},{"wmode":0,"bbox":{"x":62,"y":563,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":573,"text":"When primes are of sufficient strength, there seems to be"},{"wmode":0,"bbox":{"x":53,"y":574,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":584,"text":"no disadvantage to reusing them. However, widespread reuse"},{"wmode":0,"bbox":{"x":53,"y":584,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":594,"text":"of Diffie-Hellman groups can convert attacks that are at the"},{"wmode":0,"bbox":{"x":53,"y":595,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":605,"text":"limits of an adversary’s capabilities into devastating breaks,"},{"wmode":0,"bbox":{"x":53,"y":605,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":615,"text":"since it allows the attacker to amortize the cost of discrete"},{"wmode":0,"bbox":{"x":53,"y":616,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":626,"text":"log precomputation among vast numbers of potential targets."}]},{"type":"text","bbox":{"x":52,"y":640,"w":242,"h":79},"lines":[{"wmode":0,"bbox":{"x":53,"y":640,"w":8,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":53,"y":652,"text":"3."},{"wmode":0,"bbox":{"x":74,"y":640,"w":96,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":74,"y":652,"text":"ATTACKING TLS"},{"wmode":0,"bbox":{"x":62,"y":654,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":665,"text":"TLS supports Diffie-Hellman as one of several possible"},{"wmode":0,"bbox":{"x":53,"y":665,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":675,"text":"key exchange methods, and about two-thirds of popular"},{"wmode":0,"bbox":{"x":53,"y":675,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":685,"text":"HTTPS sites allow it, most commonly using 1024-bit primes."},{"wmode":0,"bbox":{"x":53,"y":686,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":696,"text":"However, a smaller number of servers also support legacy"},{"wmode":0,"bbox":{"x":52,"y":696,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":52,"y":706,"text":"“export-grade” Diffie-Hellman using 512-bit primes that are"},{"wmode":0,"bbox":{"x":53,"y":707,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":717,"text":"well within reach of NFS-based cryptanalysis. Furthermore,"}]},{"type":"text","bbox":{"x":322,"y":54,"w":114,"h":11},"lines":[{"wmode":0,"bbox":{"x":322,"y":54,"w":24,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":322,"y":63,"text":"Source"},{"wmode":0,"bbox":{"x":364,"y":54,"w":38,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":364,"y":63,"text":"Popularity"},{"wmode":0,"bbox":{"x":414,"y":54,"w":22,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":414,"y":63,"text":"Prime"}]},{"type":"text","bbox":{"x":322,"y":67,"w":227,"h":38},"lines":[{"wmode":0,"bbox":{"x":322,"y":67,"w":27,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":322,"y":76,"text":"Apache"},{"wmode":0,"bbox":{"x":364,"y":67,"w":15,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":364,"y":76,"text":"82%"},{"wmode":0,"bbox":{"x":414,"y":68,"w":135,"h":10},"font":{"name":"XYNSKK+LMMono8-Regular","family":"monospace","weight":"normal","style":"normal","size":7},"x":414,"y":76,"text":"9fdb8b8a004544f0045f1737d0ba2e0b"},{"wmode":0,"bbox":{"x":414,"y":77,"w":135,"h":10},"font":{"name":"XYNSKK+LMMono8-Regular","family":"monospace","weight":"normal","style":"normal","size":7},"x":414,"y":85,"text":"274cdf1a9f588218fb435316a16e3741"},{"wmode":0,"bbox":{"x":414,"y":86,"w":135,"h":10},"font":{"name":"XYNSKK+LMMono8-Regular","family":"monospace","weight":"normal","style":"normal","size":7},"x":414,"y":94,"text":"71fd19d8d8f37c39bf863fd60e3e3006"},{"wmode":0,"bbox":{"x":414,"y":95,"w":135,"h":10},"font":{"name":"XYNSKK+LMMono8-Regular","family":"monospace","weight":"normal","style":"normal","size":7},"x":414,"y":103,"text":"80a3030c6e4c3757d08f70e6aa871033"}]},{"type":"text","bbox":{"x":322,"y":106,"w":227,"h":38},"lines":[{"wmode":0,"bbox":{"x":322,"y":106,"w":31,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":322,"y":115,"text":"mod_ssl"},{"wmode":0,"bbox":{"x":364,"y":106,"w":15,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":364,"y":115,"text":"10%"},{"wmode":0,"bbox":{"x":414,"y":107,"w":135,"h":10},"font":{"name":"XYNSKK+LMMono8-Regular","family":"monospace","weight":"normal","style":"normal","size":7},"x":414,"y":115,"text":"d4bcd52406f69b35994b88de5db89682"},{"wmode":0,"bbox":{"x":414,"y":116,"w":135,"h":10},"font":{"name":"XYNSKK+LMMono8-Regular","family":"monospace","weight":"normal","style":"normal","size":7},"x":414,"y":124,"text":"c8157f62d8f33633ee5772f11f05ab22"},{"wmode":0,"bbox":{"x":414,"y":125,"w":135,"h":10},"font":{"name":"XYNSKK+LMMono8-Regular","family":"monospace","weight":"normal","style":"normal","size":7},"x":414,"y":133,"text":"d6b5145b9f241e5acc31ff090a4bc711"},{"wmode":0,"bbox":{"x":414,"y":134,"w":135,"h":10},"font":{"name":"XYNSKK+LMMono8-Regular","family":"monospace","weight":"normal","style":"normal","size":7},"x":414,"y":142,"text":"48976f76795094e71e7903529f5a824b"}]},{"type":"text","bbox":{"x":322,"y":145,"w":169,"h":11},"lines":[{"wmode":0,"bbox":{"x":322,"y":145,"w":3,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":322,"y":154,"text":"("},{"wmode":0,"bbox":{"x":325,"y":145,"w":22,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":325,"y":154,"text":"others"},{"wmode":0,"bbox":{"x":348,"y":145,"w":3,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":348,"y":154,"text":")"},{"wmode":0,"bbox":{"x":367,"y":145,"w":11,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":367,"y":154,"text":"8%"},{"wmode":0,"bbox":{"x":414,"y":145,"w":77,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":414,"y":154,"text":"(463 distinct primes)"}]},{"type":"text","bbox":{"x":316,"y":164,"w":239,"h":33},"lines":[{"wmode":0,"bbox":{"x":316,"y":164,"w":31,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":174,"text":"Table 1:"},{"wmode":0,"bbox":{"x":347,"y":164,"w":150,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":347,"y":174,"text":" Top 512-bit DH primes for TLS."},{"wmode":0,"bbox":{"x":498,"y":164,"w":57,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":498,"y":174,"text":" 8.4% of Alexa"},{"wmode":0,"bbox":{"x":316,"y":175,"w":134,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":185,"text":"Top 1M HTTPS domains allow"},{"wmode":0,"bbox":{"x":450,"y":176,"w":62,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":450,"y":185,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":513,"y":175,"w":42,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":513,"y":185,"text":", of which"},{"wmode":0,"bbox":{"x":316,"y":185,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":195,"text":"92.3% use one of the two most popular primes, shown here."}]},{"type":"text","bbox":{"x":316,"y":216,"w":240,"h":148},"lines":[{"wmode":0,"bbox":{"x":316,"y":216,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":226,"text":"for both normal and export-grade Diffie-Hellman, the vast"},{"wmode":0,"bbox":{"x":316,"y":226,"w":211,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":237,"text":"majority of servers use a handful of common groups."},{"wmode":0,"bbox":{"x":325,"y":237,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":247,"text":"In this section, we exploit these facts to construct a novel"},{"wmode":0,"bbox":{"x":316,"y":247,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":257,"text":"attack against TLS, which we call the Logjam attack. First,"},{"wmode":0,"bbox":{"x":316,"y":258,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":268,"text":"we perform NFS precomputations for the two most popular"},{"wmode":0,"bbox":{"x":316,"y":268,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":278,"text":"512-bit primes on the web, so that we can quickly compute"},{"wmode":0,"bbox":{"x":316,"y":279,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":289,"text":"the discrete log for any key-exchange message that uses one"},{"wmode":0,"bbox":{"x":316,"y":289,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":299,"text":"of them. Next, we show how a man-in-the-middle, so armed,"},{"wmode":0,"bbox":{"x":316,"y":300,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":310,"text":"can attack connections between popular browsers and any"},{"wmode":0,"bbox":{"x":316,"y":310,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":320,"text":"server that allows export-grade Diffie-Hellman, by using a"},{"wmode":0,"bbox":{"x":316,"y":321,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":331,"text":"TLS protocol flaw to downgrade the connection to export-"},{"wmode":0,"bbox":{"x":316,"y":331,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":341,"text":"strength and then recovering the session key. We find that"},{"wmode":0,"bbox":{"x":316,"y":341,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":352,"text":"this attack with our precomputations can compromise about"},{"wmode":0,"bbox":{"x":316,"y":352,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":362,"text":"7.8% of HTTPS servers among Alexa Top Million domains."}]},{"type":"text","bbox":{"x":316,"y":369,"w":241,"h":299},"lines":[{"wmode":0,"bbox":{"x":316,"y":369,"w":14,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":316,"y":380,"text":"3.1"},{"wmode":0,"bbox":{"x":343,"y":369,"w":123,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":343,"y":380,"text":"TLS and Diffie-Hellman"},{"wmode":0,"bbox":{"x":325,"y":383,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":393,"text":"The TLS handshake begins with a negotiation to determine"},{"wmode":0,"bbox":{"x":316,"y":394,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":404,"text":"the crypto algorithms used for the session. The client sends a"},{"wmode":0,"bbox":{"x":316,"y":404,"w":197,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":414,"text":"list of supported ciphersuites (and a random nonce"},{"wmode":0,"bbox":{"x":514,"y":408,"w":10,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":514,"y":414,"text":" cr"},{"wmode":0,"bbox":{"x":524,"y":404,"w":31,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":524,"y":414,"text":") within"},{"wmode":0,"bbox":{"x":316,"y":415,"w":12,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":425,"text":"the"},{"wmode":0,"bbox":{"x":329,"y":414,"w":43,"h":13},"font":{"name":"ECMDET+LMSans9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":329,"y":425,"text":" ClientHello"},{"wmode":0,"bbox":{"x":372,"y":415,"w":183,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":372,"y":425,"text":" message, where each ciphersuite specifies a key"},{"wmode":0,"bbox":{"x":316,"y":425,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":435,"text":"exchange algorithm and other primitives. The server selects"},{"wmode":0,"bbox":{"x":316,"y":436,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":446,"text":"a ciphersuite from the client’s list and signals its selection in"},{"wmode":0,"bbox":{"x":316,"y":446,"w":4,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":456,"text":"a"},{"wmode":0,"bbox":{"x":321,"y":446,"w":46,"h":13},"font":{"name":"ECMDET+LMSans9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":321,"y":456,"text":" ServerHello"},{"wmode":0,"bbox":{"x":368,"y":446,"w":151,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":368,"y":456,"text":" message (containing a random nonce"},{"wmode":0,"bbox":{"x":519,"y":449,"w":11,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":519,"y":456,"text":" sr"},{"wmode":0,"bbox":{"x":531,"y":446,"w":6,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":531,"y":456,"text":")."},{"wmode":0,"bbox":{"x":325,"y":456,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":467,"text":"TLS specifies ciphersuites supporting multiple varieties of"},{"wmode":0,"bbox":{"x":316,"y":467,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":477,"text":"Diffie-Hellman. Textbook Diffie-Hellman with unrestricted"},{"wmode":0,"bbox":{"x":316,"y":477,"w":198,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":488,"text":"strength is called “ephemeral” Diffie-Hellman, or"},{"wmode":0,"bbox":{"x":514,"y":478,"w":20,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":514,"y":488,"text":" DHE"},{"wmode":0,"bbox":{"x":535,"y":477,"w":20,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":535,"y":488,"text":", and"},{"wmode":0,"bbox":{"x":316,"y":488,"w":174,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":498,"text":"is identified by ciphersuites that begin with"},{"wmode":0,"bbox":{"x":491,"y":489,"w":45,"h":11},"font":{"name":"LYJWZZ+LMMono9-Regular","family":"monospace","weight":"normal","style":"normal","size":8},"x":491,"y":498,"text":" TLS_DHE_*"},{"wmode":0,"bbox":{"x":536,"y":488,"w":2,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":536,"y":498,"text":"."},{"wmode":0,"bbox":{"x":539,"y":487,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":539,"y":494,"text":"2"},{"wmode":0,"bbox":{"x":542,"y":484,"w":12,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":542,"y":494,"text":" In"},{"wmode":0,"bbox":{"x":316,"y":499,"w":16,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":508,"text":"DHE"},{"wmode":0,"bbox":{"x":333,"y":498,"w":222,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":333,"y":508,"text":", the server is responsible for selecting the Diffie-Hellman"},{"wmode":0,"bbox":{"x":316,"y":509,"w":120,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":519,"text":"parameters. It chooses a group"},{"wmode":0,"bbox":{"x":437,"y":509,"w":5,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":437,"y":519,"text":" ("},{"wmode":0,"bbox":{"x":442,"y":512,"w":13,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":442,"y":519,"text":"p, g"},{"wmode":0,"bbox":{"x":456,"y":509,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":456,"y":519,"text":")"},{"wmode":0,"bbox":{"x":459,"y":509,"w":42,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":459,"y":519,"text":", computes"},{"wmode":0,"bbox":{"x":502,"y":512,"w":6,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":502,"y":519,"text":" g"},{"wmode":0,"bbox":{"x":509,"y":511,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":509,"y":515,"text":"b"},{"wmode":0,"bbox":{"x":512,"y":509,"w":43,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":512,"y":519,"text":", and sends"},{"wmode":0,"bbox":{"x":316,"y":519,"w":4,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":529,"text":"a"},{"wmode":0,"bbox":{"x":321,"y":519,"w":76,"h":13},"font":{"name":"ECMDET+LMSans9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":321,"y":529,"text":" ServerKeyExchange"},{"wmode":0,"bbox":{"x":397,"y":519,"w":158,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":397,"y":529,"text":" message containing a signature over the"},{"wmode":0,"bbox":{"x":316,"y":530,"w":20,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":540,"text":"tuple"},{"wmode":0,"bbox":{"x":337,"y":530,"w":7,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":337,"y":540,"text":" ("},{"wmode":0,"bbox":{"x":344,"y":533,"w":46,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":344,"y":540,"text":"cr, sr, p, g, g"},{"wmode":0,"bbox":{"x":391,"y":532,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":391,"y":536,"text":"b"},{"wmode":0,"bbox":{"x":395,"y":530,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":395,"y":540,"text":")"},{"wmode":0,"bbox":{"x":398,"y":530,"w":157,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":398,"y":540,"text":" using the long-term signing key from"},{"wmode":0,"bbox":{"x":316,"y":540,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":550,"text":"its certificate. The client verifies the signature and responds"},{"wmode":0,"bbox":{"x":316,"y":551,"w":25,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":561,"text":"with a"},{"wmode":0,"bbox":{"x":342,"y":550,"w":76,"h":13},"font":{"name":"ECMDET+LMSans9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":342,"y":561,"text":" ClientKeyExchange"},{"wmode":0,"bbox":{"x":419,"y":551,"w":80,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":419,"y":561,"text":" message containing"},{"wmode":0,"bbox":{"x":499,"y":554,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":499,"y":561,"text":" g"},{"wmode":0,"bbox":{"x":507,"y":552,"w":4,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":507,"y":557,"text":"a"},{"wmode":0,"bbox":{"x":511,"y":551,"w":2,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":511,"y":561,"text":"."},{"wmode":0,"bbox":{"x":325,"y":561,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":571,"text":"To ensure agreement on the negotiation messages, and to"},{"wmode":0,"bbox":{"x":316,"y":572,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":582,"text":"prevent downgrade attacks [52], each party computes the"},{"wmode":0,"bbox":{"x":316,"y":582,"w":92,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":592,"text":"TLS master secret from"},{"wmode":0,"bbox":{"x":409,"y":585,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":409,"y":592,"text":" g"},{"wmode":0,"bbox":{"x":416,"y":584,"w":7,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":416,"y":588,"text":"ab"},{"wmode":0,"bbox":{"x":423,"y":578,"w":132,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":423,"y":588,"text":" and calculates a MAC of its view"},{"wmode":0,"bbox":{"x":316,"y":592,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":603,"text":"of the handshake transcript. These MACs are exchanged"},{"wmode":0,"bbox":{"x":316,"y":603,"w":44,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":613,"text":"in a pair of"},{"wmode":0,"bbox":{"x":361,"y":603,"w":35,"h":13},"font":{"name":"ECMDET+LMSans9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":361,"y":613,"text":" Finished"},{"wmode":0,"bbox":{"x":396,"y":603,"w":161,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":396,"y":613,"text":" messages and verified by the recipients."},{"wmode":0,"bbox":{"x":316,"y":613,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":624,"text":"Thereafter, client and server start exchanging application"},{"wmode":0,"bbox":{"x":316,"y":624,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":634,"text":"data, protected by an authenticated encryption scheme with"},{"wmode":0,"bbox":{"x":316,"y":634,"w":89,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":644,"text":"keys also derived from"},{"wmode":0,"bbox":{"x":406,"y":638,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":406,"y":644,"text":" g"},{"wmode":0,"bbox":{"x":414,"y":636,"w":7,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":414,"y":641,"text":"ab"},{"wmode":0,"bbox":{"x":422,"y":634,"w":2,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":422,"y":644,"text":"."},{"wmode":0,"bbox":{"x":325,"y":645,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":655,"text":"To comply with 1990s-era U.S. export restrictions on cryp-"},{"wmode":0,"bbox":{"x":316,"y":655,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":665,"text":"tography, SSL 3.0 and TLS 1.0 supported reduced-strength"}]},{"type":"text","bbox":{"x":316,"y":670,"w":239,"h":49},"lines":[{"wmode":0,"bbox":{"x":317,"y":670,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":317,"y":677,"text":"2"},{"wmode":0,"bbox":{"x":321,"y":671,"w":234,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":321,"y":681,"text":"TLS also supports a rarely used “static” Diffie-Hellman"},{"wmode":0,"bbox":{"x":316,"y":680,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":690,"text":"format, where the server’s key exchange value is fixed and"},{"wmode":0,"bbox":{"x":316,"y":689,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":699,"text":"contained in its certificate. New ciphersuites that use elliptic"},{"wmode":0,"bbox":{"x":316,"y":698,"w":88,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":708,"text":"curve Diffie-Hellman ("},{"wmode":0,"bbox":{"x":404,"y":699,"w":27,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":404,"y":708,"text":"ECDHE"},{"wmode":0,"bbox":{"x":432,"y":698,"w":124,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":432,"y":708,"text":") are gaining in popularity, but"},{"wmode":0,"bbox":{"x":316,"y":707,"w":232,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":717,"text":"we focus exclusively on the traditional prime field variety."}]},{"type":"text","bbox":{"x":302,"y":737,"w":4,"h":12},"lines":[{"wmode":0,"bbox":{"x":302,"y":737,"w":4,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":302,"y":747,"text":"3"}]}]},{"blocks":[{"type":"text","bbox":{"x":53,"y":204,"w":240,"h":75},"lines":[{"wmode":0,"bbox":{"x":53,"y":204,"w":36,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":214,"text":"Figure 2:"},{"wmode":0,"bbox":{"x":90,"y":204,"w":95,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":90,"y":214,"text":" The Logjam attack."},{"wmode":0,"bbox":{"x":185,"y":204,"w":106,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":185,"y":214,"text":" A man-in-the-middle can"},{"wmode":0,"bbox":{"x":53,"y":214,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":224,"text":"force TLS clients to use export-strength DH with any server"},{"wmode":0,"bbox":{"x":53,"y":225,"w":44,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":235,"text":"that allows"},{"wmode":0,"bbox":{"x":98,"y":225,"w":59,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":98,"y":235,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":157,"y":225,"w":136,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":157,"y":235,"text":". Then, by finding the 512-bit dis-"},{"wmode":0,"bbox":{"x":53,"y":235,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":245,"text":"crete log, the attacker can learn the session key and arbitrarily"},{"wmode":0,"bbox":{"x":53,"y":245,"w":111,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":256,"text":"read or modify the contents."},{"wmode":0,"bbox":{"x":164,"y":246,"w":22,"h":11},"font":{"name":"LYJWZZ+LMMono9-Regular","family":"monospace","weight":"normal","style":"normal","size":8},"x":164,"y":256,"text":" Data"},{"wmode":0,"bbox":{"x":187,"y":247,"w":7,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":187,"y":252,"text":"fs"},{"wmode":0,"bbox":{"x":195,"y":242,"w":97,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":195,"y":252,"text":" refers to False Start [30]"},{"wmode":0,"bbox":{"x":53,"y":256,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":266,"text":"application data that some TLS clients send before receiving"},{"wmode":0,"bbox":{"x":53,"y":266,"w":45,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":276,"text":"the server’s"},{"wmode":0,"bbox":{"x":99,"y":266,"w":34,"h":13},"font":{"name":"ECMDET+LMSans9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":99,"y":276,"text":" Finished"},{"wmode":0,"bbox":{"x":134,"y":266,"w":37,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":134,"y":276,"text":" message."}]},{"type":"text","bbox":{"x":53,"y":298,"w":241,"h":357},"lines":[{"wmode":0,"bbox":{"x":53,"y":299,"w":55,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":308,"text":"DHE_EXPORT"},{"wmode":0,"bbox":{"x":109,"y":298,"w":183,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":109,"y":308,"text":" ciphersuites that were restricted to primes no"},{"wmode":0,"bbox":{"x":53,"y":309,"w":178,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":319,"text":"longer than 512 bits. In all other respects,"},{"wmode":0,"bbox":{"x":231,"y":309,"w":61,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":231,"y":319,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":53,"y":319,"w":134,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":329,"text":"protocol messages are identical to"},{"wmode":0,"bbox":{"x":188,"y":320,"w":20,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":188,"y":329,"text":" DHE"},{"wmode":0,"bbox":{"x":208,"y":319,"w":84,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":208,"y":329,"text":". The relevant export"},{"wmode":0,"bbox":{"x":53,"y":329,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":340,"text":"restrictions are no longer in effect, but many libraries and"},{"wmode":0,"bbox":{"x":53,"y":340,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":350,"text":"servers maintain support for backwards compatibility. Many"},{"wmode":0,"bbox":{"x":53,"y":350,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":360,"text":"TLS servers are still configured with two groups: a strong"},{"wmode":0,"bbox":{"x":53,"y":361,"w":103,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":371,"text":"1024-bit group for regular"},{"wmode":0,"bbox":{"x":157,"y":362,"w":20,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":157,"y":371,"text":" DHE"},{"wmode":0,"bbox":{"x":177,"y":361,"w":115,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":177,"y":371,"text":" key exchanges and a 512-bit"},{"wmode":0,"bbox":{"x":53,"y":371,"w":67,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":381,"text":"group for legacy"},{"wmode":0,"bbox":{"x":120,"y":372,"w":61,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":120,"y":381,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":182,"y":371,"w":110,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":182,"y":381,"text":". This has been considered"},{"wmode":0,"bbox":{"x":53,"y":382,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":392,"text":"safe because most modern TLS clients do not offer or accept"},{"wmode":0,"bbox":{"x":53,"y":393,"w":56,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":402,"text":"DHE_EXPORT"},{"wmode":0,"bbox":{"x":110,"y":392,"w":52,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":110,"y":402,"text":" ciphersuites."},{"wmode":0,"bbox":{"x":62,"y":403,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":413,"text":"To understand how HTTPS servers in the wild use Diffie-"},{"wmode":0,"bbox":{"x":53,"y":413,"w":218,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":423,"text":"Hellman, we modified the ZMap [15] toolchain to offer"},{"wmode":0,"bbox":{"x":272,"y":414,"w":20,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":272,"y":423,"text":" DHE"},{"wmode":0,"bbox":{"x":53,"y":424,"w":15,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":434,"text":"and"},{"wmode":0,"bbox":{"x":68,"y":425,"w":61,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":68,"y":434,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":130,"y":424,"w":162,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":130,"y":434,"text":" ciphersuites and scanned TCP/443 on"},{"wmode":0,"bbox":{"x":53,"y":434,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":444,"text":"both the full public IPv4 address space and the Alexa"},{"wmode":0,"bbox":{"x":53,"y":445,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":455,"text":"Top 1M domains. The scans took place in March 2015. Of"},{"wmode":0,"bbox":{"x":53,"y":455,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":465,"text":"539,000 HTTPS sites among Top 1M domains, we found that"},{"wmode":0,"bbox":{"x":53,"y":465,"w":69,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":476,"text":"68.3% supported"},{"wmode":0,"bbox":{"x":122,"y":466,"w":21,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":122,"y":476,"text":" DHE"},{"wmode":0,"bbox":{"x":144,"y":465,"w":86,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":144,"y":476,"text":" and 8.4% supported"},{"wmode":0,"bbox":{"x":230,"y":466,"w":61,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":230,"y":476,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":292,"y":465,"w":2,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":292,"y":476,"text":"."},{"wmode":0,"bbox":{"x":53,"y":476,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":486,"text":"Of 14.3 million IPv4 HTTPS servers with browser-trusted"},{"wmode":0,"bbox":{"x":53,"y":486,"w":116,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":496,"text":"certificates, 23.9% supported"},{"wmode":0,"bbox":{"x":169,"y":487,"w":20,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":169,"y":496,"text":" DHE"},{"wmode":0,"bbox":{"x":190,"y":486,"w":40,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":190,"y":496,"text":" and 4.9%"},{"wmode":0,"bbox":{"x":230,"y":487,"w":59,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":230,"y":496,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":290,"y":486,"w":2,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":290,"y":496,"text":"."},{"wmode":0,"bbox":{"x":62,"y":497,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":507,"text":"While the TLS protocol allows servers to generate their own"},{"wmode":0,"bbox":{"x":53,"y":507,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":517,"text":"Diffie-Hellman parameters, the overwhelming majority use"},{"wmode":0,"bbox":{"x":53,"y":518,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":528,"text":"one of a handful of primes. As shown in Table 1, just two 512-"},{"wmode":0,"bbox":{"x":53,"y":528,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":538,"text":"bit primes account for 92.3% of Alexa Top 1M domains that"},{"wmode":0,"bbox":{"x":53,"y":539,"w":30,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":549,"text":"support"},{"wmode":0,"bbox":{"x":84,"y":540,"w":57,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":84,"y":549,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":142,"y":539,"w":152,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":142,"y":549,"text":", and 92.5% of all servers with browser-"},{"wmode":0,"bbox":{"x":53,"y":549,"w":126,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":559,"text":"trusted certificates that support"},{"wmode":0,"bbox":{"x":180,"y":550,"w":58,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":180,"y":559,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":239,"y":549,"w":54,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":239,"y":559,"text":". (Non-export"},{"wmode":0,"bbox":{"x":53,"y":561,"w":17,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":570,"text":"DHE"},{"wmode":0,"bbox":{"x":70,"y":560,"w":222,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":70,"y":570,"text":" follows a similar distribution with longer primes.) The"},{"wmode":0,"bbox":{"x":53,"y":570,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":580,"text":"most popular 512-bit prime was hard-coded into many ver-"},{"wmode":0,"bbox":{"x":53,"y":581,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":591,"text":"sions of Apache. Introduced in 2005 with Apache 2.1.5, it"},{"wmode":0,"bbox":{"x":53,"y":591,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":601,"text":"was used until 2.4.7, which disabled export ciphersuites. We"},{"wmode":0,"bbox":{"x":53,"y":601,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":612,"text":"found it in use by about 564,000 servers with browser-trusted"},{"wmode":0,"bbox":{"x":53,"y":612,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":622,"text":"certificates. The second most popular 512-bit prime is the"},{"wmode":0,"bbox":{"x":53,"y":622,"w":63,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":632,"text":"default used for"},{"wmode":0,"bbox":{"x":117,"y":623,"w":59,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":117,"y":632,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":176,"y":622,"w":48,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":176,"y":632,"text":" when using"},{"wmode":0,"bbox":{"x":225,"y":623,"w":36,"h":11},"font":{"name":"LYJWZZ+LMMono9-Regular","family":"monospace","weight":"normal","style":"normal","size":8},"x":225,"y":632,"text":" mod_ssl"},{"wmode":0,"bbox":{"x":261,"y":622,"w":31,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":261,"y":632,"text":". It was"},{"wmode":0,"bbox":{"x":53,"y":633,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":643,"text":"introduced in version 2.3.0 in 1999. We found it in use by"},{"wmode":0,"bbox":{"x":53,"y":643,"w":217,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":653,"text":"about 89,000 servers with browser-trusted certificates."}]},{"type":"text","bbox":{"x":53,"y":661,"w":239,"h":58},"lines":[{"wmode":0,"bbox":{"x":53,"y":661,"w":14,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":53,"y":672,"text":"3.2"},{"wmode":0,"bbox":{"x":80,"y":661,"w":211,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":80,"y":672,"text":"Active Downgrade to Export-Grade DHE"},{"wmode":0,"bbox":{"x":62,"y":675,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":685,"text":"Given the widespread use of these primes, an attacker with"},{"wmode":0,"bbox":{"x":53,"y":686,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":696,"text":"the ability to compute discrete logs in 512-bit groups could"},{"wmode":0,"bbox":{"x":53,"y":696,"w":63,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":706,"text":"efficiently break"},{"wmode":0,"bbox":{"x":117,"y":697,"w":59,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":117,"y":706,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":177,"y":696,"w":115,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":177,"y":706,"text":" handshakes for about 8% of"},{"wmode":0,"bbox":{"x":53,"y":707,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":717,"text":"Alexa Top 1M HTTPS sites, but modern browsers never"}]},{"type":"text","bbox":{"x":316,"y":53,"w":240,"h":347},"lines":[{"wmode":0,"bbox":{"x":316,"y":53,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":63,"text":"negotiate export-grade ciphersuites. To circumvent this, we"},{"wmode":0,"bbox":{"x":316,"y":64,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":74,"text":"show how an attacker who can compute 512-bit discrete"},{"wmode":0,"bbox":{"x":316,"y":74,"w":15,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":84,"text":"logs"},{"wmode":0,"bbox":{"x":332,"y":74,"w":50,"h":12},"font":{"name":"DEEZDF+LMRoman9-Italic","family":"serif","weight":"normal","style":"italic","size":9},"x":332,"y":84,"text":" in real time"},{"wmode":0,"bbox":{"x":383,"y":74,"w":104,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":383,"y":84,"text":" can downgrade a regular"},{"wmode":0,"bbox":{"x":488,"y":75,"w":20,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":488,"y":84,"text":" DHE"},{"wmode":0,"bbox":{"x":508,"y":74,"w":47,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":508,"y":84,"text":" connection"},{"wmode":0,"bbox":{"x":316,"y":85,"w":32,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":95,"text":"to use a"},{"wmode":0,"bbox":{"x":349,"y":85,"w":60,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":349,"y":95,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":410,"y":85,"w":145,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":410,"y":95,"text":" group, and thereby break both the"},{"wmode":0,"bbox":{"x":316,"y":95,"w":193,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":105,"text":"confidentiality and integrity of application data."