0.737 w  q 1 0 0 1 63.054 737.833 cm 0 0 m 483.605 0 l S Q BT /T1_0 7.97 Tf 281.867 728.683 Td [(V)82(ulner)55.001(able)-383.998(servers,)-383.998(if)-384.011(the)-383.998(attac)-0.991(ker)-384.011(c)55.006(an)-384.001(pr)55.001(e)55.001(c)54.993(ompu)-0.991(te)-383.998(for)-384.011(.)-164.001(.)-164.992(.)]TJ ET 0.276 w  q 1 0 0 1 231.994 724.312 cm 0 0 m 314.666 0 l S Q BT /T1_1 7.97 Tf 237.374 715.392 Td [(all)-354(512-bit)-354(groups)-1349.997(all)-353.998(768-bit)-354.011(groups)-1349.997(one)-353.998(1024-bit)-353.998(group)-1349.997(ten)-354.011(1024-bit)-353.998(groups)]TJ ET 0.46 w  q 1 0 0 1 63.054 710.929 cm 0 0 m 483.605 0 l S Q BT 68.434 701.917 Td [(HTTPS)-354(T)89(op)-355(1M)-353.998(w/)-353.998(activ)30(e)-355.002(do)30(wngrade)]TJ 183.121 0 Td [(45,10)1.004(0)-355.002(\(8.4%\))-3127.003(45,100)-353.998(\(8.4%\))-2650.007(205,000)-353.998(\(37.1%\))-2949.991(309,000)-353.998(\(56.1%\))]TJ -183.121 -8.967 Td [(HTTPS)-353.998(T)88.995(op)-355.002(1M)]TJ 193.928 0 Td [(118)-353.998(\(0.0%\))-4485.004(407)-353.998(\()-1.004(0)1.004(.1%\))-3180.992(98,500)-354.011(\(17.9%\))-2950.995(132,000)-353.998(\(24.0%\))]TJ -193.928 -8.966 Td [(HTTPS)-353.998(T)88.995(ruste)-0.991(d)-354.011(w/)-353.998(activ)30(e)-354.99(do)29.987(wngrade)-4801.989(489,000)-354.011(\(3.4%\))-2595.992(556,000)-353.998(\(3.9%\))-1823.003(1,840,000)-353.998(\(12.8%\))-2124.003(3,410,000)-353.998(\(23.8%\))]TJ 0 -8.967 TD [(HTTPS)-353.998(T)88.995(ruste)-0.991(d)]TJ 187.337 0 Td [(1,000)-353.998(\(0.0%\))-3128.006(46,700)-353.998(\(0.3%\))-2649.994(9)0.991(39,000)-353.998(\(6.56%\))-2124.994(1,43)1.004(0,000)-355.002(\(1)0.991(0.0%\))]TJ -187.337 -14.943 Td [(IKEv1)-353.998(IPv4)]TJ 229.682 0 Td [(\025)-3128.006(64,700)-353.998(\(2.6%\))-1822.99(1,690,000)-354.011(\(66.1%\))-2123.99(1,690,000)-353.998(\(66.1%\))]TJ -229.682 -8.967 Td [(IKEv2)-353.998(IPv4)]TJ 229.682 0 Td [(\025)-3127.994(66,000)-354.011(\(5.8%\))-2648.99(726,000)-353.998(\(63.9%\))-2951.007(726,000)-353.998(\(63.9%\))]TJ -229.682 -14.944 Td [(SSH)-353.998(IPv4)]TJ 229.682 0 Td (\025)Tj 75.74 0 Td [(\025)-1823.003(3,600,000)-353.998(\(25.7%\))-2124.003(3,600,000)-353.998(\(25.7%\))]TJ ET 0.737 w  q 1 0 0 1 63.054 631.563 cm 0 0 m 483.605 0 l S Q BT /T1_2 8.966 Tf 1.02 0 0 1 53.467 615.902 Tm [(T)84.003(able)-341.999(3:)]TJ /T1_3 8.966 Tf 1 0 0 1 90.838 615.902 Tm [(Estimated)-400.997(impact)-401.008(of)-400.997(Di\036e-)-1.004(Hellman)-400.997(attac)33.001(ks.)]TJ /T1_2 8.966 Tf 1.02 0 0 1 299.81 615.902 Tm [(W)84.003(e)-341.999(use)-341.006(In)28.005(ternet-wide)-341.999(scanning)-341.006(to)-341.999(estimate)-340.995(the)-341.999(n)27.993(um)28.005(b)-28.005(er)-340.995(of)-341.999(real-)]TJ 0.99 0 0 1 53.467 605.441 Tm [(w)28.997(orld)-346.003(serv)28.005(ers)-346.003(for)-345.992(whic)28.997(h)-347.007(t)29.008(ypical)-346.003(connections)-346.995(could)-346.003(b)-28.997(e)-346.003(compromised)-347.007(b)29.008(y)-346.003(attac)28.997(k)28.997(ers)-346.995(with)-346.003(v)58.005(arious)-347.007(lev)29.008(els)-346.003(of)-347.007(computational)-345.992(resources.)]TJ 0.983 0 0 1 53.798 594.98 Tm [(F)87.003(or)-347.999(HTTPS,)-347.007(w)28.997(e)-347.999(pro)29.008(vide)-347.007(\034gures)-347.999(with)-347.999(and)-346.995(without)-347.999(do)28.997(wngrade)-347.999(attac)30.001(k)-1.004(s)-346.995(on)-347.999(the)-347.999(c)28.997(hose)0.993(n)-347.999(ciphersuite.)-463.999(All)-347.999(others)-347.999(are)-346.995(passiv)28.997(e)-347.999(attac)28.997(ks.)]TJ 1.02 0 0 1 53.798 563.947 Tm [(targeted)-376.996(malw)27.993(are)-376.996(is)-376.996(a)-377.007(piece)-376.996(of)-376.996(the)-377.007(collection)-376.996(strategy)-376.996([60];)]TJ 1.018 0 0 1 53.798 553.486 Tm [(ho)28.005(w)27.993(ev)28.005(er,)-338.006(the)-336.991(same)-338.006(do)-27.993(cumen)27.993(ts)-337.995(also)-337.003(note)-338.006(that)-337.995(decryption)-337.003(of)]TJ 1.02 0 0 1 53.798 543.025 Tm [(the)-352.003(resulting)-350.999(tra\036c)]TJ /T1_4 8.966 Tf 80.724 0 Td [(do)51.002(es)-374.007(not)]TJ /T1_2 8.966 Tf 36.397 0 Td [(require)-352.003(IKE)-350.999(handshak)28.005(es,)-356.007(and)]TJ -117.121 -10.461 Td [(th)28.005(us)-380.008(app)-27.993(ears)-380.008(to)-379.996(b)-28.005(e)-379.996(an)-379.996(alternativ)27.993(e)-379.996(mec)28.005(hanism)-380.008(to)-379.996(the)-379.996(V)111.996(A)28.005(O)]TJ 1.002 0 0 1 53.798 522.103 Tm [(attac)28.997(k)-343.995(de)0.993(scrib)-28.997(ed)-343.003(ab)-27.993(o)27.993(v)28.005(e)1.004(.)-460.006(The)-342.992(most)-343.003(comp)-28.005(elling)-343.003(argumen)28.005(t)-343.003(for)]TJ 1.02 0 0 1 53.798 511.643 Tm [(a)-406.005(pure)-405.993(cryptographic)-406.005(attac)28.005(k)-406.005(is)-405.993(the)-406.005(generalit)28.005(y)-407.008(of)-405.993(the)-406.005(V)112.007(A)27.993(O)]TJ 0.985 0 0 1 53.798 501.182 Tm [(approac)28.997(h,)-349.003(whic)29.008(h)-349.003(app)-28.997(ears)-347.999(to)-349.003(succeed)-349.003(across)-347.999(a)-349.003(broad)-348.992(sw)28.997(ath)-347.999(of)]TJ 1 0 0 1 53.798 490.721 Tm [(non-compromised)-343.003(devices.)]TJ /T1_5 11.955 Tf 0 -21.812 TD [(4.3)-1000(Effects)-250(of)-250(a)-250(1024-bit)-250(Br)18(eak)]TJ /T1_2 8.966 Tf 1.02 0 0 1 62.765 455.957 Tm [(In)-396.001(this)-397.004(section,)-411.001(w)28.005(e)-396.001(use)-396.993(In)27.993(ternet-w)1.004(ide)-397.004(scanning)-396.001(to)-396.001(assess)]TJ 0.997 0 0 1 53.798 445.497 Tm [(the)-343.003(impact)-343.003(of)-342.992(a)-344.007(h)29.008(yp)-29.008(othe)1.004(tical)-343.995(DH-1)0.993(024)-343.995(break)-343.003(on)-343.003(three)-342.992(p)-29.008(opu-)]TJ 1.02 0 0 1 53.798 435.036 Tm [(lar)-343.003(proto)-27.993(cols:)-463.006(IKE,)-343.003(SSH,)-343.995(and)-343.003(HTTPS.)-469.999(Our)-343.003(measuremen)28.005(ts)]TJ 0 -10.461 TD [(indicate)-379.004(that)-378.993(these)-379.004(proto)-28.005(cols,)-390(as)-378.993(they)-379.004(are)-379.996(c)0.993(om)-0.993(monly)-379.004(used,)]TJ 0.989 0 0 1 53.467 414.114 Tm [(w)28.997(ould)-344.999(b)-28.997(e)-344.999(sub)-28.997(ject)-344.999(to)-345.01(widespread)-344.999(compromise)-344.999(b)28.997(y)-344.999(a)-344.999(state-lev)29.008(el)]TJ 0.994 0 0 1 53.798 403.653 Tm [(attac)28.997(k)28.005(e)0.993(r)-345.992(who)-344.999(had)-344.999(the)-344.999(resources)-345.01(to)-344.999(in)29.008(v)27.993(est)-344.999(in)-344.999(precomputation)]TJ 1 0 0 1 53.798 393.193 Tm [(for)-343.003(a)-341.999(small)-343.003(n)29.008(um)27.993(b)-27.993(er)-343.003(of)-341.999(comm)-1.004(on)-341.999(1024-bit)-343.003(groups.)]TJ /T1_3 8.966 Tf 0 -15.141 TD (IKE)Tj /T1_2 8.966 Tf 0.98 0 0 1 85.265 378.052 Tm [(W)87.003(e)-338.999(m)-1.004(e)1.004(asured)-340.003(ho)28.997(w)-340.003(IPsec)-339.992(VPNs)-340.003(use)-338.999(Di\036e-Hellman)-340.003(in)]TJ -32.109 -10.46 Td [(practice)-320.998(b)30.001(y)-320.998(scanning)-321.01(a)-320.998(1%)-319.995(random)-320.998(sample)-320.998(of)-320.006(the)-320.998(public)-320.998(IPv4)]TJ 1.012 0 0 1 53.798 357.131 Tm [(address)-338.999(spac)1.004(e)-339.01(for)-338.999(IKEv1)-337.995(and)-338.999(IKEv2)-338.006(\(the)-338.999(proto)-27.993(cols)-338.006(used)-338.999(to)]TJ 1.02 0 0 1 53.798 346.67 Tm [(initiate)-363(an)-363(IPsec)-363(VPN)-362.007(connection\))-363(in)-363(Ma)28.005(y)-363(2015.)-528.997(W)83.991(e)-363(used)]TJ 0.98 0 0 1 53.798 336.209 Tm [(the)-296.998(ZMap)-296.998(UDP)-297.009(prob)-28.997(e)-296.998(mo)-28.997(dule)-297.009(to)-296.998(measure)-296.998(supp)-28.997(ort)-296.998(for)-297.009(Oakley)]TJ 1.02 0 0 1 53.798 325.748 Tm [(Groups)-435.002(1)-435.994(and)-435.002(2)-435.002(\(t)28.005(w)27.993(o)-435.994(p)-28.005(opula)1.004(r)-436.006(768-)-435.002(and)-435.002(1024-bit,)-460.999(built)1.004(-in)]TJ 0 -10.46 TD [(groups\))-430.005(and)-429.994(whic)28.005(h)-430.005(group)-430.005(serv)28.005(ers)-429.002(prefer.)-730.003(T)84.003(o)-429.994(test)-430.005(supp)-27.993(ort)]TJ 0 -10.461 TD [(for)-409.997(individual)-410.008(groups,)-428.99(w)27.993(e)-409.997(o\033ered)-409.997(only)-410.008(the)-409.997(single)-409.997(group)-409.997(in)]TJ T* [(question.)-569.002(T)84.003(o)-376.996(detect)-376.004(default)-376.004(b)-27.993(eha)27.993(vior,)-387(w)28.005(e)-376.004(o\033ered)-375.993(serv)27.993(ers)-376.996(a)]TJ 0.998 0 0 1 53.559 283.905 Tm [(v)57.002(ariet)28.997(y)-343.995(of)-343.003(DH)-344.007(groups,)-343.995(with)-343.003(the)-343.995(lo)28.997(w)28.005(e)0.993(st)-343.995(priorit)28.997(y)-343.995(groups)-344.007(b)-27.993(eing)]TJ 0.995 0 0 1 53.798 273.445 Tm [(Oakley)-343.995(Groups)-343.003(1)-344.007(and)-343.995(2.)-457.999(When)-344.007(measuring)-343.995(serv)28.997(er)-343.995(preference,)]TJ 1.02 0 0 1 53.467 262.984 Tm [(w)28.005(e)-459.002(scanned)-460.006(with)-458.991(the)-459.002(3DES)-460.006(symmetric)-458.991(cipher)-121.007(\026)-120.996(the)-459.002(most)]TJ 1.014 0 0 1 53.798 252.523 Tm [(commonly)-338.999(supp)-28.005(orted)-338.999(symmetric)-338.999(cipher)-338.999(in)-338.999(our)-338.999(single)-338.999(group)]TJ 0.98 0 0 1 53.798 242.062 Tm [(scans.)-459.995(Because)-332.006(of)-331.995(this,)-335.999(the)-332.006(p)-28.997(ercen)28.997(tages)-331.995(w)30.001(e)-332.006(presen)28.997(t)-331.995(for)-332.006(IKEv1)]TJ T* [(and)-343.995(IKEv)-1.004(2)-344.007(are)-343.995(a)-344.999(lo)28.997(w)28.997(e)1.004(r)-344.999(b)-28.997(ound)-344.007(f)-0.993(or)-344.007(the)-343.995(n)28.997(um)28.997(b)-28.997(er)-344.999(of)-343.995(serv)28.997(ers)-344.007(that)]TJ 1 0 0 1 53.798 221.141 Tm [(prefer)-343.003(Oakley)-341.999(Groups)-343.003(1)-341.999(and)-342.992(2.)]TJ 0.982 0 0 1 62.765 210.68 Tm [(Of)-349.996(the)-349.003(80K)-350.007(hosts)-348.992(that)-350.007(resp)-28.997(onded)-349.003(with)-349.996(a)-349.003(v)58.005(alid)-350.007(IKE)-348.992(pac)28.997(k)28.997(et,)]TJ 0.98 0 0 1 53.476 200.219 Tm [(44.2%)-287.005(w)29.008(ere)-287.005(willing)-286.994(to)-287.005(accept)-287.005(an)-287.997(o\033ered)-286.994(prop)-29.008(osal)-286.994(from)-287.005(at)-286.994(least)]TJ 1.02 0 0 1 53.798 189.758 Tm [(one)-378(sca)1.004(n.)-573.006(The)-378(ma)-27.993(jorit)27.993(y)-376.996(of)-378(the)-378(re)1.004(m)-1.004(aining)-376.996(hosts)-378(resp)-28.005(onde)1.004(d)]TJ -0.325 -10.46 Td [(with)-341.999(a)]TJ /T1_6 8.966 Tf 1 0 0 1 82.796 179.298 Tm (NO-PROPOSAL-CHOSEN)Tj /T1_2 8.966 Tf 1.02 0 0 1 170.655 179.298 Tm [(message)-341.999(regardless)-341.999(of)-341.999(our)-341.999(pro-)]TJ -114.566 -10.461 Td [(p)-28.005(osal.)-480.996(Man)28.005(y)-347.007(of)-346.995(these)-346.003(ma)28.005(y)-347.007(b)-27.993(e)-347.007(site-to-site)-346.995(VPNs)-347.007(that)-345.992(reject)]TJ 0.98 0 0 1 53.798 158.376 Tm [(our)-292.001(source)-292.001(address.)