},{"wmode":0,"bbox":{"x":325,"y":105,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":116,"text":"The attack, which we call Logjam, is depicted in Figure 2"},{"wmode":0,"bbox":{"x":316,"y":116,"w":198,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":126,"text":"and relies on a flaw in the way TLS composes"},{"wmode":0,"bbox":{"x":514,"y":117,"w":21,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":514,"y":126,"text":" DHE"},{"wmode":0,"bbox":{"x":536,"y":116,"w":19,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":536,"y":126,"text":" and"},{"wmode":0,"bbox":{"x":316,"y":127,"w":57,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":136,"text":"DHE_EXPORT"},{"wmode":0,"bbox":{"x":374,"y":126,"w":96,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":374,"y":136,"text":". When a server selects"},{"wmode":0,"bbox":{"x":471,"y":127,"w":61,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":471,"y":136,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":532,"y":126,"w":23,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":532,"y":136,"text":" for a"},{"wmode":0,"bbox":{"x":316,"y":137,"w":163,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":147,"text":"handshake, it proceeds by issuing a signed"},{"wmode":0,"bbox":{"x":479,"y":137,"w":75,"h":13},"font":{"name":"ECMDET+LMSans9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":479,"y":147,"text":" ServerKeyExchange"},{"wmode":0,"bbox":{"x":316,"y":147,"w":116,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":157,"text":"message containing a 512-bit"},{"wmode":0,"bbox":{"x":433,"y":151,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":433,"y":157,"text":" p"},{"wmode":0,"bbox":{"x":440,"y":152,"w":10,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":440,"y":158,"text":"512"},{"wmode":0,"bbox":{"x":452,"y":147,"w":103,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":452,"y":157,"text":", but the structure of this"},{"wmode":0,"bbox":{"x":316,"y":158,"w":219,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":168,"text":"message is identical to the message sent during standard"},{"wmode":0,"bbox":{"x":536,"y":159,"w":19,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":536,"y":168,"text":" DHE"},{"wmode":0,"bbox":{"x":316,"y":168,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":178,"text":"ciphersuites. Critically, the signed portion of the server’s"},{"wmode":0,"bbox":{"x":316,"y":179,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":189,"text":"message fails to include any indication of the specific cipher-"},{"wmode":0,"bbox":{"x":316,"y":189,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":199,"text":"suite that the server has chosen. Provided that a client offers"},{"wmode":0,"bbox":{"x":316,"y":201,"w":16,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":210,"text":"DHE"},{"wmode":0,"bbox":{"x":333,"y":200,"w":167,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":333,"y":210,"text":", an active attacker can rewrite the client’s"},{"wmode":0,"bbox":{"x":501,"y":199,"w":43,"h":13},"font":{"name":"ECMDET+LMSans9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":501,"y":210,"text":" ClientHello"},{"wmode":0,"bbox":{"x":545,"y":200,"w":10,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":545,"y":210,"text":" to"},{"wmode":0,"bbox":{"x":316,"y":210,"w":83,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":220,"text":"offer a corresponding"},{"wmode":0,"bbox":{"x":400,"y":211,"w":59,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":400,"y":220,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":459,"y":210,"w":96,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":459,"y":220,"text":" ciphersuite accepted by"},{"wmode":0,"bbox":{"x":316,"y":221,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":231,"text":"the server and remove other ciphersuites that could be chosen"},{"wmode":0,"bbox":{"x":316,"y":231,"w":141,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":241,"text":"instead. The attacker rewrites the"},{"wmode":0,"bbox":{"x":458,"y":231,"w":47,"h":13},"font":{"name":"ECMDET+LMSans9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":458,"y":241,"text":" ServerHello"},{"wmode":0,"bbox":{"x":506,"y":231,"w":49,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":506,"y":241,"text":" response to"},{"wmode":0,"bbox":{"x":316,"y":241,"w":70,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":252,"text":"replace the chosen"},{"wmode":0,"bbox":{"x":387,"y":242,"w":57,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":387,"y":252,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":445,"y":241,"w":110,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":445,"y":252,"text":" ciphersuite with a matching"},{"wmode":0,"bbox":{"x":316,"y":252,"w":161,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":262,"text":"non-export ciphersuite and forwards the"},{"wmode":0,"bbox":{"x":478,"y":252,"w":77,"h":13},"font":{"name":"ECMDET+LMSans9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":478,"y":262,"text":" ServerKeyExchange"},{"wmode":0,"bbox":{"x":316,"y":262,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":272,"text":"message to the client as is. The client will interpret the"},{"wmode":0,"bbox":{"x":316,"y":273,"w":73,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":283,"text":"export-grade tuple"},{"wmode":0,"bbox":{"x":390,"y":273,"w":6,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":390,"y":283,"text":" ("},{"wmode":0,"bbox":{"x":396,"y":276,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":396,"y":283,"text":"p"},{"wmode":0,"bbox":{"x":401,"y":277,"w":10,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":401,"y":284,"text":"512"},{"wmode":0,"bbox":{"x":413,"y":276,"w":17,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":413,"y":283,"text":", g, g"},{"wmode":0,"bbox":{"x":430,"y":275,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":430,"y":279,"text":"b"},{"wmode":0,"bbox":{"x":434,"y":273,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":434,"y":283,"text":")"},{"wmode":0,"bbox":{"x":438,"y":273,"w":33,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":438,"y":283,"text":" as valid"},{"wmode":0,"bbox":{"x":471,"y":274,"w":19,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":471,"y":283,"text":" DHE"},{"wmode":0,"bbox":{"x":491,"y":273,"w":66,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":491,"y":283,"text":" parameters cho-"},{"wmode":0,"bbox":{"x":316,"y":283,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":293,"text":"sen by the server and proceed with the handshake. The"},{"wmode":0,"bbox":{"x":316,"y":294,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":304,"text":"client and server have different handshake transcripts at this"},{"wmode":0,"bbox":{"x":316,"y":304,"w":167,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":314,"text":"stage, but an attacker who can compute"},{"wmode":0,"bbox":{"x":484,"y":308,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":484,"y":314,"text":" b"},{"wmode":0,"bbox":{"x":491,"y":304,"w":64,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":491,"y":314,"text":" in close to real"},{"wmode":0,"bbox":{"x":316,"y":315,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":325,"text":"time can then derive the master secret and connection keys"},{"wmode":0,"bbox":{"x":316,"y":325,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":335,"text":"to complete the handshake with the client, and then freely"},{"wmode":0,"bbox":{"x":316,"y":336,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":346,"text":"read and write application data pretending to be the server."},{"wmode":0,"bbox":{"x":325,"y":346,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":356,"text":"There are two remaining challenges in implementing this"},{"wmode":0,"bbox":{"x":316,"y":357,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":367,"text":"active downgrade attack. The first is to compute individual"},{"wmode":0,"bbox":{"x":316,"y":367,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":377,"text":"discrete logs in close to real time, and the second is to delay"},{"wmode":0,"bbox":{"x":316,"y":377,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":388,"text":"handshake completion until the discrete log computation has"},{"wmode":0,"bbox":{"x":316,"y":388,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":398,"text":"had time to finish. We address these in the next subsections."}]},{"type":"text","bbox":{"x":316,"y":403,"w":240,"h":316},"lines":[{"wmode":0,"bbox":{"x":316,"y":403,"w":161,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":316,"y":413,"text":"Comparison with previous attacks"},{"wmode":0,"bbox":{"x":491,"y":403,"w":66,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":491,"y":413,"text":"Logjam is remi-"},{"wmode":0,"bbox":{"x":316,"y":414,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":424,"text":"niscent of the recent FREAK [7] attack, in which an attacker"},{"wmode":0,"bbox":{"x":316,"y":424,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":434,"text":"downgrades a regular RSA key exchange to one that uses"},{"wmode":0,"bbox":{"x":316,"y":435,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":445,"text":"export-grade 512-bit ephemeral RSA keys, relying on a bug"},{"wmode":0,"bbox":{"x":316,"y":445,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":455,"text":"in several TLS client implementations. The attacker then"},{"wmode":0,"bbox":{"x":316,"y":456,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":466,"text":"factors the ephemeral key to hijack future connections that"},{"wmode":0,"bbox":{"x":316,"y":466,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":476,"text":"use the same key. The cryptanalysis takes several hours on"},{"wmode":0,"bbox":{"x":316,"y":477,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":487,"text":"commodity hardware and is usable until the server generates"},{"wmode":0,"bbox":{"x":316,"y":487,"w":223,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":497,"text":"a fresh ephemeral RSA key (typically when it restarts)."},{"wmode":0,"bbox":{"x":325,"y":497,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":508,"text":"In contrast, Logjam is due to a protocol flaw in TLS, not"},{"wmode":0,"bbox":{"x":316,"y":508,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":518,"text":"an implementation bug. From a client perspective, the only"},{"wmode":0,"bbox":{"x":316,"y":518,"w":139,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":529,"text":"defense is to reject small primes in"},{"wmode":0,"bbox":{"x":456,"y":519,"w":20,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":456,"y":529,"text":" DHE"},{"wmode":0,"bbox":{"x":476,"y":518,"w":79,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":476,"y":529,"text":" handshakes. (Prior"},{"wmode":0,"bbox":{"x":316,"y":529,"w":178,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":539,"text":"to this work, most popular browsers accepted"},{"wmode":0,"bbox":{"x":495,"y":532,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":495,"y":539,"text":" p"},{"wmode":0,"bbox":{"x":503,"y":529,"w":27,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":503,"y":539,"text":" of size"},{"wmode":0,"bbox":{"x":530,"y":532,"w":9,"h":15},"font":{"name":"BIPZIA+LMMathSymbols9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":530,"y":539,"text":" ≥"},{"wmode":0,"bbox":{"x":540,"y":529,"w":16,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":540,"y":539,"text":" 512"},{"wmode":0,"bbox":{"x":316,"y":539,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":549,"text":"bits.) Logjam affects fewer servers than FREAK, but, as we"},{"wmode":0,"bbox":{"x":316,"y":550,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":560,"text":"shall see, the cost per compromised connection is far lower,"},{"wmode":0,"bbox":{"x":316,"y":560,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":570,"text":"since the precomputation for each 512-bit group can be used"},{"wmode":0,"bbox":{"x":316,"y":571,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":581,"text":"indefinitely against all servers that use that group, and since"},{"wmode":0,"bbox":{"x":316,"y":581,"w":221,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":591,"text":"each individual discrete log only takes about a minute."},{"wmode":0,"bbox":{"x":325,"y":592,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":602,"text":"Logjam and FREAK both follow the same pattern as other"},{"wmode":0,"bbox":{"x":316,"y":602,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":612,"text":"cross-protocol attacks discovered in TLS. As early as SSL 3.0,"},{"wmode":0,"bbox":{"x":316,"y":613,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":623,"text":"Schneier and Wagner noted a related vulnerability that they"},{"wmode":0,"bbox":{"x":316,"y":623,"w":23,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":633,"text":"called"},{"wmode":0,"bbox":{"x":340,"y":623,"w":89,"h":12},"font":{"name":"DEEZDF+LMRoman9-Italic","family":"serif","weight":"normal","style":"italic","size":9},"x":340,"y":633,"text":" key exchange rollback"},{"wmode":0,"bbox":{"x":429,"y":623,"w":127,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":429,"y":633,"text":" [52]. Mavrogiannopoulos et al."},{"wmode":0,"bbox":{"x":316,"y":633,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":644,"text":"showed how explicit-curve ECDHE handshakes could be con-"},{"wmode":0,"bbox":{"x":316,"y":644,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":654,"text":"fused with DHE handshakes [35]. All these attacks could"},{"wmode":0,"bbox":{"x":316,"y":654,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":665,"text":"be prevented by additionally signing the ciphersuite in the"},{"wmode":0,"bbox":{"x":316,"y":665,"w":73,"h":13},"font":{"name":"ECMDET+LMSans9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":675,"text":"ServerKeyExchange"},{"wmode":0,"bbox":{"x":390,"y":665,"w":165,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":390,"y":675,"text":" message. We expect that TLS 1.3 will fix"},{"wmode":0,"bbox":{"x":316,"y":675,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":685,"text":"this protocol flaw. More generally, Logjam can also be inter-"},{"wmode":0,"bbox":{"x":316,"y":686,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":696,"text":"preted as a backwards compatibility attack [23] where one"},{"wmode":0,"bbox":{"x":316,"y":696,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":706,"text":"party uses only strong cryptography but the other supports"},{"wmode":0,"bbox":{"x":316,"y":707,"w":140,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":717,"text":"both strong and weak ciphersuites."}]},{"type":"text","bbox":{"x":302,"y":737,"w":4,"h":12},"lines":[{"wmode":0,"bbox":{"x":302,"y":737,"w":4,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":302,"y":747,"text":"4"}]}]},{"blocks":[{"type":"text","bbox":{"x":53,"y":52,"w":240,"h":89},"lines":[{"wmode":0,"bbox":{"x":53,"y":52,"w":14,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":53,"y":63,"text":"3.3"},{"wmode":0,"bbox":{"x":80,"y":52,"w":178,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":80,"y":63,"text":"512-bit Discrete Log Computations"},{"wmode":0,"bbox":{"x":62,"y":66,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":76,"text":"We modified CADO-NFS [1] to implement the number field"},{"wmode":0,"bbox":{"x":53,"y":77,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":87,"text":"sieve discrete log algorithm from §2 and applied it to three"},{"wmode":0,"bbox":{"x":53,"y":87,"w":149,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":97,"text":"512-bit primes, including the top two"},{"wmode":0,"bbox":{"x":203,"y":88,"w":59,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":203,"y":97,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":263,"y":87,"w":29,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":263,"y":97,"text":" primes"},{"wmode":0,"bbox":{"x":53,"y":97,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":108,"text":"shown in Table 1. Precomputation took 7 days for each prime,"},{"wmode":0,"bbox":{"x":53,"y":108,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":118,"text":"after which computing individual logs took a median of 70 sec-"},{"wmode":0,"bbox":{"x":53,"y":118,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":129,"text":"onds. We list the runtime for each stage of the computation"},{"wmode":0,"bbox":{"x":53,"y":129,"w":220,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":139,"text":"below. The times were about the same for each prime."}]},{"type":"text","bbox":{"x":53,"y":146,"w":241,"h":326},"lines":[{"wmode":0,"bbox":{"x":53,"y":146,"w":74,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":53,"y":156,"text":"Precomputation"},{"wmode":0,"bbox":{"x":140,"y":146,"w":153,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":140,"y":156,"text":"As illustrated in Figure 1, the precom-"},{"wmode":0,"bbox":{"x":53,"y":156,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":166,"text":"putation phase includes the polynomial selection, sieving, and"},{"wmode":0,"bbox":{"x":53,"y":167,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":177,"text":"linear algebra steps. For this precomputation, we deliberately"},{"wmode":0,"bbox":{"x":53,"y":177,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":187,"text":"sieved more than strictly necessary. This enabled two opti-"},{"wmode":0,"bbox":{"x":53,"y":188,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":198,"text":"mizations: first, with more relations obtained from sieving,"},{"wmode":0,"bbox":{"x":53,"y":198,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":208,"text":"we eventually obtain a larger database of known logs, which"},{"wmode":0,"bbox":{"x":53,"y":209,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":219,"text":"makes the descent faster. Second, more sieving relations also"},{"wmode":0,"bbox":{"x":53,"y":219,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":229,"text":"yield a smaller linear algebra step, which is desirable because"},{"wmode":0,"bbox":{"x":53,"y":229,"w":223,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":240,"text":"sieving is much easier to parallelize than linear algebra."},{"wmode":0,"bbox":{"x":62,"y":240,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":250,"text":"For the polynomial selection and sieving steps, we used"},{"wmode":0,"bbox":{"x":53,"y":250,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":261,"text":"idle time on 2000–3000 CPU cores in parallel, of which most"},{"wmode":0,"bbox":{"x":53,"y":261,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":271,"text":"CPUs were Intel Sandy Bridge. Polynomial selection ran"},{"wmode":0,"bbox":{"x":53,"y":271,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":281,"text":"for about 3 hours, which in total corresponds to 7,600 core-"},{"wmode":0,"bbox":{"x":53,"y":282,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":292,"text":"hours. Sieving ran for 15 hours, corresponding to 21,400"},{"wmode":0,"bbox":{"x":53,"y":292,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":302,"text":"core-hours. This sufficed to collect 40,003,519 relations of"},{"wmode":0,"bbox":{"x":53,"y":303,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":313,"text":"which 28,372,442 were unique, involving 15,207,865 primes"},{"wmode":0,"bbox":{"x":53,"y":313,"w":129,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":323,"text":"of at most 27 bits (hence bound"},{"wmode":0,"bbox":{"x":182,"y":317,"w":10,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":182,"y":323,"text":" B"},{"wmode":0,"bbox":{"x":192,"y":313,"w":43,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":192,"y":323,"text":" from §2 is"},{"wmode":0,"bbox":{"x":236,"y":313,"w":7,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":236,"y":323,"text":" 2"},{"wmode":0,"bbox":{"x":244,"y":313,"w":7,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":244,"y":319,"text":"27"},{"wmode":0,"bbox":{"x":252,"y":313,"w":6,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":252,"y":323,"text":")."},{"wmode":0,"bbox":{"x":62,"y":324,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":334,"text":"From this data set, we obtained a square matrix with"},{"wmode":0,"bbox":{"x":53,"y":334,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":344,"text":"2,157,378 rows and columns, with 113 nonzero coefficients per"},{"wmode":0,"bbox":{"x":53,"y":345,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":355,"text":"row on average. We solved the corresponding linear system on"},{"wmode":0,"bbox":{"x":53,"y":355,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":365,"text":"a 36-node cluster with two 8-core Intel Xeon E5-2650 CPUs"},{"wmode":0,"bbox":{"x":53,"y":365,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":376,"text":"per node, connected with Infiniband FDR. We used the block"},{"wmode":0,"bbox":{"x":53,"y":376,"w":188,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":386,"text":"Wiedemann algorithm [11,49] with parameters"},{"wmode":0,"bbox":{"x":242,"y":379,"w":11,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":242,"y":386,"text":" m"},{"wmode":0,"bbox":{"x":253,"y":376,"w":21,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":253,"y":386,"text":" = 18"},{"wmode":0,"bbox":{"x":274,"y":376,"w":17,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":274,"y":386,"text":" and"},{"wmode":0,"bbox":{"x":53,"y":390,"w":5,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":53,"y":397,"text":"n"},{"wmode":0,"bbox":{"x":59,"y":386,"w":16,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":59,"y":397,"text":" = 6"},{"wmode":0,"bbox":{"x":76,"y":386,"w":218,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":76,"y":397,"text":". Using the unoptimized implementation from CADO-"},{"wmode":0,"bbox":{"x":53,"y":397,"w":132,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":407,"text":"NFS [1] for linear algebra over"},{"wmode":0,"bbox":{"x":186,"y":397,"w":17,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":186,"y":407,"text":" GF"},{"wmode":0,"bbox":{"x":204,"y":397,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":204,"y":407,"text":"("},{"wmode":0,"bbox":{"x":207,"y":400,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":207,"y":407,"text":"p"},{"wmode":0,"bbox":{"x":212,"y":397,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":212,"y":407,"text":")"},{"wmode":0,"bbox":{"x":215,"y":397,"w":76,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":215,"y":407,"text":", the computation"},{"wmode":0,"bbox":{"x":53,"y":407,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":417,"text":"finished in 120 hours, corresponding to 60,000 core-hours."},{"wmode":0,"bbox":{"x":53,"y":418,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":428,"text":"We expect that optimizations could bring this cost down by"},{"wmode":0,"bbox":{"x":53,"y":428,"w":100,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":438,"text":"at least a factor of three."},{"wmode":0,"bbox":{"x":62,"y":439,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":449,"text":"In total, the wall-clock time for each precomputation was"},{"wmode":0,"bbox":{"x":53,"y":449,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":459,"text":"slightly over one week. Each resulting database of known"},{"wmode":0,"bbox":{"x":53,"y":460,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":470,"text":"logs for the descent occupies about 2.5 GB in ASCII format."}]},{"type":"text","bbox":{"x":53,"y":476,"w":241,"h":243},"lines":[{"wmode":0,"bbox":{"x":53,"y":476,"w":36,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":53,"y":487,"text":"Descent"},{"wmode":0,"bbox":{"x":102,"y":477,"w":190,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":102,"y":487,"text":"Once this precomputation was finished, we were"},{"wmode":0,"bbox":{"x":53,"y":487,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":497,"text":"able to run the final descent step to compute individual dis-"},{"wmode":0,"bbox":{"x":53,"y":497,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":508,"text":"crete logs in about a minute for targets in each of these groups."},{"wmode":0,"bbox":{"x":53,"y":508,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":518,"text":"In order to save time on individual computations, we imple-"},{"wmode":0,"bbox":{"x":53,"y":518,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":529,"text":"mented a client-server architecture using the ZeroMQ mes-"},{"wmode":0,"bbox":{"x":53,"y":529,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":539,"text":"saging library. The server maintains the precomputed data"},{"wmode":0,"bbox":{"x":53,"y":539,"w":236,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":549,"text":"in RAM and returns logs for values passed to it by clients."},{"wmode":0,"bbox":{"x":62,"y":550,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":560,"text":"We implemented the descent calculation in a mix of Python"},{"wmode":0,"bbox":{"x":53,"y":560,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":570,"text":"and C. The first and second stages are parallelized and run"},{"wmode":0,"bbox":{"x":53,"y":571,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":581,"text":"sieving in C, and the final discrete log is deduced in Python."},{"wmode":0,"bbox":{"x":53,"y":581,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":591,"text":"We ran the server on a machine with two 18-core Intel Xeon"},{"wmode":0,"bbox":{"x":53,"y":592,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":602,"text":"E5-2699 CPUs and 128 GB of RAM. On average, computing"},{"wmode":0,"bbox":{"x":53,"y":602,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":612,"text":"individual logs took about 70 seconds, but the time varied"},{"wmode":0,"bbox":{"x":53,"y":613,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":623,"text":"from 34 to 206 seconds (see Fig. 3). This is divided between"},{"wmode":0,"bbox":{"x":53,"y":623,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":633,"text":"about 20 seconds for descent initialization and the remainder"},{"wmode":0,"bbox":{"x":53,"y":633,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":644,"text":"on the middle phase. Further optimizations—such as more"},{"wmode":0,"bbox":{"x":53,"y":644,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":654,"text":"effective parallelization on the middle phase or additional"},{"wmode":0,"bbox":{"x":53,"y":654,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":665,"text":"sieving—should bring the median time well below a minute."},{"wmode":0,"bbox":{"x":62,"y":665,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":675,"text":"For purposes of comparison, a single 512-bit RSA factor-"},{"wmode":0,"bbox":{"x":53,"y":675,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":685,"text":"ization using the CADO-NFS implementation takes about"},{"wmode":0,"bbox":{"x":53,"y":686,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":696,"text":"eight days of wall-clock time on the computer used for the"},{"wmode":0,"bbox":{"x":53,"y":696,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":706,"text":"descent, and about three hours parallelized across 1,800 cores"},{"wmode":0,"bbox":{"x":53,"y":707,"w":64,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":717,"text":"of Amazon EC2"},{"wmode":0,"bbox":{"x":117,"y":708,"w":50,"h":11},"font":{"name":"LYJWZZ+LMMono9-Regular","family":"monospace","weight":"normal","style":"normal","size":8},"x":117,"y":717,"text":" c4.8xlarge"},{"wmode":0,"bbox":{"x":168,"y":707,"w":42,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":168,"y":717,"text":" instances."}]},{"type":"text","bbox":{"x":344,"y":110,"w":202,"h":24},"lines":[{"wmode":0,"bbox":{"x":362,"y":125,"w":10,"h":10},"font":{"name":"WNSJEE+CMR10","family":"serif","weight":"normal","style":"normal","size":10},"x":362,"y":132,"text":"30"},{"wmode":0,"bbox":{"x":405,"y":125,"w":10,"h":10},"font":{"name":"WNSJEE+CMR10","family":"serif","weight":"normal","style":"normal","size":10},"x":405,"y":132,"text":"60"},{"wmode":0,"bbox":{"x":448,"y":125,"w":10,"h":10},"font":{"name":"WNSJEE+CMR10","family":"serif","weight":"normal","style":"normal","size":10},"x":448,"y":132,"text":"90"},{"wmode":0,"bbox":{"x":488,"y":125,"w":15,"h":10},"font":{"name":"WNSJEE+CMR10","family":"serif","weight":"normal","style":"normal","size":10},"x":488,"y":132,"text":"120"},{"wmode":0,"bbox":{"x":531,"y":125,"w":15,"h":10},"font":{"name":"WNSJEE+CMR10","family":"serif","weight":"normal","style":"normal","size":10},"x":531,"y":132,"text":"150"},{"wmode":0,"bbox":{"x":344,"y":110,"w":5,"h":10},"font":{"name":"WNSJEE+CMR10","family":"serif","weight":"normal","style":"normal","size":10},"x":344,"y":118,"text":"0"}]},{"type":"text","bbox":{"x":336,"y":84,"w":13,"h":10},"lines":[{"wmode":0,"bbox":{"x":336,"y":84,"w":5,"h":10},"font":{"name":"WNSJEE+CMR10","family":"serif","weight":"normal","style":"normal","size":10},"x":336,"y":91,"text":"0"},{"wmode":0,"bbox":{"x":341,"y":84,"w":2,"h":10},"font":{"name":"CUJHND+CMMI10","family":"serif","weight":"normal","style":"italic","size":10},"x":341,"y":91,"text":"."},{"wmode":0,"bbox":{"x":344,"y":84,"w":5,"h":10},"font":{"name":"WNSJEE+CMR10","family":"serif","weight":"normal","style":"normal","size":10},"x":344,"y":91,"text":"5"}]},{"type":"text","bbox":{"x":344,"y":57,"w":5,"h":10},"lines":[{"wmode":0,"bbox":{"x":344,"y":57,"w":5,"h":10},"font":{"name":"WNSJEE+CMR10","family":"serif","weight":"normal","style":"normal","size":10},"x":344,"y":64,"text":"1"}]},{"type":"text","bbox":{"x":436,"y":139,"w":35,"h":10},"lines":[{"wmode":0,"bbox":{"x":436,"y":139,"w":35,"h":10},"font":{"name":"WNSJEE+CMR10","family":"serif","weight":"normal","style":"normal","size":10},"x":436,"y":147,"text":"Seconds"}]},{"type":"text","bbox":{"x":319,"y":60,"w":10,"h":55},"lines":[{"wmode":0,"bbox":{"x":319,"y":60,"w":10,"h":55},"font":{"name":"WNSJEE+CMR10","family":"serif","weight":"normal","style":"normal","size":10},"x":327,"y":116,"text":"CDF of keys"}]},{"type":"text","bbox":{"x":316,"y":155,"w":241,"h":54},"lines":[{"wmode":0,"bbox":{"x":316,"y":155,"w":35,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":165,"text":"Figure 3:"},{"wmode":0,"bbox":{"x":352,"y":155,"w":205,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":352,"y":165,"text":" Individual discrete log time for 512-bit DH."},{"wmode":0,"bbox":{"x":316,"y":166,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":176,"text":"After a week-long precomputation for each of the two top"},{"wmode":0,"bbox":{"x":316,"y":176,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":186,"text":"export-grade primes (see Table 1), we can quickly break"},{"wmode":0,"bbox":{"x":316,"y":187,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":197,"text":"any key exchange that uses them. Here we show times for"},{"wmode":0,"bbox":{"x":316,"y":197,"w":236,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":207,"text":"computing 3,500 individual logs; the median is 70 seconds."}]},{"type":"text","bbox":{"x":316,"y":229,"w":240,"h":100},"lines":[{"wmode":0,"bbox":{"x":316,"y":229,"w":14,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":316,"y":241,"text":"3.4"},{"wmode":0,"bbox":{"x":343,"y":229,"w":154,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":343,"y":241,"text":"Active Attack Implementation"},{"wmode":0,"bbox":{"x":325,"y":244,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":254,"text":"We implemented a man-in-the-middle network attacker"},{"wmode":0,"bbox":{"x":316,"y":254,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":264,"text":"that sits between a TLS client (web browser) and any server"},{"wmode":0,"bbox":{"x":316,"y":265,"w":53,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":275,"text":"that supports"},{"wmode":0,"bbox":{"x":370,"y":266,"w":58,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":370,"y":275,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":428,"y":265,"w":129,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":428,"y":275,"text":" and uses the most common 512-"},{"wmode":0,"bbox":{"x":316,"y":275,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":285,"text":"bit Apache group. Our implementation follows the message"},{"wmode":0,"bbox":{"x":316,"y":286,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":296,"text":"sequence in Figure 2: it downgrades the connection towards"},{"wmode":0,"bbox":{"x":316,"y":296,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":306,"text":"the server, computes the session keys, and takes over the"},{"wmode":0,"bbox":{"x":316,"y":307,"w":236,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":317,"text":"connection towards the client by impersonating the server."},{"wmode":0,"bbox":{"x":325,"y":317,"w":214,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":327,"text":"The main challenge is to compute the shared secret"},{"wmode":0,"bbox":{"x":539,"y":320,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":539,"y":327,"text":" g"},{"wmode":0,"bbox":{"x":548,"y":319,"w":7,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":548,"y":323,"text":"ab"}]},{"type":"text","bbox":{"x":316,"y":327,"w":240,"h":44},"lines":[{"wmode":0,"bbox":{"x":316,"y":327,"w":204,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":338,"text":"before the handshake completes in order to forge a"},{"wmode":0,"bbox":{"x":521,"y":327,"w":34,"h":13},"font":{"name":"ECMDET+LMSans9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":521,"y":338,"text":" Finished"},{"wmode":0,"bbox":{"x":316,"y":338,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":348,"text":"message from the server. With our descent implementation,"},{"wmode":0,"bbox":{"x":316,"y":348,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":358,"text":"the computation takes an average of 70 seconds, but there"},{"wmode":0,"bbox":{"x":316,"y":359,"w":228,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":369,"text":"are several ways an attacker can work around this delay:"}]},{"type":"text","bbox":{"x":316,"y":374,"w":239,"h":54},"lines":[{"wmode":0,"bbox":{"x":316,"y":374,"w":80,"h":12},"font":{"name":"APLFGU+LMRomanSlant9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":316,"y":384,"text":"Non-browser clients."},{"wmode":0,"bbox":{"x":405,"y":374,"w":150,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":405,"y":384,"text":"Different TLS clients impose different"},{"wmode":0,"bbox":{"x":316,"y":384,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":394,"text":"time limits for the handshake, after which they kill the"},{"wmode":0,"bbox":{"x":316,"y":395,"w":46,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":405,"text":"connection."},{"wmode":0,"bbox":{"x":370,"y":395,"w":124,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":370,"y":405,"text":"Command-line clients such as"},{"wmode":0,"bbox":{"x":495,"y":396,"w":22,"h":11},"font":{"name":"LYJWZZ+LMMono9-Regular","family":"monospace","weight":"normal","style":"normal","size":8},"x":495,"y":405,"text":" curl"},{"wmode":0,"bbox":{"x":518,"y":395,"w":19,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":518,"y":405,"text":" and"},{"wmode":0,"bbox":{"x":537,"y":396,"w":18,"h":11},"font":{"name":"LYJWZZ+LMMono9-Regular","family":"monospace","weight":"normal","style":"normal","size":8},"x":537,"y":405,"text":" git"},{"wmode":0,"bbox":{"x":316,"y":405,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":415,"text":"often run unattended, so they have long or no timeouts, and"},{"wmode":0,"bbox":{"x":316,"y":415,"w":200,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":426,"text":"we can hijack their connections without difficulty."}]},{"type":"text","bbox":{"x":315,"y":430,"w":242,"h":96},"lines":[{"wmode":0,"bbox":{"x":315,"y":430,"w":83,"h":12},"font":{"name":"APLFGU+LMRomanSlant9-Regular","family":"serif","weight":"normal","style":"italic","size":9},"x":315,"y":440,"text":"TLS warning alerts."},{"wmode":0,"bbox":{"x":409,"y":430,"w":146,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":409,"y":440,"text":"Web browsers tend to have shorter"},{"wmode":0,"bbox":{"x":316,"y":441,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":451,"text":"timeouts, but we can keep their connections alive by sending"},{"wmode":0,"bbox":{"x":316,"y":451,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":461,"text":"TLS warning alerts, which are ignored by the browser but"},{"wmode":0,"bbox":{"x":316,"y":462,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":472,"text":"reset the handshake timer. For example, this allows us to keep"},{"wmode":0,"bbox":{"x":316,"y":472,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":482,"text":"Firefox’s TLS connections alive indefinitely. (Other browsers"},{"wmode":0,"bbox":{"x":316,"y":483,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":493,"text":"we tested close the connection after a minute.) Although"},{"wmode":0,"bbox":{"x":316,"y":493,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":503,"text":"the victim connection still takes much longer than usual,"},{"wmode":0,"bbox":{"x":316,"y":504,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":514,"text":"the attacker might choose to compromise a request for a"},{"wmode":0,"bbox":{"x":316,"y":514,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":524,"text":"background resource that does not delay rendering the page."}]},{"type":"text","bbox":{"x":316,"y":529,"w":239,"h":23},"lines":[{"wmode":0,"bbox":{"x":316,"y":529,"w":98,"h":12},"font":{"name":"APLFGU+LMRomanSlant9-Regular","family":"serif","weight":"normal","style":"italic","size":9},"x":316,"y":539,"text":"Ephemeral key caching."