-447.002(W)88.006(e)-292.001(consider)-292.001(these)-292.001(hosts)-292.001(\020unpro\034led\021)-292.001(and)]TJ 1 0 0 1 53.798 147.915 Tm [(omit)-343.003(them)-341.999(from)-343.003(the)-341.999(results)-342.992(here.)]TJ 0.98 0 0 1 62.765 137.455 Tm [(W)87.003(e)-275.997(found)-277.001(that)-276.008(31.8%)-277.001(of)-277.001(IKEv1)-275.997(and)-277.001(19.7%)-275.997(of)-277.001(IKEv2)-277.001(serv)28.997(ers)]TJ 1.02 0 0 1 53.798 126.994 Tm [(supp)-28.005(ort)-363(Oakley)-361.996(Group)-363(1)-361.996(\(768-bit\))-363(while)-362.007(86.1%)-363(and)-361.996(91.0%)]TJ T* [(resp)-28.005(ectiv)28.005(ely)-364.996(supp)-28.005(orted)-364.996(Oakley)-365.007(Group)-364.996(2)-364.003(\(1024-bit\).)-534.997(In)-364.996(our)]TJ 1.013 0 0 1 53.798 106.072 Tm [(sample)-337.995(of)-339.01(IKEv1)-337.995(serv)28.005(ers,)-338.006(2.6%)-337.995(of)-338.999(pro\034le)0.993(d)-338.999(serv)28.005(ers)-338.006(preferred)]TJ 0.993 0 0 1 53.798 95.611 Tm [(the)-343.995(768-bit)-344.007(Oakley)-343.003(Group)-343.995(1)-123.996(\026)-125(whic)28.997(h)-344.007(is)-343.995(w)1.004(ithin)-344.007(cryptanalytic)]TJ 0.984 0 0 1 53.798 85.151 Tm [(reac)28.997(h)-347.999(to)-28.997(da)28.997(y)-346.995(for)-347.999(mo)-29.008(derately)-347.999(resourced)-346.995(attac)28.997(k)28.997(ers)-125(\026)-125.993(and)-347.007(66.1%)]TJ 1.02 0 0 1 53.798 74.69 Tm [(preferred)-393.001(the)-391.997(1024-bit)-393.001(Oakley)-393.001(Group)-393.001(2.)-618.007(F)84.003(or)-393.001(IKEv2,)-406.997(5.8%)]TJ 1.019 0 0 1 316.812 563.947 Tm [(of)-337.003(pro\034led)-335.999(serv)28.005(ers)-337.003(c)27.993(hose)-335.999(Oakley)-336.991(Group)-337.003(1,)-335.999(and)-337.003(63.9%)-337.003(c)28.005(hose)]TJ 0.989 0 0 1 316.812 553.486 Tm [(Oakley)-346.995(Group)-347.007(2.)-465.003(This)-346.995(coincides)-346.995(with)-347.007(our)-346.995(anecdotal)-347.007(\034ndings)]TJ 0.98 0 0 1 316.812 543.025 Tm [(that)-338.999(m)-1.004(o)1.004(s)-1.004(t)-338.999(VPN)-338.999(clien)28.997(ts)-340.003(only)-338.999(o\033er)-339.992(Oakley)-338.999(Group)-340.003(2)-338.999(b)28.997(y)-340.003(default.)]TJ /T1_3 8.966 Tf 1 0 0 1 316.812 528.534 Tm (SSH)Tj /T1_2 8.966 Tf 1.02 0 0 1 349.921 528.534 Tm [(All)-417.001(SSH)-417.994(handshak)27.993(es)-417.001(complete)-417.994(eit)0.993(her)-417.994(a)-417.001(\034nite)-418.005(\034eld)]TJ 1.015 0 0 1 316.812 518.073 Tm [(Di\036e-Hellman)-337.003(or)-335.999(elliptic)-337.003(curv)28.005(e)-337.003(Di\036e-Hellman)-335.999(exc)28.005(hange)-337.003(as)]TJ 1.005 0 0 1 316.812 507.612 Tm [(part)-340.995(of)-341.006(the)-340.995(SSH)-341.006(k)28.005(ey)-341.006(exc)29.008(hange.)-454.999(The)-341.006(SSH)-340.995(proto)-28.005(col)-340.995(explicitly)]TJ 1.02 0 0 1 316.812 497.151 Tm [(de\034nes)-335.999(supp)-28.005(ort)-335.999(for)-335.999(O)1.004(ak)-1.004(le)1.004(y)-335.999(Group)-336.01(2)-335.999(\(1024-bit\))-335.999(and)-335.999(Oakley)]TJ 1.008 0 0 1 316.812 486.691 Tm [(Group)-340.003(14)-340.995(\(2048)0.993(-bit\))-340.995(but)-340.003(also)-340.003(allo)28.005(ws)-340.003(a)-340.995(serv)28.997(er-de\034ned)-340.003(group,)]TJ 0.98 0 0 1 316.48 476.23 Tm [(whic)28.997(h)-332.999(can)-332.999(b)-30.001(e)-332.999(negotiated)-332.999(through)-332.999(an)-332.999(auxiliary)-334.002(Di\036e-Hellman)]TJ 1 0 0 1 316.812 465.769 Tm [(Group)-343.003(Exc)28.997(hange)-342.992(\(DH)0.993(-GEX\))-342.992(handshak)28.997(e)-343.003([16].)]TJ 1.02 0 0 1 325.778 455.308 Tm [(In)-430.998(order)-430.998(to)-432.002(measure)-430.998(ho)27.993(w)-430.998(SSH)-430.998(uses)-430.998(DH)-431.009(in)-431.991(practice,)-455.01(w)28.005(e)]TJ 1.019 0 0 1 316.812 444.847 Tm [(implemen)28.005(ted)-337.003(the)-337.003(SSH)-337.995(prot)0.993(o)-28.997(c)1.004(ol)-338.006(in)-337.003(the)-336.991(ZMap)-337.003(to)-28.005(olc)28.005(hain)-338.006(a)1.004(nd)]TJ 0.98 0 0 1 316.812 434.387 Tm [(scanned)-280.001(1%)-278.997(random)-280.001(samples)-280.001(of)-280.001(the)-280.001(public)-278.997(IPv4)-280.001(address)-280.001(space)]TJ 1.02 0 0 1 316.812 423.926 Tm [(in)-355.003(April)-354.992(2015.)-506(W)83.991(e)-354.992(\034nd)-355.003(that)-356.007(98.9%)-354.992(of)-355.003(SSH)-355.003(serv)28.005(ers)-355.003(supp)-27.993(ort)]TJ T* [(the)-381(1024-bit)-379.996(Oakley)-381(Group)-381(2,)-391.004(77.6%)-381(supp)-28.005(ort)-381(the)-379.996(2048-bit)]TJ 1 0 0 1 316.812 403.004 Tm [(Oakley)-343.003(Group)-341.999(14,)-343.003(and)-341.999(68.7%)-342.992(supp)-28.005(ort)-343.003(DH-GEX.)]TJ 0.98 0 0 1 325.778 392.544 Tm [(During)-299.998(the)-299.998(SSH)-300.009(handshak)29.008(e,)-310.002(the)-301.002(clie)1.004(n)28.997(t)-301.002(and)-299.998(serv)28.997(er)-299.998(select)-299.998(the)]TJ 1.02 0 0 1 316.812 382.083 Tm [(clien)28.005(t's)-398.008(highest)-399.001(priorit)28.005(y)-397.997(m)27.993(utually)-399.001(supp)-27.993(orted)-398.008(k)28.005(ey)-399.001(e)1.004(x)-1.004(c)28.005(ha)0.993(nge)]TJ 0.98 0 0 1 316.812 371.622 Tm [(algorithm.)-462.995(Therefore,)-341.006(w)28.997(e)-338.999(cannot)-338.999(directly)-338.999(measure)-340.003(w)1.004(h)-1.004(a)1.004(t)-340.003(algo-)]TJ T* [(rithm)-283.001(serv)28.997(ers)-281.997(will)-283.001(prefer)-283.001(in)-283.001(practice.)-444.002(In)-281.997(order)-283.001(to)-283.001(estimate)-282.99(t)0.993(h)-0.993(i)0.993(s)-0.993(,)]TJ 1.016 0 0 1 316.48 350.701 Tm [(w)28.005(e)-336.01(p)-27.993(erformed)-335.006(a)-335.999(scan)-335.999(in)-335.999(whic)28.997(h)-335.999(w)28.005(e)-335.999(mimic)27.993(k)28.005(ed)-335.006(the)-335.999(algorithms)]TJ 0.989 0 0 1 316.812 340.24 Tm [(o\033ered)-344.999(b)27.993(y)-344.999(Op)-28.997(enSSH)-346.003(6.6.1p1,)-344.999(the)-345.992(latest)-346.003(v)28.997(ersion)-344.999(of)-346.003(Op)-28.997(enSSH.)]TJ 0.999 0 0 1 316.812 329.779 Tm [(In)-343.003(this)-341.999(scan,)-343.003(21.8%)-342.992(of)-341.999(serv)27.993(ers)-343.003(pre)1.004(f)-1.004(e)1.004(rred)-343.003(the)-342.992(1024-bit)-342.01(Oakley)]TJ 0.98 0 0 1 316.812 319.318 Tm [(Group)-307.002(2,)-314.998(and)-305.998(37.4%)-307.002(preferred)-305.998(a)-307.002(serv)28.997(er-de\034ned)-305.998(group.)-451.999(10%)-305.998(of)]TJ 1.007 0 0 1 316.812 308.857 Tm [(the)-338.999(serv)27.993(er-de\034ned)-338.999(groups)-339.992(w)28.997(ere)-340.003(1024-bit,)-338.999(but,)-340.003(of)-338.999(those,)-340.003(near)]TJ 1 0 0 1 316.812 298.397 Tm [(all)-343.003(pro)28.997(vided)-342.992(Oakley)-341.999(Group)-343.003(2)-341.999(rather)-343.003(than)-341.999(a)-343.003(custom)-343.003(group.)]TJ 1.008 0 0 1 325.778 287.936 Tm [(Com)28.005(bining)-339.01(these)-338.999(equiv)56.009(alen)27.993(t)-338.999(c)28.005(hoice)0.993(s,)-339.992(w)27.993(e)-338.999(\034nd)-338.999(that)-340.003(a)-338.999(state-)]TJ 1.003 0 0 1 316.812 277.475 Tm [(lev)28.005(el)-342.01(attac)28.005(k)28.997(er)-342.992(who)-343.003(p)-28.997(erformed)-342.01(NFS)-342.992(precomputations)-343.003(for)-343.003(the)]TJ 1.02 0 0 1 316.351 267.014 Tm [(1024-bit)-335.999(Oakley)-337.003(Group)-335.999(2)-337.003(\(whic)28.005(h)-335.999(has)-337.003(b)-28.005(een)-335.999(in)-337.003(standards)-335.999(for)]TJ 0.98 0 0 1 316.812 256.554 Tm [(almost)-251.996(t)28.997(w)28.997(o)-251.996(decades\))-252.007(could)-253(passiv)29.008(e)0.993(ly)-253(ea)29.008(v)28.997(esdrop)-251.996(on)-252.007(connections)]TJ 1 0 0 1 316.812 246.093 Tm [(to)-343.003(3.6M)-341.999(\(25.7%\))-343.003(publicly)-341.999(accessible)-342.992(SSH)-342.01(serv)28.005(ers.)]TJ /T1_3 8.966 Tf 0 -14.492 TD (HTTPS)Tj /T1_7 7.97 Tf 0.98 0 0 1 364.356 231.601 Tm (DHE)Tj /T1_2 8.966 Tf 19.356 0 Td [(is)-244(commonly)-244(deplo)30.001(y)28.997(ed)-244(on)-244(w)28.997(eb)-242.996(serv)28.997(ers.)-430.998(68.3%)]TJ 1.02 0 0 1 316.812 221.141 Tm [(of)-406.005(Alexa)-405.001(T)84.003(op)-405.993(1M)-406.005(sites)-405.001(supp)-27.993(ort)]TJ /T1_7 7.97 Tf 129.526 0 Td (DHE)Tj /T1_2 8.966 Tf [(,)-406.005(as)-405.001(do)-405.993(23.9%)-406.005(of)-405.001(sites)]TJ 1.008 0 0 1 316.48 210.68 Tm [(with)-340.995(bro)28.997(wser-trusted)-341.006(certi\034cate)1.004(s.)-456.002(Of)-340.995(t)0.993(he)-340.995(T)84.995(op)-340.995(1M)-340.003(sites)-340.995(that)]TJ 0.98 0 0 1 316.812 200.219 Tm [(supp)-28.997(ort)]TJ /T1_7 7.97 Tf 33.955 0 Td (DHE)Tj /T1_2 8.966 Tf [(,)-323.998(84%)-323.998(use)-323.998(a)-323.006(1024-bit)-323.998(or)-323.998(smaller)-323.998(group,)-329.006(with)-322.995(94%)]TJ 1 0 0 1 316.812 189.758 Tm [(of)-343.003(these)-341.999(using)-343.003(one)-341.999(of)-342.992(\034v)28.997(e)-343.003(groups.)]TJ 0.993 0 0 1 325.778 179.298 Tm [(Despite)-343.003(widespread)-343.995(supp)-28.997(ort)-343.003(for)]TJ /T1_7 7.97 Tf 129.153 0 Td (DHE)Tj /T1_2 8.966 Tf [(,)-343.995(a)-343.003(passiv)28.997(e)-343.995(ea)28.997(v)29.008(esdrop-)]TJ 1.016 0 0 1 316.812 168.837 Tm [(p)-28.005(er)-337.995(can)-338.006(only)-338.999(decrypt)-337.995(connections)-337.995(that)-338.006(organically)-337.995(agree)-338.006(to)]TJ 0.988 0 0 1 316.812 158.376 Tm [(use)-346.995(Di\036e-Hellman.)-465.003(W)87.003(e)-347.007(can)-347.999(estimate)-346.995(the)-347.007(n)28.005(um)28.997(b)-28.997(er)-347.007(of)-346.995(sites)-347.999(for)]TJ 0.98 0 0 1 316.48 147.915 Tm [(whic)28.997(h)-310.994(this)-311.006(will)-310.994(o)-29.008(ccur)-310.994(b)28.997(y)-310.994(o\033ering)-311.006(the)-310.994(same)-311.006(sets)-310.994(of)-311.006(ciphersuites)]TJ 1.02 0 0 1 316.812 137.455 Tm [(as)-372(Chrome,)-381(Firefo)28.005(x,)-381(and)-372(Safari.)-556.009(While)-372(the)-372(o\033ered)-372(ciphers)]TJ 1.019 0 0 1 316.812 126.994 Tm [(di\033er)-335.999(sligh)27.993(tly)-335.999(b)-27.993(et)27.993(w)28.005(een)-335.006(bro)28.005(wsers,)-335.999(this)-335.999(turns)-335.999(out)-335.999(to)-335.999(result)-336.01(in)]TJ 1 0 0 1 316.812 116.533 Tm [(negligible)-341.999(di\033erences)-343.003(in)-343.003(w)1.004(hether)]TJ /T1_7 7.97 Tf 131.949 0 Td (DHE)Tj /T1_2 8.966 Tf 20.244 0 Td [(is)-343.001(c)29(hosen.)]TJ 0.98 0 0 1 325.778 106.072 Tm [(Appro)28.997(ximately)-272.997(24.0%)-272.997(of)-273.008(bro)29.008(wser)-273.008(connections)-272.997(with)-272.997(HTTPS-)]TJ 1.007 0 0 1 316.812 95.611 Tm [(enabled)-340.003(T)85.006(op)-338.999(1M)-340.003(sites)-340.003(\(and)-338.999(10%)-340.003(with)-340.003(bro)29.008(wser-trusted)-340.003(sites\))]TJ 0.98 0 0 1 316.48 85.151 Tm [(will)-313.994(negotiate)]TJ /T1_7 7.97 Tf 56.835 0 Td (DHE)Tj /T1_2 8.966 Tf 19.987 0 Td [(with)-313.994(one)-314.006(of)-313.994(the)-314.006(ten)-313.994(most)-314.006(p)-28.997(opular)-314.006(1024-bit)]TJ 1.02 0 0 1 316.812 74.69 Tm [(primes;)-421.005(17.9%)-393.001(of)-391.997(connections)-393.001(with)-391.997(T)84.003(op)-393.001(1M)-393.001(sites)-391.997(could)-393.001(b)-28.005(e)]TJ 1 0 0 1 300.249 44.802 Tm (10)Tj ET BT /T1_0 8.966 Tf 0.98 0 0 1 53.798 728.239 Tm [(passiv)28.997(ely)-301.994(ea)28.997(v)28.997(esdropp)-28.997(ed)-302.005(giv)30.001(en)-301.994(the)-302.005(precomputation)-301.994(for)-302.005(a)-301.994(single)]TJ 1.02 0 0 1 53.337 717.778 Tm [(1024-bit)-438.002(prime.)