},{"wmode":0,"bbox":{"x":424,"y":529,"w":131,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":424,"y":539,"text":"Many TLS servers do not use a"},{"wmode":0,"bbox":{"x":316,"y":539,"w":44,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":549,"text":"fresh value"},{"wmode":0,"bbox":{"x":361,"y":543,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":361,"y":549,"text":" b"},{"wmode":0,"bbox":{"x":368,"y":539,"w":175,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":368,"y":549,"text":" for each connection, but instead compute"},{"wmode":0,"bbox":{"x":543,"y":543,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":543,"y":549,"text":" g"},{"wmode":0,"bbox":{"x":552,"y":541,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":552,"y":546,"text":"b"}]},{"type":"text","bbox":{"x":316,"y":550,"w":239,"h":23},"lines":[{"wmode":0,"bbox":{"x":316,"y":550,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":560,"text":"once and reuse it for multiple negotiations. Without enabling"},{"wmode":0,"bbox":{"x":316,"y":560,"w":13,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":570,"text":"the"},{"wmode":0,"bbox":{"x":329,"y":561,"w":97,"h":11},"font":{"name":"LYJWZZ+LMMono9-Regular","family":"monospace","weight":"normal","style":"normal","size":8},"x":329,"y":570,"text":" SSL_OP_SINGLE_DH_USE"},{"wmode":0,"bbox":{"x":427,"y":560,"w":116,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":427,"y":570,"text":" option, OpenSSL will reuse"},{"wmode":0,"bbox":{"x":544,"y":564,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":544,"y":570,"text":" g"},{"wmode":0,"bbox":{"x":552,"y":562,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":552,"y":567,"text":"b"}]},{"type":"text","bbox":{"x":316,"y":571,"w":240,"h":148},"lines":[{"wmode":0,"bbox":{"x":316,"y":571,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":581,"text":"for the lifetime of a TLS context. While both Apache and"},{"wmode":0,"bbox":{"x":316,"y":581,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":591,"text":"Nginx internally apply this option, certain load balancers,"},{"wmode":0,"bbox":{"x":316,"y":592,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":602,"text":"such as stud [48], do not. The F5 BIG-IP load balancers"},{"wmode":0,"bbox":{"x":316,"y":602,"w":154,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":612,"text":"and hardware TLS frontends will reuse"},{"wmode":0,"bbox":{"x":471,"y":605,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":471,"y":612,"text":" g"},{"wmode":0,"bbox":{"x":478,"y":604,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":478,"y":608,"text":"b"},{"wmode":0,"bbox":{"x":482,"y":598,"w":73,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":482,"y":608,"text":" unless the “Single"},{"wmode":0,"bbox":{"x":316,"y":613,"w":214,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":623,"text":"DH” option is checked [53]. Microsoft Schannel caches"},{"wmode":0,"bbox":{"x":531,"y":616,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":531,"y":623,"text":" g"},{"wmode":0,"bbox":{"x":538,"y":614,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":538,"y":619,"text":"b"},{"wmode":0,"bbox":{"x":541,"y":609,"w":14,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":541,"y":619,"text":" for"},{"wmode":0,"bbox":{"x":316,"y":623,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":633,"text":"two hours—this setting is hard-coded. For these servers, an"},{"wmode":0,"bbox":{"x":316,"y":633,"w":158,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":644,"text":"attacker can compute the discrete log of"},{"wmode":0,"bbox":{"x":475,"y":637,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":475,"y":644,"text":" g"},{"wmode":0,"bbox":{"x":483,"y":635,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":483,"y":640,"text":"b"},{"wmode":0,"bbox":{"x":486,"y":630,"w":71,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":486,"y":640,"text":" from one connec-"},{"wmode":0,"bbox":{"x":316,"y":644,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":654,"text":"tion and use it to attack later handshakes, avoiding the need"},{"wmode":0,"bbox":{"x":316,"y":654,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":665,"text":"to do the computation online. By randomly sampling IPv4"},{"wmode":0,"bbox":{"x":316,"y":665,"w":217,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":675,"text":"hosts serving browser-trusted certificates that support"},{"wmode":0,"bbox":{"x":534,"y":666,"w":20,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":534,"y":675,"text":" DHE"},{"wmode":0,"bbox":{"x":554,"y":665,"w":2,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":554,"y":675,"text":","},{"wmode":0,"bbox":{"x":316,"y":675,"w":107,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":685,"text":"we found that 17% reused"},{"wmode":0,"bbox":{"x":423,"y":679,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":423,"y":685,"text":" g"},{"wmode":0,"bbox":{"x":431,"y":677,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":431,"y":682,"text":"b"},{"wmode":0,"bbox":{"x":435,"y":672,"w":120,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":435,"y":682,"text":" at least once over the course"},{"wmode":0,"bbox":{"x":316,"y":686,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":696,"text":"of 20 handshakes, and that 15% only used one value. How-"},{"wmode":0,"bbox":{"x":316,"y":696,"w":33,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":706,"text":"ever, for"},{"wmode":0,"bbox":{"x":349,"y":697,"w":59,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":349,"y":706,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":409,"y":696,"w":74,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":409,"y":706,"text":", only 0.1% reused"},{"wmode":0,"bbox":{"x":483,"y":700,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":483,"y":706,"text":" g"},{"wmode":0,"bbox":{"x":491,"y":698,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":491,"y":703,"text":"b"},{"wmode":0,"bbox":{"x":494,"y":696,"w":60,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":494,"y":706,"text":", likely because"},{"wmode":0,"bbox":{"x":316,"y":707,"w":237,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":717,"text":"Microsoft IIS does not support 512-bit export ciphersuites."}]},{"type":"text","bbox":{"x":302,"y":737,"w":4,"h":12},"lines":[{"wmode":0,"bbox":{"x":302,"y":737,"w":4,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":302,"y":747,"text":"5"}]}]},{"blocks":[{"type":"text","bbox":{"x":52,"y":53,"w":242,"h":159},"lines":[{"wmode":0,"bbox":{"x":52,"y":53,"w":68,"h":12},"font":{"name":"APLFGU+LMRomanSlant9-Regular","family":"serif","weight":"normal","style":"italic","size":9},"x":52,"y":63,"text":"TLS False Start."},{"wmode":0,"bbox":{"x":130,"y":53,"w":163,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":130,"y":63,"text":"Even when clients enforce shorter time-"},{"wmode":0,"bbox":{"x":53,"y":64,"w":160,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":74,"text":"outs and servers do not reuse values for"},{"wmode":0,"bbox":{"x":214,"y":67,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":214,"y":74,"text":" b"},{"wmode":0,"bbox":{"x":221,"y":64,"w":71,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":221,"y":74,"text":", the attacker can"},{"wmode":0,"bbox":{"x":53,"y":74,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":84,"text":"still break the confidentiality of user requests if the client"},{"wmode":0,"bbox":{"x":53,"y":85,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":95,"text":"supports the TLS False Start extension [30]. This extension"},{"wmode":0,"bbox":{"x":53,"y":95,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":105,"text":"reduces connection latency by having the client send early"},{"wmode":0,"bbox":{"x":53,"y":105,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":116,"text":"application data (such as an HTTP request) without waiting"},{"wmode":0,"bbox":{"x":53,"y":116,"w":60,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":126,"text":"for the server’s"},{"wmode":0,"bbox":{"x":114,"y":116,"w":35,"h":13},"font":{"name":"ECMDET+LMSans9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":114,"y":126,"text":" Finished"},{"wmode":0,"bbox":{"x":149,"y":116,"w":143,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":149,"y":126,"text":" message to arrive. Recent versions"},{"wmode":0,"bbox":{"x":53,"y":126,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":136,"text":"of Chrome, Internet Explorer, and Firefox implement False"},{"wmode":0,"bbox":{"x":53,"y":137,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":147,"text":"Start, but their policies on when to enable it vary between"},{"wmode":0,"bbox":{"x":53,"y":147,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":157,"text":"versions. Firefox 35, Chrome 41, and Internet Explorer (Win-"},{"wmode":0,"bbox":{"x":53,"y":158,"w":146,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":168,"text":"dows 10) send False Start data with"},{"wmode":0,"bbox":{"x":200,"y":159,"w":20,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":200,"y":168,"text":" DHE"},{"wmode":0,"bbox":{"x":220,"y":158,"w":72,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":220,"y":168,"text":". In these cases, a"},{"wmode":0,"bbox":{"x":53,"y":168,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":178,"text":"man-in-the-middle can record the handshake and decrypt the"},{"wmode":0,"bbox":{"x":53,"y":179,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":189,"text":"False Start payload at leisure. We note that this initial data"},{"wmode":0,"bbox":{"x":53,"y":189,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":199,"text":"sent by a browser often contains sensitive user authentication"},{"wmode":0,"bbox":{"x":53,"y":200,"w":177,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":210,"text":"information, such as passwords and cookies."}]},{"type":"text","bbox":{"x":53,"y":220,"w":239,"h":37},"lines":[{"wmode":0,"bbox":{"x":53,"y":220,"w":14,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":53,"y":232,"text":"3.5"},{"wmode":0,"bbox":{"x":80,"y":220,"w":202,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":80,"y":232,"text":"Other Weak and Misconfigured Groups"},{"wmode":0,"bbox":{"x":62,"y":235,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":245,"text":"In our scans, we found several other exploitable security"},{"wmode":0,"bbox":{"x":53,"y":245,"w":219,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":255,"text":"issues in the DHE configurations used by TLS servers."}]},{"type":"text","bbox":{"x":53,"y":260,"w":240,"h":190},"lines":[{"wmode":0,"bbox":{"x":53,"y":260,"w":137,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":53,"y":270,"text":"512-bit primes in non-export"},{"wmode":0,"bbox":{"x":191,"y":261,"w":22,"h":11},"font":{"name":"QSKEHF+LMSans10-Bold","family":"serif","weight":"bold","style":"normal","size":7},"x":191,"y":270,"text":" DHE"},{"wmode":0,"bbox":{"x":227,"y":260,"w":66,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":227,"y":270,"text":"We found 2,631"},{"wmode":0,"bbox":{"x":53,"y":271,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":281,"text":"servers with browser-trusted certificates (and 118 in the"},{"wmode":0,"bbox":{"x":53,"y":281,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":291,"text":"Top 1M domains) that used 512-bit or weaker primes for"},{"wmode":0,"bbox":{"x":53,"y":292,"w":44,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":302,"text":"non-export"},{"wmode":0,"bbox":{"x":98,"y":293,"w":21,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":98,"y":302,"text":" DHE"},{"wmode":0,"bbox":{"x":120,"y":292,"w":2,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":120,"y":302,"text":"."},{"wmode":0,"bbox":{"x":131,"y":292,"w":162,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":131,"y":302,"text":"In these instances, active attacks may"},{"wmode":0,"bbox":{"x":53,"y":302,"w":170,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":312,"text":"be unnecessary. If a browser negotiates a"},{"wmode":0,"bbox":{"x":224,"y":303,"w":20,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":224,"y":312,"text":" DHE"},{"wmode":0,"bbox":{"x":245,"y":302,"w":47,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":245,"y":312,"text":" ciphersuite"},{"wmode":0,"bbox":{"x":53,"y":313,"w":111,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":323,"text":"with one of these servers, a"},{"wmode":0,"bbox":{"x":165,"y":313,"w":31,"h":12},"font":{"name":"DEEZDF+LMRoman9-Italic","family":"serif","weight":"normal","style":"italic","size":9},"x":165,"y":323,"text":" passive"},{"wmode":0,"bbox":{"x":196,"y":313,"w":96,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":196,"y":323,"text":" eavesdropper can later"},{"wmode":0,"bbox":{"x":53,"y":323,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":333,"text":"compute the discrete log and obtain the TLS session keys"},{"wmode":0,"bbox":{"x":53,"y":333,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":344,"text":"for the connection. An active attack may still be necessary"},{"wmode":0,"bbox":{"x":53,"y":344,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":354,"text":"when the client’s ordering of ciphersuites would result in the"},{"wmode":0,"bbox":{"x":53,"y":354,"w":74,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":364,"text":"server not selecting"},{"wmode":0,"bbox":{"x":128,"y":355,"w":19,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":128,"y":364,"text":" DHE"},{"wmode":0,"bbox":{"x":148,"y":354,"w":87,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":148,"y":364,"text":". In this case, as in the"},{"wmode":0,"bbox":{"x":235,"y":355,"w":57,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":235,"y":364,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":53,"y":365,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":375,"text":"downgrade attack, an active attacker can force the server to"},{"wmode":0,"bbox":{"x":53,"y":375,"w":78,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":385,"text":"choose a vulnerable"},{"wmode":0,"bbox":{"x":132,"y":376,"w":20,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":132,"y":385,"text":" DHE"},{"wmode":0,"bbox":{"x":152,"y":375,"w":49,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":152,"y":385,"text":" ciphersuite."},{"wmode":0,"bbox":{"x":62,"y":386,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":396,"text":"As a proof-of-concept, we implemented a passive eaves-"},{"wmode":0,"bbox":{"x":53,"y":396,"w":76,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":406,"text":"dropper for regular"},{"wmode":0,"bbox":{"x":130,"y":397,"w":20,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":130,"y":406,"text":" DHE"},{"wmode":0,"bbox":{"x":150,"y":396,"w":142,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":150,"y":406,"text":" connections and used it to decrypt"},{"wmode":0,"bbox":{"x":53,"y":407,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":417,"text":"test connections to www.fbi.gov. Until April 2015, this server"},{"wmode":0,"bbox":{"x":53,"y":417,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":427,"text":"used the default 512-bit DH group from OpenSSL, which"},{"wmode":0,"bbox":{"x":53,"y":428,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":438,"text":"was the third group for which we performed the NFS pre-"},{"wmode":0,"bbox":{"x":53,"y":438,"w":184,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":448,"text":"computation. The website no longer supports"},{"wmode":0,"bbox":{"x":237,"y":439,"w":20,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":237,"y":448,"text":" DHE"},{"wmode":0,"bbox":{"x":258,"y":438,"w":2,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":258,"y":448,"text":"."}]},{"type":"text","bbox":{"x":52,"y":453,"w":241,"h":248},"lines":[{"wmode":0,"bbox":{"x":53,"y":453,"w":184,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":53,"y":463,"text":"Attacks on composite-order subgroups"},{"wmode":0,"bbox":{"x":251,"y":453,"w":41,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":251,"y":463,"text":"Failure to"},{"wmode":0,"bbox":{"x":53,"y":464,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":474,"text":"generate Diffie-Hellman primes according to best practices"},{"wmode":0,"bbox":{"x":53,"y":474,"w":140,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":484,"text":"can result in devastating attacks."},{"wmode":0,"bbox":{"x":201,"y":474,"w":91,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":201,"y":484,"text":"Not every TLS server"},{"wmode":0,"bbox":{"x":53,"y":485,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":495,"text":"uses “safe” primes. Out of approximately 70,000 distinct"},{"wmode":0,"bbox":{"x":53,"y":495,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":505,"text":"primes seen across both export and non-export TLS scans,"},{"wmode":0,"bbox":{"x":53,"y":506,"w":137,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":516,"text":"4,800 were not safe, meaning that"},{"wmode":0,"bbox":{"x":190,"y":506,"w":6,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":190,"y":516,"text":" ("},{"wmode":0,"bbox":{"x":197,"y":509,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":197,"y":516,"text":"p"},{"wmode":0,"bbox":{"x":201,"y":509,"w":9,"h":15},"font":{"name":"BIPZIA+LMMathSymbols9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":201,"y":516,"text":" −"},{"wmode":0,"bbox":{"x":211,"y":506,"w":10,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":211,"y":516,"text":" 1)"},{"wmode":0,"bbox":{"x":221,"y":509,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":221,"y":516,"text":"/"},{"wmode":0,"bbox":{"x":226,"y":506,"w":4,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":226,"y":516,"text":"2"},{"wmode":0,"bbox":{"x":230,"y":506,"w":64,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":230,"y":516,"text":" was composite."},{"wmode":0,"bbox":{"x":52,"y":516,"w":166,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":52,"y":526,"text":"(Incidentally, we also found 9 composite"},{"wmode":0,"bbox":{"x":218,"y":519,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":218,"y":526,"text":" p"},{"wmode":0,"bbox":{"x":226,"y":516,"w":65,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":226,"y":526,"text":".) These groups"},{"wmode":0,"bbox":{"x":53,"y":527,"w":159,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":537,"text":"are not necessarily vulnerable, as long as"},{"wmode":0,"bbox":{"x":213,"y":530,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":213,"y":537,"text":" g"},{"wmode":0,"bbox":{"x":220,"y":527,"w":72,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":220,"y":537,"text":" generates a group"},{"wmode":0,"bbox":{"x":53,"y":537,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":547,"text":"with at least one sufficiently large subgroup order to rule out"},{"wmode":0,"bbox":{"x":53,"y":547,"w":174,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":558,"text":"the Pohlig-Hellman algorithm as an attack."},{"wmode":0,"bbox":{"x":62,"y":558,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":568,"text":"In some real-life configurations, however, choosing such"},{"wmode":0,"bbox":{"x":53,"y":568,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":578,"text":"primes can lead to an attack. For efficiency reasons, some"},{"wmode":0,"bbox":{"x":53,"y":579,"w":141,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":589,"text":"implementations use ephemeral keys"},{"wmode":0,"bbox":{"x":194,"y":582,"w":6,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":194,"y":589,"text":" g"},{"wmode":0,"bbox":{"x":201,"y":581,"w":4,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":201,"y":585,"text":"x"},{"wmode":0,"bbox":{"x":205,"y":575,"w":87,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":205,"y":585,"text":" with a short exponent"},{"wmode":0,"bbox":{"x":53,"y":593,"w":5,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":53,"y":599,"text":"x"},{"wmode":0,"bbox":{"x":59,"y":589,"w":121,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":59,"y":599,"text":"; commonly suggested sizes for"},{"wmode":0,"bbox":{"x":180,"y":593,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":180,"y":599,"text":" x"},{"wmode":0,"bbox":{"x":188,"y":589,"w":104,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":188,"y":599,"text":" are as small as 160 or 224"},{"wmode":0,"bbox":{"x":53,"y":600,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":610,"text":"bits, intended to match the estimated strength of a 1024- or"},{"wmode":0,"bbox":{"x":53,"y":610,"w":100,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":620,"text":"2048-bit group. For safe"},{"wmode":0,"bbox":{"x":154,"y":614,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":154,"y":620,"text":" p"},{"wmode":0,"bbox":{"x":162,"y":610,"w":130,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":162,"y":620,"text":", such exponent lengths are not"},{"wmode":0,"bbox":{"x":53,"y":621,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":631,"text":"known to decrease security, as the most efficient attack will"},{"wmode":0,"bbox":{"x":53,"y":631,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":641,"text":"be the Pollard lambda algorithm. But if the order of the"},{"wmode":0,"bbox":{"x":53,"y":642,"w":89,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":652,"text":"subgroup generated by"},{"wmode":0,"bbox":{"x":143,"y":645,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":143,"y":652,"text":" g"},{"wmode":0,"bbox":{"x":151,"y":642,"w":141,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":151,"y":652,"text":" has small factors, they can be used"},{"wmode":0,"bbox":{"x":53,"y":652,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":662,"text":"to recover information about exponents. From a subset of"},{"wmode":0,"bbox":{"x":53,"y":663,"w":27,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":673,"text":"factors"},{"wmode":0,"bbox":{"x":81,"y":666,"w":8,"h":15},"font":{"name":"BIPZIA+LMMathSymbols9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":81,"y":673,"text":" {"},{"wmode":0,"bbox":{"x":89,"y":666,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":89,"y":673,"text":"q"},{"wmode":0,"bbox":{"x":94,"y":664,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":94,"y":668,"text":"e"},{"wmode":0,"bbox":{"x":97,"y":664,"w":3,"h":7},"font":{"name":"DUMKJS+LMRoman5-Regular","family":"serif","weight":"normal","style":"normal","size":4},"x":97,"y":670,"text":"1"},{"wmode":0,"bbox":{"x":93,"y":668,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":93,"y":675,"text":"1"},{"wmode":0,"bbox":{"x":97,"y":666,"w":22,"h":11},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":97,"y":675,"text":" . . . q"},{"wmode":0,"bbox":{"x":120,"y":664,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":120,"y":668,"text":"e"},{"wmode":0,"bbox":{"x":123,"y":666,"w":3,"h":4},"font":{"name":"IAGHLJ+LMMathItalic5-Regular","family":"serif","weight":"normal","style":"italic","size":4},"x":123,"y":670,"text":"k"},{"wmode":0,"bbox":{"x":120,"y":671,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":120,"y":675,"text":"k"},{"wmode":0,"bbox":{"x":124,"y":666,"w":9,"h":18},"font":{"name":"BIPZIA+LMMathSymbols9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":124,"y":675,"text":" }"},{"wmode":0,"bbox":{"x":133,"y":663,"w":22,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":133,"y":673,"text":" with"},{"wmode":0,"bbox":{"x":155,"y":658,"w":13,"h":44},"font":{"name":"ITXTHR+LMMathExtension10-Regula","family":"serif","weight":"normal","style":"normal","size":9},"x":155,"y":673,"text":" �"}]},{"type":"text","bbox":{"x":53,"y":659,"w":239,"h":54},"lines":[{"wmode":0,"bbox":{"x":168,"y":671,"w":2,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":168,"y":676,"text":"i"},{"wmode":0,"bbox":{"x":171,"y":666,"w":6,"h":12},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":171,"y":676,"text":" q"},{"wmode":0,"bbox":{"x":177,"y":664,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":177,"y":668,"text":"e"},{"wmode":0,"bbox":{"x":177,"y":659,"w":6,"h":18},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":177,"y":675,"text":"i i"},{"wmode":0,"bbox":{"x":189,"y":663,"w":7,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":189,"y":673,"text":"="},{"wmode":0,"bbox":{"x":196,"y":666,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":196,"y":673,"text":" z"},{"wmode":0,"bbox":{"x":204,"y":663,"w":88,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":204,"y":673,"text":", Pohlig-Hellman can"},{"wmode":0,"bbox":{"x":53,"y":674,"w":27,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":684,"text":"recover"},{"wmode":0,"bbox":{"x":81,"y":677,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":81,"y":684,"text":" x"},{"wmode":0,"bbox":{"x":89,"y":674,"w":23,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":89,"y":684,"text":" mod"},{"wmode":0,"bbox":{"x":113,"y":677,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":113,"y":684,"text":" z"},{"wmode":0,"bbox":{"x":121,"y":674,"w":31,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":121,"y":684,"text":" in time"},{"wmode":0,"bbox":{"x":152,"y":669,"w":13,"h":44},"font":{"name":"ITXTHR+LMMathExtension10-Regula","family":"serif","weight":"normal","style":"normal","size":9},"x":152,"y":684,"text":" �"}]},{"type":"text","bbox":{"x":53,"y":672,"w":239,"h":56},"lines":[{"wmode":0,"bbox":{"x":166,"y":683,"w":2,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":166,"y":687,"text":"i"},{"wmode":0,"bbox":{"x":168,"y":677,"w":6,"h":12},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":168,"y":687,"text":" e"},{"wmode":0,"bbox":{"x":175,"y":681,"w":2,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":175,"y":685,"text":"i"},{"wmode":0,"bbox":{"x":178,"y":672,"w":7,"h":15},"font":{"name":"BIPZIA+LMMathSymbols9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":178,"y":678,"text":"√"},{"wmode":0,"bbox":{"x":185,"y":677,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":185,"y":684,"text":"q"},{"wmode":0,"bbox":{"x":190,"y":681,"w":2,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":190,"y":685,"text":"i"},{"wmode":0,"bbox":{"x":193,"y":674,"w":12,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":193,"y":684,"text":". If"},{"wmode":0,"bbox":{"x":205,"y":677,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":205,"y":684,"text":" x"},{"wmode":0,"bbox":{"x":214,"y":677,"w":9,"h":15},"font":{"name":"BIPZIA+LMMathSymbols9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":214,"y":684,"text":" ≤"},{"wmode":0,"bbox":{"x":223,"y":677,"w":6,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":223,"y":684,"text":" z"},{"wmode":0,"bbox":{"x":231,"y":674,"w":61,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":231,"y":684,"text":", this suffices to"},{"wmode":0,"bbox":{"x":53,"y":684,"w":29,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":695,"text":"recover"},{"wmode":0,"bbox":{"x":82,"y":688,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":82,"y":695,"text":" x"},{"wmode":0,"bbox":{"x":91,"y":684,"w":201,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":91,"y":695,"text":". If not, Pollard lambda can use this information"},{"wmode":0,"bbox":{"x":53,"y":696,"w":40,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":706,"text":"to recover"},{"wmode":0,"bbox":{"x":93,"y":700,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":93,"y":706,"text":" x"},{"wmode":0,"bbox":{"x":102,"y":696,"w":31,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":102,"y":706,"text":" in time"},{"wmode":0,"bbox":{"x":137,"y":690,"w":9,"h":37},"font":{"name":"ITXTHR+LMMathExtension10-Regula","family":"serif","weight":"normal","style":"normal","size":9},"x":137,"y":698,"text":"�"}]},{"type":"text","bbox":{"x":53,"y":696,"w":239,"h":23},"lines":[{"wmode":0,"bbox":{"x":147,"y":700,"w":14,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":147,"y":706,"text":"x/z"},{"wmode":0,"bbox":{"x":161,"y":696,"w":131,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":161,"y":706,"text":". This attack was first described"},{"wmode":0,"bbox":{"x":53,"y":707,"w":200,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":717,"text":"as hypothetical by van Oorschot and Wiener [51]."}]},{"type":"text","bbox":{"x":315,"y":53,"w":241,"h":431},"lines":[{"wmode":0,"bbox":{"x":325,"y":53,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":63,"text":"To see if TLS servers in the wild were vulnerable to this"},{"wmode":0,"bbox":{"x":316,"y":64,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":74,"text":"attack, we tested various non-safe primes found in our scans."},{"wmode":0,"bbox":{"x":316,"y":74,"w":101,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":84,"text":"For each non-safe prime"},{"wmode":0,"bbox":{"x":418,"y":77,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":418,"y":84,"text":" p"},{"wmode":0,"bbox":{"x":427,"y":74,"w":128,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":427,"y":84,"text":", we opportunistically factored"},{"wmode":0,"bbox":{"x":316,"y":88,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":316,"y":95,"text":"p"},{"wmode":0,"bbox":{"x":321,"y":88,"w":9,"h":15},"font":{"name":"BIPZIA+LMMathSymbols9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":321,"y":95,"text":" −"},{"wmode":0,"bbox":{"x":330,"y":85,"w":6,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":330,"y":95,"text":" 1"},{"wmode":0,"bbox":{"x":337,"y":85,"w":218,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":337,"y":95,"text":" using Bernstein’s batch method [5]. We then ran the"},{"wmode":0,"bbox":{"x":316,"y":95,"w":173,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":105,"text":"GMP-ECM implementations of the Pollard"},{"wmode":0,"bbox":{"x":490,"y":98,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":490,"y":105,"text":" p"},{"wmode":0,"bbox":{"x":498,"y":98,"w":9,"h":15},"font":{"name":"BIPZIA+LMMathSymbols9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":498,"y":105,"text":" −"},{"wmode":0,"bbox":{"x":507,"y":95,"w":6,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":507,"y":105,"text":" 1"},{"wmode":0,"bbox":{"x":514,"y":95,"w":41,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":514,"y":105,"text":" algorithm"},{"wmode":0,"bbox":{"x":316,"y":105,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":116,"text":"and the ECM factoring methods [54] for 5 days parallelized"},{"wmode":0,"bbox":{"x":316,"y":116,"w":209,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":126,"text":"across 28 cores and discovered 36,447 prime factors."},{"wmode":0,"bbox":{"x":325,"y":126,"w":130,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":136,"text":"We then examined the generators"},{"wmode":0,"bbox":{"x":456,"y":130,"w":6,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":456,"y":136,"text":" g"},{"wmode":0,"bbox":{"x":463,"y":126,"w":85,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":463,"y":136,"text":" used with each prime"},{"wmode":0,"bbox":{"x":548,"y":130,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":548,"y":136,"text":" p"},{"wmode":0,"bbox":{"x":555,"y":126,"w":2,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":555,"y":136,"text":"."},{"wmode":0,"bbox":{"x":316,"y":137,"w":83,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":147,"text":"We classified a tuple"},{"wmode":0,"bbox":{"x":399,"y":137,"w":6,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":399,"y":147,"text":" ("},{"wmode":0,"bbox":{"x":406,"y":140,"w":22,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":406,"y":147,"text":"p, g, y"},{"wmode":0,"bbox":{"x":428,"y":137,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":428,"y":147,"text":")"},{"wmode":0,"bbox":{"x":432,"y":137,"w":123,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":432,"y":147,"text":" sent by a server as interesting"},{"wmode":0,"bbox":{"x":316,"y":147,"w":108,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":157,"text":"if the prime factorization of"},{"wmode":0,"bbox":{"x":425,"y":151,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":425,"y":157,"text":" p"},{"wmode":0,"bbox":{"x":433,"y":150,"w":8,"h":15},"font":{"name":"BIPZIA+LMMathSymbols9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":433,"y":157,"text":" −"},{"wmode":0,"bbox":{"x":442,"y":147,"w":6,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":442,"y":157,"text":" 1"},{"wmode":0,"bbox":{"x":448,"y":147,"w":107,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":448,"y":157,"text":" had revealed prime factors"},{"wmode":0,"bbox":{"x":316,"y":158,"w":58,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":168,"text":"of the order of"},{"wmode":0,"bbox":{"x":375,"y":161,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":375,"y":168,"text":" g"},{"wmode":0,"bbox":{"x":383,"y":158,"w":172,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":383,"y":168,"text":", and ordered them by the estimated work"},{"wmode":0,"bbox":{"x":316,"y":168,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":178,"text":"required using Pohlig-Hellman and Pollard lambda to recover"},{"wmode":0,"bbox":{"x":316,"y":179,"w":100,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":189,"text":"a target private exponent"},{"wmode":0,"bbox":{"x":416,"y":182,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":416,"y":189,"text":" x"},{"wmode":0,"bbox":{"x":425,"y":179,"w":91,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":425,"y":189,"text":" of length ranging from"},{"wmode":0,"bbox":{"x":516,"y":179,"w":11,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":516,"y":189,"text":" 64"},{"wmode":0,"bbox":{"x":528,"y":179,"w":10,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":528,"y":189,"text":" to"},{"wmode":0,"bbox":{"x":539,"y":179,"w":16,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":539,"y":189,"text":" 256"},{"wmode":0,"bbox":{"x":316,"y":189,"w":85,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":199,"text":"bits. There were 753"},{"wmode":0,"bbox":{"x":402,"y":189,"w":6,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":402,"y":199,"text":" ("},{"wmode":0,"bbox":{"x":408,"y":193,"w":13,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":408,"y":199,"text":"p, g"},{"wmode":0,"bbox":{"x":422,"y":189,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":422,"y":199,"text":")"},{"wmode":0,"bbox":{"x":425,"y":189,"w":129,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":425,"y":199,"text":" pairs where we knew factors of"},{"wmode":0,"bbox":{"x":316,"y":200,"w":105,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":210,"text":"the subgroup generated by"},{"wmode":0,"bbox":{"x":421,"y":203,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":421,"y":210,"text":" g"},{"wmode":0,"bbox":{"x":429,"y":200,"w":126,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":429,"y":210,"text":"; these had been used for 40,903"},{"wmode":0,"bbox":{"x":316,"y":210,"w":140,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":220,"text":"connections across all of our scans."},{"wmode":0,"bbox":{"x":325,"y":221,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":231,"text":"We implemented the van Oorschot and Wiener algorithm in"},{"wmode":0,"bbox":{"x":316,"y":231,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":241,"text":"Sage [47] using a parallel Pollard rho implementation that we"},{"wmode":0,"bbox":{"x":316,"y":241,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":252,"text":"wrote in C using the GMP library. We used the distinguished"},{"wmode":0,"bbox":{"x":316,"y":252,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":262,"text":"points method for collision detection; for a prime known in"},{"wmode":0,"bbox":{"x":316,"y":262,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":272,"text":"advance, this implementation can be arbitrarily sped up by"},{"wmode":0,"bbox":{"x":316,"y":273,"w":182,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":283,"text":"precomputing a table of distinguished points."},{"wmode":0,"bbox":{"x":325,"y":283,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":293,"text":"We computed partial information about the server secret"},{"wmode":0,"bbox":{"x":316,"y":294,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":304,"text":"exponent used in 460 exchanges and were able to recover"},{"wmode":0,"bbox":{"x":316,"y":304,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":314,"text":"the whole exponent used by 159 different hosts, 53 of which"},{"wmode":0,"bbox":{"x":316,"y":315,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":325,"text":"authenticated with valid browser-trusted certificates. In all"},{"wmode":0,"bbox":{"x":316,"y":325,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":335,"text":"cases, the vulnerable hosts used 512-bit prime moduli; three"},{"wmode":0,"bbox":{"x":316,"y":336,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":346,"text":"of them used 160-bit exponents and the rest used 128 bits."},{"wmode":0,"bbox":{"x":316,"y":346,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":356,"text":"The order of the largest-order subgroup ranged from 46 bits"},{"wmode":0,"bbox":{"x":315,"y":357,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":315,"y":367,"text":"(which finishes in seconds) to 81 bits (which took between"},{"wmode":0,"bbox":{"x":316,"y":367,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":377,"text":"50 and 176 hours) implementation. The Pollard lambda"},{"wmode":0,"bbox":{"x":316,"y":377,"w":238,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":388,"text":"calculations used interval width varying from 40 to 70 bits."},{"wmode":0,"bbox":{"x":325,"y":388,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":398,"text":"Our computations would have allowed us to hijack con-"},{"wmode":0,"bbox":{"x":316,"y":398,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":408,"text":"nections to a variety of vulnerable TLS servers, including"},{"wmode":0,"bbox":{"x":316,"y":409,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":419,"text":"web interfaces for VPN devices (48 hosts), communications"},{"wmode":0,"bbox":{"x":316,"y":419,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":429,"text":"software (21 hosts), web conferencing servers (27 hosts), and"},{"wmode":0,"bbox":{"x":316,"y":430,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":440,"text":"FTP servers (6 hosts). As a proof-of-concept, we modified"},{"wmode":0,"bbox":{"x":316,"y":440,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":450,"text":"our man-in-the-middle attacker of §3.3 to impersonate a"},{"wmode":0,"bbox":{"x":316,"y":451,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":461,"text":"vulnerable server and capture user credentials. Compared"},{"wmode":0,"bbox":{"x":316,"y":461,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":471,"text":"to an attack using NFS, we could compute the discrete log"},{"wmode":0,"bbox":{"x":316,"y":472,"w":196,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":482,"text":"with a delay hardly noticeable for browser users."}]},{"type":"text","bbox":{"x":315,"y":487,"w":241,"h":232},"lines":[{"wmode":0,"bbox":{"x":316,"y":487,"w":99,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":316,"y":497,"text":"Misconfigured groups"},{"wmode":0,"bbox":{"x":427,"y":487,"w":128,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":427,"y":497,"text":"The Digital Signature Algorithm"},{"wmode":0,"bbox":{"x":315,"y":497,"w":94,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":315,"y":508,"text":"(DSA) [38] uses primes"},{"wmode":0,"bbox":{"x":409,"y":501,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":409,"y":508,"text":" p"},{"wmode":0,"bbox":{"x":417,"y":497,"w":41,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":417,"y":508,"text":" such that"},{"wmode":0,"bbox":{"x":458,"y":501,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":458,"y":508,"text":" p"},{"wmode":0,"bbox":{"x":466,"y":501,"w":9,"h":15},"font":{"name":"BIPZIA+LMMathSymbols9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":466,"y":508,"text":" −"},{"wmode":0,"bbox":{"x":475,"y":497,"w":6,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":475,"y":508,"text":" 1"},{"wmode":0,"bbox":{"x":482,"y":497,"w":73,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":482,"y":508,"text":" has a large prime"},{"wmode":0,"bbox":{"x":316,"y":508,"w":23,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":518,"text":"factor"},{"wmode":0,"bbox":{"x":340,"y":511,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":340,"y":518,"text":" q"},{"wmode":0,"bbox":{"x":347,"y":508,"w":18,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":347,"y":518,"text":" and"},{"wmode":0,"bbox":{"x":365,"y":511,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":365,"y":518,"text":" g"},{"wmode":0,"bbox":{"x":373,"y":508,"w":144,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":373,"y":518,"text":" generates only a subgroup of order"},{"wmode":0,"bbox":{"x":517,"y":511,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":517,"y":518,"text":" q"},{"wmode":0,"bbox":{"x":525,"y":508,"w":30,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":525,"y":518,"text":". When"},{"wmode":0,"bbox":{"x":316,"y":518,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":529,"text":"using properly generated DSA parameters, these groups are"},{"wmode":0,"bbox":{"x":316,"y":529,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":539,"text":"secure for use in Diffie-Hellman key exchanges. Notably, DSA"},{"wmode":0,"bbox":{"x":316,"y":539,"w":136,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":549,"text":"groups are hard-coded in Java’s"},{"wmode":0,"bbox":{"x":452,"y":540,"w":103,"h":11},"font":{"name":"LYJWZZ+LMMono9-Regular","family":"monospace","weight":"normal","style":"normal","size":8},"x":452,"y":549,"text":" sun.security.provider"},{"wmode":0,"bbox":{"x":316,"y":550,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":560,"text":"package and are used by default in many Java-based TLS"},{"wmode":0,"bbox":{"x":316,"y":560,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":570,"text":"servers. However, some servers in our scans used Java’s DSA"},{"wmode":0,"bbox":{"x":316,"y":571,"w":36,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":581,"text":"primes as"},{"wmode":0,"bbox":{"x":353,"y":574,"w":6,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":353,"y":581,"text":" p"},{"wmode":0,"bbox":{"x":360,"y":571,"w":164,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":360,"y":581,"text":" but mistakenly used the DSA group order"},{"wmode":0,"bbox":{"x":524,"y":574,"w":6,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":524,"y":581,"text":" q"},{"wmode":0,"bbox":{"x":530,"y":571,"w":25,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":530,"y":581,"text":" in the"},{"wmode":0,"bbox":{"x":316,"y":581,"w":84,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":591,"text":"place of the generator"},{"wmode":0,"bbox":{"x":401,"y":585,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":401,"y":591,"text":" g"},{"wmode":0,"bbox":{"x":409,"y":581,"w":146,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":409,"y":591,"text":". We found 5,741 hosts misconfigured"},{"wmode":0,"bbox":{"x":316,"y":592,"w":35,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":602,"text":"this way."},{"wmode":0,"bbox":{"x":325,"y":602,"w":77,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":612,"text":"This substitution of"},{"wmode":0,"bbox":{"x":403,"y":605,"w":6,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":403,"y":612,"text":" q"},{"wmode":0,"bbox":{"x":409,"y":602,"w":13,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":409,"y":612,"text":" for"},{"wmode":0,"bbox":{"x":423,"y":605,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":423,"y":612,"text":" g"},{"wmode":0,"bbox":{"x":430,"y":602,"w":126,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":430,"y":612,"text":" is likely due to a usability prob-"},{"wmode":0,"bbox":{"x":316,"y":613,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":623,"text":"lem: the canonical ASN.1 representation of Diffie-Hellman"},{"wmode":0,"bbox":{"x":316,"y":623,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":633,"text":"key exchange parameters (coming from PKCS#3) is a se-"},{"wmode":0,"bbox":{"x":316,"y":633,"w":27,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":644,"text":"quence"},{"wmode":0,"bbox":{"x":344,"y":633,"w":6,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":344,"y":644,"text":" ("},{"wmode":0,"bbox":{"x":351,"y":637,"w":13,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":351,"y":644,"text":"p, g"},{"wmode":0,"bbox":{"x":364,"y":633,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":364,"y":644,"text":")"},{"wmode":0,"bbox":{"x":368,"y":633,"w":187,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":368,"y":644,"text":", while that of DSA parameters (coming from"},{"wmode":0,"bbox":{"x":316,"y":644,"w":36,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":654,"text":"PKIX) is"},{"wmode":0,"bbox":{"x":352,"y":644,"w":6,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":352,"y":654,"text":" ("},{"wmode":0,"bbox":{"x":359,"y":647,"w":21,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":359,"y":654,"text":"p, q, g"},{"wmode":0,"bbox":{"x":381,"y":644,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":381,"y":654,"text":")"},{"wmode":0,"bbox":{"x":385,"y":644,"w":170,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":385,"y":654,"text":"; we conjecture that the confusion between"},{"wmode":0,"bbox":{"x":316,"y":654,"w":198,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":665,"text":"these formats led to a simple programming error."},{"wmode":0,"bbox":{"x":325,"y":665,"w":186,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":675,"text":"In a DSA group, the subgroup generated by"},{"wmode":0,"bbox":{"x":512,"y":668,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":512,"y":675,"text":" q"},{"wmode":0,"bbox":{"x":520,"y":665,"w":36,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":520,"y":675,"text":" is likely"},{"wmode":0,"bbox":{"x":316,"y":675,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":685,"text":"to have many small prime factors in its order, since for"},{"wmode":0,"bbox":{"x":547,"y":679,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":547,"y":685,"text":" p"},{"wmode":0,"bbox":{"x":316,"y":686,"w":114,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":696,"text":"generated according to [38],"},{"wmode":0,"bbox":{"x":431,"y":686,"w":6,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":431,"y":696,"text":" ("},{"wmode":0,"bbox":{"x":438,"y":689,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":438,"y":696,"text":"p"},{"wmode":0,"bbox":{"x":442,"y":689,"w":9,"h":15},"font":{"name":"BIPZIA+LMMathSymbols9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":442,"y":696,"text":" −"},{"wmode":0,"bbox":{"x":452,"y":686,"w":10,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":452,"y":696,"text":" 1)"},{"wmode":0,"bbox":{"x":462,"y":689,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":462,"y":696,"text":"/q"},{"wmode":0,"bbox":{"x":471,"y":686,"w":86,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":471,"y":696,"text":" is a random integer."},{"wmode":0,"bbox":{"x":316,"y":696,"w":39,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":706,"text":"For Java’s"},{"wmode":0,"bbox":{"x":356,"y":697,"w":101,"h":11},"font":{"name":"LYJWZZ+LMMono9-Regular","family":"monospace","weight":"normal","style":"normal","size":8},"x":356,"y":706,"text":" sun.security.provider"},{"wmode":0,"bbox":{"x":457,"y":696,"w":80,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":457,"y":706,"text":" 512-bit prime, using"},{"wmode":0,"bbox":{"x":538,"y":700,"w":6,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":538,"y":706,"text":" q"},{"wmode":0,"bbox":{"x":545,"y":696,"w":10,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":545,"y":706,"text":" as"},{"wmode":0,"bbox":{"x":316,"y":707,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":717,"text":"a generator leaks 290 bits of information about exponents at"}]},{"type":"text","bbox":{"x":302,"y":737,"w":4,"h":12},"lines":[{"wmode":0,"bbox":{"x":302,"y":737,"w":4,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":302,"y":747,"text":"6"}]}]},{"blocks":[{"type":"text","bbox":{"x":53,"y":49,"w":240,"h":58},"lines":[{"wmode":0,"bbox":{"x":53,"y":53,"w":67,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":63,"text":"a cost of roughly"},{"wmode":0,"bbox":{"x":121,"y":53,"w":7,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":121,"y":63,"text":" 2"},{"wmode":0,"bbox":{"x":128,"y":53,"w":7,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":128,"y":59,"text":"40"},{"wmode":0,"bbox":{"x":135,"y":49,"w":157,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":135,"y":59,"text":" operations. Luckily, since the provider"},{"wmode":0,"bbox":{"x":53,"y":64,"w":125,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":74,"text":"generates exponents of length"},{"wmode":0,"bbox":{"x":179,"y":64,"w":21,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":179,"y":74,"text":" max"},{"wmode":0,"bbox":{"x":201,"y":64,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":201,"y":74,"text":"("},{"wmode":0,"bbox":{"x":205,"y":67,"w":10,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":205,"y":74,"text":"n/"},{"wmode":0,"bbox":{"x":215,"y":64,"w":4,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":215,"y":74,"text":"2"},{"wmode":0,"bbox":{"x":220,"y":67,"w":2,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":220,"y":74,"text":","},{"wmode":0,"bbox":{"x":222,"y":64,"w":19,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":222,"y":74,"text":" 384)"},{"wmode":0,"bbox":{"x":241,"y":64,"w":15,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":241,"y":74,"text":" for"},{"wmode":0,"bbox":{"x":257,"y":67,"w":10,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":257,"y":74,"text":" n"},{"wmode":0,"bbox":{"x":267,"y":64,"w":14,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":267,"y":74,"text":"-bit"},{"wmode":0,"bbox":{"x":282,"y":67,"w":9,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":282,"y":74,"text":" p"},{"wmode":0,"bbox":{"x":291,"y":64,"w":2,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":291,"y":74,"text":","},{"wmode":0,"bbox":{"x":53,"y":74,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":84,"text":"this does not suffice to recover a full exponent. Still, this"},{"wmode":0,"bbox":{"x":53,"y":85,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":95,"text":"misconfiguration bug results in a significant loss of security"},{"wmode":0,"bbox":{"x":53,"y":95,"w":196,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":105,"text":"and serves as a cautionary tale for programmers."}]},{"type":"text","bbox":{"x":53,"y":117,"w":241,"h":476},"lines":[{"wmode":0,"bbox":{"x":53,"y":117,"w":8,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":53,"y":129,"text":"4."},{"wmode":0,"bbox":{"x":74,"y":117,"w":181,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":74,"y":129,"text":"STATE-LEVEL THREATS TO DH"},{"wmode":0,"bbox":{"x":62,"y":132,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":142,"text":"The previous sections demonstrate the existence of practi-"},{"wmode":0,"bbox":{"x":53,"y":142,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":152,"text":"cal attacks against Diffie-Hellman key exchange as currently"},{"wmode":0,"bbox":{"x":53,"y":152,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":163,"text":"used by TLS. However, these attacks rely on the ability to"},{"wmode":0,"bbox":{"x":53,"y":163,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":173,"text":"downgrade connections to export-grade crypto or on the use"},{"wmode":0,"bbox":{"x":53,"y":173,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":183,"text":"of unsafe parameters. In this section we address the following"},{"wmode":0,"bbox":{"x":53,"y":184,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":194,"text":"question: how secure is Diffie-Hellman in broader practice,"},{"wmode":0,"bbox":{"x":53,"y":194,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":204,"text":"as used in other protocols that do not suffer from downgrade,"},{"wmode":0,"bbox":{"x":53,"y":205,"w":162,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":215,"text":"and when applied with stronger groups?"},{"wmode":0,"bbox":{"x":62,"y":215,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":225,"text":"To answer this question we must first examine how the"},{"wmode":0,"bbox":{"x":53,"y":226,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":236,"text":"number field sieve for discrete log scales to 768- and 1024-bit"},{"wmode":0,"bbox":{"x":53,"y":236,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":246,"text":"groups. As we argue below, 768-bit groups, which are still in"},{"wmode":0,"bbox":{"x":53,"y":247,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":257,"text":"relatively widespread use, are now within reach for academic"},{"wmode":0,"bbox":{"x":53,"y":257,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":267,"text":"computational resources, and performing precomputations"},{"wmode":0,"bbox":{"x":53,"y":268,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":278,"text":"for a small number of 1024-bit groups is plausibly within"},{"wmode":0,"bbox":{"x":53,"y":278,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":288,"text":"the resources of state-level attackers. The precomputation"},{"wmode":0,"bbox":{"x":53,"y":288,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":299,"text":"would likely require special-purpose hardware, but would not"},{"wmode":0,"bbox":{"x":53,"y":299,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":309,"text":"require any major algorithmic improvements beyond what is"},{"wmode":0,"bbox":{"x":53,"y":309,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":319,"text":"known in the academic literature. We further show that even"},{"wmode":0,"bbox":{"x":53,"y":320,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":330,"text":"in the 1024-bit case, the descent time—necessary to solve"},{"wmode":0,"bbox":{"x":53,"y":330,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":340,"text":"any specific discrete log instance within a common group—"},{"wmode":0,"bbox":{"x":53,"y":341,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":351,"text":"would be fast enough to break individual key exchanges in"},{"wmode":0,"bbox":{"x":53,"y":351,"w":71,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":361,"text":"close to real time."},{"wmode":0,"bbox":{"x":62,"y":362,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":372,"text":"In light of these results, we examine several standard Inter-"},{"wmode":0,"bbox":{"x":53,"y":372,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":382,"text":"net security protocols—IKE, SSH, and TLS—to determine"},{"wmode":0,"bbox":{"x":53,"y":383,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":393,"text":"the vulnerability of their key exchanges to attacks by resource-"},{"wmode":0,"bbox":{"x":53,"y":393,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":403,"text":"ful attackers. Although the cost of the precomputation for a"},{"wmode":0,"bbox":{"x":53,"y":404,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":414,"text":"1024-bit group is several times higher than for an RSA key"},{"wmode":0,"bbox":{"x":53,"y":414,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":424,"text":"of equal size, we observe that a one-time investment could be"},{"wmode":0,"bbox":{"x":53,"y":424,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":435,"text":"used to attack millions of hosts, due to widespread reuse of"},{"wmode":0,"bbox":{"x":53,"y":435,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":445,"text":"the most common Diffie-Hellman parameters. Unfortunately,"},{"wmode":0,"bbox":{"x":53,"y":445,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":455,"text":"our measurements also indicate that it may be very difficult"},{"wmode":0,"bbox":{"x":53,"y":456,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":466,"text":"to sunset the use of fixed 1024-bit Diffie-Hellman groups that"},{"wmode":0,"bbox":{"x":53,"y":466,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":476,"text":"have long been embedded in standards and implementations."},{"wmode":0,"bbox":{"x":62,"y":477,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":487,"text":"Finally, we apply this new understanding to a set of re-"},{"wmode":0,"bbox":{"x":53,"y":487,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":497,"text":"cently published documents leaked by Edward Snowden [46]"},{"wmode":0,"bbox":{"x":53,"y":498,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":508,"text":"to evaluate the hypothesis that the National Security Agency"},{"wmode":0,"bbox":{"x":53,"y":508,"w":13,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":518,"text":"has"},{"wmode":0,"bbox":{"x":67,"y":508,"w":32,"h":12},"font":{"name":"DEEZDF+LMRoman9-Italic","family":"serif","weight":"normal","style":"italic","size":9},"x":67,"y":518,"text":" already"},{"wmode":0,"bbox":{"x":99,"y":508,"w":193,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":99,"y":518,"text":" implemented such a capability. We show that"},{"wmode":0,"bbox":{"x":53,"y":519,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":529,"text":"this hypothesis is consistent with the published details of"},{"wmode":0,"bbox":{"x":53,"y":529,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":539,"text":"the intelligence community’s cryptanalytic capabilities, and,"},{"wmode":0,"bbox":{"x":53,"y":539,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":550,"text":"indeed, matches the known capabilities more closely than"},{"wmode":0,"bbox":{"x":53,"y":550,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":560,"text":"other proposed explanations, such as novel breaks on RC4"},{"wmode":0,"bbox":{"x":53,"y":560,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":571,"text":"or AES. We believe that this analysis may help shed light"},{"wmode":0,"bbox":{"x":53,"y":571,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":581,"text":"on unanswered questions about how NSA may be gaining"},{"wmode":0,"bbox":{"x":53,"y":581,"w":151,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":591,"text":"access to VPN, SSH, and TLS traffic."}]},{"type":"text","bbox":{"x":53,"y":598,"w":240,"h":121},"lines":[{"wmode":0,"bbox":{"x":53,"y":598,"w":14,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":53,"y":610,"text":"4.1"},{"wmode":0,"bbox":{"x":80,"y":598,"w":188,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":80,"y":610,"text":"Scaling NFS to 768- and 1024-bit DH"},{"wmode":0,"bbox":{"x":62,"y":613,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":623,"text":"Estimating the cost for discrete log cryptanalysis at longer"},{"wmode":0,"bbox":{"x":53,"y":623,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":633,"text":"key sizes is far from straightforward, due in part to the"},{"wmode":0,"bbox":{"x":53,"y":633,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":644,"text":"complexity of parameter tuning and to tradeoffs between the"},{"wmode":0,"bbox":{"x":53,"y":644,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":654,"text":"sieving and linear algebra steps, which have very different"},{"wmode":0,"bbox":{"x":53,"y":654,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":665,"text":"computational characteristics. (Much more attention has"},{"wmode":0,"bbox":{"x":53,"y":665,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":675,"text":"gone to understanding 1024-bit factorization, but, even there,"},{"wmode":0,"bbox":{"x":53,"y":675,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":685,"text":"many published estimates are crude extrapolations of the"},{"wmode":0,"bbox":{"x":53,"y":686,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":696,"text":"asymptotic complexity.) We attempt estimates for 768- and"},{"wmode":0,"bbox":{"x":53,"y":696,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":706,"text":"1024-bit discrete log based on the existing literature and"},{"wmode":0,"bbox":{"x":53,"y":707,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":717,"text":"our own experiments, but further work is needed for greater"}]},{"type":"text","bbox":{"x":316,"y":53,"w":239,"h":23},"lines":[{"wmode":0,"bbox":{"x":316,"y":53,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":63,"text":"confidence, particularly for the 1024-bit case. We summarize"},{"wmode":0,"bbox":{"x":316,"y":64,"w":194,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":74,"text":"all the costs, measured or estimated, in Table 2."}]},{"type":"text","bbox":{"x":316,"y":78,"w":241,"h":420},"lines":[{"wmode":0,"bbox":{"x":316,"y":78,"w":180,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":316,"y":88,"text":"DH-768: Feasible with academic power"},{"wmode":0,"bbox":{"x":509,"y":78,"w":47,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":509,"y":88,"text":"For the 768-"},{"wmode":0,"bbox":{"x":316,"y":88,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":99,"text":"bit case, we base our estimates on the recent discrete log"},{"wmode":0,"bbox":{"x":316,"y":99,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":109,"text":"record at 596 bits [8] and the integer factorization record of"},{"wmode":0,"bbox":{"x":316,"y":109,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":120,"text":"768 bits from 2009 [29]. While the algorithms for factorization"},{"wmode":0,"bbox":{"x":316,"y":120,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":130,"text":"and discrete log are similar, the discrete log linear algebra"},{"wmode":0,"bbox":{"x":316,"y":130,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":140,"text":"stage is many times more difficult, as the matrix entries are"},{"wmode":0,"bbox":{"x":316,"y":141,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":151,"text":"no longer Boolean. We can reduce overall time by sieving"},{"wmode":0,"bbox":{"x":316,"y":151,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":161,"text":"more, thus generating a smaller input matrix to the linear"},{"wmode":0,"bbox":{"x":316,"y":162,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":172,"text":"algebra step. Since sieving parallelizes better than linear"},{"wmode":0,"bbox":{"x":316,"y":172,"w":199,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":182,"text":"algebra, this tradeoff is desirable for large inputs."},{"wmode":0,"bbox":{"x":325,"y":183,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":193,"text":"A 596-bit factorization takes about 5 core-years, most"},{"wmode":0,"bbox":{"x":316,"y":193,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":203,"text":"of it spent on sieving. In comparison, the record 596-bit"},{"wmode":0,"bbox":{"x":316,"y":204,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":214,"text":"discrete log effort tuned parameters such that they spent"},{"wmode":0,"bbox":{"x":316,"y":214,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":224,"text":"50 core-years on sieving. This reduced their linear algebra"},{"wmode":0,"bbox":{"x":316,"y":224,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":235,"text":"calculation to 80 core-years. We used this same strategy in"},{"wmode":0,"bbox":{"x":316,"y":235,"w":128,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":245,"text":"our 512-bit experiments in §3.3."},{"wmode":0,"bbox":{"x":325,"y":245,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":256,"text":"Similarly, the 768-bit RSA factoring record spent more"},{"wmode":0,"bbox":{"x":316,"y":256,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":266,"text":"time on sieving in order to save time on the linear algebra"},{"wmode":0,"bbox":{"x":316,"y":266,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":276,"text":"step. The cost of sieving was around 1500 core-years, and"},{"wmode":0,"bbox":{"x":316,"y":277,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":287,"text":"the matrix that was produced had 200M rows and columns."},{"wmode":0,"bbox":{"x":316,"y":287,"w":241,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":297,"text":"As a result, the linear algebra took 150 core-years, but tak-"},{"wmode":0,"bbox":{"x":316,"y":298,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":308,"text":"ing algorithmic improvements since 2009 into account and"},{"wmode":0,"bbox":{"x":316,"y":308,"w":115,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":318,"text":"optimizing for the total time,"},{"wmode":0,"bbox":{"x":432,"y":308,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":432,"y":314,"text":"3"},{"wmode":0,"bbox":{"x":436,"y":304,"w":119,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":436,"y":314,"text":" we estimate that factoring an"},{"wmode":0,"bbox":{"x":316,"y":319,"w":208,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":329,"text":"RSA-768 integer would take 900 core-years in total."},{"wmode":0,"bbox":{"x":325,"y":329,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":339,"text":"For a 768-bit discrete log, we can expect that ten times as"},{"wmode":0,"bbox":{"x":316,"y":340,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":350,"text":"much sieving as the RSA case would reduce the matrix to"},{"wmode":0,"bbox":{"x":316,"y":350,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":360,"text":"around 150M rows. We extrapolate from experiments with"},{"wmode":0,"bbox":{"x":316,"y":360,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":371,"text":"existing software that this linear algebra would take 28,500"},{"wmode":0,"bbox":{"x":316,"y":371,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":381,"text":"core-years, for a total of 36,500 core-years. This is within"},{"wmode":0,"bbox":{"x":316,"y":381,"w":201,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":391,"text":"reach by computing power available to academics."},{"wmode":0,"bbox":{"x":325,"y":392,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":402,"text":"The descent step takes relatively little time. We experi-"},{"wmode":0,"bbox":{"x":316,"y":402,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":412,"text":"mented with both CADO-NFS and a new implementation"},{"wmode":0,"bbox":{"x":316,"y":413,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":423,"text":"with GMP-ECM based on the early-abort strategy described"},{"wmode":0,"bbox":{"x":316,"y":423,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":433,"text":"in [6]. Using these techniques, the initial descent phase took"},{"wmode":0,"bbox":{"x":316,"y":434,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":444,"text":"an average of around 1 core-day. The remaining phase uses"},{"wmode":0,"bbox":{"x":316,"y":444,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":454,"text":"sieving much as in the precomputation; extrapolating from"},{"wmode":0,"bbox":{"x":316,"y":455,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":465,"text":"experiments, the rest of the descent should take at most"},{"wmode":0,"bbox":{"x":316,"y":465,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":475,"text":"1 core-day. In total, after precomputation, the cost of a"},{"wmode":0,"bbox":{"x":316,"y":476,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":486,"text":"single 768-bit discrete log computation is around 2 core-days"},{"wmode":0,"bbox":{"x":316,"y":486,"w":107,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":496,"text":"and is easily parallelizable."}]},{"type":"text","bbox":{"x":316,"y":500,"w":240,"h":190},"lines":[{"wmode":0,"bbox":{"x":316,"y":500,"w":213,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":316,"y":511,"text":"DH-1024: Plausible with state-level resources"},{"wmode":0,"bbox":{"x":542,"y":500,"w":14,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":542,"y":511,"text":"Ex-"},{"wmode":0,"bbox":{"x":316,"y":511,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":521,"text":"perimentally extrapolating sieving parameters to the 1024-bit"},{"wmode":0,"bbox":{"x":316,"y":521,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":531,"text":"case is difficult due to the tradeoffs between the steps of the"},{"wmode":0,"bbox":{"x":316,"y":532,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":542,"text":"algorithm and their relative parallelism. The prior work"},{"wmode":0,"bbox":{"x":316,"y":542,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":552,"text":"proposing parameters for factoring a 1024-bit RSA key is"},{"wmode":0,"bbox":{"x":316,"y":553,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":563,"text":"thin: [28] proposes smoothness bounds of 42 bits, but the"},{"wmode":0,"bbox":{"x":316,"y":563,"w":192,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":573,"text":"proposed value of the sieving region parameter"},{"wmode":0,"bbox":{"x":509,"y":564,"w":7,"h":11},"font":{"name":"LYJWZZ+LMMono9-Regular","family":"monospace","weight":"normal","style":"normal","size":8},"x":509,"y":573,"text":" I"},{"wmode":0,"bbox":{"x":516,"y":563,"w":39,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":516,"y":573,"text":" is clearly"},{"wmode":0,"bbox":{"x":316,"y":574,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":584,"text":"too small, giving too few smooth results per sieving sub-"},{"wmode":0,"bbox":{"x":316,"y":584,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":594,"text":"task. Since no publicly available software can currently deal"},{"wmode":0,"bbox":{"x":316,"y":595,"w":57,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":605,"text":"with values of"},{"wmode":0,"bbox":{"x":374,"y":596,"w":8,"h":11},"font":{"name":"LYJWZZ+LMMono9-Regular","family":"monospace","weight":"normal","style":"normal","size":8},"x":374,"y":605,"text":" I"},{"wmode":0,"bbox":{"x":382,"y":595,"w":173,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":382,"y":605,"text":" larger than those proposed, we could not"},{"wmode":0,"bbox":{"x":316,"y":605,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":615,"text":"experimentally update the estimates of this paper with more"},{"wmode":0,"bbox":{"x":316,"y":615,"w":109,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":626,"text":"relevant parameter choices."},{"wmode":0,"bbox":{"x":325,"y":626,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":636,"text":"Without better parameter choices, we resort to extrapolat-"},{"wmode":0,"bbox":{"x":316,"y":636,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":647,"text":"ing from asymptotic complexity. For the number field sieve,"},{"wmode":0,"bbox":{"x":316,"y":647,"w":71,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":657,"text":"the complexity is"},{"wmode":0,"bbox":{"x":388,"y":647,"w":17,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":388,"y":657,"text":" exp"},{"wmode":0,"bbox":{"x":406,"y":641,"w":6,"h":45},"font":{"name":"ITXTHR+LMMathExtension10-Regula","family":"serif","weight":"normal","style":"normal","size":9},"x":406,"y":657,"text":" �"},{"wmode":0,"bbox":{"x":412,"y":647,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":412,"y":657,"text":"("},{"wmode":0,"bbox":{"x":416,"y":650,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":416,"y":657,"text":"k"},{"wmode":0,"bbox":{"x":421,"y":647,"w":10,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":421,"y":657,"text":" +"},{"wmode":0,"bbox":{"x":431,"y":650,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":431,"y":657,"text":" o"},{"wmode":0,"bbox":{"x":438,"y":647,"w":19,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":438,"y":657,"text":"(1))("},{"wmode":0,"bbox":{"x":457,"y":647,"w":11,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":457,"y":657,"text":"log"},{"wmode":0,"bbox":{"x":469,"y":650,"w":9,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":469,"y":657,"text":" N"},{"wmode":0,"bbox":{"x":479,"y":647,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":479,"y":657,"text":")"},{"wmode":0,"bbox":{"x":483,"y":646,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":483,"y":653,"text":"1"},{"wmode":0,"bbox":{"x":486,"y":649,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":486,"y":653,"text":"/"},{"wmode":0,"bbox":{"x":490,"y":646,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":490,"y":653,"text":"3"},{"wmode":0,"bbox":{"x":494,"y":647,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":494,"y":657,"text":"("},{"wmode":0,"bbox":{"x":498,"y":647,"w":25,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":498,"y":657,"text":"log log"},{"wmode":0,"bbox":{"x":523,"y":650,"w":9,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":523,"y":657,"text":" N"},{"wmode":0,"bbox":{"x":533,"y":647,"w":3,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":533,"y":657,"text":")"},{"wmode":0,"bbox":{"x":537,"y":646,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":537,"y":653,"text":"2"},{"wmode":0,"bbox":{"x":540,"y":649,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":540,"y":653,"text":"/"},{"wmode":0,"bbox":{"x":544,"y":646,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":544,"y":653,"text":"3"},{"wmode":0,"bbox":{"x":548,"y":641,"w":4,"h":37},"font":{"name":"ITXTHR+LMMathExtension10-Regula","family":"serif","weight":"normal","style":"normal","size":9},"x":548,"y":649,"text":"�"},{"wmode":0,"bbox":{"x":553,"y":650,"w":2,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":553,"y":657,"text":","},{"wmode":0,"bbox":{"x":316,"y":657,"w":24,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":667,"text":"where"},{"wmode":0,"bbox":{"x":340,"y":661,"w":10,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":340,"y":667,"text":" N"},{"wmode":0,"bbox":{"x":351,"y":657,"w":204,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":351,"y":667,"text":" is the integer to factor or the prime modulus for"},{"wmode":0,"bbox":{"x":316,"y":668,"w":67,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":678,"text":"discrete log, and"},{"wmode":0,"bbox":{"x":384,"y":671,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":384,"y":678,"text":" k"},{"wmode":0,"bbox":{"x":392,"y":668,"w":163,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":392,"y":678,"text":" is an algorithm-specific constant. This"},{"wmode":0,"bbox":{"x":316,"y":678,"w":168,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":688,"text":"formula is inherently imprecise, since the"},{"wmode":0,"bbox":{"x":485,"y":682,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":485,"y":688,"text":" o"},{"wmode":0,"bbox":{"x":492,"y":678,"w":12,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":492,"y":688,"text":"(1)"},{"wmode":0,"bbox":{"x":504,"y":678,"w":52,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":504,"y":688,"text":" in the expo-"}]},{"type":"text","bbox":{"x":316,"y":697,"w":239,"h":22},"lines":[{"wmode":0,"bbox":{"x":317,"y":697,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":317,"y":704,"text":"3"},{"wmode":0,"bbox":{"x":321,"y":698,"w":234,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":321,"y":708,"text":"We would lower the smoothness bounds compared to the"},{"wmode":0,"bbox":{"x":316,"y":707,"w":75,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":717,"text":"parameters in [29]."