-753(The)-438.002(most)-436.998(p)-27.993(opular)-438.002(site)-436.998(that)-438.002(negotiates)-438.002(a)]TJ /T1_1 7.97 Tf 0.98 0 0 1 53.798 707.318 Tm (DHE)Tj /T1_0 8.966 Tf 20.282 0 Td [(ciphersuite)-346.995(using)-347.007(one)-346.003(of)-346.995(the)-346.995(t)28.997(w)28.997(o)-346.995(most)-346.003(common)-346.995(1024-bit)]TJ 1 0 0 1 53.798 696.857 Tm [(primes)-343.003(is)-341.999(soh)28.005(u.com)-341.999(\(rank)27.993(ed)-341.999(31st)-343.003(globally\).)]TJ /T1_2 8.966 Tf 0 -13.592 TD (Mail)Tj /T1_0 8.966 Tf 1.008 0 0 1 87.184 683.265 Tm [(TLS)-338.999(is)-338.006(also)-338.999(used)-338.999(to)-338.999(secure)-337.995(email)-338.999(transp)-28.005(ort.)-453.002(SMTP)85.006(,)]TJ 1.02 0 0 1 53.798 672.804 Tm [(the)-396.001(proto)-28.005(col)-396.001(used)-395.989(to)-396.001(rela)27.993(y)-396.001(messages)-394.997(b)-28.005(et)28.005(w)28.005(een)-396.001(mail)-396.001(serv)27.993(ers,)]TJ 0 -10.461 TD [(allo)28.005(ws)-355.003(a)-356.007(connection)-354.992(to)-355.003(b)-28.005(e)-355.996(upgraded)-355.003(to)-354.992(TLS)-356.007(b)28.005(y)-355.003(issuing)-355.996(the)]TJ /T1_3 8.966 Tf 1 0 0 1 53.798 651.883 Tm (STARTTLS)Tj /T1_0 8.966 Tf 0.98 0 0 1 94.384 651.883 Tm [(command.)-460.999(POP3S)-332.999(and)-332.999(IMAPS,)-332.999(used)-333.01(b)29.008(y)-332.999(end)-333.01(users)]TJ 1 0 0 1 53.798 641.422 Tm [(to)-343.003(fetc)28.997(h)-342.992(rec)0.993(eiv)28.005(ed)-343.003(mail,)-341.999(wrap)-343.003(the)-341.999(en)28.005(tire)-341.999(connection)-343.003(in)-341.999(TLS.)]TJ 1.008 0 0 1 62.765 630.961 Tm [(W)84.995(e)-338.999(studied)-339.992(1%)-339.01(samples)-339.992(of)-338.999(the)-340.003(public)-338.999(IPv4)-340.003(address)-338.999(space)]TJ 0.998 0 0 1 53.798 620.5 Tm [(for)-343.995(IMAPS,)-343.003(POP3S,)-344.007(and)-342.992(SMTP+StartTLS.)-459.002(W)85.999(e)-343.003(found)-343.995(that)]TJ 1.02 0 0 1 53.798 610.039 Tm [(50.7%)-477.003(of)-475.999(SMTP)-475.999(serv)28.005(ers)-477.003(supp)-28.005(orted)]TJ /T1_3 8.966 Tf 1 0 0 1 203.626 610.039 Tm (STARTTLS)Tj /T1_0 8.966 Tf 1.02 0 0 1 241.285 610.039 Tm [(,)-475.999(41.4%)-477.003(sup-)]TJ -183.811 -10.46 Td [(p)-28.005(orted)]TJ /T1_1 7.97 Tf 30.322 0 Td (DHE)Tj /T1_0 8.966 Tf [(,)-439.006(and)-438.994(14.8%)-439.006(supp)-27.993(orted)]TJ /T1_1 7.97 Tf 114.647 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf 60.406 0 Td (ciphers.)Tj -205.826 -10.461 Td [(15.5%)-350.999(of)-350.999(SMTP)-350.999(serv)27.993(ers)-350.999(used)-350.999(one)-350.999(of)-350.999(the)-350.999(ten)-350.999(most)-350.999(common)]TJ 1 0 0 1 53.337 578.657 Tm [(1024-bit)-343.003(groups.)]TJ 0.985 0 0 1 62.765 568.196 Tm [(F)87.003(or)-347.999(IMAPS,)-347.007(8.4%)-347.999(of)-346.995(serv)28.997(ers)-347.999(supp)-28.997(orted)]TJ /T1_1 7.97 Tf 159.207 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf 59.587 0 Td (and)Tj 0.98 0 0 1 53.568 557.736 Tm [(75%)-266.997(supp)-29.008(orted)]TJ /T1_1 7.97 Tf 61.951 0 Td (DHE)Tj /T1_0 8.966 Tf [(.)-266.997(Ho)28.997(w)28.997(e)1.004(v)28.997(er,)-283.994(the)-267.008(ten)-265.993(m)-1.004(o)1.004(s)-1.004(t)-266.004(common)-266.997(1024-bit)]TJ -61.716 -10.461 Td [(primes)-346.003(accoun)28.997(t)-345.992(f)-1.004(o)1.004(r)-347.007(only)-345.992(5.4%)-347.007(of)-346.003(serv)29.008(ers.)-465.003(POP3S)-346.003(deplo)28.997(ymen)29.008(t)]TJ 1.02 0 0 1 53.798 536.814 Tm [(is)-423.001(similar,)-444.995(with)-422.009(8.9%)-422.99(of)-423.001(serv)27.993(ers)-423.001(supp)-27.993(orting)]TJ /T1_1 7.97 Tf 178.227 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf 0.994 0 0 1 53.798 526.353 Tm [(and)-344.999(74.9%)-344.007(supp)-28.997(orting)]TJ /T1_1 7.97 Tf 91.632 0 Td (DHE)Tj /T1_0 8.966 Tf [(,)-344.999(but)-343.995(with)-344.999(the)-344.007(ten)-344.999(most)-344.999(common)]TJ 1 0 0 1 53.337 515.893 Tm [(1024-bit)-343.003(primes)-341.999(accoun)28.005(t)0.993(ing)-342.992(for)-343.003(only)-341.999(4.8%)-343.003(of)-343.003(se)1.004(rv)28.005(ers.)]TJ 0.98 0 0 1 62.765 505.432 Tm [(If)-272.004(eac)29.008(h)-272.004(of)-272.004(the)-271.993(to)0.993(p)-271.993(ten)-272.004(1024-bit)-271.993(primes)-272.004(used)-272.004(b)29.008(y)-272.004(eac)28.997(h)-271.993(proto)-29.008(col)]TJ 1.02 0 0 1 53.467 494.971 Tm [(w)28.005(ere)-421.005(compromised,)-441.995(this)-421.005(w)28.005(ould)-422.009(a\033e)1.004(ct)-421.998(appro)27.993(ximately)-420.994(1.7M)]TJ 1.002 0 0 1 53.798 484.51 Tm [(SMTP)84.995(,)-341.999(276K)-342.992(IMAPS,)-343.003(a)0.993(nd)-342.992(245K)-343.003(POP3S)-341.999(serv)27.993(ers.)-457.999(Using)-342.992(our)]TJ 0.98 0 0 1 53.798 474.049 Tm [(do)28.997(wngrade)-329.999(attac)28.997(k)-329.999(of)-331.002(\2373.3,)-333.991(an)-331.002(attac)30.001(k)28.997(er)-331.002(with)-329.999(mo)-28.997(dest)-331.002(resources)]TJ 0.993 0 0 1 53.798 463.589 Tm [(can)-343.995(hijac)28.997(k)-344.007(connections)-343.995(to)-343.003(appro)28.005(ximately)-343.003(1.6M)-343.995(SMTP)85.999(,)-344.007(429K)]TJ 1 0 0 1 53.798 453.128 Tm [(IMAPS,)-343.003(and)-341.999(454K)-343.003(POP3S)-341.999(serv)28.005(ers.)]TJ /T1_4 11.955 Tf 0 -24.48 TD [(5.)-1000(RECOMMEND)35(A)95(TIONS)]TJ /T1_0 8.966 Tf 1.02 0 0 1 62.765 415.697 Tm [(Our)-417.001(\034ndings)-417.001(indicate)-417.001(that)-417.001(one)-415.997(of)-417.001(the)-417.001(k)28.005(ey)-417.001(recommenda-)]TJ 0.98 0 0 1 53.798 405.236 Tm [(tions)-343.003(from)-343.003(securit)29.008(y)-343.003(exp)-30.001(e)1.004(rts)-344.007(in)-342.992(resp)-29.008(onse)-342.992(to)-343.003(the)-343.003(threat)-343.003(of)-343.995(mass)]TJ 1.02 0 0 1 53.798 394.775 Tm [(surv)28.005(eillance)-121.007(\026)-120.996(promotion)-468.003(of)-468.995(DHE-based)-469.007(TLS)-467.992(ciphersuites)]TJ 0 -10.46 TD [(o\033ering)-400.004(\020p)-27.993(erfec)0.993(t)-399.993(forw)27.993(ard)-399.993(secrecy\021)-399.001(o)27.993(v)28.005(er)-400.004(RSA-based)-399.993(cipher-)]TJ 0.998 0 0 1 53.798 373.854 Tm [(suites)-123.996(\026)-123.004(ma)28.005(y)-342.01(ha)29.008(v)27.993(e)-341.999(actually)-343.003(reduced)-341.999(securit)29.008(y)-343.003(for)-341.999(man)27.993(y)-341.999(hosts.)]TJ 1.002 0 0 1 53.798 363.393 Tm [(In)-341.999(this)-343.003(section,)-341.999(w)28.005(e)-341.999(presen)27.993(t)-341.999(concrete)-341.999(recommendations)-343.003(t)1.004(o)-343.003(re-)]TJ 0.984 0 0 1 53.798 352.932 Tm [(co)28.997(v)28.997(er)-346.995(the)-347.999(exp)-28.997(ected)-347.007(securit)29.008(y)-347.999(of)-347.007(Di\036e-Hellman)-346.995(as)-347.999(it)-347.007(is)-347.999(used)-346.995(in)]TJ 1 0 0 1 53.798 342.471 Tm [(mainstream)-343.003(In)28.997(ternet)-342.992(pro)0.993(to)-28.997(cols.)]TJ /T1_2 8.966 Tf -0.371 -13.591 Td [(T)99(ransition)-503(to)-502(elliptic)-503(curv)33(es.)]TJ /T1_0 8.966 Tf 1.02 0 0 1 203.229 328.88 Tm [(T)84.003(ransitioning)-427.998(to)-428.009(ellip-)]TJ 1.006 0 0 1 53.798 318.419 Tm [(tic)-340.995(curv)27.993(e)-341.999(Di\036e-H)1.004(ellman)-341.999(\(ECDH\))-341.006(k)28.005(ey)-341.006(exc)28.005(hange)-340.995(with)-342.01(appro-)]TJ 1.02 0 0 1 53.798 307.958 Tm [(priate)-421.998(parameters)-421.998(a)27.993(v)28.005(oids)-421.998(all)-422.009(kno)28.005(wn)-421.998(feasible)-422.009(cryptanalytic)]TJ 0 -10.461 TD [(attac)28.005(ks.)-628(Curren)27.993(t)-396.001(elliptic)-396.001(curv)28.005(e)-396.001(discrete)-396.001(log)-396.001(algorithms)-396.001(for)]TJ T* [(strong)-424.998(curv)27.993(es)-423.994(do)-424.998(not)-425.009(gain)-423.994(as)-424.998(m)27.993(uc)28.005(h)-424.998(of)-424.005(an)-424.998(adv)55.998(an)28.005(tage)-425.009(from)]TJ 1.015 0 0 1 53.798 276.576 Tm [(precomputation.)-450.002(In)-335.999(addition,)-337.003(ECDH)-335.999(k)28.005(eys)-337.003(are)-335.999(shorter)-335.999(than)]TJ 1 0 0 1 53.798 266.115 Tm [(in)-340.995(\020mo)-28.005(d)]TJ /T1_5 8.966 Tf 35.81 0 Td (p)Tj /T1_0 8.966 Tf [(\021)-341.006(Di\036e-Hellman,)-340.995(and)-341.006(shared-secre)1.004(t)-340.995(computations)]TJ 0.98 0 0 1 53.798 255.654 Tm [(are)-350.999(faster.)-469.007(Unfortunately)87.003(,)-350.999(the)-350.999(most)-349.996(widely)-350.999(supp)-29.008(orted)-350.999(ECDH)]TJ 1.02 0 0 1 53.798 245.193 Tm [(parameters,)-338.999(those)-338.006(sp)-27.993(eci\034ed)-338.006(b)28.005(y)-337.995(NIST,)-338.006(are)-337.995(no)27.993(w)-337.995(view)27.993(ed)-337.995(with)]TJ 1.019 0 0 1 53.798 234.733 Tm [(suspicion)-334.995(due)-335.006(to)-334.995(NSA)-335.999(in\035uence)-335.006(on)-334.995(their)-335.006(design,)-334.995(despite)-335.006(no)]TJ 1.02 0 0 1 53.798 224.272 Tm [(kno)28.005(wn)-420.001(or)-420.001(susp)-28.005(ected)-418.998(w)28.005(eaknesses.)-700.002(These)-420.001(curv)27.993(es)-418.998(are)-420.001(under-)]TJ T* [(going)-441.002(scrutin)28.005(y)83.991(,)-467.992(and)-441.002(new)-441.002(curv)28.005(es,)-468.003(suc)28.005(h)-441.002(as)-442.006(Curv)28.005(e25519)0.993(,)-467.992(are)]TJ T* [(b)-28.005(eing)-369.992(standardized)-371.007(b)28.005(y)-370.004(the)-369.992(IR)82.999(TF)-370.004(for)-370.004(use)-370.996(in)-370.004(In)28.005(ternet)-370.004(proto-)]TJ 0 -10.46 TD [(cols.)-469.999(W)82.999(e)-343.003(recommend)-343.003(transitioning)-343.995(to)-343.003(elliptic)-342.992(curv)27.993(es)-343.995(where)]TJ 0.998 0 0 1 53.798 182.429 Tm [(p)-28.997(ossible;)-344.007(this)-344.999(is)-343.995(the)-344.007(most)-344.999(e)1.004(\033ectiv)28.005(e)-344.007(long-term)-343.995(solution)-344.999(t)0.993(o)-344.999(the)]TJ 1 0 0 1 53.559 171.968 Tm [(vulnerabilities)-341.999(describ)-28.997(ed)-343.003(in)-341.999(this)-343.003(pap)-28.005(er.)]TJ /T1_2 8.966 Tf 0.239 -13.592 Td [(Increase)-469(minim)33(um)-469(k)33(ey)-469(strengths.)]TJ /T1_0 8.966 Tf 1.02 0 0 1 225.132 158.376 Tm [(Serv)28.005(er)-399.001(op)-28.005(erators)]TJ 0.98 0 0 1 53.798 147.915 Tm [(should)-334.995(disable)]TJ /T1_1 7.97 Tf 59.872 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf 59.473 0 Td [(and)-334.995(con\034gure)]TJ /T1_1 7.97 Tf 57.231 0 Td (DHE)Tj /T1_0 8.966 Tf 20.176 0 Td (ciphersuites)Tj 1.02 0 0 1 53.798 137.455 Tm [(to)-378(use)-379.004(primes)-378(of)-378.993(2048)-378(bits)-378(or)-379.004(larger.)-575.002(Bro)28.005(wsers)-379.004(and)-378(clien)28.005(ts)]TJ 1.018 0 0 1 53.798 126.994 Tm [(should)-334.995(raise)-335.006(the)-334.995(minim)27.993(um)-335.999(accepted)-334.995(size)-335.006(for)-334.995(Di\036e-Hellman)]TJ 0.996 0 0 1 53.798 116.533 Tm [(groups)-344.999(to)-344.999(at)-344.999(least)-344.007(1024)-344.999(bits)-344.999(in)-344.999(order)-344.999(to)-344.999(a)28.997(v)28.997(oid)-344.999(do)28.005(wngrade)-344.999(a)0.993(t-)]TJ 0.98 0 0 1 53.798 106.072 Tm [(tac)28.997(ks)-319.002(when)-318.991(comm)28.997(unicating)-319.002(with)-319.002(serv)28.997(ers)-318.991(that)-319.002(still)-319.002(use)-319.002(smaller)]TJ 1.02 0 0 1 53.798 95.611 Tm [(groups.)-692.006(Primes)-416.99(of)-417.001(less)-417.001(than)-418.005(1024)-417.001(bits)-417.001(should)-416.99(not)-417.001(b)-28.005(e)-417.001(con-)]TJ T* [(sidered)-350.999(secure,)-353.999(ev)27.993(en)-350.999(against)-350.999(an)-350.999(attac)28.005(k)27.993(er)-350.999(with)-350.999(mo)-27.993(derate)-350.007(re-)]TJ 1 0 0 1 53.798 74.69 Tm (sources.)Tj 1.02 0 0 1 325.778 728.239 Tm [(Our)-370.996(analysis)-371.007(suggests)-370.996(that)-370.996(1024-bit)-371.007(discrete)-370.996(log)-370.996(ma)27.993(y)-370.996(b)-28.005(e)]TJ -9.116 -10.461 Td [(within)-376.996(reac)27.993(h)-376.996(for)-376.996(state-lev)27.993(el)-376.996(ac)0.993(tors.)