}]},{"type":"text","bbox":{"x":302,"y":737,"w":4,"h":12},"lines":[{"wmode":0,"bbox":{"x":302,"y":737,"w":4,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":302,"y":747,"text":"7"}]}]},{"blocks":[{"type":"text","bbox":{"x":147,"y":54,"w":182,"h":11},"lines":[{"wmode":0,"bbox":{"x":147,"y":54,"w":26,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":147,"y":63,"text":"Sieving"},{"wmode":0,"bbox":{"x":225,"y":54,"w":55,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":225,"y":63,"text":"Linear Algebra"},{"wmode":0,"bbox":{"x":301,"y":54,"w":28,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":301,"y":63,"text":"Descent"}]},{"type":"text","bbox":{"x":119,"y":67,"w":213,"h":13},"lines":[{"wmode":0,"bbox":{"x":119,"y":68,"w":4,"h":10},"font":{"name":"XYNSKK+LMMono8-Regular","family":"monospace","weight":"normal","style":"normal","size":7},"x":119,"y":76,"text":"I"},{"wmode":0,"bbox":{"x":134,"y":67,"w":10,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":134,"y":76,"text":"log"},{"wmode":0,"bbox":{"x":145,"y":71,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":145,"y":78,"text":"2"},{"wmode":0,"bbox":{"x":149,"y":70,"w":8,"h":10},"font":{"name":"GSJZLO+LMMathItalic8-Regular","family":"serif","weight":"normal","style":"italic","size":7},"x":149,"y":78,"text":" B"},{"wmode":0,"bbox":{"x":170,"y":67,"w":36,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":170,"y":76,"text":"core-years"},{"wmode":0,"bbox":{"x":221,"y":67,"w":16,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":221,"y":76,"text":"rows"},{"wmode":0,"bbox":{"x":250,"y":67,"w":36,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":250,"y":76,"text":"core-years"},{"wmode":0,"bbox":{"x":298,"y":67,"w":34,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":298,"y":76,"text":"core-time"}]},{"type":"text","bbox":{"x":71,"y":81,"w":475,"h":20},"lines":[{"wmode":0,"bbox":{"x":71,"y":81,"w":32,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":90,"text":"RSA-512"},{"wmode":0,"bbox":{"x":115,"y":81,"w":8,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":115,"y":90,"text":"14"},{"wmode":0,"bbox":{"x":149,"y":81,"w":8,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":149,"y":90,"text":"29"},{"wmode":0,"bbox":{"x":196,"y":81,"w":10,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":196,"y":90,"text":"0.5"},{"wmode":0,"bbox":{"x":219,"y":81,"w":18,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":219,"y":90,"text":"4.3M"},{"wmode":0,"bbox":{"x":272,"y":81,"w":15,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":272,"y":90,"text":"0.33"},{"wmode":0,"bbox":{"x":351,"y":82,"w":161,"h":9},"font":{"name":"LGIJZT+LMRoman7-Regular","family":"serif","weight":"normal","style":"normal","size":6},"x":351,"y":90,"text":"Timings with default CADO-NFS parameters."},{"wmode":0,"bbox":{"x":76,"y":90,"w":28,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":76,"y":99,"text":"DH-512"},{"wmode":0,"bbox":{"x":115,"y":90,"w":8,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":115,"y":99,"text":"15"},{"wmode":0,"bbox":{"x":149,"y":90,"w":8,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":149,"y":99,"text":"27"},{"wmode":0,"bbox":{"x":196,"y":90,"w":10,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":196,"y":99,"text":"2.5"},{"wmode":0,"bbox":{"x":219,"y":90,"w":18,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":219,"y":99,"text":"2.1M"},{"wmode":0,"bbox":{"x":276,"y":90,"w":10,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":276,"y":99,"text":"7.7"},{"wmode":0,"bbox":{"x":305,"y":90,"w":27,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":305,"y":99,"text":"10 mins"},{"wmode":0,"bbox":{"x":351,"y":91,"w":195,"h":9},"font":{"name":"LGIJZT+LMRoman7-Regular","family":"serif","weight":"normal","style":"normal","size":6},"x":351,"y":99,"text":"For the computations in this paper; may be suboptimal."}]},{"type":"text","bbox":{"x":71,"y":103,"w":442,"h":20},"lines":[{"wmode":0,"bbox":{"x":71,"y":103,"w":32,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":112,"text":"RSA-768"},{"wmode":0,"bbox":{"x":115,"y":103,"w":8,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":115,"y":112,"text":"16"},{"wmode":0,"bbox":{"x":149,"y":103,"w":8,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":149,"y":112,"text":"37"},{"wmode":0,"bbox":{"x":194,"y":103,"w":12,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":194,"y":112,"text":"800"},{"wmode":0,"bbox":{"x":217,"y":103,"w":20,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":217,"y":112,"text":"250M"},{"wmode":0,"bbox":{"x":274,"y":103,"w":12,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":274,"y":112,"text":"100"},{"wmode":0,"bbox":{"x":351,"y":104,"w":123,"h":9},"font":{"name":"LGIJZT+LMRoman7-Regular","family":"serif","weight":"normal","style":"normal","size":6},"x":351,"y":112,"text":"Est. based on [29] with less sieving."},{"wmode":0,"bbox":{"x":76,"y":112,"w":28,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":76,"y":121,"text":"DH-768"},{"wmode":0,"bbox":{"x":115,"y":112,"w":8,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":115,"y":121,"text":"17"},{"wmode":0,"bbox":{"x":149,"y":112,"w":8,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":149,"y":121,"text":"35"},{"wmode":0,"bbox":{"x":187,"y":112,"w":19,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":187,"y":121,"text":"8,000"},{"wmode":0,"bbox":{"x":217,"y":112,"w":20,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":217,"y":121,"text":"150M"},{"wmode":0,"bbox":{"x":264,"y":112,"w":23,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":264,"y":121,"text":"28,500"},{"wmode":0,"bbox":{"x":310,"y":112,"w":22,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":310,"y":121,"text":"2 days"},{"wmode":0,"bbox":{"x":351,"y":113,"w":162,"h":9},"font":{"name":"LGIJZT+LMRoman7-Regular","family":"serif","weight":"normal","style":"normal","size":6},"x":351,"y":121,"text":"Est. based on [8,29] and our own experiments."}]},{"type":"text","bbox":{"x":67,"y":125,"w":477,"h":20},"lines":[{"wmode":0,"bbox":{"x":67,"y":125,"w":37,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":67,"y":134,"text":"RSA-1024"},{"wmode":0,"bbox":{"x":115,"y":125,"w":8,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":115,"y":134,"text":"18"},{"wmode":0,"bbox":{"x":149,"y":125,"w":8,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":149,"y":134,"text":"42"},{"wmode":0,"bbox":{"x":172,"y":125,"w":34,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":172,"y":134,"text":"1,000,000"},{"wmode":0,"bbox":{"x":221,"y":125,"w":16,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":221,"y":134,"text":"8.7B"},{"wmode":0,"bbox":{"x":259,"y":125,"w":27,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":259,"y":134,"text":"120,000"},{"wmode":0,"bbox":{"x":351,"y":126,"w":118,"h":9},"font":{"name":"LGIJZT+LMRoman7-Regular","family":"serif","weight":"normal","style":"normal","size":6},"x":351,"y":134,"text":"Est. based on complexity formula."},{"wmode":0,"bbox":{"x":72,"y":134,"w":32,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":72,"y":143,"text":"DH-1024"},{"wmode":0,"bbox":{"x":115,"y":134,"w":8,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":115,"y":143,"text":"19"},{"wmode":0,"bbox":{"x":149,"y":134,"w":8,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":149,"y":143,"text":"40"},{"wmode":0,"bbox":{"x":168,"y":134,"w":38,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":168,"y":143,"text":"10,000,000"},{"wmode":0,"bbox":{"x":221,"y":134,"w":16,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":221,"y":143,"text":"5.2B"},{"wmode":0,"bbox":{"x":249,"y":134,"w":38,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":249,"y":143,"text":"35,000,000"},{"wmode":0,"bbox":{"x":306,"y":134,"w":26,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":306,"y":143,"text":"30 days"},{"wmode":0,"bbox":{"x":351,"y":135,"w":193,"h":9},"font":{"name":"LGIJZT+LMRoman7-Regular","family":"serif","weight":"normal","style":"normal","size":6},"x":351,"y":143,"text":"Est. based on complexity formula and our experiments."}]},{"type":"text","bbox":{"x":53,"y":153,"w":502,"h":33},"lines":[{"wmode":0,"bbox":{"x":53,"y":153,"w":31,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":163,"text":"Table 2:"},{"wmode":0,"bbox":{"x":85,"y":153,"w":218,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":85,"y":163,"text":" Estimating costs for factoring and discrete log"},{"wmode":0,"bbox":{"x":303,"y":153,"w":252,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":303,"y":163,"text":". For sieving, we give two important parameters: the number of"},{"wmode":0,"bbox":{"x":53,"y":164,"w":116,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":174,"text":"bits of the smoothness bound"},{"wmode":0,"bbox":{"x":170,"y":165,"w":7,"h":11},"font":{"name":"LYJWZZ+LMMono9-Regular","family":"monospace","weight":"normal","style":"normal","size":8},"x":170,"y":174,"text":" B"},{"wmode":0,"bbox":{"x":178,"y":164,"w":133,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":178,"y":174,"text":" and the sieving region parameter"},{"wmode":0,"bbox":{"x":312,"y":165,"w":7,"h":11},"font":{"name":"LYJWZZ+LMMono9-Regular","family":"monospace","weight":"normal","style":"normal","size":8},"x":312,"y":174,"text":" I"},{"wmode":0,"bbox":{"x":319,"y":164,"w":236,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":319,"y":174,"text":". For linear algebra, all costs for DH are for safe primes; for"},{"wmode":0,"bbox":{"x":53,"y":174,"w":69,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":184,"text":"DSA primes with"},{"wmode":0,"bbox":{"x":123,"y":178,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":123,"y":184,"text":" q"},{"wmode":0,"bbox":{"x":130,"y":174,"w":375,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":130,"y":184,"text":" of 160 bits, this should be divided by 6.4 for 1024 bits, 4.8 for 768 bits, and 3.2 for 512 bits."}]},{"type":"text","bbox":{"x":53,"y":205,"w":241,"h":368},"lines":[{"wmode":0,"bbox":{"x":53,"y":205,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":215,"text":"nent can hide polynomial factors. This complexity formula,"},{"wmode":0,"bbox":{"x":53,"y":216,"w":18,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":226,"text":"with"},{"wmode":0,"bbox":{"x":71,"y":219,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":71,"y":226,"text":" k"},{"wmode":0,"bbox":{"x":79,"y":216,"w":17,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":79,"y":226,"text":" = 1"},{"wmode":0,"bbox":{"x":96,"y":219,"w":2,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":96,"y":226,"text":"."},{"wmode":0,"bbox":{"x":99,"y":216,"w":13,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":99,"y":226,"text":"923"},{"wmode":0,"bbox":{"x":113,"y":216,"w":179,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":113,"y":226,"text":", describes the overall time for both discrete"},{"wmode":0,"bbox":{"x":53,"y":226,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":236,"text":"log and factorization, which are both dominated by sieving"},{"wmode":0,"bbox":{"x":53,"y":237,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":247,"text":"and linear algebra in the precomputation. The space com-"},{"wmode":0,"bbox":{"x":53,"y":247,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":257,"text":"plexity (the size of the matrix in memory) is the square root"},{"wmode":0,"bbox":{"x":53,"y":257,"w":191,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":268,"text":"of this function, i.e., the same function, taking"},{"wmode":0,"bbox":{"x":245,"y":261,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":245,"y":268,"text":" k"},{"wmode":0,"bbox":{"x":253,"y":257,"w":17,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":253,"y":268,"text":" = 0"},{"wmode":0,"bbox":{"x":270,"y":261,"w":2,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":270,"y":268,"text":"."},{"wmode":0,"bbox":{"x":273,"y":257,"w":18,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":273,"y":268,"text":"9615"},{"wmode":0,"bbox":{"x":292,"y":257,"w":2,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":292,"y":268,"text":"."},{"wmode":0,"bbox":{"x":53,"y":268,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":278,"text":"Discrete log descent has a complexity of the same form as"},{"wmode":0,"bbox":{"x":53,"y":278,"w":104,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":289,"text":"well; [2, Chapter 4] gives"},{"wmode":0,"bbox":{"x":157,"y":282,"w":8,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":157,"y":289,"text":" k"},{"wmode":0,"bbox":{"x":166,"y":278,"w":19,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":166,"y":289,"text":" = 1"},{"wmode":0,"bbox":{"x":185,"y":282,"w":2,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":185,"y":289,"text":"."},{"wmode":0,"bbox":{"x":188,"y":278,"w":14,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":188,"y":289,"text":"232"},{"wmode":0,"bbox":{"x":202,"y":278,"w":90,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":202,"y":289,"text":", using an early-abort"},{"wmode":0,"bbox":{"x":53,"y":289,"w":203,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":299,"text":"strategy similar to the one in [6] mentioned above."},{"wmode":0,"bbox":{"x":62,"y":299,"w":183,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":309,"text":"Evaluating the formula for 768- and 1024-bit"},{"wmode":0,"bbox":{"x":246,"y":303,"w":10,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":246,"y":309,"text":" N"},{"wmode":0,"bbox":{"x":257,"y":299,"w":35,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":257,"y":309,"text":" gives us"},{"wmode":0,"bbox":{"x":53,"y":310,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":320,"text":"estimated multiplicative factors by which time and space will"},{"wmode":0,"bbox":{"x":53,"y":320,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":330,"text":"increase from the 768- to the 1024-bit case. For precompu-"},{"wmode":0,"bbox":{"x":53,"y":331,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":341,"text":"tation, the total time complexity will increase by a factor"},{"wmode":0,"bbox":{"x":53,"y":341,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":351,"text":"of 1220, while space complexity will increase by a factor of"},{"wmode":0,"bbox":{"x":53,"y":352,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":362,"text":"35. These are valid for both factorization and discrete log,"},{"wmode":0,"bbox":{"x":53,"y":362,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":372,"text":"since they have the same asymptotic behavior. Hence, for"},{"wmode":0,"bbox":{"x":53,"y":373,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":383,"text":"DH-1024, we get a total cost for the precomputation of about"},{"wmode":0,"bbox":{"x":53,"y":383,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":393,"text":"45M core-years. The time complexity for each individual"},{"wmode":0,"bbox":{"x":53,"y":393,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":404,"text":"log after the precomputation should be multiplied by 95."},{"wmode":0,"bbox":{"x":53,"y":404,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":414,"text":"This last number does not correspond to what we observed"},{"wmode":0,"bbox":{"x":53,"y":414,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":424,"text":"in practice; we attribute that to the fact that the descent"},{"wmode":0,"bbox":{"x":53,"y":425,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":435,"text":"step has been far less studied both in theory and in practice"},{"wmode":0,"bbox":{"x":53,"y":435,"w":115,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":445,"text":"compared to the other steps."},{"wmode":0,"bbox":{"x":62,"y":446,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":456,"text":"For 1024-bit descent, we experimented with our early-"},{"wmode":0,"bbox":{"x":53,"y":456,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":466,"text":"abort implementation to inform our estimates for descent"},{"wmode":0,"bbox":{"x":53,"y":467,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":477,"text":"initialization, which should dominate the individual discrete"},{"wmode":0,"bbox":{"x":53,"y":477,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":487,"text":"log computation. For a random target in Oakley Group 2,"},{"wmode":0,"bbox":{"x":53,"y":488,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":498,"text":"initialization took 22 core-days, yielding a few primes of at"},{"wmode":0,"bbox":{"x":53,"y":498,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":508,"text":"most 130 bits to be descended further. In twice this time,"},{"wmode":0,"bbox":{"x":53,"y":509,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":519,"text":"we reached primes of about 110 bits. At this point, we were"},{"wmode":0,"bbox":{"x":53,"y":519,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":529,"text":"certain to have bootstrapped the descent, and could continue"},{"wmode":0,"bbox":{"x":53,"y":529,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":540,"text":"down to the smoothness bound in a few more core-days if"},{"wmode":0,"bbox":{"x":53,"y":540,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":550,"text":"proper sieving software were available. Thus we estimate"},{"wmode":0,"bbox":{"x":53,"y":550,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":560,"text":"that a 1024-bit descent would take about 30 core-days, once"},{"wmode":0,"bbox":{"x":53,"y":561,"w":105,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":571,"text":"again easily parallelizable."}]},{"type":"text","bbox":{"x":53,"y":581,"w":241,"h":138},"lines":[{"wmode":0,"bbox":{"x":53,"y":581,"w":84,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":53,"y":591,"text":"Costs in hardware"},{"wmode":0,"bbox":{"x":150,"y":581,"w":142,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":150,"y":591,"text":"Although 45M core-years is a huge"},{"wmode":0,"bbox":{"x":53,"y":592,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":602,"text":"computational effort, it is not necessarily out of reach for a"},{"wmode":0,"bbox":{"x":53,"y":602,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":612,"text":"nation state. Moreover, at this scale, significant cost savings"},{"wmode":0,"bbox":{"x":53,"y":613,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":623,"text":"could be realized by developing application-specific hardware."},{"wmode":0,"bbox":{"x":62,"y":623,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":633,"text":"Sieving is a natural target for hardware implementation."},{"wmode":0,"bbox":{"x":53,"y":633,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":644,"text":"To our knowledge, the best prior description of an ASIC"},{"wmode":0,"bbox":{"x":53,"y":644,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":654,"text":"implementation of 1024-bit sieving is the 2007 work of Geisel-"},{"wmode":0,"bbox":{"x":53,"y":654,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":665,"text":"mann and Steinwandt [18]. In the following, we update their"},{"wmode":0,"bbox":{"x":53,"y":665,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":675,"text":"estimates for modern techniques and adjust parameters for"},{"wmode":0,"bbox":{"x":53,"y":675,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":685,"text":"discrete log. We increase their chip count by a factor of ten to"},{"wmode":0,"bbox":{"x":53,"y":686,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":696,"text":"sieve more and save on linear algebra as above, giving an esti-"},{"wmode":0,"bbox":{"x":53,"y":696,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":706,"text":"mate of 3M chips to complete sieving in one year. Shrinking"},{"wmode":0,"bbox":{"x":53,"y":707,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":717,"text":"the dies from the 130 nm technology node used in the paper to"}]},{"type":"text","bbox":{"x":316,"y":205,"w":241,"h":389},"lines":[{"wmode":0,"bbox":{"x":316,"y":205,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":215,"text":"a more modern size reduces costs, as transistors are cheaper"},{"wmode":0,"bbox":{"x":316,"y":216,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":226,"text":"at newer technologies. With standard transistor costs and uti-"},{"wmode":0,"bbox":{"x":316,"y":226,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":236,"text":"lization, this would cost about $2 per chip to manufacture, af-"},{"wmode":0,"bbox":{"x":316,"y":237,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":247,"text":"ter fixed design and tape-out costs of roughly $2M [32]. This"},{"wmode":0,"bbox":{"x":316,"y":247,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":257,"text":"suggests that an $8M investment would buy enough ASICs"},{"wmode":0,"bbox":{"x":316,"y":257,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":268,"text":"to complete the DH-1024 sieving precomputation in one year."},{"wmode":0,"bbox":{"x":316,"y":268,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":278,"text":"Since a step of descent uses sieving, the same hardware could"},{"wmode":0,"bbox":{"x":316,"y":278,"w":224,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":289,"text":"likely be reused to speed calculations of individual logs."},{"wmode":0,"bbox":{"x":325,"y":289,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":299,"text":"Estimating the financial cost for the linear algebra is more"},{"wmode":0,"bbox":{"x":316,"y":299,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":309,"text":"difficult, since there has been little work on designing chips"},{"wmode":0,"bbox":{"x":316,"y":310,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":320,"text":"that are suitable for the larger fields involved in discrete log."},{"wmode":0,"bbox":{"x":316,"y":320,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":330,"text":"To derive a rough estimate, we can begin with general purpose"},{"wmode":0,"bbox":{"x":316,"y":331,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":341,"text":"hardware and the core-year estimate from Table 2. The"},{"wmode":0,"bbox":{"x":316,"y":341,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":351,"text":"Titan supercomputer [39]—at 300,000 CPU cores, currently"},{"wmode":0,"bbox":{"x":316,"y":352,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":362,"text":"the most powerful supercomputer in the U.S.—would take"},{"wmode":0,"bbox":{"x":316,"y":362,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":372,"text":"117 years to complete the 1024-bit linear algebra stage. Titan"},{"wmode":0,"bbox":{"x":316,"y":373,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":383,"text":"was constructed in 2012 for $94M, suggesting a cost of $11B"},{"wmode":0,"bbox":{"x":316,"y":383,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":393,"text":"in supercomputers to finish this step in a year. In the context"},{"wmode":0,"bbox":{"x":316,"y":393,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":404,"text":"of factorization, moving linear algebra from general purpose"},{"wmode":0,"bbox":{"x":316,"y":404,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":414,"text":"CPUs to ASICs has been estimated to reduce costs by a"},{"wmode":0,"bbox":{"x":316,"y":414,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":424,"text":"factor of 80 [17]. If we optimistically assume that a similar"},{"wmode":0,"bbox":{"x":316,"y":425,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":435,"text":"reduction can be achieved for discrete log, the hardware cost"},{"wmode":0,"bbox":{"x":316,"y":435,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":445,"text":"to perform the linear algebra for DH-1024 in one year is"},{"wmode":0,"bbox":{"x":316,"y":446,"w":226,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":456,"text":"plausibly on the order of hundreds of millions of dollars."},{"wmode":0,"bbox":{"x":325,"y":456,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":466,"text":"To put this dollar figure in context, the FY 2012 bud-"},{"wmode":0,"bbox":{"x":316,"y":467,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":477,"text":"get for the U.S. Consolidated Cryptologic Program (which"},{"wmode":0,"bbox":{"x":316,"y":477,"w":151,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":487,"text":"includes the NSA) was $10.5 billion"},{"wmode":0,"bbox":{"x":468,"y":477,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":468,"y":483,"text":"4"},{"wmode":0,"bbox":{"x":472,"y":473,"w":21,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":472,"y":483,"text":" [57]."},{"wmode":0,"bbox":{"x":501,"y":477,"w":54,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":501,"y":487,"text":"The agency’s"},{"wmode":0,"bbox":{"x":316,"y":488,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":498,"text":"classified 2013 budget request, which prioritized investment"},{"wmode":0,"bbox":{"x":316,"y":498,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":508,"text":"in “groundbreaking cryptanalytic capabilities to defeat ad-"},{"wmode":0,"bbox":{"x":316,"y":509,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":519,"text":"versarial cryptography and exploit internet traffic,” included"},{"wmode":0,"bbox":{"x":316,"y":519,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":529,"text":"notable $100M increases in two programs [57]: “cryptanalytic"},{"wmode":0,"bbox":{"x":316,"y":529,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":540,"text":"IT services” (to $247M), and a cryptically named “cryptanal-"},{"wmode":0,"bbox":{"x":316,"y":540,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":550,"text":"ysis and exploitation services program C” (to $360M). NSA’s"},{"wmode":0,"bbox":{"x":316,"y":550,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":560,"text":"leaked strategic plan for the period called for it to “continue"},{"wmode":0,"bbox":{"x":316,"y":561,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":571,"text":"to invest in the industrial base and drive the state of the"},{"wmode":0,"bbox":{"x":316,"y":571,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":581,"text":"art for high performance computing to maintain pre-eminent"},{"wmode":0,"bbox":{"x":316,"y":582,"w":178,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":592,"text":"cryptanalytic capability for the nation” [63]."}]},{"type":"text","bbox":{"x":316,"y":601,"w":240,"h":100},"lines":[{"wmode":0,"bbox":{"x":316,"y":601,"w":14,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":316,"y":613,"text":"4.2"},{"wmode":0,"bbox":{"x":343,"y":601,"w":157,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":343,"y":613,"text":"Is NSA Breaking 1024-bit DH?"},{"wmode":0,"bbox":{"x":325,"y":615,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":625,"text":"Our calculations suggest that it is plausibly within NSA’s"},{"wmode":0,"bbox":{"x":316,"y":626,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":636,"text":"resources to have performed number field sieve precomputa-"},{"wmode":0,"bbox":{"x":316,"y":636,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":646,"text":"tions for at least a small number of 1024-bit Diffie-Hellman"},{"wmode":0,"bbox":{"x":316,"y":647,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":657,"text":"groups. This would allow them to break any key exchanges"},{"wmode":0,"bbox":{"x":316,"y":657,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":667,"text":"made with those groups in close to real time. If true, this"},{"wmode":0,"bbox":{"x":316,"y":668,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":678,"text":"would answer one of the major cryptographic questions raised"},{"wmode":0,"bbox":{"x":316,"y":678,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":688,"text":"by the Edward Snowden leaks: How is NSA defeating the"},{"wmode":0,"bbox":{"x":316,"y":689,"w":174,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":699,"text":"encryption for widely used VPN protocols?"}]},{"type":"text","bbox":{"x":317,"y":706,"w":236,"h":13},"lines":[{"wmode":0,"bbox":{"x":317,"y":706,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":317,"y":713,"text":"4"},{"wmode":0,"bbox":{"x":321,"y":707,"w":232,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":321,"y":717,"text":"The National Science Foundation’s budget was $7 billion."}]},{"type":"text","bbox":{"x":302,"y":737,"w":4,"h":12},"lines":[{"wmode":0,"bbox":{"x":302,"y":737,"w":4,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":302,"y":747,"text":"8"}]}]},{"blocks":[{"type":"text","bbox":{"x":52,"y":53,"w":241,"h":666},"lines":[{"wmode":0,"bbox":{"x":62,"y":53,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":63,"text":"Classified documents published by Der Spiegel [46] indi-"},{"wmode":0,"bbox":{"x":53,"y":64,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":74,"text":"cate that NSA is passively decrypting IPsec connections at"},{"wmode":0,"bbox":{"x":53,"y":74,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":84,"text":"significant scale. The documents do not describe the crypt-"},{"wmode":0,"bbox":{"x":53,"y":85,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":95,"text":"analytic techniques used, but they do provide an overview of"},{"wmode":0,"bbox":{"x":53,"y":95,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":105,"text":"the attack system architecture. After reviewing how IPsec"},{"wmode":0,"bbox":{"x":53,"y":105,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":116,"text":"key establishment works, we will use the published informa-"},{"wmode":0,"bbox":{"x":53,"y":116,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":126,"text":"tion to evaluate the hypothesis that the NSA is leveraging"},{"wmode":0,"bbox":{"x":53,"y":126,"w":201,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":136,"text":"precomputation to calculate discrete logs at scale."},{"wmode":0,"bbox":{"x":53,"y":139,"w":19,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":53,"y":149,"text":"IKE"},{"wmode":0,"bbox":{"x":86,"y":139,"w":208,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":86,"y":149,"text":"Internet Key Exchange (IKE) is the main key es-"},{"wmode":0,"bbox":{"x":53,"y":150,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":160,"text":"tablishment protocol used for IPsec VPNs. There are two"},{"wmode":0,"bbox":{"x":53,"y":160,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":170,"text":"versions, IKEv1 [22] and IKEv2 [25], which differ in mes-"},{"wmode":0,"bbox":{"x":53,"y":171,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":181,"text":"sage structure but are conceptually similar. For the sake of"},{"wmode":0,"bbox":{"x":53,"y":181,"w":159,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":191,"text":"brevity, we will use IKEv1 terminology."},{"wmode":0,"bbox":{"x":62,"y":192,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":202,"text":"Each IKE session begins with a Phase 1 handshake, in"},{"wmode":0,"bbox":{"x":53,"y":202,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":212,"text":"which the client and server select a Diffie-Hellman group"},{"wmode":0,"bbox":{"x":53,"y":213,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":223,"text":"from a small set of standardized parameters and perform a"},{"wmode":0,"bbox":{"x":53,"y":223,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":233,"text":"key exchange to establish a shared secret. The shared secret"},{"wmode":0,"bbox":{"x":53,"y":233,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":244,"text":"is combined with other cleartext values transmitted by each"},{"wmode":0,"bbox":{"x":53,"y":244,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":254,"text":"side, such as nonces and cookies, to derive a value called"},{"wmode":0,"bbox":{"x":53,"y":255,"w":30,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":265,"text":"SKEYID"},{"wmode":0,"bbox":{"x":84,"y":254,"w":210,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":84,"y":265,"text":". IKE provides several authentication mechanisms,"},{"wmode":0,"bbox":{"x":53,"y":265,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":275,"text":"including symmetric pre-shared keys (PSK); when IKEv1 is"},{"wmode":0,"bbox":{"x":53,"y":275,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":285,"text":"authenticated with a PSK, this value is incorporated into"},{"wmode":0,"bbox":{"x":53,"y":286,"w":66,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":296,"text":"the derivation of"},{"wmode":0,"bbox":{"x":120,"y":287,"w":33,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":120,"y":296,"text":" SKEYID"},{"wmode":0,"bbox":{"x":153,"y":286,"w":2,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":153,"y":296,"text":"."},{"wmode":0,"bbox":{"x":62,"y":296,"w":53,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":306,"text":"The resulting"},{"wmode":0,"bbox":{"x":115,"y":297,"w":32,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":115,"y":306,"text":" SKEYID"},{"wmode":0,"bbox":{"x":148,"y":296,"w":144,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":148,"y":306,"text":" is used to encrypt and authenticate"},{"wmode":0,"bbox":{"x":53,"y":307,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":317,"text":"a Phase 2 handshake. Phase 2 establishes the parameters"},{"wmode":0,"bbox":{"x":53,"y":317,"w":72,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":327,"text":"and key material,"},{"wmode":0,"bbox":{"x":126,"y":318,"w":39,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":126,"y":327,"text":" KEYMAT"},{"wmode":0,"bbox":{"x":165,"y":317,"w":127,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":165,"y":327,"text":", for a cryptographic transport"},{"wmode":0,"bbox":{"x":53,"y":328,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":338,"text":"protocol used to protect subsequent traffic, such as Encapsu-"},{"wmode":0,"bbox":{"x":53,"y":338,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":348,"text":"lating Security Payload (ESP) [27] or Authenticated Header"},{"wmode":0,"bbox":{"x":52,"y":349,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":52,"y":359,"text":"(AH) [26]. In some circumstances, this phase includes an"},{"wmode":0,"bbox":{"x":53,"y":359,"w":191,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":369,"text":"additional round of Diffie-Hellman. Ultimately,"},{"wmode":0,"bbox":{"x":245,"y":360,"w":38,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":245,"y":369,"text":" KEYMAT"},{"wmode":0,"bbox":{"x":283,"y":359,"w":9,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":283,"y":369,"text":" is"},{"wmode":0,"bbox":{"x":53,"y":369,"w":52,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":380,"text":"derived from"},{"wmode":0,"bbox":{"x":106,"y":370,"w":33,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":106,"y":380,"text":" SKEYID"},{"wmode":0,"bbox":{"x":139,"y":369,"w":153,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":139,"y":380,"text":", additional nonces, and the result of"},{"wmode":0,"bbox":{"x":53,"y":380,"w":186,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":390,"text":"the optional Phase 2 Diffie-Hellman exchange."},{"wmode":0,"bbox":{"x":53,"y":393,"w":149,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":53,"y":403,"text":"NSA’s VPN exploitation process"},{"wmode":0,"bbox":{"x":214,"y":393,"w":80,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":214,"y":403,"text":"The documents pub-"},{"wmode":0,"bbox":{"x":53,"y":403,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":413,"text":"lished by Der Spiegel describe a system named TURMOIL"},{"wmode":0,"bbox":{"x":53,"y":414,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":424,"text":"that is used to collect and decrypt VPN traffic. The evidence"},{"wmode":0,"bbox":{"x":53,"y":424,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":434,"text":"indicates that this decryption is performed using passive"},{"wmode":0,"bbox":{"x":53,"y":435,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":445,"text":"eavesdropping and does not require message injection or"},{"wmode":0,"bbox":{"x":53,"y":445,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":455,"text":"man-in-the-middle attacks on IPsec or IKE. Figure 4, an"},{"wmode":0,"bbox":{"x":53,"y":456,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":466,"text":"excerpt from one of the documents [67], illustrates the flow"},{"wmode":0,"bbox":{"x":53,"y":466,"w":186,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":476,"text":"of information through the TURMOIL system"},{"wmode":0,"bbox":{"x":62,"y":477,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":487,"text":"The initial phases of the attack involve collecting IKE and"},{"wmode":0,"bbox":{"x":53,"y":487,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":497,"text":"ESP payloads and determining whether the traffic matches"},{"wmode":0,"bbox":{"x":53,"y":497,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":508,"text":"any tasked selector [65]. If so, TURMOIL transmits the"},{"wmode":0,"bbox":{"x":53,"y":508,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":518,"text":"complete IKE handshake and may transmit a small amount"},{"wmode":0,"bbox":{"x":53,"y":518,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":529,"text":"of ESP ciphertext to NSA’s Cryptanalysis and Exploitation"},{"wmode":0,"bbox":{"x":53,"y":529,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":539,"text":"Services (CES) [56,65] via a secure tunnel. Within CES, a"},{"wmode":0,"bbox":{"x":53,"y":539,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":549,"text":"specialized VPN Attack Orchestrator (VAO) system manages"},{"wmode":0,"bbox":{"x":53,"y":550,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":560,"text":"a collection of high-performance grid computing resources"},{"wmode":0,"bbox":{"x":53,"y":560,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":570,"text":"located at NSA Headquarters and in a data center at Oak"},{"wmode":0,"bbox":{"x":53,"y":571,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":581,"text":"Ridge National Laboratory, which perform the computation"},{"wmode":0,"bbox":{"x":53,"y":581,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":591,"text":"required to generate the ESP session key [61,62,67]. VAO"},{"wmode":0,"bbox":{"x":53,"y":592,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":602,"text":"also maintains a database, CORALREEF, that stores cryp-"},{"wmode":0,"bbox":{"x":53,"y":602,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":612,"text":"tographic values, including a set of known PSKs and the"},{"wmode":0,"bbox":{"x":53,"y":613,"w":201,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":623,"text":"resulting “recovered” ESP session keys [60,61,67]."},{"wmode":0,"bbox":{"x":62,"y":623,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":633,"text":"The ESP traffic itself is buffered for up to 15 minutes [64],"},{"wmode":0,"bbox":{"x":53,"y":633,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":644,"text":"until CES can respond with the recovered ESP keys if they"},{"wmode":0,"bbox":{"x":53,"y":644,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":654,"text":"were generated correctly. Once keys have been returned, the"},{"wmode":0,"bbox":{"x":53,"y":654,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":665,"text":"ESP traffic is decrypted via hardware accelerators [59] or"},{"wmode":0,"bbox":{"x":53,"y":665,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":675,"text":"in software [68,69]. From this point, decrypted VPN traffic"},{"wmode":0,"bbox":{"x":53,"y":675,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":685,"text":"is reinjected into TURMOIL processing infrastructure and"},{"wmode":0,"bbox":{"x":53,"y":686,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":696,"text":"passed to other systems for storage and analysis [69]. The"},{"wmode":0,"bbox":{"x":53,"y":696,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":706,"text":"documents indicate that NSA is recovering ESP keys at large"},{"wmode":0,"bbox":{"x":53,"y":707,"w":178,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":717,"text":"scale, with a target of 100,000 per hour [64]."}]},{"type":"text","bbox":{"x":316,"y":183,"w":240,"h":65},"lines":[{"wmode":0,"bbox":{"x":316,"y":183,"w":35,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":193,"text":"Figure 4:"},{"wmode":0,"bbox":{"x":351,"y":183,"w":182,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":351,"y":193,"text":" NSA’s VPN decryption infrastructure."},{"wmode":0,"bbox":{"x":534,"y":183,"w":21,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":534,"y":193,"text":" This"},{"wmode":0,"bbox":{"x":316,"y":194,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":204,"text":"classified illustration published by Der Spiegel [67] shows"},{"wmode":0,"bbox":{"x":316,"y":204,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":214,"text":"captured IKE handshake messages being passed to a high-"},{"wmode":0,"bbox":{"x":316,"y":215,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":225,"text":"performance computing system, which returns the symmetric"},{"wmode":0,"bbox":{"x":316,"y":225,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":235,"text":"keys for ESP session traffic. The details of this attack are"},{"wmode":0,"bbox":{"x":316,"y":236,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":246,"text":"consistent with an efficient break for 1024-bit Diffie-Hellman."}]},{"type":"text","bbox":{"x":315,"y":267,"w":241,"h":452},"lines":[{"wmode":0,"bbox":{"x":316,"y":267,"w":156,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":316,"y":277,"text":"Evidence for a discrete log attack"},{"wmode":0,"bbox":{"x":486,"y":267,"w":70,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":486,"y":277,"text":"While the ability"},{"wmode":0,"bbox":{"x":316,"y":278,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":288,"text":"to decrypt VPN traffic does not by itself indicate a defeat"},{"wmode":0,"bbox":{"x":316,"y":288,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":298,"text":"of Diffie-Hellman, there are several features of IKE and the"},{"wmode":0,"bbox":{"x":316,"y":299,"w":187,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":309,"text":"VAO’s operation that support this hypothesis."},{"wmode":0,"bbox":{"x":325,"y":309,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":319,"text":"The IKE protocol has been extensively analyzed [9, 36],"},{"wmode":0,"bbox":{"x":316,"y":320,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":330,"text":"and is not believed to be exploitable in standard configu-"},{"wmode":0,"bbox":{"x":316,"y":330,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":340,"text":"rations under passive eavesdropping attacks. In order to"},{"wmode":0,"bbox":{"x":316,"y":341,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":351,"text":"recover the session keys for the ESP or AH protocols, the"},{"wmode":0,"bbox":{"x":316,"y":351,"w":161,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":361,"text":"attacker must at minimum recover the"},{"wmode":0,"bbox":{"x":478,"y":352,"w":34,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":478,"y":361,"text":" SKEYID"},{"wmode":0,"bbox":{"x":512,"y":351,"w":43,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":512,"y":361,"text":" generated"},{"wmode":0,"bbox":{"x":316,"y":361,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":372,"text":"by the Phase 1 exchange. Absent a vulnerability in the key"},{"wmode":0,"bbox":{"x":316,"y":372,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":382,"text":"derivation function or transport encryption, this requires"},{"wmode":0,"bbox":{"x":316,"y":382,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":393,"text":"the attacker to recover a Diffie-Hellman shared secret after"},{"wmode":0,"bbox":{"x":316,"y":393,"w":157,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":403,"text":"passively observing an IKE handshake."},{"wmode":0,"bbox":{"x":325,"y":403,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":413,"text":"While IKE is designed to support a range of Diffie-Hellman"},{"wmode":0,"bbox":{"x":316,"y":414,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":424,"text":"groups, our Internet-wide scans (§4.3) show that the vast"},{"wmode":0,"bbox":{"x":316,"y":424,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":434,"text":"majority of IKE systems select one particular 1024-bit DH"},{"wmode":0,"bbox":{"x":316,"y":435,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":445,"text":"group, Oakley Group 2, even when offered stronger groups."},{"wmode":0,"bbox":{"x":325,"y":445,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":455,"text":"Given an efficient oracle for solving the discrete logarithm"},{"wmode":0,"bbox":{"x":316,"y":456,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":466,"text":"problem, attacks on IKE are possible provided that the"},{"wmode":0,"bbox":{"x":316,"y":466,"w":135,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":476,"text":"attacker can obtain the following:"},{"wmode":0,"bbox":{"x":452,"y":466,"w":15,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":452,"y":476,"text":" (1)"},{"wmode":0,"bbox":{"x":468,"y":466,"w":87,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":468,"y":476,"text":" a complete two-sided"},{"wmode":0,"bbox":{"x":316,"y":477,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":487,"text":"IKE transcript, including the Diffie-Hellman ephemeral keys"},{"wmode":0,"bbox":{"x":316,"y":490,"w":4,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":316,"y":497,"text":"g"},{"wmode":0,"bbox":{"x":321,"y":489,"w":4,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":321,"y":493,"text":"a"},{"wmode":0,"bbox":{"x":325,"y":483,"w":18,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":493,"text":" and"},{"wmode":0,"bbox":{"x":344,"y":490,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":344,"y":497,"text":" g"},{"wmode":0,"bbox":{"x":351,"y":489,"w":3,"h":5},"font":{"name":"GXWQDH+LMMathItalic6-Regular","family":"serif","weight":"normal","style":"italic","size":5},"x":351,"y":493,"text":"b"},{"wmode":0,"bbox":{"x":355,"y":483,"w":201,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":355,"y":493,"text":" as well as the nonces and cookies transmitted by"},{"wmode":0,"bbox":{"x":316,"y":497,"w":129,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":508,"text":"both sides of the connection, and"},{"wmode":0,"bbox":{"x":446,"y":497,"w":14,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":446,"y":508,"text":" (2)"},{"wmode":0,"bbox":{"x":460,"y":497,"w":95,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":460,"y":508,"text":" in IKEv1 only, the PSK"},{"wmode":0,"bbox":{"x":316,"y":508,"w":64,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":518,"text":"used in deriving"},{"wmode":0,"bbox":{"x":381,"y":509,"w":32,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":381,"y":518,"text":" SKEYID"},{"wmode":0,"bbox":{"x":414,"y":508,"w":2,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":414,"y":518,"text":"."},{"wmode":0,"bbox":{"x":325,"y":518,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":529,"text":"Both of the above requirements are also present in the"},{"wmode":0,"bbox":{"x":316,"y":529,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":539,"text":"NSA’s VPN attack system. As Figure 4 illustrates, a hard"},{"wmode":0,"bbox":{"x":316,"y":539,"w":201,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":549,"text":"requirement of the VAO is the need to obtain the"},{"wmode":0,"bbox":{"x":517,"y":539,"w":37,"h":12},"font":{"name":"DEEZDF+LMRoman9-Italic","family":"serif","weight":"normal","style":"italic","size":9},"x":517,"y":549,"text":" complete"},{"wmode":0,"bbox":{"x":316,"y":550,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":560,"text":"two-sided IKE transcript [60]. The published documents"},{"wmode":0,"bbox":{"x":316,"y":560,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":570,"text":"indicate that this requirement substantially increases the"},{"wmode":0,"bbox":{"x":316,"y":571,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":581,"text":"complexity of the attack execution, since IKE transcripts"},{"wmode":0,"bbox":{"x":316,"y":581,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":591,"text":"must be reassembled (“paired”) whenever the interaction"},{"wmode":0,"bbox":{"x":316,"y":592,"w":190,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":602,"text":"traverses multiple network paths [55,56,58,66]."},{"wmode":0,"bbox":{"x":325,"y":602,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":612,"text":"The attack system also seems to require knowledge of the"},{"wmode":0,"bbox":{"x":316,"y":613,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":623,"text":"PSK. Several documents describe techniques for analysts"},{"wmode":0,"bbox":{"x":316,"y":623,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":633,"text":"to locate a PSK, including using a database of router con-"},{"wmode":0,"bbox":{"x":316,"y":633,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":644,"text":"figurations [70, 71], the CORALREEF database of known"},{"wmode":0,"bbox":{"x":316,"y":644,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":654,"text":"PSKs [60], previously decrypted SSH traffic [60], or system"},{"wmode":0,"bbox":{"x":316,"y":654,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":665,"text":"administrator “chatter” [70]. Additionally, NSA is willing to"},{"wmode":0,"bbox":{"x":315,"y":665,"w":143,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":315,"y":675,"text":"“[r]un attacks to recover PSK” [60]."},{"wmode":0,"bbox":{"x":325,"y":675,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":685,"text":"Of course, this explanation is not dispositive. The possi-"},{"wmode":0,"bbox":{"x":316,"y":686,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":696,"text":"bility remains that NSA could defeat IPsec using alternative"},{"wmode":0,"bbox":{"x":316,"y":696,"w":28,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":706,"text":"means."},{"wmode":0,"bbox":{"x":353,"y":696,"w":204,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":353,"y":706,"text":"Certain published NSA documents refer to soft-"},{"wmode":0,"bbox":{"x":316,"y":707,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":717,"text":"ware “implants” on VPN devices, indicating that the use of"}]},{"type":"text","bbox":{"x":302,"y":737,"w":4,"h":12},"lines":[{"wmode":0,"bbox":{"x":302,"y":737,"w":4,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":302,"y":747,"text":"9"}]}]},{"blocks":[{"type":"text","bbox":{"x":281,"y":54,"w":213,"h":11},"lines":[{"wmode":0,"bbox":{"x":281,"y":54,"w":213,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":281,"y":63,"text":"Vulnerable servers, if the attacker can precompute for . . ."}]},{"type":"text","bbox":{"x":237,"y":67,"w":303,"h":11},"lines":[{"wmode":0,"bbox":{"x":237,"y":67,"w":64,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":237,"y":76,"text":"all 512-bit groups"},{"wmode":0,"bbox":{"x":313,"y":67,"w":64,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":313,"y":76,"text":"all 768-bit groups"},{"wmode":0,"bbox":{"x":388,"y":67,"w":69,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":388,"y":76,"text":"one 1024-bit group"},{"wmode":0,"bbox":{"x":469,"y":67,"w":72,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":469,"y":76,"text":"ten 1024-bit groups"}]},{"type":"text","bbox":{"x":68,"y":81,"w":472,"h":38},"lines":[{"wmode":0,"bbox":{"x":68,"y":81,"w":141,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":68,"y":90,"text":"HTTPS Top 1M w/ active downgrade"},{"wmode":0,"bbox":{"x":251,"y":81,"w":50,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":251,"y":90,"text":"45,100 (8.4%)"},{"wmode":0,"bbox":{"x":327,"y":81,"w":50,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":327,"y":90,"text":"45,100 (8.4%)"},{"wmode":0,"bbox":{"x":399,"y":81,"w":59,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":399,"y":90,"text":"205,000 (37.1%)"},{"wmode":0,"bbox":{"x":481,"y":81,"w":59,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":481,"y":90,"text":"309,000 (56.1%)"},{"wmode":0,"bbox":{"x":68,"y":90,"w":61,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":68,"y":99,"text":"HTTPS Top 1M"},{"wmode":0,"bbox":{"x":262,"y":90,"w":39,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":262,"y":99,"text":"118 (0.0%)"},{"wmode":0,"bbox":{"x":338,"y":90,"w":39,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":338,"y":99,"text":"407 (0.1%)"},{"wmode":0,"bbox":{"x":403,"y":90,"w":55,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":403,"y":99,"text":"98,500 (17.9%)"},{"wmode":0,"bbox":{"x":481,"y":90,"w":59,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":481,"y":99,"text":"132,000 (24.0%)"},{"wmode":0,"bbox":{"x":68,"y":99,"w":140,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":68,"y":108,"text":"HTTPS Trusted w/ active downgrade"},{"wmode":0,"bbox":{"x":247,"y":99,"w":55,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":247,"y":108,"text":"489,000 (3.4%)"},{"wmode":0,"bbox":{"x":322,"y":99,"w":55,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":322,"y":108,"text":"556,000 (3.9%)"},{"wmode":0,"bbox":{"x":392,"y":99,"w":65,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":392,"y":108,"text":"1,840,000 (12.8%)"},{"wmode":0,"bbox":{"x":475,"y":99,"w":65,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":475,"y":108,"text":"3,410,000 (23.8%)"},{"wmode":0,"bbox":{"x":68,"y":108,"w":60,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":68,"y":116,"text":"HTTPS Trusted"},{"wmode":0,"bbox":{"x":255,"y":108,"w":46,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":255,"y":116,"text":"1,000 (0.0%)"},{"wmode":0,"bbox":{"x":327,"y":108,"w":50,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":327,"y":116,"text":"46,700 (0.3%)"},{"wmode":0,"bbox":{"x":399,"y":108,"w":59,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":399,"y":116,"text":"939,000 (6.56%)"},{"wmode":0,"bbox":{"x":475,"y":108,"w":65,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":475,"y":116,"text":"1,430,000 (10.0%)"}]},{"type":"text","bbox":{"x":68,"y":122,"w":472,"h":20},"lines":[{"wmode":0,"bbox":{"x":68,"y":122,"w":44,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":68,"y":131,"text":"IKEv1 IPv4"},{"wmode":0,"bbox":{"x":298,"y":122,"w":4,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":298,"y":131,"text":"–"},{"wmode":0,"bbox":{"x":327,"y":122,"w":50,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":327,"y":131,"text":"64,700 (2.6%)"},{"wmode":0,"bbox":{"x":392,"y":122,"w":65,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":392,"y":131,"text":"1,690,000 (66.1%)"},{"wmode":0,"bbox":{"x":475,"y":122,"w":65,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":475,"y":131,"text":"1,690,000 (66.1%)"},{"wmode":0,"bbox":{"x":68,"y":131,"w":44,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":68,"y":140,"text":"IKEv2 IPv4"},{"wmode":0,"bbox":{"x":298,"y":131,"w":4,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":298,"y":140,"text":"–"},{"wmode":0,"bbox":{"x":327,"y":131,"w":50,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":327,"y":140,"text":"66,000 (5.8%)"},{"wmode":0,"bbox":{"x":399,"y":131,"w":59,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":399,"y":140,"text":"726,000 (63.9%)"},{"wmode":0,"bbox":{"x":481,"y":131,"w":59,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":481,"y":140,"text":"726,000 (63.9%)"}]},{"type":"text","bbox":{"x":68,"y":146,"w":472,"h":11},"lines":[{"wmode":0,"bbox":{"x":68,"y":146,"w":36,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":68,"y":155,"text":"SSH IPv4"},{"wmode":0,"bbox":{"x":298,"y":146,"w":4,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":298,"y":155,"text":"–"},{"wmode":0,"bbox":{"x":373,"y":146,"w":4,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":373,"y":155,"text":"–"},{"wmode":0,"bbox":{"x":392,"y":146,"w":65,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":392,"y":155,"text":"3,600,000 (25.7%)"},{"wmode":0,"bbox":{"x":475,"y":146,"w":65,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":475,"y":155,"text":"3,600,000 (25.7%)"}]},{"type":"text","bbox":{"x":53,"y":165,"w":504,"h":33},"lines":[{"wmode":0,"bbox":{"x":53,"y":165,"w":33,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":176,"text":"Table 3:"},{"wmode":0,"bbox":{"x":86,"y":165,"w":208,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":86,"y":176,"text":" Estimated impact of Diffie-Hellman attacks."},{"wmode":0,"bbox":{"x":295,"y":165,"w":261,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":295,"y":176,"text":" We use Internet-wide scanning to estimate the number of real-"},{"wmode":0,"bbox":{"x":53,"y":176,"w":504,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":186,"text":"world servers for which typical connections could be compromised by attackers with various levels of computational resources."},{"wmode":0,"bbox":{"x":53,"y":186,"w":502,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":197,"text":"For HTTPS, we provide figures with and without downgrade attacks on the chosen ciphersuite. All others are passive attacks."}]},{"type":"text","bbox":{"x":53,"y":217,"w":240,"h":85},"lines":[{"wmode":0,"bbox":{"x":53,"y":217,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":228,"text":"targeted malware is a piece of the collection strategy [60];"},{"wmode":0,"bbox":{"x":53,"y":228,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":238,"text":"however, the same documents also note that decryption of"},{"wmode":0,"bbox":{"x":53,"y":238,"w":79,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":248,"text":"the resulting traffic"},{"wmode":0,"bbox":{"x":132,"y":238,"w":37,"h":12},"font":{"name":"DEEZDF+LMRoman9-Italic","family":"serif","weight":"normal","style":"italic","size":9},"x":132,"y":248,"text":" does not"},{"wmode":0,"bbox":{"x":170,"y":238,"w":122,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":170,"y":248,"text":" require IKE handshakes, and"},{"wmode":0,"bbox":{"x":53,"y":249,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":259,"text":"thus appears to be an alternative mechanism to the VAO"},{"wmode":0,"bbox":{"x":53,"y":259,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":269,"text":"attack described above. The most compelling argument for"},{"wmode":0,"bbox":{"x":53,"y":270,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":280,"text":"a pure cryptographic attack is the generality of the VAO"},{"wmode":0,"bbox":{"x":53,"y":280,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":290,"text":"approach, which appears to succeed across a broad swath of"},{"wmode":0,"bbox":{"x":53,"y":291,"w":104,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":301,"text":"non-compromised devices."}]},{"type":"text","bbox":{"x":53,"y":311,"w":240,"h":89},"lines":[{"wmode":0,"bbox":{"x":53,"y":311,"w":14,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":53,"y":323,"text":"4.3"},{"wmode":0,"bbox":{"x":80,"y":311,"w":135,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":80,"y":323,"text":"Effects of a 1024-bit Break"},{"wmode":0,"bbox":{"x":62,"y":325,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":336,"text":"In this section, we use Internet-wide scanning to assess"},{"wmode":0,"bbox":{"x":53,"y":336,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":346,"text":"the impact of a hypothetical DH-1024 break on three popu-"},{"wmode":0,"bbox":{"x":53,"y":346,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":356,"text":"lar protocols: IKE, SSH, and HTTPS. Our measurements"},{"wmode":0,"bbox":{"x":53,"y":357,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":367,"text":"indicate that these protocols, as they are commonly used,"},{"wmode":0,"bbox":{"x":53,"y":367,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":377,"text":"would be subject to widespread compromise by a state-level"},{"wmode":0,"bbox":{"x":53,"y":378,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":388,"text":"attacker who had the resources to invest in precomputation"},{"wmode":0,"bbox":{"x":53,"y":388,"w":191,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":398,"text":"for a small number of common 1024-bit groups."}]},{"type":"text","bbox":{"x":53,"y":403,"w":240,"h":316},"lines":[{"wmode":0,"bbox":{"x":53,"y":403,"w":19,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":53,"y":413,"text":"IKE"},{"wmode":0,"bbox":{"x":85,"y":403,"w":207,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":85,"y":413,"text":"We measured how IPsec VPNs use Diffie-Hellman in"},{"wmode":0,"bbox":{"x":53,"y":414,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":424,"text":"practice by scanning a 1% random sample of the public IPv4"},{"wmode":0,"bbox":{"x":53,"y":424,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":434,"text":"address space for IKEv1 and IKEv2 (the protocols used to"},{"wmode":0,"bbox":{"x":53,"y":435,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":445,"text":"initiate an IPsec VPN connection) in May 2015. We used"},{"wmode":0,"bbox":{"x":53,"y":445,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":455,"text":"the ZMap UDP probe module to measure support for Oakley"},{"wmode":0,"bbox":{"x":53,"y":456,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":466,"text":"Groups 1 and 2 (two popular 768- and 1024-bit, built-in"},{"wmode":0,"bbox":{"x":53,"y":466,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":476,"text":"groups) and which group servers prefer. To test support"},{"wmode":0,"bbox":{"x":53,"y":477,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":487,"text":"for individual groups, we offered only the single group in"},{"wmode":0,"bbox":{"x":53,"y":487,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":497,"text":"question. To detect default behavior, we offered servers a"},{"wmode":0,"bbox":{"x":53,"y":497,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":508,"text":"variety of DH groups, with the lowest priority groups being"},{"wmode":0,"bbox":{"x":53,"y":508,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":518,"text":"Oakley Groups 1 and 2. When measuring server preference,"},{"wmode":0,"bbox":{"x":53,"y":518,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":529,"text":"we scanned with the 3DES symmetric cipher—the most"},{"wmode":0,"bbox":{"x":53,"y":529,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":539,"text":"commonly supported symmetric cipher in our single group"},{"wmode":0,"bbox":{"x":53,"y":539,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":549,"text":"scans. Because of this, the percentages we present for IKEv1"},{"wmode":0,"bbox":{"x":53,"y":550,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":560,"text":"and IKEv2 are a lower bound for the number of servers that"},{"wmode":0,"bbox":{"x":53,"y":560,"w":122,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":570,"text":"prefer Oakley Groups 1 and 2."},{"wmode":0,"bbox":{"x":62,"y":571,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":581,"text":"Of the 80K hosts that responded with a valid IKE packet,"},{"wmode":0,"bbox":{"x":53,"y":581,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":591,"text":"44.2% were willing to accept an offered proposal from at least"},{"wmode":0,"bbox":{"x":53,"y":592,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":602,"text":"one scan. The majority of the remaining hosts responded"},{"wmode":0,"bbox":{"x":53,"y":602,"w":26,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":612,"text":"with a"},{"wmode":0,"bbox":{"x":79,"y":603,"w":87,"h":11},"font":{"name":"LYJWZZ+LMMono9-Regular","family":"monospace","weight":"normal","style":"normal","size":8},"x":79,"y":612,"text":" NO-PROPOSAL-CHOSEN"},{"wmode":0,"bbox":{"x":167,"y":602,"w":126,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":167,"y":612,"text":" message regardless of our pro-"},{"wmode":0,"bbox":{"x":53,"y":613,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":623,"text":"posal. Many of these may be site-to-site VPNs that reject"},{"wmode":0,"bbox":{"x":53,"y":623,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":633,"text":"our source address. We consider these hosts “unprofiled” and"},{"wmode":0,"bbox":{"x":53,"y":633,"w":131,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":644,"text":"omit them from the results here."},{"wmode":0,"bbox":{"x":62,"y":644,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":654,"text":"We found that 31.8% of IKEv1 and 19.7% of IKEv2 servers"},{"wmode":0,"bbox":{"x":53,"y":654,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":665,"text":"support Oakley Group 1 (768-bit) while 86.1% and 91.0%"},{"wmode":0,"bbox":{"x":53,"y":665,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":675,"text":"respectively supported Oakley Group 2 (1024-bit). In our"},{"wmode":0,"bbox":{"x":53,"y":675,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":685,"text":"sample of IKEv1 servers, 2.6% of profiled servers preferred"},{"wmode":0,"bbox":{"x":53,"y":686,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":696,"text":"the 768-bit Oakley Group 1—which is within cryptanalytic"},{"wmode":0,"bbox":{"x":53,"y":696,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":706,"text":"reach today for moderately resourced attackers—and 66.1%"},{"wmode":0,"bbox":{"x":53,"y":707,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":717,"text":"preferred the 1024-bit Oakley Group 2. For IKEv2, 5.8%"}]},{"type":"text","bbox":{"x":316,"y":217,"w":240,"h":33},"lines":[{"wmode":0,"bbox":{"x":316,"y":217,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":228,"text":"of profiled servers chose Oakley Group 1, and 63.9% chose"},{"wmode":0,"bbox":{"x":316,"y":228,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":238,"text":"Oakley Group 2. This coincides with our anecdotal findings"},{"wmode":0,"bbox":{"x":316,"y":238,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":248,"text":"that most VPN clients only offer Oakley Group 2 by default."}]},{"type":"text","bbox":{"x":316,"y":253,"w":241,"h":295},"lines":[{"wmode":0,"bbox":{"x":316,"y":253,"w":20,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":316,"y":263,"text":"SSH"},{"wmode":0,"bbox":{"x":349,"y":253,"w":206,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":349,"y":263,"text":"All SSH handshakes complete either a finite field"},{"wmode":0,"bbox":{"x":316,"y":263,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":273,"text":"Diffie-Hellman or elliptic curve Diffie-Hellman exchange as"},{"wmode":0,"bbox":{"x":316,"y":274,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":284,"text":"part of the SSH key exchange. The SSH protocol explicitly"},{"wmode":0,"bbox":{"x":316,"y":284,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":294,"text":"defines support for Oakley Group 2 (1024-bit) and Oakley"},{"wmode":0,"bbox":{"x":316,"y":295,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":305,"text":"Group 14 (2048-bit) but also allows a server-defined group,"},{"wmode":0,"bbox":{"x":316,"y":305,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":315,"text":"which can be negotiated through an auxiliary Diffie-Hellman"},{"wmode":0,"bbox":{"x":316,"y":316,"w":180,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":326,"text":"Group Exchange (DH-GEX) handshake [16]."},{"wmode":0,"bbox":{"x":325,"y":326,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":336,"text":"In order to measure how SSH uses DH in practice, we"},{"wmode":0,"bbox":{"x":316,"y":337,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":347,"text":"implemented the SSH protocol in the ZMap toolchain and"},{"wmode":0,"bbox":{"x":316,"y":347,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":357,"text":"scanned 1% random samples of the public IPv4 address space"},{"wmode":0,"bbox":{"x":316,"y":357,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":368,"text":"in April 2015. We find that 98.9% of SSH servers support"},{"wmode":0,"bbox":{"x":316,"y":368,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":378,"text":"the 1024-bit Oakley Group 2, 77.6% support the 2048-bit"},{"wmode":0,"bbox":{"x":316,"y":378,"w":194,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":388,"text":"Oakley Group 14, and 68.7% support DH-GEX."},{"wmode":0,"bbox":{"x":325,"y":389,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":399,"text":"During the SSH handshake, the client and server select the"},{"wmode":0,"bbox":{"x":316,"y":399,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":409,"text":"client’s highest priority mutually supported key exchange"},{"wmode":0,"bbox":{"x":316,"y":410,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":420,"text":"algorithm. Therefore, we cannot directly measure what algo-"},{"wmode":0,"bbox":{"x":316,"y":420,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":430,"text":"rithm servers will prefer in practice. In order to estimate this,"},{"wmode":0,"bbox":{"x":316,"y":431,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":441,"text":"we performed a scan in which we mimicked the algorithms"},{"wmode":0,"bbox":{"x":316,"y":441,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":451,"text":"offered by OpenSSH 6.6.1p1, the latest version of OpenSSH."},{"wmode":0,"bbox":{"x":316,"y":452,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":462,"text":"In this scan, 21.8% of servers preferred the 1024-bit Oakley"},{"wmode":0,"bbox":{"x":316,"y":462,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":472,"text":"Group 2, and 37.4% preferred a server-defined group. 10% of"},{"wmode":0,"bbox":{"x":316,"y":473,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":483,"text":"the server-defined groups were 1024-bit, but, of those, near"},{"wmode":0,"bbox":{"x":316,"y":483,"w":232,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":493,"text":"all provided Oakley Group 2 rather than a custom group."},{"wmode":0,"bbox":{"x":325,"y":493,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":504,"text":"Combining these equivalent choices, we find that a state-"},{"wmode":0,"bbox":{"x":316,"y":504,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":514,"text":"level attacker who performed NFS precomputations for the"},{"wmode":0,"bbox":{"x":316,"y":514,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":524,"text":"1024-bit Oakley Group 2 (which has been in standards for"},{"wmode":0,"bbox":{"x":316,"y":525,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":535,"text":"almost two decades) could passively eavesdrop on connections"},{"wmode":0,"bbox":{"x":316,"y":535,"w":195,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":545,"text":"to 3.6M (25.7%) publicly accessible SSH servers."}]},{"type":"text","bbox":{"x":316,"y":550,"w":240,"h":169},"lines":[{"wmode":0,"bbox":{"x":316,"y":550,"w":36,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":316,"y":560,"text":"HTTPS"},{"wmode":0,"bbox":{"x":364,"y":551,"w":16,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":364,"y":560,"text":"DHE"},{"wmode":0,"bbox":{"x":381,"y":550,"w":175,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":381,"y":560,"text":" is commonly deployed on web servers. 68.3%"},{"wmode":0,"bbox":{"x":316,"y":560,"w":128,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":570,"text":"of Alexa Top 1M sites support"},{"wmode":0,"bbox":{"x":445,"y":561,"w":21,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":445,"y":570,"text":" DHE"},{"wmode":0,"bbox":{"x":466,"y":560,"w":89,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":466,"y":570,"text":", as do 23.9% of sites"},{"wmode":0,"bbox":{"x":316,"y":571,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":581,"text":"with browser-trusted certificates. Of the Top 1M sites that"},{"wmode":0,"bbox":{"x":316,"y":581,"w":30,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":591,"text":"support"},{"wmode":0,"bbox":{"x":347,"y":582,"w":19,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":347,"y":591,"text":" DHE"},{"wmode":0,"bbox":{"x":366,"y":581,"w":189,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":366,"y":591,"text":", 84% use a 1024-bit or smaller group, with 94%"},{"wmode":0,"bbox":{"x":316,"y":592,"w":131,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":602,"text":"of these using one of five groups."