-570.998(As)-376.996(suc)28.005(h,)-388.004(1024-bit)]TJ /T1_1 7.97 Tf 217.569 0 Td (DHE)Tj /T1_0 8.966 Tf -218.3 -10.46 Td [(\(and)-378(1024-bit)-379.004(RSA\))-378(m)27.001(ust)-378(b)-27.993(e)-379.004(phased)-378(out)-379.004(in)-378(the)-378.993(near)-378(term.)]TJ 0.98 0 0 1 316.812 696.857 Tm [(NIST)-346.003(has)-346.003(recommended)-344.999(suc)29.008(h)-346.003(a)-346.003(transition)-346.003(since)-344.999(2010)-345.992([4].)-465.003(W)87.003(e)]TJ 0 -10.461 TD [(recommend)-289.001(that)-287.997(clien)28.997(ts)-289.001(raise)-287.997(the)-289.001(minim)28.997(um)]TJ /T1_1 7.97 Tf 173.405 0 Td (DHE)Tj /T1_0 8.966 Tf 19.76 0 Td [(group)-289.001(size)-287.997(to)]TJ -193.4 -10.461 Td [(2048)-278.005(bits)-277.993(as)-278.005(so)-28.997(on)-278.997(as)-278.005(serv)28.997(er)-277.993(con\034gurations)-278.005(allo)28.997(w.)-441.995(Serv)28.997(er)-277.993(op)-29.008(era-)]TJ 0.235 -10.461 Td [(tors)-274.001(should)-274.001(mo)28.997(v)30.001(e)-274.001(to)-274.001(2048-bit)-274.001(or)-273.99(larger)-273.008(groups)-274.001(to)-274.001(facilitate)-274.001(this)]TJ 1.02 0 0 1 316.812 655.014 Tm [(transition.)-507.997(Precomputation)-356.007(for)-354.992(a)-356.007(2048-bit)-355.996(non-trap)-28.005(do)-27.993(ored)]TJ 0.994 0 0 1 316.812 644.553 Tm [(group)-343.995(is)-344.007(around)]TJ /T1_6 8.966 Tf 66.687 0 Td (10)Tj /T1_7 5.978 Tf 1 0 0 1 392.259 648.362 Tm (9)Tj /T1_0 8.966 Tf 0.994 0 0 1 399.477 644.553 Tm [(times)-343.995(harder)-344.007(than)-343.995(for)-344.007(a)-343.995(1024-bit)-344.007(group,)]TJ 0.98 0 0 1 316.812 634.092 Tm [(so)-293.998(2048-bit)-295.001(Di\036e-H)1.004(ellman)-295.001(will)-294.009(remain)-293.998(secure)-295.001(barring)-293.998(a)-293.998(ma)-28.997(jor)]TJ 1 0 0 1 316.812 623.631 Tm [(algorithmic)-343.003(impro)28.997(v)29.008(em)-1.004(e)1.004(n)27.993(t.)]TJ /T1_2 8.966 Tf -0.403 -13.2 Td [(A)131.999(v)31.999(oid)-393.001(\034xed-prime)-394.004(1024-bit)-392.989(groups.)]TJ /T1_0 8.966 Tf 1.001 0 0 1 490.942 610.431 Tm [(F)85.999(or)-341.999(implemen)28.005(t)0.993(a-)]TJ 1.008 0 0 1 316.812 599.97 Tm [(tions)-340.995(t)0.993(hat)-340.995(m)27.993(ust)-339.992(con)27.993(tin)28.005(ue)-340.003(to)-340.995(use)-340.003(or)-341.006(supp)-27.993(ort)-340.003(1024-bit)-340.995(groups)]TJ 0.999 0 0 1 316.812 589.509 Tm [(for)-340.995(compatibilit)27.993(y)-340.995(reasons,)-341.999(generating)-341.006(fresh)-341.999(groups)-340.995(ma)28.997(y)-341.999(help)]TJ 1.017 0 0 1 316.812 579.049 Tm [(mitigate)-335.999(some)-335.006(of)-335.999(the)-335.999(damage)-334.995(caused)-335.999(b)27.993(y)-334.995(NFS-st)27.993(yle)-335.999(precom-)]TJ 1.02 0 0 1 316.812 568.588 Tm [(putation)-335.999(for)-335.999(v)27.993(ery)-335.999(common)-335.999(\034xed)-334.995(groups.)-448.006(Ho)28.005(w)27.993(ev)28.005(er,)-335.999(w)27.993(e)-335.999(note)]TJ 1.015 0 0 1 316.812 558.127 Tm [(that)-337.995(it)-337.003(is)-338.006(p)-27.993(ossible)-338.006(to)-336.991(create)-338.006(trap)-28.005(do)-27.993(ored)-338.006(primes)-336.991([20,)-132.004(44])-337.995(that)]TJ 0.985 0 0 1 316.812 547.666 Tm [(are)-346.003(computationally)-346.003(di\036cult)-346.995(to)-346.003(detect.)-462.995(A)28.997(t)-346.003(minim)29.008(um,)-347.007(clien)28.997(ts)]TJ 1.02 0 0 1 316.812 537.205 Tm [(should)-341.999(c)27.993(hec)28.005(k)-340.995(that)-341.999(serv)27.993(ers')-340.995(parameters)-341.999(use)-341.006(safe)-341.999(primes)-341.999(or)-340.995(a)]TJ 0.988 0 0 1 316.572 526.745 Tm [(v)28.997(eri\034able)-346.003(generation)-345.992(pro)-29.008(cess,)-345.992(suc)28.997(h)-346.003(as)-346.003(that)-345.992(prop)-29.008(osed)-345.992(in)-344.999(FIPS)]TJ 1.02 0 0 1 316.351 516.284 Tm [(186)-343.003([38].)-471.003(Ide)1.004(ally)82.999(,)-344.999(the)-343.003(pro)-27.993(cess)-343.003(for)-343.995(generating)-343.003(and)-343.003(v)55.998(alidating)]TJ 1.017 0 0 1 316.812 505.823 Tm [(parameters)-337.995(in)-338.006(TLS)-337.003(should)-337.995(b)-28.005(e)-337.995(standardized)-338.006(so)-337.995(as)-337.995(to)-337.003(th)27.993(w)28.005(art)]TJ 1 0 0 1 316.812 495.362 Tm [(the)-343.003(risk)-341.999(of)-343.003(trap)-27.993(do)-28.997(ors.)]TJ /T1_2 8.966 Tf 0 -13.2 TD [(Don't)-465(delib)-33(erately)-466(w)33(eak)33(en)-465(crypto.)]TJ /T1_0 8.966 Tf 1.02 0 0 1 491.924 482.162 Tm [(Our)-396.001(do)28.005(wngrade)]TJ 0.98 0 0 1 316.812 471.701 Tm [(attac)28.997(k)-316.002(on)-316.995(exp)-28.997(ort-grade)-317.006(512-bit)-316.002(Di\036e-Hellman)-316.995(groups)-316.002(in)-316.995(TLS)]TJ 1.02 0 0 1 316.812 461.24 Tm [(illustrates)-373.996(the)-374.007(fragilit)28.005(y)-375(of)-373.996(cryptographic)-374.007(\020fron)28.005(t)-374.007(do)-27.993(ors\021)140(.)-563.002(Al-)]TJ 1.019 0 0 1 316.812 450.78 Tm [(though)-334.995(the)-336.01(k)28.005(ey)-335.999(sizes)-335.006(originally)-335.999(used)-334.995(in)]TJ /T1_1 7.97 Tf 156.96 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf 59.478 0 Td [(w)28.005(ere)]TJ 1.015 0 0 1 316.812 440.319 Tm [(in)28.005(tended)-336.01(to)-335.999(b)-27.993(e)-337.003(tractable)-335.999(only)-335.999(to)-335.999(NSA,)-337.003(t)27.993(w)29.008(o)-337.003(decades)-335.999(of)-335.999(algo-)]TJ 1 0 0 1 316.812 429.858 Tm [(rithmic)-340.995(and)-342.01(computational)-340.995(impro)28.997(v)28.005(emen)28.997(ts)-341.999(ha)28.997(v)28.005(e)-341.006(signi\034can)29.008(tly)]TJ 1.02 0 0 1 316.812 419.397 Tm [(lo)28.005(w)27.993(ered)-385.997(the)-387(bar)-387(to)-385.997(attac)27.993(ks)-387(on)-385.997(suc)27.993(h)-386.989(k)27.993(ey)-385.997(sizes.)-600.007(Despite)-387(the)]TJ 1.008 0 0 1 316.812 408.936 Tm [(ev)28.005(en)28.997(tual)-340.003(relaxation)-340.003(of)-339.992(crypto)-339.01(exp)-28.997(ort)-338.999(restrictions)-340.003(and)-339.992(subse-)]TJ 1.02 0 0 1 316.812 398.476 Tm [(quen)28.005(t)-405.001(attempts)-406.005(to)-405.001(remo)28.005(v)27.993(e)-405.001(supp)-27.993(ort)-406.005(for)]TJ /T1_1 7.97 Tf 158.948 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf [(,)-405.001(the)]TJ 0.986 0 0 1 316.812 388.015 Tm [(tec)28.997(hnical)-346.003(debt)-346.995(induced)-346.003(b)29.008(y)-346.003(the)-347.007(additional)-345.992(complexit)28.997(y)-346.995(has)-346.003(left)]TJ 1.02 0 0 1 316.812 377.554 Tm [(implemen)28.005(tations)-359.007(vulnerable)-358.996(for)-359.007(decades.)-516.997(Lik)28.005(e)-359.007(FREAK)-358.996([7],)]TJ 0 -10.461 TD [(our)-489.003(attac)28.005(ks)-489.003(w)28.005(arn)-489.003(of)-488(the)-489.003(long-term)-488.992(debilitating)-489.003(e\033ects)-489.003(of)]TJ 1 0 0 1 316.812 356.633 Tm [(delib)-28.997(e)0.993(rately)-342.992(w)28.997(eak)27.993(ening)-341.999(cryptograph)28.005(y)85.999(.)]TJ /T1_4 11.955 Tf 0 -23.413 TD [(6.)-1000(DISCLOSURE)-250(AND)-250(RESPONSE)]TJ /T1_0 8.966 Tf 1.02 0 0 1 325.778 320.269 Tm [(W)84.003(e)-540.005(noti\034ed)-540.997(ma)-28.005(jor)-539.994(clien)27.993(t)-539.994(and)-540.005(serv)28.005(er)-540.997(dev)27.993(elop)-27.993(e)0.993(rs)-540.997(ab)-28.005(out)]TJ -8.79 -10.461 Td [(the)-361.996(vulnerabilities)-362.007(discusse)1.004(d)-361.996(in)-362.007(this)-361.996(pap)-28.005(er)-361.996(b)-28.005(efore)-361.996(w)27.993(e)-360.992(made)]TJ 0 -10.461 TD [(our)-391.004(\034ndings)-390(public.)-613(Prior)-390(to)-390.993(our)-391.004(w)28.005(ork,)-404.008(In)28.005(ternet)-391.004(Explorer,)]TJ 0 -10.46 TD [(Chrome,)-478.999(F)-1.004(ire)1.004(f)-1.004(o)28.005(x,)-478.999(and)-451.006(Op)-27.993(era)-451.006(all)-449.991(accepted)-451.006(512-bit)-450.995(primes,)]TJ -0.325 -10.461 Td [(whereas)-454.006(Safari)-453.995(allo)28.005(w)27.993(ed)-453.995(groups)-454.999(as)-454.006(small)-453.995(as)-454.006(16)-453.995(bits.)-802.998(As)-454.006(a)]TJ 0.983 0 0 1 316.812 267.965 Tm [(result)-349.003(of)-349.003(our)-348.992(disclosures,)-349.003(In)28.997(ternet)-348.992(Explorer)-349.003([37],)-349.003(Firefo)28.997(x,)-348.992(and)]TJ 0.98 0 0 1 316.812 257.504 Tm [(Chrome)-238(are)-238(transitioning)-238(the)-238(minim)28.997(um)-238(size)-239.003(of)-238(the)]TJ /T1_1 7.97 Tf 197.983 0 Td (DHE)Tj /T1_0 8.966 Tf 19.306 0 Td (groups)Tj 1.02 0 0 1 316.812 247.044 Tm [(they)-372(accept)-372(to)-373.004(1024)-372(bits,)-381(and)-372.992(Op)-28.005(enSSL)-372(and)-372(Safari)-372(are)-373.004(ex-)]TJ 0.98 0 0 1 316.812 236.583 Tm [(p)-28.997(ected)-320.998(to)-321.01(follo)29.008(w)-320.998(suit.)-457.006(On)-320.998(the)-320.998(serv)28.997(e)1.004(r)-322.002(side,)-326.006(w)29.008(e)-320.998(noti\034ed)-321.01(Apac)29.008(he,)]TJ 1.02 0 0 1 316.812 226.122 Tm [(Oracle,)-462.003(IBM,)-436.998(Cisco,)-462.995(and)-437.009(v)56.009(arious)-437.009(hosting)-436.998(pro)28.005(viders.)-751.004(Aka-)]TJ 1.007 0 0 1 316.812 215.661 Tm [(mai)-340.995(has)-341.006(remo)28.005(v)27.993(e)1.004(d)-341.999(all)-341.006(supp)-27.993(ort)-341.006(for)-340.995(exp)-28.005(ort)-341.999(c)1.004(iphersuites.)-456.995(Man)28.997(y)]TJ 0.983 0 0 1 316.48 205.2 Tm [(TLS)-349.003(dev)28.997(elop)-28.997(ers)-349.003(plan)-348.992(to)-347.999(supp)-29.008(ort)-348.992(a)-349.003(new)-349.003(extension)-349.003(that)-348.992(allo)28.997(ws)]TJ 1.008 0 0 1 316.812 194.74 Tm [(clien)28.005(ts)-341.006(a)1.004(n)-1.004(d)-340.003(serv)28.005(ers)-340.995(to)-341.006(negotiate)-340.995(a)-341.006(few)-340.003(w)28.005(ell-kno)28.005(wn)-341.006(groups)-340.995(of)]TJ 0.98 0 0 1 316.582 184.279 Tm [(2048-bits)-311.998(and)-311.998(higher)-313.002(and)-311.998(to)-312.009(gracefully)-311.998(reject)-313.002(w)30.001(eak)-312.991(ones)-312.009([19].)]TJ /T1_4 11.955 Tf 1 0 0 1 316.812 160.867 Tm [(7.)-1000(CONCLUSION)]TJ /T1_0 8.966 Tf 1.02 0 0 1 325.778 147.915 Tm [(Di\036e-Hellman)-384(k)28.005(ey)-384(exc)27.993(hange)-384.993(is)-384(a)-384(cornerstone)-384(of)-384(applied)]TJ 0.98 0 0 1 316.812 137.455 Tm [(cryptograph)28.997(y)88.006(,)-301.002(but)-287.997(w)28.997(e)-287.997(\034nd)-288.009(that,)-301.002(as)-287.997(used)-287.997(in)-287.997(practice,)-299.998(it)-289.001(is)-288.009(often)]TJ 1.02 0 0 1 316.812 126.994 Tm [(less)-350.999(secure)-350.999(than)-350.999(widely)-350.999(b)-28.005(eliev)28.005(ed.)-494(The)-350.999(proble)0.993(m)-0.993(s)-350.999(stem)-351.01(from)]TJ 0.98 0 0 1 316.812 116.533 Tm [(the)-328.002(fact)-326.999(that)-328.002(the)-326.999(n)28.997(um)29.008(b)-29.008(er)-327.991(\034eld)-327.01(siev)29.008(e)-328.002(for)-326.999(discrete)-328.002(log)-326.999(allo)28.997(ws)-328.002(an)]TJ 1.02 0 0 1 316.812 106.072 Tm [(attac)28.005(k)27.993(er)-346.003(to)-346.995(p)-28.005(erform)-345.992(a)-347.007(single)-346.003(precomputation)-345.992(that)-347.007(dep)-27.993(ends)]TJ 0.992 0 0 1 316.812 95.611 Tm [(only)-346.003(on)-346.995(the)-346.003(group,)-346.995(after)-346.003(whic)28.997(h)-346.995(computing)-346.003(individual)-346.003(logs)-346.995(in)]TJ 1.02 0 0 1 316.812 85.151 Tm [(that)-355.996(group)-356.007(has)-356.999(a)-355.996(far)-356.007(lo)28.005(w)28.005(er)-356.007(cost.)-509(Although)-356.999(this)-355.996(fact)-356.007(is)-355.996(w)28.005(ell)]TJ 0.988 0 0 1 316.812 74.69 Tm [(kno)28.997(wn)-346.003(to)-345.992(cryptographers,)-346.003(it)-346.003(apparen)28.997(tly)-345.992(has)-346.003(not)-346.003(b)-28.997(een)-346.003(widely)]TJ 1 0 0 1 300.249 44.802 Tm (11)Tj ET BT /T1_0 8.966 Tf 1.019 0 0 1 53.798 728.239 Tm [(understo)-28.005(o)-27.993(d)-335.999(b)27.993(y)-337.003(system)-335.999(builders.)-448.998(Lik)28.005(ewise,)-335.999(man)27.993(y)-336.991(cryptogra-)]TJ 0.98 0 0 1 53.798 717.778 Tm [(phers)-349.003(did)-349.003(not)-348.992(appreciate)-349.003(that)-349.003(the)-348.992(securit)28.997(y)-349.003(of)-349.003(a)-348.992(large)-349.003(fraction)]TJ 1.02 0 0 1 53.798 707.318 Tm [(of)-372(In)28.005(ternet)-372(comm)27.993(unication)-370.996(dep)-28.005(ends)-372(on)-372(Di\036e-Hellman)-372(k)28.005(ey)]TJ 1 0 0 1 53.798 696.857 Tm [(exc)28.997(hanges)-343.003(that)-342.992(use)-341.999(a)-343.003(few)-341.999(small,)-343.003(widely)-341.999(shared)-343.003(groups.)]TJ 1.02 0 0 1 62.765 686.396 Tm [(A)-370.004(k)28.005(ey)-370.996(lesson)-370.004(from)-370.004(this)-370.996(state)-370.004(of)-370.004(a\033airs)-370.996(is)-370.004(that)-369.992(cryptogra-)]TJ 0.98 0 0 1 53.798 675.935 Tm [(phers)-286.001(and)-287.005(creators)-285.99(of)-287.005(practical)-286.001(systems)-286.001(need)-286.994(to)-286.001(w)28.997(ork)-287.005(t)1.004(ogether)]TJ 1.004 0 0 1 53.798 665.474 Tm [(more)-338.999(e\033ectiv)28.997(ely)85.006(.)-454.006(System)-338.999(builders)-340.003(sho)1.004(uld)-340.003(ta)1.004(k)27.993(e)-338.999(resp)-28.997(o)1.004(ns)-1.004(i)1.004(b)-1.004(i)1.004(l)-1.004(i)1.004(t)27.993(y)]TJ 1.02 0 0 1 53.798 655.014 Tm [(for)-364.003(b)-27.993(eing)-363(a)27.993(w)28.005(are)-364.003(of)-364.003(applicable)-363(cryptanalytic)-363.992(attac)27.993(ks.)-530.993(Cryp-)]TJ 0.997 0 0 1 53.798 644.553 Tm [(tographers,)-341.999(for)-343.003(t)1.004(heir)-343.003(part,)-341.999(should)-341.999(in)28.997(v)28.005(olv)28.997(e)-341.999(themselv)27.993(es)-341.999(in)-341.999(ho)29.008(w)]TJ 0.98 0 0 1 53.798 634.092 Tm [(crypto)-299.998(is)-299.005(actually)-299.998(b)-28.997(eing)-299.005(applied,)-310.002(suc)29.008(h)-299.005(as)-299.998(through)-299.005(engagemen)29.008(t)]TJ -0.338 -10.461 Td [(with)-317.006(standards)-316.995(e\033orts)-317.006(and)-317.998(soft)30.001(w)29.008(are)-318.009(re)1.004(v)-1.004(ie)1.004(w.)-456.002(Bridging)-316.995(the)-317.006(p)-28.997(er-)]TJ 0.997 0 0 1 53.798 613.171 Tm [(ilous)-343.995(gap)-343.003(that)-344.007(separates)-342.992(these)-344.007(comm)28.997(unities)-343.995(will)-343.003(b)-28.997(e)-343.003(essen)28.005(tial)]TJ 1 0 0 1 53.798 602.71 Tm [(for)-343.003(k)28.997(eeping)-342.992(future)-341.999(systems)-343.003(secure.)]TJ /T1_1 11.955 Tf 0 -25.191 TD [(Ackno)10(wledgments)]TJ /T1_0 8.966 Tf 0.98 0 0 1 53.467 563.073 Tm [(The)-346.995(authors)-347.007(wish)-346.995(to)-347.007(thank)-347.999(Mic)30.001(hael)-346.995(B)-1.004(aile)1.004(y)87.003(,)-348.01(Daniel)-346.995(Bernstein,)]TJ 0.338 -10.461 Td [(Ron)-235(Dreslinski,)-259(T)87.995(anja)-235.992(L)0.993(ange,)-259(A)30.001(dam)-235.992(Langley)87.995(,)-259(Kenn)30.001(y)-236.003(P)28.997(aterson,)]TJ 1.012 0 0 1 53.457 542.151 Tm [(Andrei)-337.003(P)28.005(op)-28.005(o)28.005(v,)-338.006(Iv)57.002(an)-337.995(Ristic,)-337.003(Edw)28.005(ard)-337.003(Sno)27.993(wden,)-336.991(Brian)-338.006(Smith,)]TJ 0.989 0 0 1 53.798 531.69 Tm [(Martin)-346.003(Thomson,)-346.995(and)-346.003(Eric)-346.003(Rescorla.)-461.991(This)-346.003(material)-347.007(is)-345.992(based)]TJ 1.017 0 0 1 53.798 521.23 Tm [(in)-335.999(part)-335.999(up)-28.005(on)-335.999(w)28.005(ork)-335.999(supp)-28.005(orted)-335.999(b)27.993(y)-336.991(the)-335.999(U.S.)-336.01(National)-335.999(Science)]TJ 1.02 0 0 1 53.798 510.769 Tm [(F)84.003(oundation)-468.003(under)-468.003(con)28.005(tracts)-466.999(CNS-1345254,)-501.004(CNS-1409505,)]TJ 0 -10.461 TD [(CNS-1518741,)-444.002(and)-423.001(EFRI-1441209,)-444.002(b)28.005(y)-423.001(the)-423.001(O\036ce)-421.998(of)-423.001(Na)28.005(v)55.998(al)]TJ T* [(Researc)28.005(h)-487.007(under)-486.996(con)27.993(tract)-486.996(N00014-11-1-0470,)-525.004(b)28.005(y)-486.996(the)-487.007(ER)28.005(C)]TJ 0 -10.46 TD [(Starting)-417.001(Gran)28.005(t)-417.001(259639)-417.001(\(CR)84.003(YSP\),)-417.001(b)27.993(y)-417.001(the)-416.99(F)83.991(renc)28.005(h)-417.001(ANR)-417.001(re-)]TJ 0 -10.461 TD [(searc)28.005(h)-390(gran)27.993(t)-390(ANR-12-BS02-001-01,)-403.997(b)28.005(y)-390(the)-390(NSF)-390(Graduate)]TJ T* [(Researc)28.005(h)-451.006(F)84.003(ello)27.993(wship)-449.991(Program)-451.006(under)-450.995(gran)27.993(t)-449.991(DGE-1256260,)]TJ T* [(b)28.005(y)-367.003(the)-367.003(Mozilla)-366(F)82.999(oundat)1.004(ion,)-375(b)28.005(y)-367.003(a)-367.003(gift)-367.003(from)-366(Sup)-27.993(ermicro,)-375(b)27.993(y)]TJ 1.014 0 0 1 53.798 437.543 Tm [(the)-337.995(Go)-29.008(ogle)-337.995(Ph.D.)-338.999(F)84.995(ello)28.005(wship)-338.006(in)-338.999(Computer)-337.995(Securit)27.993(y)84.003(,)-337.995(b)27.993(y)-338.999(the)]TJ 1.02 0 0 1 53.798 427.083 Tm [(Morris)-332.999(W)84.003(ellman)-334.002(F)84.003(acult)27.993(y)-332.999(Dev)28.005(elopmen)27.993(t)-332.999(Assistan)28.005(t)-334.002(Professor-)]TJ 0.98 0 0 1 53.798 416.622 Tm [(ship,)-337.995(and)-336.01(b)29.008(y)-335.999(an)-335.006(Alfred)-335.999(P)87.995(.)-335.999(Sloan)-334.995(F)87.003(oundation)-335.999(Researc)29.99(h)-335.999(F)87.003(ello)30.001(w-)]TJ T* [(ship.)-465.003(Some)-344.999(exp)-28.997(erimen)28.997(ts)-344.999(w)28.997(ere)-344.999(conducted)-346.003(using)-344.999(the)-344.999(Grid'5000)]TJ 1.005 0 0 1 53.798 395.7 Tm [(testb)-28.005(ed,)-341.999(whic)29.008(h)-342.01(is)-340.995(supp)-28.997(ort)0.993(ed)-341.999(b)29.008(y)-342.01(INRIA,)-340.995(CNRS,)-341.999(RENA)85.999(TER,)]TJ 1.006 0 0 1 53.798 385.24 Tm [(and)-338.999(sev)27.993(eral)-338.999(other)-338.999(univ)29.008(ersities)-339.01(and)-338.999(organizations;)-339.992(additional)]TJ 1 0 0 1 53.798 374.779 Tm [(exp)-28.997(erimen)28.997(ts)-343.003(used)-341.999(UCS)-343.003(hardw)29.008(are)-343.003(donated)-341.999(b)27.993(y)-341.999(Cisco.)]TJ /T1_1 11.955 Tf 0 -25.191 TD [(8.)-1000(REFERENCES)]TJ /T1_2 7.97 Tf 4.234 -14.873 Td [([1])-563(S.)-354(Bai,)-353.998(C.)-353.998(Bouvier,)-355.002(A)1.004(.)-355.002(Filb)-29.008(ois,)-353.998(P)88.004(.)-354(Gaudry)88.004(,)-354.011(L.)-353.998(Im)29.008(b)-29.008(ert,)]TJ 13.109 -8.967 Td [(A.)-354(Kruppa,)-354(F.)-353.998(Morain,)-355.002(E.)-354(Thom\351,)-354(and)-353.998(P)87.991(.)-353.998(Zimmermann.)]TJ /T1_3 7.97 Tf 0.313 -8.966 Td (cado-nfs)Tj /T1_2 7.97 Tf [(,)-353.998(an)-353.998(imple)-1.004(men)30(tation)-353.998(of)-353.998(the)-355.002(n)30(um)28.996(b)-28.996(er)-353.998(\034eld)-353.998(si)-1.004(ev)30(e)]TJ 0 -8.966 TD [(algorithm,)-354(2014.)-354(Release)-355.002(2.1.1.)]TJ -13.422 -9.963 Td ([2])Tj 0.996 0 0 1 71.454 297.853 Tm [(R.)-355.002(Barbulescu.)]TJ /T1_4 7.97 Tf 57.455 0 Td [(A)41.003(lgorithmes)-385.002(de)-385.002(lo)55.006(garithmes)-385.002(discr)54.993(ets)-383.998(da)-1.004(ns)-383.998(les)]TJ 0.989 0 0 1 70.772 288.887 Tm [(c)55.006(orps)-388.001(\034nis)]TJ /T1_2 7.97 Tf 38.18 0 Td [(.)-358.001(PhD)-358.001(thesis,)-359.005(Univ)30(ersit\351)-357.988(de)-358.001(Lorraine,)-358.001(F)88.995(rance,)-358.001(2013.)]TJ 1 0 0 1 58.032 278.924 Tm [([3])-563.005(R.)-353.998(Barbulescu,)-353.998(P)88.004(.)-353.998(Gaudry)88.995(,)-353.998(A.)-355.002(Joux,)-353.998(and)-353.998(E.)-353.998(Thom\351.)-353.998(A)]TJ 13.422 -8.966 Td [(heuristic)-354(quasi-p)-30(olynomial)-353.998(algorithm)-353.998(for)-353.998(discrete)-355.002(logarithm)]TJ 0 -8.967 TD [(in)-354(\034nite)-355(\034elds)-353.998(of)-353.998(small)-353.998(c)28.996(haracteristic.)-353.998(In)]TJ /T1_4 7.97 Tf 149.992 0 Td [(Eur)55.001(o)55.001(crypt)]TJ /T1_2 7.97 Tf [(,)-353.998(2014.)]TJ -163.414 -9.962 Td [([4])-563(E.)-354(Bark)30(er,)-354(W.)-355.002(Bark)30(er,)-353.998(W.)-355(Burr,)-354(W.)-354(P)30(olk,)-355(and)-353.998(M.)-353.998(Smid.)]TJ /T1_4 7.97 Tf 0.997 0 0 1 70.982 242.062 Tm [(NIST)-383.998(Sp)54.993(e)55.006(cial)-385.002(Public)55.006(ation)-384.011(800-57:)-495.001(R)55.006(e)55.006(c)54.993(ommendation)-385.002(for)-383.998(K)55.006(ey)]TJ 1 0 0 1 70.938 233.096 Tm (Management)Tj /T1_2 7.97 Tf [(,)-353.998(2007.)]TJ -12.906 -9.963 Td [([5])-563.005(D.)-353.998(J.)-353.998(Bernstein.)-353.998(Ho)28.996(w)-353.998(to)-353.998(\034nd)-353.998(smo)-30(oth)-353.998(parts)-353.998(of)-354.011(in)29.008(tegers,)-353.998(2004.)]TJ 13.422 -8.966 Td [(h)28.996(ttp://)1.004(c)-1.004(r)1.004(.)-1.004(yp.to/f)1.004(actorization/smo)-30(othparts-)-62.007(20040510.p)-28.996(df)-79.999(.)]TJ -13.422 -9.963 Td ([6])Tj 0.988 0 0 1 71.454 204.204 Tm [(D.)-358.001(J.)-358.001(Bernstein)-359.005(and)-357.988(T.)-358.001(Lange.)-358.001(Batc)30(h)-358.001(NFS.)-358.001(In)]TJ /T1_4 7.97 Tf 171.542 0 Td [(Sele)55.006(cte)55.997(d)-389.004(A)55.997(r)55.006(e)55.997(as)]TJ 1 0 0 1 70.903 195.238 Tm [(in)-383.998(Crypto)54.993(gr)55.006(aphy)]TJ /T1_2 7.97 Tf [(,)-353.998(2014.)]TJ -12.871 -9.963 Td [([7])-563.005(B.)-353.998(Beurdouc)30(he,)-355.002(K.)-353.998(Bharga)30(v)59.008(an,)-353.998(A.)-354.011(De)-0.991(lignat-)0.991(L)-0.991(a)30(v)58.996(aud,)]TJ 0.992 0 0 1 71.454 176.309 Tm [(C.)-356.997(F)89.999(ournet,)-356.997(M.)-357.01(K)30(ohlw)30(eiss,)-356.997(A.)-356.997(Piron)30(ti,)-356.997(P)88.995(.-Y.)-355.993(Strub,)-357.01(and)-356.997(J.)-355.993(K.)]TJ 1 0 0 1 71.454 167.342 Tm [(Zinzindohoue.)-353.998(A)-353.998(m)-1.004(essy)-353.998(state)-353.998(of)-353.998(the)-354.011(union:)-472.993(T)88.995(aming)-353.998(the)]TJ 0 -8.966 TD [(comp)-30(osite)-354(state)-353.998(mac)28.996(hines)-353.998(of)-354(TLS.)-354(In)]TJ /T1_4 7.97 Tf 138.565 0 Td [(IEEE)-384.001(Symp)55.001(osium)-384.001(on)]TJ -139.002 -8.966 Td [(Se)55.001(curity)-384.001(and)-384.001(Privac)-1(y)]TJ /T1_2 7.97 Tf [(,)-353.998(2015.)]TJ -12.985 -9.963 Td [([8])-563(C.)-354(Bouvier,)-353.998(P)88.995(.)-355.002(Gaudry)89.008(,)-353.998(L.)-355.002(Im)30(b)-30(ert,)-353.998(H.)-354.011(Jeljeli,)-353.998(and)-354.99(E.)-354.011(Thom\351.)]TJ 13.422 -8.966 Td [(New)-354(record)-354(for)-353.998(disc)-1.004(r)1.004(e)-1.004(te)-353.998(logarithm)-354(in)-354(a)-353.998(prime)-353.998(\034nite)-355.002(\034eld)-353.998(of)]TJ -0.423 -8.967 Td [(180)-354(decimal)-354(digits,)-355.002(201)1.004(4.)-355.002(h)30(ttp://caramel.loria.fr/p180.txt.)]TJ -12.999 -9.962 Td [([9])-563(R.)-354(Canetti)-353.998(and)-353.998(H.)-353.998(Kra)28.996(w)30(czyk.)-355.002(Securit)30(y)-353.998(analysis)-355(of)-354(IKE's)]TJ 13.422 -8.967 Td [(signature-based)-354(k)29(ey-exc)30(hange)-355(p)1(roto)-30(col.)