},{"wmode":0,"bbox":{"x":325,"y":602,"w":125,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":612,"text":"Despite widespread support for"},{"wmode":0,"bbox":{"x":450,"y":603,"w":20,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":450,"y":612,"text":" DHE"},{"wmode":0,"bbox":{"x":471,"y":602,"w":86,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":471,"y":612,"text":", a passive eavesdrop-"},{"wmode":0,"bbox":{"x":316,"y":613,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":623,"text":"per can only decrypt connections that organically agree to"},{"wmode":0,"bbox":{"x":316,"y":623,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":633,"text":"use Diffie-Hellman. We can estimate the number of sites for"},{"wmode":0,"bbox":{"x":316,"y":633,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":644,"text":"which this will occur by offering the same sets of ciphersuites"},{"wmode":0,"bbox":{"x":316,"y":644,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":654,"text":"as Chrome, Firefox, and Safari. While the offered ciphers"},{"wmode":0,"bbox":{"x":316,"y":654,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":665,"text":"differ slightly between browsers, this turns out to result in"},{"wmode":0,"bbox":{"x":316,"y":665,"w":128,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":675,"text":"negligible differences in whether"},{"wmode":0,"bbox":{"x":445,"y":666,"w":20,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":445,"y":675,"text":" DHE"},{"wmode":0,"bbox":{"x":465,"y":665,"w":41,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":465,"y":675,"text":" is chosen."},{"wmode":0,"bbox":{"x":325,"y":675,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":325,"y":685,"text":"Approximately 24.0% of browser connections with HTTPS-"},{"wmode":0,"bbox":{"x":316,"y":686,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":696,"text":"enabled Top 1M sites (and 10% with browser-trusted sites)"},{"wmode":0,"bbox":{"x":316,"y":696,"w":52,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":706,"text":"will negotiate"},{"wmode":0,"bbox":{"x":369,"y":697,"w":19,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":369,"y":706,"text":" DHE"},{"wmode":0,"bbox":{"x":389,"y":696,"w":167,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":389,"y":706,"text":" with one of the ten most popular 1024-bit"},{"wmode":0,"bbox":{"x":316,"y":707,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":717,"text":"primes; 17.9% of connections with Top 1M sites could be"}]},{"type":"text","bbox":{"x":300,"y":737,"w":9,"h":12},"lines":[{"wmode":0,"bbox":{"x":300,"y":737,"w":9,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":300,"y":747,"text":"10"}]}]},{"blocks":[{"type":"text","bbox":{"x":53,"y":53,"w":239,"h":44},"lines":[{"wmode":0,"bbox":{"x":53,"y":53,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":63,"text":"passively eavesdropped given the precomputation for a single"},{"wmode":0,"bbox":{"x":53,"y":64,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":74,"text":"1024-bit prime. The most popular site that negotiates a"},{"wmode":0,"bbox":{"x":53,"y":75,"w":16,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":84,"text":"DHE"},{"wmode":0,"bbox":{"x":70,"y":74,"w":222,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":70,"y":84,"text":" ciphersuite using one of the two most common 1024-bit"},{"wmode":0,"bbox":{"x":53,"y":85,"w":170,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":95,"text":"primes is sohu.com (ranked 31st globally)."}]},{"type":"text","bbox":{"x":53,"y":98,"w":241,"h":242},"lines":[{"wmode":0,"bbox":{"x":53,"y":98,"w":21,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":53,"y":108,"text":"Mail"},{"wmode":0,"bbox":{"x":87,"y":98,"w":206,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":87,"y":108,"text":"TLS is also used to secure email transport. SMTP,"},{"wmode":0,"bbox":{"x":53,"y":109,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":119,"text":"the protocol used to relay messages between mail servers,"},{"wmode":0,"bbox":{"x":53,"y":119,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":129,"text":"allows a connection to be upgraded to TLS by issuing the"},{"wmode":0,"bbox":{"x":53,"y":131,"w":37,"h":11},"font":{"name":"LYJWZZ+LMMono9-Regular","family":"monospace","weight":"normal","style":"normal","size":8},"x":53,"y":140,"text":"STARTTLS"},{"wmode":0,"bbox":{"x":91,"y":130,"w":201,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":91,"y":140,"text":" command. POP3S and IMAPS, used by end users"},{"wmode":0,"bbox":{"x":53,"y":140,"w":233,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":150,"text":"to fetch received mail, wrap the entire connection in TLS."},{"wmode":0,"bbox":{"x":62,"y":150,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":161,"text":"We studied 1% samples of the public IPv4 address space"},{"wmode":0,"bbox":{"x":53,"y":161,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":171,"text":"for IMAPS, POP3S, and SMTP+StartTLS. We found that"},{"wmode":0,"bbox":{"x":53,"y":171,"w":145,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":181,"text":"50.7% of SMTP servers supported"},{"wmode":0,"bbox":{"x":199,"y":172,"w":42,"h":11},"font":{"name":"LYJWZZ+LMMono9-Regular","family":"monospace","weight":"normal","style":"normal","size":8},"x":199,"y":181,"text":" STARTTLS"},{"wmode":0,"bbox":{"x":241,"y":171,"w":53,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":241,"y":181,"text":", 41.4% sup-"},{"wmode":0,"bbox":{"x":53,"y":182,"w":26,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":192,"text":"ported"},{"wmode":0,"bbox":{"x":80,"y":183,"w":21,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":80,"y":192,"text":" DHE"},{"wmode":0,"bbox":{"x":102,"y":182,"w":95,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":102,"y":192,"text":", and 14.8% supported"},{"wmode":0,"bbox":{"x":197,"y":183,"w":61,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":197,"y":192,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":259,"y":182,"w":35,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":259,"y":192,"text":" ciphers."},{"wmode":0,"bbox":{"x":53,"y":192,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":202,"text":"15.5% of SMTP servers used one of the ten most common"},{"wmode":0,"bbox":{"x":53,"y":203,"w":65,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":213,"text":"1024-bit groups."},{"wmode":0,"bbox":{"x":62,"y":213,"w":153,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":223,"text":"For IMAPS, 8.4% of servers supported"},{"wmode":0,"bbox":{"x":216,"y":214,"w":58,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":216,"y":223,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":275,"y":213,"w":17,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":275,"y":223,"text":" and"},{"wmode":0,"bbox":{"x":53,"y":224,"w":58,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":234,"text":"75% supported"},{"wmode":0,"bbox":{"x":111,"y":225,"w":19,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":111,"y":234,"text":" DHE"},{"wmode":0,"bbox":{"x":131,"y":224,"w":162,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":131,"y":234,"text":". However, the ten most common 1024-bit"},{"wmode":0,"bbox":{"x":53,"y":234,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":244,"text":"primes account for only 5.4% of servers. POP3S deployment"},{"wmode":0,"bbox":{"x":53,"y":245,"w":177,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":255,"text":"is similar, with 8.9% of servers supporting"},{"wmode":0,"bbox":{"x":231,"y":245,"w":61,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":231,"y":255,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":53,"y":255,"w":87,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":265,"text":"and 74.9% supporting"},{"wmode":0,"bbox":{"x":141,"y":256,"w":20,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":141,"y":265,"text":" DHE"},{"wmode":0,"bbox":{"x":161,"y":255,"w":130,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":161,"y":265,"text":", but with the ten most common"},{"wmode":0,"bbox":{"x":53,"y":265,"w":209,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":276,"text":"1024-bit primes accounting for only 4.8% of servers."},{"wmode":0,"bbox":{"x":62,"y":276,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":62,"y":286,"text":"If each of the top ten 1024-bit primes used by each protocol"},{"wmode":0,"bbox":{"x":53,"y":286,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":297,"text":"were compromised, this would affect approximately 1.7M"},{"wmode":0,"bbox":{"x":53,"y":297,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":307,"text":"SMTP, 276K IMAPS, and 245K POP3S servers. Using our"},{"wmode":0,"bbox":{"x":53,"y":307,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":317,"text":"downgrade attack of §3.3, an attacker with modest resources"},{"wmode":0,"bbox":{"x":53,"y":318,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":328,"text":"can hijack connections to approximately 1.6M SMTP, 429K"},{"wmode":0,"bbox":{"x":53,"y":328,"w":140,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":338,"text":"IMAPS, and 454K POP3S servers."}]},{"type":"text","bbox":{"x":53,"y":351,"w":240,"h":100},"lines":[{"wmode":0,"bbox":{"x":53,"y":351,"w":8,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":53,"y":363,"text":"5."},{"wmode":0,"bbox":{"x":74,"y":351,"w":126,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":74,"y":363,"text":"RECOMMENDATIONS"},{"wmode":0,"bbox":{"x":62,"y":366,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":376,"text":"Our findings indicate that one of the key recommenda-"},{"wmode":0,"bbox":{"x":53,"y":376,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":386,"text":"tions from security experts in response to the threat of mass"},{"wmode":0,"bbox":{"x":53,"y":387,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":397,"text":"surveillance—promotion of DHE-based TLS ciphersuites"},{"wmode":0,"bbox":{"x":53,"y":397,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":407,"text":"offering “perfect forward secrecy” over RSA-based cipher-"},{"wmode":0,"bbox":{"x":53,"y":408,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":418,"text":"suites—may have actually reduced security for many hosts."},{"wmode":0,"bbox":{"x":53,"y":418,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":428,"text":"In this section, we present concrete recommendations to re-"},{"wmode":0,"bbox":{"x":53,"y":428,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":439,"text":"cover the expected security of Diffie-Hellman as it is used in"},{"wmode":0,"bbox":{"x":53,"y":439,"w":124,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":449,"text":"mainstream Internet protocols."}]},{"type":"text","bbox":{"x":53,"y":452,"w":241,"h":169},"lines":[{"wmode":0,"bbox":{"x":53,"y":452,"w":133,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":53,"y":463,"text":"Transition to elliptic curves."},{"wmode":0,"bbox":{"x":203,"y":453,"w":91,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":203,"y":463,"text":"Transitioning to ellip-"},{"wmode":0,"bbox":{"x":53,"y":463,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":473,"text":"tic curve Diffie-Hellman (ECDH) key exchange with appro-"},{"wmode":0,"bbox":{"x":53,"y":473,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":484,"text":"priate parameters avoids all known feasible cryptanalytic"},{"wmode":0,"bbox":{"x":53,"y":484,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":494,"text":"attacks. Current elliptic curve discrete log algorithms for"},{"wmode":0,"bbox":{"x":53,"y":494,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":504,"text":"strong curves do not gain as much of an advantage from"},{"wmode":0,"bbox":{"x":53,"y":505,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":515,"text":"precomputation. In addition, ECDH keys are shorter than"},{"wmode":0,"bbox":{"x":53,"y":515,"w":32,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":525,"text":"in “mod"},{"wmode":0,"bbox":{"x":86,"y":519,"w":7,"h":8},"font":{"name":"NYBUOU+LMMathItalic9-Regular","family":"serif","weight":"normal","style":"italic","size":8},"x":86,"y":525,"text":" p"},{"wmode":0,"bbox":{"x":94,"y":515,"w":198,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":94,"y":525,"text":"” Diffie-Hellman, and shared-secret computations"},{"wmode":0,"bbox":{"x":53,"y":526,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":536,"text":"are faster. Unfortunately, the most widely supported ECDH"},{"wmode":0,"bbox":{"x":53,"y":536,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":546,"text":"parameters, those specified by NIST, are now viewed with"},{"wmode":0,"bbox":{"x":53,"y":547,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":557,"text":"suspicion due to NSA influence on their design, despite no"},{"wmode":0,"bbox":{"x":53,"y":557,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":567,"text":"known or suspected weaknesses. These curves are under-"},{"wmode":0,"bbox":{"x":53,"y":568,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":578,"text":"going scrutiny, and new curves, such as Curve25519, are"},{"wmode":0,"bbox":{"x":53,"y":578,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":588,"text":"being standardized by the IRTF for use in Internet proto-"},{"wmode":0,"bbox":{"x":53,"y":588,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":599,"text":"cols. We recommend transitioning to elliptic curves where"},{"wmode":0,"bbox":{"x":53,"y":599,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":609,"text":"possible; this is the most effective long-term solution to the"},{"wmode":0,"bbox":{"x":53,"y":609,"w":154,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":620,"text":"vulnerabilities described in this paper."}]},{"type":"text","bbox":{"x":53,"y":623,"w":240,"h":96},"lines":[{"wmode":0,"bbox":{"x":53,"y":623,"w":156,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":53,"y":633,"text":"Increase minimum key strengths."},{"wmode":0,"bbox":{"x":225,"y":623,"w":67,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":225,"y":633,"text":"Server operators"},{"wmode":0,"bbox":{"x":53,"y":633,"w":55,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":644,"text":"should disable"},{"wmode":0,"bbox":{"x":109,"y":634,"w":58,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":109,"y":644,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":167,"y":633,"w":56,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":167,"y":644,"text":" and configure"},{"wmode":0,"bbox":{"x":223,"y":634,"w":19,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":223,"y":644,"text":" DHE"},{"wmode":0,"bbox":{"x":243,"y":633,"w":49,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":243,"y":644,"text":" ciphersuites"},{"wmode":0,"bbox":{"x":53,"y":644,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":654,"text":"to use primes of 2048 bits or larger. Browsers and clients"},{"wmode":0,"bbox":{"x":53,"y":654,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":665,"text":"should raise the minimum accepted size for Diffie-Hellman"},{"wmode":0,"bbox":{"x":53,"y":665,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":675,"text":"groups to at least 1024 bits in order to avoid downgrade at-"},{"wmode":0,"bbox":{"x":53,"y":675,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":685,"text":"tacks when communicating with servers that still use smaller"},{"wmode":0,"bbox":{"x":53,"y":686,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":696,"text":"groups. Primes of less than 1024 bits should not be con-"},{"wmode":0,"bbox":{"x":53,"y":696,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":706,"text":"sidered secure, even against an attacker with moderate re-"},{"wmode":0,"bbox":{"x":53,"y":707,"w":31,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":717,"text":"sources."}]},{"type":"text","bbox":{"x":315,"y":53,"w":241,"h":384},"lines":[{"wmode":0,"bbox":{"x":325,"y":53,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":63,"text":"Our analysis suggests that 1024-bit discrete log may be"},{"wmode":0,"bbox":{"x":316,"y":64,"w":218,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":74,"text":"within reach for state-level actors. As such, 1024-bit"},{"wmode":0,"bbox":{"x":534,"y":65,"w":20,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":534,"y":74,"text":" DHE"},{"wmode":0,"bbox":{"x":315,"y":74,"w":241,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":315,"y":84,"text":"(and 1024-bit RSA) must be phased out in the near term."},{"wmode":0,"bbox":{"x":316,"y":85,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":95,"text":"NIST has recommended such a transition since 2010 [4]. We"},{"wmode":0,"bbox":{"x":316,"y":95,"w":167,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":105,"text":"recommend that clients raise the minimum"},{"wmode":0,"bbox":{"x":484,"y":96,"w":19,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":484,"y":105,"text":" DHE"},{"wmode":0,"bbox":{"x":503,"y":95,"w":52,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":503,"y":105,"text":" group size to"},{"wmode":0,"bbox":{"x":316,"y":105,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":116,"text":"2048 bits as soon as server configurations allow. Server opera-"},{"wmode":0,"bbox":{"x":316,"y":116,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":126,"text":"tors should move to 2048-bit or larger groups to facilitate this"},{"wmode":0,"bbox":{"x":316,"y":126,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":136,"text":"transition. Precomputation for a 2048-bit non-trapdoored"},{"wmode":0,"bbox":{"x":316,"y":137,"w":63,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":147,"text":"group is around"},{"wmode":0,"bbox":{"x":380,"y":137,"w":12,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":380,"y":147,"text":" 10"},{"wmode":0,"bbox":{"x":392,"y":136,"w":3,"h":8},"font":{"name":"LYFOQG+LMRoman6-Regular","family":"serif","weight":"normal","style":"normal","size":5},"x":392,"y":143,"text":"9"},{"wmode":0,"bbox":{"x":395,"y":133,"w":161,"h":16},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":395,"y":143,"text":" times harder than for a 1024-bit group,"},{"wmode":0,"bbox":{"x":316,"y":147,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":157,"text":"so 2048-bit Diffie-Hellman will remain secure barring a major"},{"wmode":0,"bbox":{"x":316,"y":158,"w":103,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":168,"text":"algorithmic improvement."},{"wmode":0,"bbox":{"x":316,"y":171,"w":161,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":316,"y":181,"text":"Avoid fixed-prime 1024-bit groups."},{"wmode":0,"bbox":{"x":490,"y":171,"w":66,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":490,"y":181,"text":"For implementa-"},{"wmode":0,"bbox":{"x":316,"y":181,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":192,"text":"tions that must continue to use or support 1024-bit groups"},{"wmode":0,"bbox":{"x":316,"y":192,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":202,"text":"for compatibility reasons, generating fresh groups may help"},{"wmode":0,"bbox":{"x":316,"y":202,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":212,"text":"mitigate some of the damage caused by NFS-style precom-"},{"wmode":0,"bbox":{"x":316,"y":213,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":223,"text":"putation for very common fixed groups. However, we note"},{"wmode":0,"bbox":{"x":316,"y":223,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":233,"text":"that it is possible to create trapdoored primes [20,44] that"},{"wmode":0,"bbox":{"x":316,"y":234,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":244,"text":"are computationally difficult to detect. At minimum, clients"},{"wmode":0,"bbox":{"x":316,"y":244,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":254,"text":"should check that servers’ parameters use safe primes or a"},{"wmode":0,"bbox":{"x":316,"y":255,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":265,"text":"verifiable generation process, such as that proposed in FIPS"},{"wmode":0,"bbox":{"x":316,"y":265,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":275,"text":"186 [38]. Ideally, the process for generating and validating"},{"wmode":0,"bbox":{"x":316,"y":276,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":286,"text":"parameters in TLS should be standardized so as to thwart"},{"wmode":0,"bbox":{"x":316,"y":286,"w":85,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":296,"text":"the risk of trapdoors."},{"wmode":0,"bbox":{"x":316,"y":299,"w":160,"h":12},"font":{"name":"UGXFPC+LMRoman9-Bold","family":"serif","weight":"bold","style":"normal","size":8},"x":316,"y":309,"text":"Don’t deliberately weaken crypto."},{"wmode":0,"bbox":{"x":491,"y":299,"w":63,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":491,"y":309,"text":"Our downgrade"},{"wmode":0,"bbox":{"x":316,"y":310,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":320,"text":"attack on export-grade 512-bit Diffie-Hellman groups in TLS"},{"wmode":0,"bbox":{"x":316,"y":320,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":330,"text":"illustrates the fragility of cryptographic “front doors”. Al-"},{"wmode":0,"bbox":{"x":316,"y":331,"w":156,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":341,"text":"though the key sizes originally used in"},{"wmode":0,"bbox":{"x":473,"y":332,"w":60,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":473,"y":341,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":534,"y":331,"w":21,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":534,"y":341,"text":" were"},{"wmode":0,"bbox":{"x":316,"y":341,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":351,"text":"intended to be tractable only to NSA, two decades of algo-"},{"wmode":0,"bbox":{"x":316,"y":352,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":362,"text":"rithmic and computational improvements have significantly"},{"wmode":0,"bbox":{"x":316,"y":362,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":372,"text":"lowered the bar to attacks on such key sizes. Despite the"},{"wmode":0,"bbox":{"x":316,"y":372,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":383,"text":"eventual relaxation of crypto export restrictions and subse-"},{"wmode":0,"bbox":{"x":316,"y":383,"w":158,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":393,"text":"quent attempts to remove support for"},{"wmode":0,"bbox":{"x":475,"y":384,"w":61,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":475,"y":393,"text":" DHE_EXPORT"},{"wmode":0,"bbox":{"x":536,"y":383,"w":19,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":536,"y":393,"text":", the"},{"wmode":0,"bbox":{"x":316,"y":393,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":403,"text":"technical debt induced by the additional complexity has left"},{"wmode":0,"bbox":{"x":316,"y":404,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":414,"text":"implementations vulnerable for decades. Like FREAK [7],"},{"wmode":0,"bbox":{"x":316,"y":414,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":424,"text":"our attacks warn of the long-term debilitating effects of"},{"wmode":0,"bbox":{"x":316,"y":425,"w":149,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":435,"text":"deliberately weakening cryptography."}]},{"type":"text","bbox":{"x":316,"y":447,"w":240,"h":163},"lines":[{"wmode":0,"bbox":{"x":316,"y":447,"w":8,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":316,"y":458,"text":"6."},{"wmode":0,"bbox":{"x":337,"y":447,"w":172,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":337,"y":458,"text":"DISCLOSURE AND RESPONSE"},{"wmode":0,"bbox":{"x":325,"y":461,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":471,"text":"We notified major client and server developers about"},{"wmode":0,"bbox":{"x":316,"y":472,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":482,"text":"the vulnerabilities discussed in this paper before we made"},{"wmode":0,"bbox":{"x":316,"y":482,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":492,"text":"our findings public. Prior to our work, Internet Explorer,"},{"wmode":0,"bbox":{"x":316,"y":492,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":503,"text":"Chrome, Firefox, and Opera all accepted 512-bit primes,"},{"wmode":0,"bbox":{"x":316,"y":503,"w":212,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":513,"text":"whereas Safari allowed groups as small as 16 bits."},{"wmode":0,"bbox":{"x":536,"y":503,"w":19,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":536,"y":513,"text":"As a"},{"wmode":0,"bbox":{"x":316,"y":513,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":524,"text":"result of our disclosures, Internet Explorer [37], Firefox, and"},{"wmode":0,"bbox":{"x":316,"y":524,"w":191,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":534,"text":"Chrome are transitioning the minimum size of the"},{"wmode":0,"bbox":{"x":508,"y":525,"w":18,"h":11},"font":{"name":"SAXERU+LMSans8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":508,"y":534,"text":" DHE"},{"wmode":0,"bbox":{"x":527,"y":524,"w":28,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":527,"y":534,"text":" groups"},{"wmode":0,"bbox":{"x":316,"y":534,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":544,"text":"they accept to 1024 bits, and OpenSSL and Safari are ex-"},{"wmode":0,"bbox":{"x":316,"y":545,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":555,"text":"pected to follow suit. On the server side, we notified Apache,"},{"wmode":0,"bbox":{"x":316,"y":555,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":565,"text":"Oracle, IBM, Cisco, and various hosting providers. Aka-"},{"wmode":0,"bbox":{"x":316,"y":566,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":576,"text":"mai has removed all support for export ciphersuites. Many"},{"wmode":0,"bbox":{"x":316,"y":576,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":586,"text":"TLS developers plan to support a new extension that allows"},{"wmode":0,"bbox":{"x":316,"y":587,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":597,"text":"clients and servers to negotiate a few well-known groups of"},{"wmode":0,"bbox":{"x":316,"y":597,"w":235,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":607,"text":"2048-bits and higher and to gracefully reject weak ones [19]."}]},{"type":"text","bbox":{"x":316,"y":619,"w":239,"h":100},"lines":[{"wmode":0,"bbox":{"x":316,"y":619,"w":8,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":316,"y":631,"text":"7."},{"wmode":0,"bbox":{"x":337,"y":619,"w":81,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":337,"y":631,"text":"CONCLUSION"},{"wmode":0,"bbox":{"x":325,"y":633,"w":230,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":325,"y":644,"text":"Diffie-Hellman key exchange is a cornerstone of applied"},{"wmode":0,"bbox":{"x":316,"y":644,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":654,"text":"cryptography, but we find that, as used in practice, it is often"},{"wmode":0,"bbox":{"x":316,"y":654,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":665,"text":"less secure than widely believed. The problems stem from"},{"wmode":0,"bbox":{"x":316,"y":665,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":675,"text":"the fact that the number field sieve for discrete log allows an"},{"wmode":0,"bbox":{"x":316,"y":675,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":685,"text":"attacker to perform a single precomputation that depends"},{"wmode":0,"bbox":{"x":316,"y":686,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":696,"text":"only on the group, after which computing individual logs in"},{"wmode":0,"bbox":{"x":316,"y":696,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":316,"y":706,"text":"that group has a far lower cost. Although this fact is well"},{"wmode":0,"bbox":{"x":316,"y":707,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":316,"y":717,"text":"known to cryptographers, it apparently has not been widely"}]},{"type":"text","bbox":{"x":300,"y":737,"w":9,"h":12},"lines":[{"wmode":0,"bbox":{"x":300,"y":737,"w":9,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":300,"y":747,"text":"11"}]}]},{"blocks":[{"type":"text","bbox":{"x":53,"y":53,"w":240,"h":138},"lines":[{"wmode":0,"bbox":{"x":53,"y":53,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":63,"text":"understood by system builders. Likewise, many cryptogra-"},{"wmode":0,"bbox":{"x":53,"y":64,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":74,"text":"phers did not appreciate that the security of a large fraction"},{"wmode":0,"bbox":{"x":53,"y":74,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":84,"text":"of Internet communication depends on Diffie-Hellman key"},{"wmode":0,"bbox":{"x":53,"y":85,"w":217,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":95,"text":"exchanges that use a few small, widely shared groups."},{"wmode":0,"bbox":{"x":62,"y":95,"w":231,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":62,"y":105,"text":"A key lesson from this state of affairs is that cryptogra-"},{"wmode":0,"bbox":{"x":53,"y":105,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":116,"text":"phers and creators of practical systems need to work together"},{"wmode":0,"bbox":{"x":53,"y":116,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":126,"text":"more effectively. System builders should take responsibility"},{"wmode":0,"bbox":{"x":53,"y":126,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":136,"text":"for being aware of applicable cryptanalytic attacks. Cryp-"},{"wmode":0,"bbox":{"x":53,"y":137,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":147,"text":"tographers, for their part, should involve themselves in how"},{"wmode":0,"bbox":{"x":53,"y":147,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":157,"text":"crypto is actually being applied, such as through engagement"},{"wmode":0,"bbox":{"x":53,"y":158,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":168,"text":"with standards efforts and software review. Bridging the per-"},{"wmode":0,"bbox":{"x":53,"y":168,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":178,"text":"ilous gap that separates these communities will be essential"},{"wmode":0,"bbox":{"x":53,"y":179,"w":136,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":189,"text":"for keeping future systems secure."}]},{"type":"text","bbox":{"x":53,"y":203,"w":93,"h":15},"lines":[{"wmode":0,"bbox":{"x":53,"y":203,"w":93,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":53,"y":214,"text":"Acknowledgments"}]},{"type":"text","bbox":{"x":53,"y":218,"w":241,"h":201},"lines":[{"wmode":0,"bbox":{"x":53,"y":218,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":228,"text":"The authors wish to thank Michael Bailey, Daniel Bernstein,"},{"wmode":0,"bbox":{"x":53,"y":229,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":239,"text":"Ron Dreslinski, Tanja Lange, Adam Langley, Kenny Paterson,"},{"wmode":0,"bbox":{"x":53,"y":239,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":249,"text":"Andrei Popov, Ivan Ristic, Edward Snowden, Brian Smith,"},{"wmode":0,"bbox":{"x":53,"y":250,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":260,"text":"Martin Thomson, and Eric Rescorla. This material is based"},{"wmode":0,"bbox":{"x":53,"y":260,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":270,"text":"in part upon work supported by the U.S. National Science"},{"wmode":0,"bbox":{"x":53,"y":271,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":281,"text":"Foundation under contracts CNS-1345254, CNS-1409505,"},{"wmode":0,"bbox":{"x":53,"y":281,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":291,"text":"CNS-1518741, and EFRI-1441209, by the Office of Naval"},{"wmode":0,"bbox":{"x":53,"y":292,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":302,"text":"Research under contract N00014-11-1-0470, by the ERC"},{"wmode":0,"bbox":{"x":53,"y":302,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":312,"text":"Starting Grant 259639 (CRYSP), by the French ANR re-"},{"wmode":0,"bbox":{"x":53,"y":312,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":323,"text":"search grant ANR-12-BS02-001-01, by the NSF Graduate"},{"wmode":0,"bbox":{"x":53,"y":323,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":333,"text":"Research Fellowship Program under grant DGE-1256260,"},{"wmode":0,"bbox":{"x":53,"y":333,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":343,"text":"by the Mozilla Foundation, by a gift from Supermicro, by"},{"wmode":0,"bbox":{"x":53,"y":344,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":354,"text":"the Google Ph.D. Fellowship in Computer Security, by the"},{"wmode":0,"bbox":{"x":53,"y":354,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":9},"x":53,"y":364,"text":"Morris Wellman Faculty Development Assistant Professor-"},{"wmode":0,"bbox":{"x":53,"y":365,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":375,"text":"ship, and by an Alfred P. Sloan Foundation Research Fellow-"},{"wmode":0,"bbox":{"x":53,"y":375,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":385,"text":"ship. Some experiments were conducted using the Grid’5000"},{"wmode":0,"bbox":{"x":53,"y":386,"w":240,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":396,"text":"testbed, which is supported by INRIA, CNRS, RENATER,"},{"wmode":0,"bbox":{"x":53,"y":396,"w":239,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":406,"text":"and several other universities and organizations; additional"},{"wmode":0,"bbox":{"x":53,"y":407,"w":206,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":53,"y":417,"text":"experiments used UCS hardware donated by Cisco."}]},{"type":"text","bbox":{"x":53,"y":430,"w":101,"h":15},"lines":[{"wmode":0,"bbox":{"x":53,"y":430,"w":8,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":53,"y":442,"text":"8."},{"wmode":0,"bbox":{"x":74,"y":430,"w":80,"h":15},"font":{"name":"IVCKUG+NimbusRomNo9L-Medi","family":"serif","weight":"bold","style":"normal","size":11},"x":74,"y":442,"text":"REFERENCES"}]},{"type":"text","bbox":{"x":53,"y":448,"w":240,"h":271},"lines":[{"wmode":0,"bbox":{"x":58,"y":448,"w":208,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":58,"y":457,"text":"[1] S. Bai, C. Bouvier, A. Filbois, P. Gaudry, L. Imbert,"},{"wmode":0,"bbox":{"x":71,"y":457,"w":207,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":466,"text":"A. Kruppa, F. Morain, E. Thomé, and P. Zimmermann."},{"wmode":0,"bbox":{"x":71,"y":467,"w":33,"h":10},"font":{"name":"XYNSKK+LMMono8-Regular","family":"monospace","weight":"normal","style":"normal","size":7},"x":71,"y":475,"text":"cado-nfs"},{"wmode":0,"bbox":{"x":105,"y":466,"w":168,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":105,"y":475,"text":", an implementation of the number field sieve"},{"wmode":0,"bbox":{"x":71,"y":475,"w":113,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":484,"text":"algorithm, 2014. Release 2.1.1."},{"wmode":0,"bbox":{"x":58,"y":485,"w":8,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":58,"y":494,"text":"[2]"},{"wmode":0,"bbox":{"x":66,"y":485,"w":58,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":66,"y":494,"text":" R. Barbulescu."},{"wmode":0,"bbox":{"x":125,"y":485,"w":167,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":125,"y":494,"text":" Algorithmes de logarithmes discrets dans les"},{"wmode":0,"bbox":{"x":70,"y":494,"w":37,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":70,"y":503,"text":"corps finis"},{"wmode":0,"bbox":{"x":108,"y":494,"w":185,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":108,"y":503,"text":". PhD thesis, Université de Lorraine, France, 2013."},{"wmode":0,"bbox":{"x":58,"y":504,"w":212,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":58,"y":513,"text":"[3] R. Barbulescu, P. Gaudry, A. Joux, and E. Thomé. A"},{"wmode":0,"bbox":{"x":71,"y":513,"w":218,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":522,"text":"heuristic quasi-polynomial algorithm for discrete logarithm"},{"wmode":0,"bbox":{"x":71,"y":522,"w":147,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":531,"text":"in finite fields of small characteristic. In"},{"wmode":0,"bbox":{"x":218,"y":522,"w":39,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":218,"y":531,"text":" Eurocrypt"},{"wmode":0,"bbox":{"x":257,"y":522,"w":24,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":257,"y":531,"text":", 2014."},{"wmode":0,"bbox":{"x":58,"y":532,"w":220,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":58,"y":540,"text":"[4] E. Barker, W. Barker, W. Burr, W. Polk, and M. Smid."},{"wmode":0,"bbox":{"x":70,"y":540,"w":221,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":70,"y":549,"text":"NIST Special Publication 800-57: Recommendation for Key"},{"wmode":0,"bbox":{"x":70,"y":549,"w":47,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":70,"y":558,"text":"Management"},{"wmode":0,"bbox":{"x":118,"y":549,"w":24,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":118,"y":558,"text":", 2007."