-354(In)]TJ /T1_4 7.97 Tf 157.942 0 Td (Crypto)Tj /T1_2 7.97 Tf [(,)-353.998(2002.)]TJ -175.598 -9.962 Td [([10])-563(A)1(.)-355(Commeine)-353.998(and)-353.998(I.)-353.998(Semaev.)-355.002(An)-353.998(algorithm)-354.011(to)-353.998(solv)29.008(e)-354.011(the)]TJ 17.656 -8.967 Td [(discrete)-354(logarithm)-355(pr)1.004(oblem)-355.002(with)-353.998(the)-353.998(n)28.996(um)30(b)-30(er)-353.998(\034eld)-353.998(siev)28.996(e.)-354(In)]TJ /T1_4 7.97 Tf -0.472 -8.966 Td [(PK)55.001(C)]TJ /T1_2 7.97 Tf 18.05 0 Td [(,)-354(2006.)]TJ 227.78 653.549 Td [([11])-562(D)-1(.)-354(Copp)-28.996(ersmith.)-354.011(Solv)-0.991(ing)-353.998(linear)-354.011(equations)-353.998(o)29.008(v)30(er)]TJ /T1_5 7.97 Tf 191.722 0 Td (GF\(2\))Tj /T1_2 7.97 Tf 25.81 0 Td (via)Tj -199.876 -8.966 Td [(blo)-30(c)30(k)-354(Wiedemann)-355(a)1.004(l)-1.004(g)1.004(orithm.)]TJ /T1_4 7.97 Tf 110.088 0 Td [(Math.)-384.001(Comp.)]TJ /T1_2 7.97 Tf [(,)-353.998(62\(205\),)-353.998(1994.)]TJ -127.744 -10.292 Td [([12])-562(R)-1(.)-354(Crandall)-353.998(and)-353.998(C.)-353.998(B.)-354.011(P)29.008(omerance.)]TJ /T1_4 7.97 Tf 148.33 0 Td [(Prime)-384.001(Numb)55.001(ers:)-494.001(A)]TJ -131.688 -8.966 Td [(Computational)-384.001(Persp)55.001(e)55.001(c)-1.004(tive)]TJ /T1_2 7.97 Tf [(.)-353.998(Springer,)-353.998(2001.)]TJ -16.642 -10.291 Td [([13])-562(B)-1(.)-354(den)-353.998(Bo)-29.008(er.)-354.99(Di\036e-Hellman)-354.011(is)-353.998(as)-353.998(strong)-353.998(as)-355.002(discrete)-353.998(log)-353.998(for)]TJ 17.656 -8.967 Td [(certain)-354(primes.)-355(In)]TJ /T1_4 7.97 Tf 68.506 0 Td (Crypto)Tj /T1_2 7.97 Tf [(,)-353.998(1988.)]TJ -86.162 -10.291 Td [([14])-562.001(W.)-355.002(Di\036e)-353.998(and)-353.998(M.)-353.998(E.)-355.002(Hellman.)-353.998(New)-353.998(directions)-353.998(in)]TJ 17.656 -8.967 Td [(cryptograph)30(y)88.004(.)]TJ /T1_4 7.97 Tf 53.647 0 Td [(IEEE)-383.998(T)81.994(r)55.006(ans.)-383.998(Inform.)-383.998(The)54.993(ory)]TJ /T1_2 7.97 Tf 108.249 0 Td [(,)-354(22\(6\):644\025654,)]TJ -162.319 -8.966 Td (1976.)Tj -17.233 -10.291 Td [([15])-562(Z.)-355(Durumeric,)-353.998(E.)-353.998(W)87.991(ustro)30(w,)-353.998(and)-353.998(J.)-355.002(A.)-353.998(Halderman.)-353.998(ZMap:)]TJ 0.994 0 0 1 334.468 633.275 Tm [(F)88.995(ast)-355.993(In)28.996(ternet-wide)-355.993(scanning)-356.006(and)-355.993(i)-1.004(ts)-356.006(securit)30(y)-356.997(applications.)-355.993(In)]TJ /T1_4 7.97 Tf 1 0 0 1 333.008 624.309 Tm [(U)55.006(senix)-384.011(Se)55.006(curity)]TJ /T1_2 7.97 Tf 57.843 0 Td [(,)-354(2013.)]TJ -74.039 -10.292 Td ([16])Tj 0.983 0 0 1 334.468 614.017 Tm [(M.)-359.996(F)89.999(riedl,)-361(N.)-360.008(Pro)30(v)30(os,)-359.996(and)-359.996(W.)-361(Simpson.)-360.008(Di\036e-Hellman)-361(group)]TJ 0.994 0 0 1 334.468 605.051 Tm [(exc)30(hange)-355.993(for)-355.002(the)-356.006(secure)-355.002(she)-0.991(ll)-355.002(\(SSH\))-356.006(transp)-28.996(ort)-356.006(la)30(y)30(er)-355.993(proto)-28.996(col.)]TJ 1 0 0 1 334.468 596.085 Tm [(RF)30(C)-355.002(441)1.004(9,)-355.002(Mar.)-353.998(2006.)]TJ -17.656 -10.292 Td [([17])-562(W.)-355(Geiselmann,)-353.998(H.)-353.998(K)28.996(opfer,)-354(R.)-354(Stein)29(w)30(andt,)-354(and)-354(E.)-355(T)88.995(romer.)]TJ 17.656 -8.966 Td [(Impro)30(v)29(ed)-353.998(routing-based)-353.998(linear)-353.998(algebra)-355.002(fo)0.991(r)-354.99(the)-353.998(n)30(um)28.996(b)-28.996(er)-354.011(\034e)-0.991(ld)]TJ T* [(siev)29(e.)-354(In)]TJ /T1_4 7.97 Tf 33.207 0 Td [(Information)-384.001(T)82(e)55.001(chnolo)55.001(gy:)-493.997(Co)54.993(ding)-383.998(and)-383.998(Computing)]TJ /T1_2 7.97 Tf (,)Tj -33.419 -8.967 Td (2005.)Tj -17.444 -10.291 Td [([18])-562.001(W.)-355.002(Geiselmann)-353.998(and)-353.998(R.)-353.998(Stein)28.996(w)30(andt.)-355.002(Non-)1.004(w)28.996(afer-scale)-353.998(sieving)]TJ 17.656 -8.967 Td [(hardw)30(are)-355.002(f)1.004(or)-355.002(the)-353.998(NFS:)-353.998(Another)-353.998(attempt)-353.998(to)-354.011(cop)-30(e)-353.998(with)]TJ -0.423 -8.966 Td [(1024-bit.)-353.998(In)]TJ /T1_4 7.97 Tf 45.861 0 Td [(Eur)55.006(o)54.993(c)-1.004(rypt)]TJ /T1_2 7.97 Tf 36.406 0 Td [(,)-353.998(2007.)]TJ -99.5 -10.291 Td ([19])Tj 0.998 0 0 1 334.468 520.379 Tm [(D.)-355.002(Gillmor.)-353.998(Negotiated)-355.002(\034nite)-355.002(\034eld)-353.998(Di\036e-Hellman)-355.002(ephemeral)]TJ 1 0 0 1 334.468 511.412 Tm [(parameters)-353.998(for)-353.998(TLS.)-353.998(IETF)-355.002(In)30(ternet)-353.998(Draft,)-353.998(Ma)28.996(y)-353.998(2015.)]TJ -17.656 -10.291 Td [([20])-562(D)-1(.)-354(M.)-353.998(Gordon.)-353.998(Designing)-353.998(and)-354.011(detec)-0.991(ting)-353.998(trap)-29.008(do)-30(ors)-353.998(for)]TJ 17.656 -8.967 Td [(discrete)-354(log)-354(c)-1.004(r)1.004(y)-1.004(pto)1.004(s)-1.004(ystems.)-353.998(In)]TJ /T1_4 7.97 Tf 112.871 0 Td (Crypto)Tj /T1_2 7.97 Tf [(,)-353.998(1992.)]TJ -130.527 -10.291 Td [([21])-562.001(D)-1.004(.)-353.998(M.)-353.998(Gordon.)-353.998(Discrete)-353.998(logarithms)-355.002(in)]TJ /T1_5 7.97 Tf 159.892 0 Td (GF\()Tj /T1_6 7.97 Tf (p)Tj /T1_5 7.97 Tf (\))Tj /T1_2 7.97 Tf 25.839 0 Td [(using)-354(the)]TJ -168.075 -8.966 Td [(n)30(um)29(b)-28.996(e)-1.004(r)-354(\034eld)-354(siev)29(e.)]TJ /T1_4 7.97 Tf 71.801 0 Td [(SIAM)-384.001(J.)-384.001(Discr)55.006(ete)-384.011(Math.)]TJ /T1_2 7.97 Tf [(,)-353.998(6\(1\),)-353.998(1993.)]TJ -89.457 -10.292 Td ([22])Tj 0.989 0 0 1 334.468 462.605 Tm [(D.)-358.001(Harkins)-358.001(and)-358.001(D.)-358.992(Ca)0.991(rrel.)-358.992(The)-358.001(In)30(ternet)-358.001(k)30(ey)-359.005(exc)30(hange)-358.001(\(IKE\).)]TJ 1 0 0 1 334.468 453.639 Tm [(RF)30(C)-355.002(240)1.004(9,)-355.002(No)30(v.)-353.998(1998.)]TJ -17.656 -10.292 Td [([23])-562(T.)-355(Jager,)-353.998(K.)-353.998(G.)-353.998(P)28.996(aterson,)-353.998(and)-353.998(J.)-354.011(Somoro)30(v)-0.991(sky)88.995(.)-353.998(One)-353.998(bad)]TJ 17.656 -8.966 Td [(apple:)-472(Bac)29(kw)30(ards)-354(compatibil)-1(it)30(y)-354(attac)29(ks)-354(on)-354(state-of-the-art)]TJ T* [(cryptograph)30(y)88(.)-354(In)]TJ /T1_4 7.97 Tf 64.224 0 Td (NDSS)Tj /T1_2 7.97 Tf [(,)-353.998(2013.)]TJ -81.88 -10.292 Td [([24])-562.001(A.)-355.002(Joux)-353.998(and)-353.998(R.)-353.998(Lercier.)-355.002(Impro)30(v)28.996(emen)30(ts)-353.998(to)-353.998(t)-1.004(he)-353.998(general)]TJ 17.656 -8.966 Td [(n)30(um)28.996(b)-30(er)-353.998(\034eld)-353.998(siev)28.996(e)-353.998(for)-353.998(discrete)-353.998(logarithms)-353.998(in)-355.002(prime)-353.998(\034elds.)-353.998(A)]TJ T* [(comparison)-353.998(with)-353.998(the)-355.002(Gau)1.004(s)-1.004(sian)-353.998(in)30(teger)-353.998(met)-1.004(h)1.004(o)-30(d.)]TJ /T1_4 7.97 Tf 176.167 0 Td (Math.)Tj -177.181 -8.967 Td (Comp.)Tj /T1_2 7.97 Tf [(,)-353.998(72\(242\):953\025967,)-353.998(2003.)]TJ -16.642 -10.291 Td ([25])Tj 0.98 0 0 1 334.468 377.933 Tm [(C.)-361(Kaufman,)-362.003(P)91.003(.)-362.003(Ho\033man,)-361(Y.)-362.003(Nir,)-361(P)90.012(.)-361.012(Eronen,)-361(and)-361.991(T.)-361(Kivinen.)]TJ 1 0 0 1 334.468 368.966 Tm [(In)28.996(ternet)-353.998(k)30(ey)-355.002(exc)30(hange)-353.998(proto)-30(col)-353.998(v)30(ersi)-1.004(o)1.004(n)-355.002(2)-353.998(\(IKEv2\).)]TJ T* [(RF)30(C)-355(729)1(6,)-355(Oct.)-354(2014.)]TJ -17.656 -10.291 Td [([26])-562(S.)-355(Ken)30(t.)-354(IP)-355.002(authen)30(tication)-353.998(header.)-354(R)-1(F)30(C)-354(4302,)-354(Dec.)-354(2005.)]TJ 0 -10.292 TD [([27])-562(S.)-355(Ken)30(t.)-354(IP)-355.002(encapsulating)-353.998(securit)30(y)-355(pa)30(yload)-354(\(ESP\).)]TJ 17.656 -8.966 Td [(RF)30(C)-355(430)1(3,)-355(Dec.)-354(2005.)]TJ -17.656 -10.292 Td ([28])Tj 0.992 0 0 1 334.468 320.159 Tm [(T.)-355.002(Kl)-1.004(einjung)1.004(.)-355.993(Cofactorisation)-355.002(strategies)-356.006(for)-354.99(the)-356.006(n)30(um)30(b)-30(er)-355.002(\034el)-1.004(d)]TJ 1 0 0 1 334.468 311.193 Tm [(siev)28.996(e)-353.998(and)-353.998(an)-353.998(estimate)-353.998(for)-353.998(the)-355.002(sieving)-353.998(step)-353.998(for)-354.011(factoring)-353.998(1024)]TJ 0 -8.966 TD [(bit)-354(in)29(tegers,)-354(2006.)-354(h)28.996(ttp://)1.004(www.h)29(yp)-29(e)-1(r)1(e)-1(lliptic.org/tanja)1(/)]TJ 0 -8.967 TD [(SHAR)30(CS/talks06/thorsten.p)-30(df)-80(.)]TJ -17.656 -10.291 Td [([29])-562(T.)-355(Kleinjung,)-353.998(K.)-353.998(A)28.996(o)1(k)-1(i,)-354(J.)-354(F)89(rank)28.996(e,)-353.998(A.)-353.998(K.)-355(Lenstra,)-354(E.)-354(Thom\351,)]TJ 17.436 -8.967 Td [(J.)-354(W.)-354(Bos,)-355.002(P)88.995(.)-353.998(Gaudry)88.004(,)-354(A.)-354(Kruppa,)-354(P)88(.)-353.998(L.)-353.998(Mon)28.996(tg)1(ome)-1(r)1(y)88(,)-354(D.)-354(A.)]TJ 0.22 -8.966 Td [(Osvik,)-354(H.)-355(te)-353.998(Riele,)-353.998(A.)-353.998(Timofeev)-1.004(,)-353.998(and)-353.998(P)88.995(.)-354(Zi)-1(mmermann.)]TJ 0 -8.966 TD [(F)89(actorization)-355(of)-354(a)-353.998(768-bit)-353.998(RSA)-354.011(mo)-28.996(dulus)-1.004(.)-353.998(In)]TJ /T1_4 7.97 Tf 163.987 0 Td (Crypto)Tj /T1_2 7.97 Tf [(,)-353.998(2010.)]TJ -181.643 -10.292 Td [([30])-562(A.)-355(Langley)88.995(,)-353.998(N.)-355.002(Mo)-28.996(dadugu,)-354(and)-354(B.)-355(Mo)-29(eller.)-353.998(T)87.991(ransp)-28.996(ort)-353.998(la)29(y)30(er)]TJ 17.656 -8.966 Td [(securit)29(y)-354(\(TLS\))-354(false)-354(start.)-353.998(IETF)-355.002(In)30(ternet)-354(Draft,)-354(2010.)]TJ -17.656 -10.291 Td [([31])-562(A.)-355(K.)-353.998(Lenstra)-353.998(and)-353.998(H.)-354.011(W.)-354.99(Lenstra,)-354.011(Jr.,)-353.998(editors.)]TJ /T1_4 7.97 Tf 191.971 0 Td (The)Tj -174.796 -8.967 Td [(Development)-384.001(of)-384.001(the)-383.998(Numb)54.002(er)-383.998(Field)-384.011(Sieve)]TJ /T1_2 7.97 Tf 148.136 0 Td [(.)-354(Springer,)-354(1993.)]TJ -165.311 -10.291 Td [([32])-562(M)-1(.)-354(Lipacis.)-353.998(Semiconductors:)-472.002(M)-1(o)-29(ore)-354(stress)-353.998(=)-355.002(stru)1(c)-1(tura)1(l)]TJ 17.656 -8.967 Td [(industry)-354(shift.)-354(T)88.004(ec)28.996(h)1(ni)-1(cal)-354(rep)-28.996(ort,)-354.011(Je\033e)-0.991(r)0.991(i)-0.991(es,)-353.998(2012.)]TJ -17.656 -10.291 Td [([33])-562(U.)-355(M.)-353.998(Maurer.)-353.998(T)87.991(o)30(w)30(ards)-354.99(the)-354.011(equiv)59.008(alence)-353.998(of)-353.998(breaking)-354.011(the)]TJ 17.656 -8.966 Td [(Di\036e-Hellman)-354(proto)-30(col)-353.998(and)-353.998(computing)-353.998(discrete)-355.002(logarithms.)]TJ 0 -8.967 TD (In)Tj /T1_4 7.97 Tf 10.577 0 Td (Crypto)Tj /T1_2 7.97 Tf [(,)-353.998(1994.)]TJ -28.233 -10.291 Td ([34])Tj 0.98 0 0 1 334.468 159.781 Tm [(U.)-346.997(M.)-348.001(Maurer)-346.997(and)-348.001(S.)-347.01(W)90.012(olf.)-347.01(Di\036e-Hellman)-348.001(oracles.)-346.997(In)]TJ /T1_4 7.97 Tf 199.345 0 Td (Crypto)Tj /T1_2 7.97 Tf (,)Tj 1 0 0 1 334.045 150.814 Tm (1996.)Tj -17.233 -10.291 Td [([35])-562(N.)-355(Ma)30(vrogiannop)-29(oulos,)-355(F.)-353.998(V)88.995(ercauteren,)-355.002(V.)-353.998(V)89.008(elic)28.996(hk)30(o)29(v,)-354(and)]TJ 17.656 -8.966 Td [(B.)-354(Preneel.)-355(A)-353.998(cross-proto)-29.008(col)-353.998(attac)29.008(k)-353.998(on)-354.011(the)-353.998(TLS)-353.998(proto)-30(col.)-353.998(In)]TJ /T1_4 7.97 Tf -0.638 -8.967 Td [(A)55.001(CM)-384.001(CCS)]TJ /T1_2 7.97 Tf 39.806 0 Td [(,)-354(pages)-354(62\02572,)-353.998(2012.)]TJ -56.824 -10.291 Td ([36])Tj 0.993 0 0 1 334.468 112.299 Tm [(C.)-355.993(Meado)29.987(ws.)-355.993(Analysis)-356.006(of)-355.993(the)-356.006(In)29.008(ternet)-356.006(k)30(ey)-355.993(exc)28.996(hange)-355.993(pro)0.991(to)-30(col)]TJ 1 0 0 1 334.468 103.332 Tm [(using)-353.998(the)-353.998(NRL)-355.002(proto)-28.996(col)-354.011(analyzer.)-353.998(In)]TJ /T1_4 7.97 Tf 137.177 0 Td [(IEEE)-384.001(Symp)55.001(osium)-384.001(on)]TJ -137.614 -8.966 Td [(Se)55.001(curity)-384.001(and)-384.001(Privacy)]TJ /T1_2 7.97 Tf 78.164 0 Td [(,)-354(1999.)]TJ -95.383 -10.291 Td [([37])-562(M)-1(icrosof)1(t)-355(Securit)30(y)-354(Bull)-1.004(etin)-353.998(MS15-055.)-353.998(V)89(ulnerabilit)29(y)-354(in)]TJ 17.656 -8.967 Td [(Sc)29(ha)1(nne)-1(l)-354(could)-354(allo)30(w)-355(infor)1(mati)-1(o)1(n)-355(disclosure,)-353.998(Ma)30(y)-355.002(2015)1(.)]TJ /T1_0 8.966 Tf -34.219 -30.306 Td (12)Tj ET BT /T1_0 7.97 Tf 53.798 728.239 Td [([38])-563(N)1(I)-1(ST)1(.)-355(FIPS)-353.998(PUB)-353.998(186-4:)-472.002(Digital)-353.998(signature)-353.998(standard,)-354.011(2013.)]TJ 0 -10.012 TD [([39])-563(O)1(ak)-355(Ridge)-353.998(National)-353.998(Lab)-29.008(oratory.)-354.99(In)30(tro)-29.008(duc)-1.004(ing)-353.998(Titan,)-353.998(2012.)]TJ 17.656 -8.967 Td [(h)29(ttps://)1(www.olc)-1(f)1(.)-1(o)1(rnl.)-1(g)1(o)29(v/titan.)]TJ -17.656 -10.012 Td [([40])-563(H)1(.)-355(Orman.)-353.998(The)-353.998(Oakley)-353.998(k)28.996(ey)-353.998(determination)-353.998(proto)-30(col.)]TJ 17.656 -8.967 Td [(RF)29(C)-354(2412)1(,)-355(No)30(v.)-354(1998.)]TJ -17.656 -10.012 Td ([41])Tj 0.992 0 0 1 71.454 680.269 Tm [(S.)-355.993(C.)-357.01(P)30(ohlig)-355.993(and)-357.01(M.)-355.993(E.)-356.997(Hellman.)-356.006(An)-356.997(impro)30(v)30(ed)-356.997(algo)0.991(rithm)-356.997(for)]TJ 1 0 0 1 71.454 671.303 Tm [(computing)-353.998(logarithms)-353.998(o)28.996(v)30(er)]TJ /T1_1 7.97 Tf 101.917 0 Td (GF\()Tj /T1_2 7.97 Tf (p)Tj /T1_1 7.97 Tf (\))Tj /T1_0 7.97 Tf 25.839 0 Td [(and)-353.998(its)-353.998(cryptographic)]TJ -127.756 -8.967 Td [(signi\034cance)-353.998(\(corresp.\).)]TJ /T1_3 7.97 Tf 85.264 0 Td [(T)81.994(r)55.006(ans.)-383.998(Inform.)-383.998(The)54.993(ory)]TJ /T1_0 7.97 Tf 84.508 0 Td [(,)-354(24\(1\),)-354(1978.)]TJ -187.428 -10.012 Td ([42])Tj 0.986 0 0 1 71.454 652.324 Tm [(J.)-359.005(M.)-359.996(P)30(ollard.)-359.005(A)-358.992(Mon)30(te)-359.005(Carlo)-358.992(metho)-30.012(d)-359.996(f)1.004(or)-359.996(factor)0.991(i)-0.991(zation.)]TJ /T1_3 7.97 Tf 208.533 0 Td (BIT)Tj 1 0 0 1 70.982 643.357 Tm [(Numeric)55.006(al)-384.011(Mathematics)]TJ /T1_0 7.97 Tf [(,)-353.998(15\(3\):331\025334,)-353.998(1975.)]TJ -17.184 -10.012 Td [([43])-563.005(O)1.004(.)-355.002(Sc)30(hirokauer.)-353.998(Virtual)-355.002(loga)1.004(rithms)-1.004(.)]TJ /T1_3 7.97 Tf 151.57 0 Td [(J.)-384.001(A)41(lgorithms)]TJ /T1_0 7.97 Tf (,)Tj -133.914 -8.966 Td [(57\(2\):140\025147,)-354(2005.)]TJ -17.656 -10.013 Td [([44])-563(I.)-354(A.)-353.998(Semaev.)-353.998(Sp)-30(ecial)-354.011(prime)-353.998(n)29.008(um)30(b)-30(ers)-353.998(and)-354.011(discrete)-354.99(log)0.991(s)-354.99(in)]TJ 17.656 -8.966 Td [(\034nite)-354(prime)-355(\034elds.)]TJ /T1_3 7.97 Tf 69.684 0 Td [(Math.)-384.001(Comp.)]TJ /T1_0 7.97 Tf [(,)-353.998(71\(237\):363\025377,)-353.998(2002.)]TJ -87.34 -10.013 Td [([45])-563(D.)-354(Shanks.)-353.998(Class)-353.998(n)28.996(um)30(b)-30(er,)-354(a)-354(theory)-354(of)-353.998(factorization,)-353.998(and)]TJ 17.656 -8.966 Td [(genera.)-354(In)]TJ /T1_3 7.97 Tf 39.753 0 Td [(Pr)55.001(o)55.001(c.)-383.998(Symp)54.002(os.)-384.011(Pur)55.006(e)-384.001(Math.)]TJ /T1_0 7.97 Tf 98.399 0 Td [(,)-354(v)29(olume)-354(20.)-354(1971.)]TJ -155.808 -10.013 Td ([46])Tj 0.994 0 0 1 71.454 576.408 Tm [(Spiegel)-355.993(Sta\033.)-357.01(Prying)-355.993(ey)30(e)-1.004(s:)-475.001(Inside)-355.993(the)-356.006(NSA's)-356.997(w)30(ar)-356.006(on)-356.997(In)30(ternet)]TJ 1 0 0 1 71.454 567.442 Tm [(securit)28.996(y)89.008(.)-353.998(Der)-355.002(Spiegel,)-353.998(Dec)-354.011(2014.)]TJ 0 -8.966 TD [(h)29(ttp://)1(www.spi)-1(egel.de/in)30(ternational/german)30(y)-1.004(/)]TJ 0 -8.967 TD [(inside-)-63.001(the-)-62.001(nsa-)-62.998(s-)-62.007(w)29.008(ar)0.991(-)-62.998(on-)-61.994(in)28.996(ternet-)-61.994(sec)-1.004(ur)1(i)-1(t)30(y-)-62.998(a)1.004(-)-63.011(1010361.h)30(tml.)]TJ -17.656 -10.012 Td [([47])-563(W.)-354(Stein)-353.998(et)-353.998(al.)]TJ /T1_3 7.97 Tf 74.81 0 Td [(Sage)-384.001(Mathematics)-384.001(Softwar)55.006(e)-385.002(\(Version)-383.998(6.5\))]TJ /T1_0 7.97 Tf (.)Tj -57.459 -8.967 Td [(The)-353.998(Sage)-353.998(Dev)28.996(elopmen)28.996(t)-353.998(T)89.008(eam,)-354.011(2015.)]TJ 0.305 -8.966 Td [(h)28.996(ttp://)1.004(www.sagemath.org)-11.995(.)]TJ -17.656 -10.012 Td [([48])-563.005(stud:)-472.002(The)-353.998(scalable)-353.998(TLS)-353.998(un)28.996(wrapping)-353.998(daemon,)-353.998(2012.)]TJ 17.656 -8.967 Td [(h)28.996(ttps://)1.004(gith)28.996(ub.com/bumptec)29.008(h/stud/b)0.991(l)-0.991(o)0.991(b/)]TJ -0.423 -8.966 Td [(19a7f19686)1.004(b)-30(cdb)-30(d6)0.991(89c6fb)-30(ea31f68a27)1.004(6e62d886/stud.c#L593.)]TJ -17.233 -10.013 Td [([49])-563.005(E)1.004(.)-355.002(Thom\351.)-353.998(Sub)-28.996(quadratic)-355.002(computation)-353.998(of)-353.998(v)30(ector)-355.002(g)1.004(e)-1.004(nera)1.004(ti)-1.004(ng)]TJ 17.656 -8.966 Td [(p)-30(o)1.004(l)-1.004(ynomials)-353.998(and)-353.998(impro)30(v)28.996(emen)28.996(t)-353.998(of)-353.998(the)-353.998(blo)-30(c)30(k)-353.998(Wiedemann)]TJ 0 -8.966 TD (algorithm.)Tj /T1_3 7.97 Tf 40.938 0 Td [(J.)-383.998(Symb)54.993(olic)-383.998(Comput.)]TJ /T1_0 7.97 Tf [(,)-353.998(33\(5\):757\025775,)-354.011(2002.)]TJ -58.594 -10.013 Td [([50])-563.005(P)89.008(.)-353.998(C.)-354.011(V)88.004(an)-353.998(Oorsc)30(hot)-353.998(and)-355.002(M.)-353.998(J.)-353.998(Wiener.)-353.998(P)28.996(arallel)-353.998(collision)]TJ 17.656 -8.966 Td [(searc)28.996(h)-353.998(with)-353.998(application)-353.998(to)-353.998(hash)-353.998(functions)-355.002(a)1.004(nd)-355.002(discrete)]TJ 0 -8.967 TD [(logarithms.)-353.998(In)]TJ /T1_3 7.97 Tf 54.855 0 Td [(A)55.006(CM)-384.011(CCS)]TJ /T1_0 7.97 Tf [(,)-354.011(1994.)]TJ -72.511 -10.012 Td [([51])-563.005(P)89.008(.)-353.998(C.)-354.011(V)88.004(an)-353.998(Oorsc)30(hot)-353.998(and)-355.002(M.)-353.998(J.)-353.998(Wiener.)-353.998(On)-353.998(D)-1.004(i\036e-Hellman)]TJ 17.656 -8.966 Td [(k)28.996(ey)-353.998(agreemen)30(t)-355.002(with)-353.998(short)-353.998(exp)-28.996(onen)28.996(ts.)-353.998(In)]TJ /T1_3 7.97 Tf 149.709 0 Td [(Eur)55.006(o)54.993(crypt)]TJ /T1_0 7.97 Tf [(,)-353.998(1996.)]TJ -167.365 -10.013 Td ([52])Tj 0.98 0 0 1 71.454 408.737 Tm [(D.)-345.002(W)89.999(agner)-345.002(and)-344.99(B.)-345.002(Sc)30(hneier.)-345.002(Analysis)-345.002(of)-345.002(the)-345.993(SSL)-345.002(3.0)-345.002(proto)-30(col.)]TJ 1 0 0 1 71.454 399.771 Tm (In)Tj /T1_3 7.97 Tf 10.577 0 Td [(2nd)-384.001(U)55.001(senix)-384.001(W)82(orkshop)-384.001(on)-383.998(Ele)54.993(ctr)54.002(onic)-383.998(Commer)55.006(c)54.993(e)]TJ /T1_0 7.97 Tf 175.369 0 Td [(,)-354(1996.)]TJ -203.602 -10.013 Td [([53])-563(J.)-354(W)88.995(agnon.)-353.998(SSL)-353.998(pro\034les)-355.002(part)-353.998(5:)-472.002(SSL)-353.998(options,)-353.998(2013.)-354(h)29(ttps://)]TJ 17.656 -8.966 Td [(dev)29(cen)30(tral.f5.com/articles/ssl-)-62.998(pro\034les-)-62.007(part-)-62.998(5-)-61.994(ssl-)-62.998(options.)]TJ 245.358 347.447 Td [([54])-562(P)88(.)-354(Zimmermann)-353.998(et)-355.002(al.)-354(GMP-ECM,)-353.998(2012.)]TJ 17.656 -8.966 Td [(h)30(ttps)-1(://)1(gforge.inria.fr/pro)-30(jects/ecm.)]TJ -17.656 -10.411 Td [([55])-562(APEX)-355(a)1.004(c)-1.004(tiv)30(e/passiv)29(e)-354(ex\034ltration.)-354(Media)-353.998(le)-1.004(a)1.004(k)-1.004(,)-353.998(A)30(ug.)-354(2009.)]TJ 17.656 -8.967 Td [(h)30(ttp:)-1(/)1(/www.spie)-1(g)1(e)-1(l.de/media/media-)-62.001(35671.p)-28.996(df)-81.003(.)]TJ -17.656 -10.411 Td [([56])-562(Fie)-1(lded)-354(capabilit)30(y:)-473(End-to-end)-353.998(VPN)-353.998(SPIN)-353.998(9)-354.011(design)-353.998(review.)]TJ 17.656 -8.966 Td [(Media)-354(leak.)-355(h)30(ttp://www.spiegel.de/media/media-)-63.001(35529)1(.)-1(p)-29(df)-80(.)]TJ -17.656 -10.411 Td [([57])-562(FY)-355(20)1.004(13)-355.002(congr)0.991(e)-0.991(ssional)-353.998(budget)-353.998(justi\034cation.)-354.011(Media)-353.998(leak.)]TJ 17.656 -8.966 Td [(h)30(ttp:)-1(/)1(/cryptome)-1(.or)1(g/2013/08/sp)30(y)-1.004(-)-61.994(budget-)-62.007(fy13.p)-30(df)-79.999(.)]TJ -17.656 -10.411 Td [([58])-562(GALL)-1(AN)1(TW)118(A)118(VE@scale.)-355(Media)-354(leak.)]TJ 17.656 -8.967 Td [(h)30(ttp:)-1(/)1(/www.spie)-1(g)1(e)-1(l.de/media/media-)-62.001(35514.p)-28.996(df)-81.003(.)]TJ -17.656 -10.411 Td [([59])-562(I)-1(n)1(no)29(v8)-354(exp)-30(erimen)30(t)-355(p)1.004(ro\034le.)-355.002(Media)-353.998(leak.)]TJ 17.656 -8.966 Td [(h)30(ttp:)-1(/)1(/www.spie)-1(g)1(e)-1(l.de/media/media-)-62.001(35509.p)-28.996(df)-81.003(.)]TJ -17.656 -10.411 Td [([60])-562(I)-1(n)30(tro)-354(to)-354(the)-353.998(VPN)-355.002(exploitation)-354(pro)-29(cess.)-355.002(Media)-353.998(leak,)-354(Sept.)]TJ 17.444 -8.966 Td [(2010.)-354(h)29(ttp://)1(www.spi)-1(egel.de/media/media-)-62.001(35515.p)-30(df)-80(.)]TJ -17.444 -10.411 Td [([61])-562(L)-1(O)1(NGHA)29(UL)-354(\025)-354(WikiInfo.)-353.998(M)-1.004(edia)-353.998(leak.)]TJ 17.656 -8.967 Td [(h)30(ttp:)-1(/)1(/www.spie)-1(g)1(e)-1(l.de/media/media-)-62.001(35533.p)-28.996(df)-81.003(.)]TJ -17.656 -10.411 Td [([62])-562(POISONNUT)-354(\025)-355(WikiInfo.)-353.998(Media)-353.998(leak.)]TJ 17.656 -8.966 Td [(h)30(ttp:)-1(/)1(/www.spie)-1(g)1(e)-1(l.de/media/media-)-62.001(35519.p)-28.996(df)-81.003(.)]TJ -17.656 -10.411 Td [([63])-562(SIGI)-1(NT)-354(strategy)88.995(.)-353.998(Media)-355.002(leak.)]TJ 17.656 -8.966 Td [(h)30(ttp:)-1(/)1(/www.n)29(ytimes.com/in)28.996(teractiv)30(e/2013/11/23/us/)]TJ T* [(p)-30(o)1(l)-1(itics/23nsa)1(-)-63.001(sigin)30(t)-1(-)-62.001(strategy-)-61.994(do)-30(cumen)28.996(t.h)30(tml.)]TJ -17.656 -10.411 Td [([64])-562(SPIN)-355(15)-353.998(VPN)-353.998(story)88.995(.)-353.998(Me)-1.004(dia)-353.998(leak.)]TJ 17.656 -8.966 Td [(h)30(ttp:)-1(/)1(/www.spie)-1(g)1(e)-1(l.de/media/media-)-62.001(35522.p)-28.996(df)-81.003(.)]TJ -17.656 -10.411 Td [([65])-562(TURMOIL)-1(/)1(APEX/APEX)-354(high)-355(lev)30(el)-353.998(desc)-1.004(r)1.004(i)-1.004(ption)-353.998(do)-29(cumen)29(t.)]TJ 17.656 -8.966 Td [(Media)-354(leak.)-355(h)30(ttp://www.spiegel.de/media/media-)-63.001(35513)1(.)-1(p)-29(df)-80(.)]TJ -17.656 -10.411 Td ([66])Tj 0.98 0 0 1 334.468 486.745 Tm [(TURMOIL)-342.004(IPsec)-342.995(VPN)-342.004(sessionization.)-342.004(Media)-342.995(leak,)-346.006(A)30(ug.)-341.991(2009.)]TJ 1 0 0 1 334.468 477.778 Tm [(h)30(ttp:)-1.004(/)1.004(/www.spie)-1.004(g)1.004(e)-1.004(l.de/media/media-)-61.994(35528.p)-29.008(df)-80.99(.)]TJ -17.656 -10.411 Td [([67])-562(TURMOIL)-355(VPN)-353.998(pro)-29.008(cessing.)