},{"wmode":0,"bbox":{"x":58,"y":559,"w":235,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":58,"y":568,"text":"[5] D. J. Bernstein. How to find smooth parts of integers, 2004."},{"wmode":0,"bbox":{"x":71,"y":568,"w":210,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":577,"text":"http://cr.yp.to/factorization/smoothparts-20040510.pdf."},{"wmode":0,"bbox":{"x":58,"y":578,"w":8,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":58,"y":587,"text":"[6]"},{"wmode":0,"bbox":{"x":66,"y":578,"w":171,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":66,"y":587,"text":" D. J. Bernstein and T. Lange. Batch NFS. In"},{"wmode":0,"bbox":{"x":238,"y":578,"w":54,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":238,"y":587,"text":" Selected Areas"},{"wmode":0,"bbox":{"x":70,"y":587,"w":59,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":70,"y":596,"text":"in Cryptography"},{"wmode":0,"bbox":{"x":130,"y":587,"w":24,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":130,"y":596,"text":", 2014."},{"wmode":0,"bbox":{"x":58,"y":597,"w":204,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":58,"y":606,"text":"[7] B. Beurdouche, K. Bhargavan, A. Delignat-Lavaud,"},{"wmode":0,"bbox":{"x":71,"y":606,"w":223,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":615,"text":"C. Fournet, M. Kohlweiss, A. Pironti, P.-Y. Strub, and J. K."},{"wmode":0,"bbox":{"x":71,"y":615,"w":202,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":624,"text":"Zinzindohoue. A messy state of the union: Taming the"},{"wmode":0,"bbox":{"x":71,"y":624,"w":135,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":633,"text":"composite state machines of TLS. In"},{"wmode":0,"bbox":{"x":207,"y":624,"w":80,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":207,"y":633,"text":" IEEE Symposium on"},{"wmode":0,"bbox":{"x":71,"y":633,"w":78,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":71,"y":642,"text":"Security and Privacy"},{"wmode":0,"bbox":{"x":149,"y":633,"w":24,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":149,"y":642,"text":", 2015."},{"wmode":0,"bbox":{"x":58,"y":643,"w":236,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":58,"y":652,"text":"[8] C. Bouvier, P. Gaudry, L. Imbert, H. Jeljeli, and E. Thomé."},{"wmode":0,"bbox":{"x":71,"y":652,"w":215,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":661,"text":"New record for discrete logarithm in a prime finite field of"},{"wmode":0,"bbox":{"x":71,"y":661,"w":213,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":670,"text":"180 decimal digits, 2014. http://caramel.loria.fr/p180.txt."},{"wmode":0,"bbox":{"x":58,"y":671,"w":220,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":58,"y":680,"text":"[9] R. Canetti and H. Krawczyk. Security analysis of IKE’s"},{"wmode":0,"bbox":{"x":71,"y":680,"w":155,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":689,"text":"signature-based key-exchange protocol. In"},{"wmode":0,"bbox":{"x":226,"y":680,"w":28,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":226,"y":689,"text":" Crypto"},{"wmode":0,"bbox":{"x":254,"y":680,"w":24,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":254,"y":689,"text":", 2002."},{"wmode":0,"bbox":{"x":53,"y":690,"w":224,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":699,"text":"[10] A. Commeine and I. Semaev. An algorithm to solve the"},{"wmode":0,"bbox":{"x":71,"y":699,"w":215,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":708,"text":"discrete logarithm problem with the number field sieve. In"},{"wmode":0,"bbox":{"x":70,"y":708,"w":18,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":70,"y":717,"text":"PKC"},{"wmode":0,"bbox":{"x":89,"y":708,"w":24,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":89,"y":717,"text":", 2006."}]},{"type":"text","bbox":{"x":316,"y":54,"w":240,"h":664},"lines":[{"wmode":0,"bbox":{"x":316,"y":54,"w":188,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":63,"text":"[11] D. Coppersmith. Solving linear equations over"},{"wmode":0,"bbox":{"x":505,"y":54,"w":25,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":505,"y":63,"text":" GF(2)"},{"wmode":0,"bbox":{"x":531,"y":54,"w":13,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":531,"y":63,"text":" via"},{"wmode":0,"bbox":{"x":334,"y":63,"w":107,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":72,"text":"block Wiedemann algorithm."},{"wmode":0,"bbox":{"x":441,"y":63,"w":52,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":441,"y":72,"text":" Math. Comp."},{"wmode":0,"bbox":{"x":493,"y":63,"w":57,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":493,"y":72,"text":", 62(205), 1994."},{"wmode":0,"bbox":{"x":316,"y":74,"w":145,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":83,"text":"[12] R. Crandall and C. B. Pomerance."},{"wmode":0,"bbox":{"x":462,"y":74,"w":74,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":462,"y":83,"text":" Prime Numbers: A"},{"wmode":0,"bbox":{"x":333,"y":83,"w":99,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":333,"y":91,"text":"Computational Perspective"},{"wmode":0,"bbox":{"x":432,"y":83,"w":60,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":432,"y":91,"text":". Springer, 2001."},{"wmode":0,"bbox":{"x":316,"y":93,"w":233,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":102,"text":"[13] B. den Boer. Diffie-Hellman is as strong as discrete log for"},{"wmode":0,"bbox":{"x":334,"y":102,"w":65,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":111,"text":"certain primes. In"},{"wmode":0,"bbox":{"x":400,"y":102,"w":28,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":400,"y":111,"text":" Crypto"},{"wmode":0,"bbox":{"x":428,"y":102,"w":24,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":428,"y":111,"text":", 1988."},{"wmode":0,"bbox":{"x":316,"y":112,"w":194,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":121,"text":"[14] W. Diffie and M. E. Hellman. New directions in"},{"wmode":0,"bbox":{"x":334,"y":121,"w":50,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":130,"text":"cryptography."},{"wmode":0,"bbox":{"x":385,"y":121,"w":111,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":385,"y":130,"text":" IEEE Trans. Inform. Theory"},{"wmode":0,"bbox":{"x":496,"y":121,"w":58,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":496,"y":130,"text":", 22(6):644–654,"},{"wmode":0,"bbox":{"x":334,"y":130,"w":19,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":139,"text":"1976."},{"wmode":0,"bbox":{"x":316,"y":140,"w":228,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":149,"text":"[15] Z. Durumeric, E. Wustrow, and J. A. Halderman. ZMap:"},{"wmode":0,"bbox":{"x":334,"y":149,"w":221,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":158,"text":"Fast Internet-wide scanning and its security applications. In"},{"wmode":0,"bbox":{"x":333,"y":158,"w":57,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":333,"y":167,"text":"Usenix Security"},{"wmode":0,"bbox":{"x":390,"y":158,"w":24,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":390,"y":167,"text":", 2013."},{"wmode":0,"bbox":{"x":316,"y":169,"w":13,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":177,"text":"[16]"},{"wmode":0,"bbox":{"x":329,"y":169,"w":225,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":329,"y":177,"text":" M. Friedl, N. Provos, and W. Simpson. Diffie-Hellman group"},{"wmode":0,"bbox":{"x":334,"y":177,"w":223,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":186,"text":"exchange for the secure shell (SSH) transport layer protocol."},{"wmode":0,"bbox":{"x":334,"y":186,"w":82,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":195,"text":"RFC 4419, Mar. 2006."},{"wmode":0,"bbox":{"x":316,"y":197,"w":235,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":206,"text":"[17] W. Geiselmann, H. Kopfer, R. Steinwandt, and E. Tromer."},{"wmode":0,"bbox":{"x":334,"y":206,"w":217,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":215,"text":"Improved routing-based linear algebra for the number field"},{"wmode":0,"bbox":{"x":334,"y":215,"w":30,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":224,"text":"sieve. In"},{"wmode":0,"bbox":{"x":364,"y":215,"w":184,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":364,"y":224,"text":" Information Technology: Coding and Computing"},{"wmode":0,"bbox":{"x":548,"y":215,"w":2,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":548,"y":224,"text":","},{"wmode":0,"bbox":{"x":334,"y":224,"w":19,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":233,"text":"2005."},{"wmode":0,"bbox":{"x":316,"y":234,"w":237,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":243,"text":"[18] W. Geiselmann and R. Steinwandt. Non-wafer-scale sieving"},{"wmode":0,"bbox":{"x":334,"y":243,"w":198,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":252,"text":"hardware for the NFS: Another attempt to cope with"},{"wmode":0,"bbox":{"x":334,"y":252,"w":43,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":261,"text":"1024-bit. In"},{"wmode":0,"bbox":{"x":377,"y":252,"w":39,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":377,"y":261,"text":" Eurocrypt"},{"wmode":0,"bbox":{"x":416,"y":252,"w":24,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":416,"y":261,"text":", 2007."},{"wmode":0,"bbox":{"x":316,"y":262,"w":13,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":271,"text":"[19]"},{"wmode":0,"bbox":{"x":329,"y":262,"w":225,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":329,"y":271,"text":" D. Gillmor. Negotiated finite field Diffie-Hellman ephemeral"},{"wmode":0,"bbox":{"x":334,"y":271,"w":197,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":280,"text":"parameters for TLS. IETF Internet Draft, May 2015."},{"wmode":0,"bbox":{"x":316,"y":281,"w":216,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":290,"text":"[20] D. M. Gordon. Designing and detecting trapdoors for"},{"wmode":0,"bbox":{"x":334,"y":290,"w":110,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":299,"text":"discrete log cryptosystems. In"},{"wmode":0,"bbox":{"x":444,"y":290,"w":28,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":444,"y":299,"text":" Crypto"},{"wmode":0,"bbox":{"x":472,"y":290,"w":24,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":472,"y":299,"text":", 1992."},{"wmode":0,"bbox":{"x":316,"y":301,"w":157,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":310,"text":"[21] D. M. Gordon. Discrete logarithms in"},{"wmode":0,"bbox":{"x":473,"y":301,"w":18,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":473,"y":310,"text":" GF("},{"wmode":0,"bbox":{"x":492,"y":304,"w":4,"h":7},"font":{"name":"GSJZLO+LMMathItalic8-Regular","family":"serif","weight":"normal","style":"italic","size":7},"x":492,"y":310,"text":"p"},{"wmode":0,"bbox":{"x":496,"y":301,"w":3,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":496,"y":310,"text":")"},{"wmode":0,"bbox":{"x":499,"y":301,"w":36,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":499,"y":310,"text":" using the"},{"wmode":0,"bbox":{"x":334,"y":310,"w":68,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":319,"text":"number field sieve."},{"wmode":0,"bbox":{"x":403,"y":310,"w":93,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":403,"y":319,"text":" SIAM J. Discrete Math."},{"wmode":0,"bbox":{"x":496,"y":310,"w":44,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":496,"y":319,"text":", 6(1), 1993."},{"wmode":0,"bbox":{"x":316,"y":320,"w":13,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":329,"text":"[22]"},{"wmode":0,"bbox":{"x":329,"y":320,"w":227,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":329,"y":329,"text":" D. Harkins and D. Carrel. The Internet key exchange (IKE)."},{"wmode":0,"bbox":{"x":334,"y":329,"w":81,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":338,"text":"RFC 2409, Nov. 1998."},{"wmode":0,"bbox":{"x":316,"y":339,"w":221,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":348,"text":"[23] T. Jager, K. G. Paterson, and J. Somorovsky. One bad"},{"wmode":0,"bbox":{"x":334,"y":348,"w":216,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":357,"text":"apple: Backwards compatibility attacks on state-of-the-art"},{"wmode":0,"bbox":{"x":334,"y":357,"w":61,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":366,"text":"cryptography. In"},{"wmode":0,"bbox":{"x":395,"y":357,"w":25,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":395,"y":366,"text":" NDSS"},{"wmode":0,"bbox":{"x":421,"y":357,"w":24,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":421,"y":366,"text":", 2013."},{"wmode":0,"bbox":{"x":316,"y":367,"w":214,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":376,"text":"[24] A. Joux and R. Lercier. Improvements to the general"},{"wmode":0,"bbox":{"x":334,"y":376,"w":219,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":385,"text":"number field sieve for discrete logarithms in prime fields. A"},{"wmode":0,"bbox":{"x":334,"y":385,"w":173,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":394,"text":"comparison with the Gaussian integer method."},{"wmode":0,"bbox":{"x":507,"y":385,"w":24,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":507,"y":394,"text":" Math."},{"wmode":0,"bbox":{"x":333,"y":394,"w":24,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":333,"y":403,"text":"Comp."},{"wmode":0,"bbox":{"x":357,"y":394,"w":89,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":357,"y":403,"text":", 72(242):953–967, 2003."},{"wmode":0,"bbox":{"x":316,"y":405,"w":13,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":414,"text":"[25]"},{"wmode":0,"bbox":{"x":329,"y":405,"w":227,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":329,"y":414,"text":" C. Kaufman, P. Hoffman, Y. Nir, P. Eronen, and T. Kivinen."},{"wmode":0,"bbox":{"x":334,"y":414,"w":185,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":423,"text":"Internet key exchange protocol version 2 (IKEv2)."},{"wmode":0,"bbox":{"x":334,"y":423,"w":80,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":432,"text":"RFC 7296, Oct. 2014."},{"wmode":0,"bbox":{"x":316,"y":433,"w":229,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":442,"text":"[26] S. Kent. IP authentication header. RFC 4302, Dec. 2005."},{"wmode":0,"bbox":{"x":316,"y":443,"w":203,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":452,"text":"[27] S. Kent. IP encapsulating security payload (ESP)."},{"wmode":0,"bbox":{"x":334,"y":452,"w":80,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":461,"text":"RFC 4303, Dec. 2005."},{"wmode":0,"bbox":{"x":316,"y":462,"w":13,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":471,"text":"[28]"},{"wmode":0,"bbox":{"x":329,"y":462,"w":225,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":329,"y":471,"text":" T. Kleinjung. Cofactorisation strategies for the number field"},{"wmode":0,"bbox":{"x":334,"y":471,"w":221,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":480,"text":"sieve and an estimate for the sieving step for factoring 1024"},{"wmode":0,"bbox":{"x":334,"y":480,"w":203,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":489,"text":"bit integers, 2006. http://www.hyperelliptic.org/tanja/"},{"wmode":0,"bbox":{"x":334,"y":489,"w":117,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":498,"text":"SHARCS/talks06/thorsten.pdf."},{"wmode":0,"bbox":{"x":316,"y":500,"w":239,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":509,"text":"[29] T. Kleinjung, K. Aoki, J. Franke, A. K. Lenstra, E. Thomé,"},{"wmode":0,"bbox":{"x":334,"y":509,"w":222,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":517,"text":"J. W. Bos, P. Gaudry, A. Kruppa, P. L. Montgomery, D. A."},{"wmode":0,"bbox":{"x":334,"y":517,"w":200,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":526,"text":"Osvik, H. te Riele, A. Timofeev, and P. Zimmermann."},{"wmode":0,"bbox":{"x":334,"y":526,"w":161,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":535,"text":"Factorization of a 768-bit RSA modulus. In"},{"wmode":0,"bbox":{"x":495,"y":526,"w":28,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":495,"y":535,"text":" Crypto"},{"wmode":0,"bbox":{"x":523,"y":526,"w":24,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":523,"y":535,"text":", 2010."},{"wmode":0,"bbox":{"x":316,"y":537,"w":236,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":546,"text":"[30] A. Langley, N. Modadugu, and B. Moeller. Transport layer"},{"wmode":0,"bbox":{"x":334,"y":546,"w":198,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":555,"text":"security (TLS) false start. IETF Internet Draft, 2010."},{"wmode":0,"bbox":{"x":316,"y":556,"w":189,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":565,"text":"[31] A. K. Lenstra and H. W. Lenstra, Jr., editors."},{"wmode":0,"bbox":{"x":505,"y":556,"w":17,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":505,"y":565,"text":" The"},{"wmode":0,"bbox":{"x":333,"y":565,"w":148,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":333,"y":574,"text":"Development of the Number Field Sieve"},{"wmode":0,"bbox":{"x":482,"y":565,"w":60,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":482,"y":574,"text":". Springer, 1993."},{"wmode":0,"bbox":{"x":316,"y":575,"w":220,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":584,"text":"[32] M. Lipacis. Semiconductors: Moore stress = structural"},{"wmode":0,"bbox":{"x":334,"y":584,"w":174,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":593,"text":"industry shift. Technical report, Jefferies, 2012."},{"wmode":0,"bbox":{"x":316,"y":595,"w":223,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":603,"text":"[33] U. M. Maurer. Towards the equivalence of breaking the"},{"wmode":0,"bbox":{"x":334,"y":603,"w":220,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":612,"text":"Diffie-Hellman protocol and computing discrete logarithms."},{"wmode":0,"bbox":{"x":334,"y":612,"w":7,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":621,"text":"In"},{"wmode":0,"bbox":{"x":342,"y":612,"w":28,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":342,"y":621,"text":" Crypto"},{"wmode":0,"bbox":{"x":370,"y":612,"w":24,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":370,"y":621,"text":", 1994."},{"wmode":0,"bbox":{"x":316,"y":623,"w":13,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":632,"text":"[34]"},{"wmode":0,"bbox":{"x":329,"y":623,"w":197,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":329,"y":632,"text":" U. M. Maurer and S. Wolf. Diffie-Hellman oracles. In"},{"wmode":0,"bbox":{"x":527,"y":623,"w":27,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":527,"y":632,"text":" Crypto"},{"wmode":0,"bbox":{"x":554,"y":623,"w":2,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":554,"y":632,"text":","},{"wmode":0,"bbox":{"x":334,"y":632,"w":19,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":641,"text":"1996."},{"wmode":0,"bbox":{"x":316,"y":642,"w":231,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":651,"text":"[35] N. Mavrogiannopoulos, F. Vercauteren, V. Velichkov, and"},{"wmode":0,"bbox":{"x":334,"y":651,"w":221,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":660,"text":"B. Preneel. A cross-protocol attack on the TLS protocol. In"},{"wmode":0,"bbox":{"x":333,"y":660,"w":39,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":333,"y":669,"text":"ACM CCS"},{"wmode":0,"bbox":{"x":373,"y":660,"w":73,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":373,"y":669,"text":", pages 62–72, 2012."},{"wmode":0,"bbox":{"x":316,"y":670,"w":13,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":679,"text":"[36]"},{"wmode":0,"bbox":{"x":329,"y":670,"w":225,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":329,"y":679,"text":" C. Meadows. Analysis of the Internet key exchange protocol"},{"wmode":0,"bbox":{"x":334,"y":679,"w":134,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":688,"text":"using the NRL protocol analyzer. In"},{"wmode":0,"bbox":{"x":468,"y":679,"w":80,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":468,"y":688,"text":" IEEE Symposium on"},{"wmode":0,"bbox":{"x":334,"y":688,"w":78,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":334,"y":697,"text":"Security and Privacy"},{"wmode":0,"bbox":{"x":412,"y":688,"w":24,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":412,"y":697,"text":", 1999."},{"wmode":0,"bbox":{"x":316,"y":698,"w":220,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":707,"text":"[37] Microsoft Security Bulletin MS15-055. Vulnerability in"},{"wmode":0,"bbox":{"x":334,"y":707,"w":205,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":716,"text":"Schannel could allow information disclosure, May 2015."}]},{"type":"text","bbox":{"x":300,"y":737,"w":9,"h":12},"lines":[{"wmode":0,"bbox":{"x":300,"y":737,"w":9,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":300,"y":747,"text":"12"}]}]},{"blocks":[{"type":"text","bbox":{"x":53,"y":54,"w":240,"h":358},"lines":[{"wmode":0,"bbox":{"x":53,"y":54,"w":233,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":63,"text":"[38] NIST. FIPS PUB 186-4: Digital signature standard, 2013."},{"wmode":0,"bbox":{"x":53,"y":64,"w":232,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":73,"text":"[39] Oak Ridge National Laboratory. Introducing Titan, 2012."},{"wmode":0,"bbox":{"x":71,"y":73,"w":119,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":82,"text":"https://www.olcf.ornl.gov/titan."},{"wmode":0,"bbox":{"x":53,"y":83,"w":208,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":92,"text":"[40] H. Orman. The Oakley key determination protocol."},{"wmode":0,"bbox":{"x":71,"y":92,"w":81,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":101,"text":"RFC 2412, Nov. 1998."},{"wmode":0,"bbox":{"x":53,"y":102,"w":13,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":111,"text":"[41]"},{"wmode":0,"bbox":{"x":66,"y":102,"w":226,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":66,"y":111,"text":" S. C. Pohlig and M. E. Hellman. An improved algorithm for"},{"wmode":0,"bbox":{"x":71,"y":111,"w":99,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":120,"text":"computing logarithms over"},{"wmode":0,"bbox":{"x":170,"y":111,"w":18,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":170,"y":120,"text":" GF("},{"wmode":0,"bbox":{"x":188,"y":114,"w":4,"h":7},"font":{"name":"GSJZLO+LMMathItalic8-Regular","family":"serif","weight":"normal","style":"italic","size":7},"x":188,"y":120,"text":"p"},{"wmode":0,"bbox":{"x":193,"y":111,"w":3,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":193,"y":120,"text":")"},{"wmode":0,"bbox":{"x":196,"y":111,"w":82,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":196,"y":120,"text":" and its cryptographic"},{"wmode":0,"bbox":{"x":71,"y":120,"w":82,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":129,"text":"significance (corresp.)."},{"wmode":0,"bbox":{"x":153,"y":120,"w":87,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":153,"y":129,"text":" Trans. Inform. Theory"},{"wmode":0,"bbox":{"x":241,"y":120,"w":48,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":241,"y":129,"text":", 24(1), 1978."},{"wmode":0,"bbox":{"x":53,"y":130,"w":13,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":139,"text":"[42]"},{"wmode":0,"bbox":{"x":66,"y":130,"w":207,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":66,"y":139,"text":" J. M. Pollard. A Monte Carlo method for factorization."},{"wmode":0,"bbox":{"x":274,"y":130,"w":18,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":274,"y":139,"text":" BIT"},{"wmode":0,"bbox":{"x":70,"y":139,"w":88,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":70,"y":148,"text":"Numerical Mathematics"},{"wmode":0,"bbox":{"x":159,"y":139,"w":80,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":159,"y":148,"text":", 15(3):331–334, 1975."},{"wmode":0,"bbox":{"x":53,"y":149,"w":148,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":158,"text":"[43] O. Schirokauer. Virtual logarithms."},{"wmode":0,"bbox":{"x":202,"y":149,"w":53,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":202,"y":158,"text":" J. Algorithms"},{"wmode":0,"bbox":{"x":256,"y":149,"w":2,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":256,"y":158,"text":","},{"wmode":0,"bbox":{"x":71,"y":158,"w":75,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":167,"text":"57(2):140–147, 2005."},{"wmode":0,"bbox":{"x":53,"y":168,"w":229,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":177,"text":"[44] I. A. Semaev. Special prime numbers and discrete logs in"},{"wmode":0,"bbox":{"x":71,"y":177,"w":66,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":186,"text":"finite prime fields."},{"wmode":0,"bbox":{"x":138,"y":177,"w":52,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":138,"y":186,"text":" Math. Comp."},{"wmode":0,"bbox":{"x":190,"y":177,"w":89,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":190,"y":186,"text":", 71(237):363–377, 2002."},{"wmode":0,"bbox":{"x":53,"y":187,"w":224,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":196,"text":"[45] D. Shanks. Class number, a theory of factorization, and"},{"wmode":0,"bbox":{"x":71,"y":196,"w":36,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":205,"text":"genera. In"},{"wmode":0,"bbox":{"x":108,"y":196,"w":101,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":108,"y":205,"text":" Proc. Sympos. Pure Math."},{"wmode":0,"bbox":{"x":209,"y":196,"w":67,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":209,"y":205,"text":", volume 20. 1971."},{"wmode":0,"bbox":{"x":53,"y":206,"w":13,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":215,"text":"[46]"},{"wmode":0,"bbox":{"x":66,"y":206,"w":226,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":66,"y":215,"text":" Spiegel Staff. Prying eyes: Inside the NSA’s war on Internet"},{"wmode":0,"bbox":{"x":71,"y":215,"w":116,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":224,"text":"security. Der Spiegel, Dec 2014."},{"wmode":0,"bbox":{"x":71,"y":224,"w":174,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":233,"text":"http://www.spiegel.de/international/germany/"},{"wmode":0,"bbox":{"x":71,"y":233,"w":214,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":242,"text":"inside-the-nsa-s-war-on-internet-security-a-1010361.html."},{"wmode":0,"bbox":{"x":53,"y":243,"w":71,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":252,"text":"[47] W. Stein et al."},{"wmode":0,"bbox":{"x":125,"y":243,"w":159,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":125,"y":252,"text":" Sage Mathematics Software (Version 6.5)"},{"wmode":0,"bbox":{"x":284,"y":243,"w":2,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":284,"y":252,"text":"."},{"wmode":0,"bbox":{"x":71,"y":252,"w":132,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":261,"text":"The Sage Development Team, 2015."},{"wmode":0,"bbox":{"x":71,"y":261,"w":98,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":270,"text":"http://www.sagemath.org."},{"wmode":0,"bbox":{"x":53,"y":271,"w":207,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":280,"text":"[48] stud: The scalable TLS unwrapping daemon, 2012."},{"wmode":0,"bbox":{"x":71,"y":280,"w":156,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":289,"text":"https://github.com/bumptech/stud/blob/"},{"wmode":0,"bbox":{"x":71,"y":289,"w":219,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":298,"text":"19a7f19686bcdbd689c6fbea31f68a276e62d886/stud.c#L593."},{"wmode":0,"bbox":{"x":53,"y":299,"w":234,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":308,"text":"[49] E. Thomé. Subquadratic computation of vector generating"},{"wmode":0,"bbox":{"x":71,"y":308,"w":204,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":317,"text":"polynomials and improvement of the block Wiedemann"},{"wmode":0,"bbox":{"x":71,"y":317,"w":38,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":326,"text":"algorithm."},{"wmode":0,"bbox":{"x":109,"y":317,"w":80,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":109,"y":326,"text":" J. Symbolic Comput."},{"wmode":0,"bbox":{"x":190,"y":317,"w":80,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":190,"y":326,"text":", 33(5):757–775, 2002."},{"wmode":0,"bbox":{"x":53,"y":327,"w":223,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":336,"text":"[50] P. C. Van Oorschot and M. J. Wiener. Parallel collision"},{"wmode":0,"bbox":{"x":71,"y":336,"w":200,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":345,"text":"search with application to hash functions and discrete"},{"wmode":0,"bbox":{"x":71,"y":345,"w":52,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":354,"text":"logarithms. In"},{"wmode":0,"bbox":{"x":123,"y":345,"w":42,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":123,"y":354,"text":" ACM CCS"},{"wmode":0,"bbox":{"x":166,"y":345,"w":24,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":166,"y":354,"text":", 1994."},{"wmode":0,"bbox":{"x":53,"y":355,"w":230,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":364,"text":"[51] P. C. Van Oorschot and M. J. Wiener. On Diffie-Hellman"},{"wmode":0,"bbox":{"x":71,"y":364,"w":146,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":373,"text":"key agreement with short exponents. In"},{"wmode":0,"bbox":{"x":218,"y":364,"w":39,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":218,"y":373,"text":" Eurocrypt"},{"wmode":0,"bbox":{"x":257,"y":364,"w":24,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":257,"y":373,"text":", 1996."},{"wmode":0,"bbox":{"x":53,"y":374,"w":13,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":383,"text":"[52]"},{"wmode":0,"bbox":{"x":66,"y":374,"w":227,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":66,"y":383,"text":" D. Wagner and B. Schneier. Analysis of the SSL 3.0 protocol."},{"wmode":0,"bbox":{"x":71,"y":383,"w":7,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":392,"text":"In"},{"wmode":0,"bbox":{"x":79,"y":383,"w":178,"h":11},"font":{"name":"QWTGJF+LMRoman8-Italic","family":"serif","weight":"normal","style":"italic","size":7},"x":79,"y":392,"text":" 2nd Usenix Workshop on Electronic Commerce"},{"wmode":0,"bbox":{"x":257,"y":383,"w":24,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":257,"y":392,"text":", 1996."},{"wmode":0,"bbox":{"x":53,"y":393,"w":239,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":53,"y":402,"text":"[53] J. Wagnon. SSL profiles part 5: SSL options, 2013. https://"},{"wmode":0,"bbox":{"x":71,"y":402,"w":209,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":71,"y":411,"text":"devcentral.f5.com/articles/ssl-profiles-part-5-ssl-options."}]},{"type":"text","bbox":{"x":316,"y":54,"w":240,"h":358},"lines":[{"wmode":0,"bbox":{"x":316,"y":54,"w":168,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":63,"text":"[54] P. Zimmermann et al. GMP-ECM, 2012."},{"wmode":0,"bbox":{"x":334,"y":63,"w":134,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":72,"text":"https://gforge.inria.fr/projects/ecm."},{"wmode":0,"bbox":{"x":316,"y":74,"w":230,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":83,"text":"[55] APEX active/passive exfiltration. Media leak, Aug. 2009."},{"wmode":0,"bbox":{"x":334,"y":83,"w":177,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":92,"text":"http://www.spiegel.de/media/media-35671.pdf."},{"wmode":0,"bbox":{"x":316,"y":93,"w":237,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":102,"text":"[56] Fielded capability: End-to-end VPN SPIN 9 design review."},{"wmode":0,"bbox":{"x":334,"y":102,"w":222,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":111,"text":"Media leak. http://www.spiegel.de/media/media-35529.pdf."},{"wmode":0,"bbox":{"x":316,"y":112,"w":223,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":121,"text":"[57] FY 2013 congressional budget justification. Media leak."},{"wmode":0,"bbox":{"x":334,"y":121,"w":190,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":130,"text":"http://cryptome.org/2013/08/spy-budget-fy13.pdf."},{"wmode":0,"bbox":{"x":316,"y":132,"w":157,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":141,"text":"[58] GALLANTWAVE@scale. Media leak."},{"wmode":0,"bbox":{"x":334,"y":141,"w":177,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":150,"text":"http://www.spiegel.de/media/media-35514.pdf."},{"wmode":0,"bbox":{"x":316,"y":151,"w":160,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":160,"text":"[59] Innov8 experiment profile. Media leak."},{"wmode":0,"bbox":{"x":334,"y":160,"w":177,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":169,"text":"http://www.spiegel.de/media/media-35509.pdf."},{"wmode":0,"bbox":{"x":316,"y":171,"w":228,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":180,"text":"[60] Intro to the VPN exploitation process. Media leak, Sept."},{"wmode":0,"bbox":{"x":334,"y":180,"w":199,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":188,"text":"2010. http://www.spiegel.de/media/media-35515.pdf."},{"wmode":0,"bbox":{"x":316,"y":190,"w":156,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":199,"text":"[61] LONGHAUL – WikiInfo. Media leak."},{"wmode":0,"bbox":{"x":334,"y":199,"w":177,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":208,"text":"http://www.spiegel.de/media/media-35533.pdf."},{"wmode":0,"bbox":{"x":316,"y":209,"w":159,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":218,"text":"[62] POISONNUT – WikiInfo. Media leak."},{"wmode":0,"bbox":{"x":334,"y":218,"w":177,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":227,"text":"http://www.spiegel.de/media/media-35519.pdf."},{"wmode":0,"bbox":{"x":316,"y":229,"w":127,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":238,"text":"[63] SIGINT strategy. Media leak."},{"wmode":0,"bbox":{"x":334,"y":238,"w":199,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":247,"text":"http://www.nytimes.com/interactive/2013/11/23/us/"},{"wmode":0,"bbox":{"x":334,"y":247,"w":169,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":256,"text":"politics/23nsa-sigint-strategy-document.html."},{"wmode":0,"bbox":{"x":316,"y":257,"w":138,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":266,"text":"[64] SPIN 15 VPN story. Media leak."},{"wmode":0,"bbox":{"x":334,"y":266,"w":177,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":275,"text":"http://www.spiegel.de/media/media-35522.pdf."},{"wmode":0,"bbox":{"x":316,"y":276,"w":238,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":285,"text":"[65] TURMOIL/APEX/APEX high level description document."},{"wmode":0,"bbox":{"x":334,"y":285,"w":222,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":294,"text":"Media leak. http://www.spiegel.de/media/media-35513.pdf."},{"wmode":0,"bbox":{"x":316,"y":296,"w":13,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":305,"text":"[66]"},{"wmode":0,"bbox":{"x":329,"y":296,"w":227,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":329,"y":305,"text":" TURMOIL IPsec VPN sessionization. Media leak, Aug. 2009."},{"wmode":0,"bbox":{"x":334,"y":305,"w":177,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":314,"text":"http://www.spiegel.de/media/media-35528.pdf."},{"wmode":0,"bbox":{"x":316,"y":315,"w":209,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":324,"text":"[67] TURMOIL VPN processing. Media leak, Oct. 2009."},{"wmode":0,"bbox":{"x":334,"y":324,"w":177,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":333,"text":"http://www.spiegel.de/media/media-35526.pdf."},{"wmode":0,"bbox":{"x":316,"y":335,"w":214,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":344,"text":"[68] VALIANTSURF (VS): Capability levels. Media leak."},{"wmode":0,"bbox":{"x":334,"y":344,"w":177,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":352,"text":"http://www.spiegel.de/media/media-35517.pdf."},{"wmode":0,"bbox":{"x":316,"y":354,"w":169,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":363,"text":"[69] VALIANTSURF – WikiInfo. Media leak."},{"wmode":0,"bbox":{"x":334,"y":363,"w":177,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":372,"text":"http://www.spiegel.de/media/media-35527.pdf."},{"wmode":0,"bbox":{"x":316,"y":373,"w":137,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":382,"text":"[70] VPN SigDev basics. Media leak."},{"wmode":0,"bbox":{"x":334,"y":382,"w":177,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":391,"text":"http://www.spiegel.de/media/media-35520.pdf."},{"wmode":0,"bbox":{"x":316,"y":393,"w":237,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":316,"y":402,"text":"[71] What your mother never told you about SIGDEV analysis."},{"wmode":0,"bbox":{"x":334,"y":402,"w":222,"h":11},"font":{"name":"FWLZSD+LMRoman8-Regular","family":"serif","weight":"normal","style":"normal","size":7},"x":334,"y":411,"text":"Media leak. http://www.spiegel.de/media/media-35551.pdf."}]},{"type":"text","bbox":{"x":300,"y":737,"w":9,"h":12},"lines":[{"wmode":0,"bbox":{"x":300,"y":737,"w":9,"h":12},"font":{"name":"UQBXFR+LMRoman9-Regular","family":"serif","weight":"normal","style":"normal","size":8},"x":300,"y":747,"text":"13"}]}]}]}