-354.99(Media)-354.011(leak,)-353.998(Oct.)-353.998(2009.)]TJ 17.656 -8.966 Td [(h)30(ttp:)-1(/)1(/www.spie)-1(g)1(e)-1(l.de/media/media-)-62.001(35526.p)-28.996(df)-81.003(.)]TJ -17.656 -10.411 Td [([68])-562(V)118(ALIANTSURF)-355(\(V)1(S\):)-355(Capabilit)30(y)-354(le)-1.004(v)30(els.)-353.998(Media)-355.002(leak.)]TJ 17.656 -8.966 Td [(h)30(ttp:)-1(/)1(/www.spie)-1(g)1(e)-1(l.de/media/media-)-62.001(35517.p)-28.996(df)-81.003(.)]TJ -17.656 -10.411 Td [([69])-562(V)118(ALIANTSURF)-355(\025)-354(WikiInfo.)-353.998(Media)-353.998(leak.)]TJ 17.656 -8.967 Td [(h)30(ttp:)-1(/)1(/www.spie)-1(g)1(e)-1(l.de/media/media-)-62.001(35527.p)-28.996(df)-81.003(.)]TJ -17.656 -10.411 Td [([70])-562(VPN)-355(SigDev)-353.998(basics.)-353.998(Media)-353.998(leak.)]TJ 17.656 -8.966 Td [(h)30(ttp:)-1(/)1(/www.spie)-1(g)1(e)-1(l.de/media/media-)-62.001(35520.p)-28.996(df)-81.003(.)]TJ -17.656 -10.411 Td [([71])-562(What)-355(y)30(our)-354(mother)-353.998(nev)28.996(er)-353.998(told)-354(y)29(ou)-354(ab)-29(out)-355(SIGDEV)-353.998(analysis.)]TJ 17.656 -8.966 Td [(Media)-354(leak.)-355(h)30(ttp://www.spiegel.de/media/media-)-63.001(35551)1(.)-1(p)-29(df)-80(.)]TJ /T1_4 8.966 Tf -34.219 -336.09 Td (13)Tj ET BT /T1_0 17.933 Tf 187.121 706.689 Td [(Imperf)10(ect)-278(Forwar)20(d)-278(Secrec)10(y:)]TJ -34.422 -19.925 Td [(Ho)15(w)-278(Dif\002e-Hellman)-278(F)20.002(ails)-278.005(in)-277.999(Practice)]TJ /T1_1 11.955 Tf -87.062 -26.165 Td [(Da)20(vid)-278(Adr)-14.998(ian)]TJ /T1_2 5.978 Tf 68.37 3.809 Td ({)Tj /T1_1 11.955 Tf 11.955 -3.809 Td [(Kar)-40(thik)20(e)20(y)20(an)-277.996(Bharga)20(v)24.993(an)]TJ /T1_2 5.978 Tf 123.484 3.809 Td (\003)Tj /T1_1 11.955 Tf 11.955 -3.809 Td [(Zakir)-278(Dur)-15(umer)-14.998(ic)]TJ /T1_2 5.978 Tf 85.371 3.809 Td ({)Tj /T1_1 11.955 Tf 11.955 -3.809 Td [(Pierr)-15(ic)20(k)-277.996(Gaudr)-30.004(y)]TJ /T1_2 5.978 Tf 82.669 3.809 Td (y)Tj /T1_1 11.955 Tf 11.955 -3.809 Td [(Matthe)20(w)-278(Green)]TJ /T1_2 5.978 Tf 81.486 3.809 Td (x)Tj /T1_1 11.955 Tf -480.611 -16.258 Td [(J)30(.)-278(Ale)30(x)-278(Halder)-25(man)]TJ /T1_2 5.978 Tf 97.242 3.809 Td ({)Tj /T1_1 11.955 Tf 11.956 -3.809 Td [(Nadia)-278(Heninger)]TJ /T1_2 5.978 Tf 83.051 3.809 Td (z)Tj /T1_1 11.955 Tf 11.955 -3.809 Td [(Dre)20(w)-278(Spr)-14.998(ingall)]TJ /T1_2 5.978 Tf 77.66 3.809 Td ({)Tj /T1_1 11.955 Tf 11.955 -3.809 Td [(Emman)10(uel)-278(Thom\351)]TJ /T1_2 5.978 Tf 97.541 3.809 Td (y)Tj /T1_1 11.955 Tf 11.956 -3.809 Td [(Luk)20(e)-278(V)70.003(alenta)]TJ /T1_2 5.978 Tf 68.705 3.809 Td (z)Tj /T1_1 11.955 Tf -468.518 -16.259 Td [(Benjamin)-278(V)70(anderSloot)]TJ /T1_2 5.978 Tf 118.104 3.809 Td ({)Tj /T1_1 11.955 Tf 11.955 -3.809 Td [(Er)-15(ic)-278(W)30.004(ustro)14.998(w)]TJ /T1_2 5.978 Tf 70.044 3.809 Td ({)Tj /T1_1 11.955 Tf 11.956 -3.809 Td [(Santiago)-278(Zanella-B\351guelin)]TJ /T1_2 5.978 Tf 140.208 3.809 Td (k)Tj /T1_1 11.955 Tf 11.955 -3.809 Td [(P)40(aul)-278(Zimmer)-25(mann)]TJ /T1_2 5.978 Tf 97.47 3.809 Td (y)Tj -433.78 -14.605 Td (\003)Tj /T1_1 9.963 Tf 5.261 -3.809 Td [(INRIA)-278(P)40(ar)-15(is-Rocquencour)-40(t)]TJ /T1_2 5.978 Tf 137.443 3.809 Td (y)Tj /T1_1 9.963 Tf 5.26 -3.809 Td [(INRIA)-278(Nancy-Gr)10(and)-278(Est,)-278(CNRS)19.995(,)-278(and)-278(Univ)25.004(ersit\351)-278(de)-278(Lorr)9.997(aine)]TJ /T1_2 5.978 Tf -165.852 -6.652 Td (k)Tj /T1_1 9.963 Tf 5.26 -3.809 Td [(Microsoft)-278(Research)]TJ /T1_2 5.978 Tf 105.733 3.809 Td (z)Tj /T1_1 9.963 Tf 5.26 -3.809 Td [(Univ)25.001(ersity)-278(of)-278(P)49.997(ennsylv)25.004(ania)]TJ /T1_2 5.978 Tf 135.75 3.809 Td (x)Tj /T1_1 9.963 Tf 5.26 -3.809 Td [(Johns)-278(Hopkins)]TJ /T1_2 5.978 Tf 85.26 3.809 Td ({)Tj /T1_1 9.963 Tf 5.26 -3.809 Td [(Univ)25.001(ersity)-278(of)-278(Michigan)]TJ -277.581 -17.439 Td [(F)30(or)-278(additional)-278(mater)-15.006(ials)-278(and)-278(contact)-278(inf)30.002(or)-24.993(mation,)-278.01(visit)-278(W)30.002(eakDH.org.)] TJ /T1_3 11.955 Tf -104.157 -26.924 Td [(ABSTRA)55(CT)]TJ /T1_4 8.966 Tf 0.98 0 0 1 53.328 551.825 Tm [(W)87.003(e)-295.001(in)28.997(v)28.997(estigate)-295.994(the)-295.001(securit)28.997(y)-295.994(of)-295.001(Di\036)-1.004(e-)1.004(Hellman)-296.005(k)28.997(ey)-295.994(exc)28.997(hange)-295.001(as)]TJ 0.48 -10.461 Td [(used)-260.997(in)-262(p)-29.008(opular)-260.997(In)28.997(ternet)-260.997(proto)-28.997(cols)-260.997(and)-261.008(\034nd)-262(it)-260.997(to)-260.997(b)-29.008(e)-260.997(less)-262(secure)]TJ 0 -10.461 TD [(than)-347.999(widely)-347.999(b)-28.997(eliev)28.997(ed.)-466.006(First,)-347.999(w)29.008(e)-348.01(presen)29.008(t)-347.999(Log)-29.008(jam,)-347.999(a)-347.999(no)29.008(v)28.997(el)-347.999(\035a)28.997(w)]TJ 0 -10.46 TD [(in)-305.998(TLS)-305.998(that)-307.002(lets)-305.998(a)-306.009(man-in-the-middle)-305.998(do)28.997(wngrade)-305.998(connections)]TJ 1.009 0 0 1 53.798 509.982 Tm [(to)-340.995(\020exp)-28.005(ort-grade\021)-340.003(Di\036e-Hellman.)-456.002(T)85.006(o)-341.006(carry)-340.995(out)-340.003(this)-340.995(attac)28.997(k,)]TJ 1.003 0 0 1 53.467 499.521 Tm [(w)28.997(e)-341.999(implemen)28.005(t)-341.006(the)-341.999(n)28.997(um)28.005(b)-28.005(er)-341.999(\034eld)-341.999(siev)29.008(e)-342.01(discrete)-340.995(log)-341.999(algorithm.)]TJ 1.02 0 0 1 53.457 489.06 Tm [(After)-454.999(a)-454.006(w)28.005(eek-long)-454.999(precomputation)-454.006(f)-0.993(or)-454.006(a)-454.999(sp)-27.993(eci\034ed)-454.006(512-bit)]TJ 0.987 0 0 1 53.798 478.6 Tm [(group,)-346.995(w)28.997(e)-347.007(can)-346.995(compute)-346.995(arbitrary)-348.01(discret)1.004(e)-347.999(logs)-346.995(in)-347.007(that)-346.995(group)]TJ 0.98 0 0 1 53.798 468.139 Tm [(in)-254.004(ab)-28.997(out)-254.996(a)-254.004(min)28.997(ute.)-433.998(W)87.003(e)-254.004(\034nd)-253.993(that)-254.004(82%)-254.996(of)-254.004(vulnerable)-254.004(serv)29.008(ers)-254.004(use)]TJ 0 -10.461 TD [(a)-259(single)-257.997(512-bit)-259(group,)-277.001(allo)28.997(wing)-257.997(us)-259(to)-259(compromise)-259(connect)0.993(ions)]TJ T* [(to)-305.005(7%)-305.998(of)-304.994(Alexa)-305.005(T)87.003(op)-305.005(Million)-305.998(HTTPS)-304.994(sites.)-451.006(In)-305.998(resp)-28.997(onse,)-314.006(ma)-28.997(jor)]TJ 1 0 0 1 53.798 436.756 Tm [(bro)28.997(wsers)-343.003(are)-342.992(b)-28.005(eing)-343.003(c)29.008(hanged)-343.003(to)-341.999(reject)-343.003(short)-341.999(groups.)]TJ 0.98 0 0 1 62.765 426.296 Tm [(W)87.003(e)-271.001(go)-272.004(on)-271.001(to)-271.993(consider)-271.001(Di\036e-Hellman)-272.004(with)-271.001(768-)-271.993(and)-271.001(1024-bit)] TJ -9.15 -10.461 Td [(groups.)-457.999(W)87.995(e)-325.002(estimate)-324.991(that)-323.998(ev)28.997(en)-325.002(in)-323.998(the)-325.002(1024-bit)-325.002(ca)1.004(s)-1.004(e)1.004(,)-329.999(the)-325.002(com-)]TJ T* [(putations)-334.995(are)-335.006(plausible)-335.999(giv)28.997(en)-334.995(nation-state)-335.006(resources.)-460.999(A)-334.995(small)]TJ 0.985 0 0 1 53.798 394.913 Tm [(n)28.997(um)28.997(b)-28.997(er)-349.003(of)-348.992(\034xed)-349.003(or)-349.003(standardized)-348.992(groups)-349.003(are)-349.003(used)-349.003(b)29.008(y)-349.003(millions)]TJ 1.009 0 0 1 53.798 384.453 Tm [(of)-340.995(serv)28.997(ers;)-341.999(p)-28.005(erforming)-340.003(precomputation)-340.995(for)-341.006(a)-339.992(single)-341.006(1024-bit)]TJ 0.987 0 0 1 53.798 373.992 Tm [(group)-346.995(w)28.997(ould)-347.007(allo)29.008(w)-347.007(passiv)28.997(e)-346.995(ea)28.997(v)28.005(e)1.004(sdropping)-347.999(o)0.993(n)-347.999(18%)-346.995(of)-347.007(p)-28.997(opular)]TJ 1.02 0 0 1 53.798 363.531 Tm [(HTTPS)-364.003(sites,)-372(and)-364.996(a)-364.003(second)-364.996(group)-364.003(w)28.005(ould)-365.007(allo)28.005(w)-364.003(decryption)]TJ 0.999 0 0 1 53.798 353.07 Tm [(of)-343.003(tra\036c)-343.003(to)-343.995(66%)-343.003(of)-342.992(IPsec)-343.003(VPNs)-343.003(and)-343.003(26%)-343.995(of)-343.003(SSH)-343.003(serv)28.005(e)1.004(rs.)-459.002(A)]TJ 0.98 0 0 1 53.798 342.61 Tm [(close)-296.998(reading)-298.001(of)-296.998(published)-298.001(NSA)-296.998(leaks)-298.001(sho)28.997(ws)-296.998(that)-298.001(the)-296.998(agency's)]TJ 1.019 0 0 1 53.798 332.149 Tm [(attac)28.005(ks)-335.006(on)-334.995(VPNs)-335.006(are)-334.995(consisten)27.993(t)-334.995(with)-335.006(ha)28.005(ving)-334.995(ac)27.993(hiev)28.005(ed)-335.006(suc)28.005(h)]TJ 0.983 0 0 1 53.798 321.688 Tm [(a)-347.999(break.)-465.003(W)88.006(e)-348.01(conclude)-347.999(that)-347.999(mo)29.008(ving)-347.999(to)-348.01(stronger)-347.999(k)29.008(ey)-347.999(exc)28.997(hange)]TJ 1 0 0 1 53.798 311.227 Tm [(metho)-28.997(ds)-341.999(should)-343.003(b)-28.005(e)-342.992(a)-342.01(priorit)28.005(y)-341.999(for)-343.003(the)-343.003(In)29.008(ternet)-341.999(comm)27.993(unit)28.997(y)85.006(.)]TJ /T1_3 11.955 Tf 0 -27.214 TD [(1.)-1000(INTR)30(ODUCTION)]TJ /T1_4 8.966 Tf 1.02 0 0 1 62.765 271.062 Tm [(Di\036e-Hellman)-391.004(k)28.005(ey)-391.997(exc)27.993(hange)-390.993(is)-391.004(widely)-391.997(used)-391.004(to)-391.004(establish)]TJ 0.98 0 0 1 53.798 260.601 Tm [(session)-254.996(k)28.997(eys)-256(in)-254.996(In)28.997(ternet)-254.996(proto)-29.008(cols.)-435.002(It)-254.996(is)-254.996(the)-256(main)-255.008(k)29.008(ey)-255.008(exc)29.008(hange)] TJ 1.004 0 0 1 53.798 250.14 Tm [(mec)28.005(hanism)-342.01(in)-341.999(SSH)-341.999(and)-341.999(IPsec)-341.999(a)1.004(nd)-343.003(a)-340.995(p)-29.008(opular)-341.999(option)-341.999(in)-341.999(TLS.)]TJ 1.011 0 0 1 53.328 239.679 Tm [(W)84.995(e)-337.995(e)1.004(x)-1.004(amine)-337.003(ho)28.997(w)-337.995(Di\036e-Hellman)-337.003(is)-337.003(commonly)-336.991(implemen)27.993(ted)]TJ 0.982 0 0 1 53.798 229.219 Tm [(and)-347.999(deplo)28.997(y)28.997(ed)-346.995(with)-347.999(these)-347.999(proto)-28.997(cols)-347.999(and)-348.01(\034nd)-346.995(that,)-347.999(in)-347.999(practice,)]TJ 1 0 0 1 53.798 218.758 Tm [(it)-343.003(frequen)28.997(tly)-342.992(o\033ers)-341.999(less)-343.003(securit)28.997(y)-343.003(than)-341.999(widely)-342.992(b)-28.005(eliev)28.005(ed.)]TJ 0.985 0 0 1 62.765 208.297 Tm [(There)-349.003(are)-347.999(t)28.997(w)29.008(o)-349.003(reasons)-349.003(for)-349.003(this.)-465.995(First,)-349.003(a)-348.992(surprising)-349.003(n)28.997(um)28.997(b)-28.997(er)]TJ 1.017 0 0 1 53.798 197.836 Tm [(of)-337.003(serv)28.005(ers)-337.003(use)-337.003(w)28.997(eak)-336.991(Di\036e-Hellman)-337.003(parameters)-337.003(or)-337.003(main)28.005(tain)]TJ 1.02 0 0 1 53.798 187.375 Tm [(supp)-28.005(ort)-378.993(for)-379.004(obsolete)-378(1990s-era)-379.004(exp)-27.993(ort-grade)-379.004(crypto.)-575.995(More)]TJ 1 0 0 1 53.798 176.915 Tm [(critically)85.999(,)-343.995(the)-344.007(common)-343.995(practice)-343.003(of)-343.995(using)-344.007(standardized,)-343.995(hard-)]TJ /T1_5 6.974 Tf 0 -32.686 TD [(Permission)-328(to)-329(mak)10(e)-328(digital)-329(or)-328(hard)-329.003(copies)-327.999(of)-327.999(part)-329.003(or)-327.999(all)-329.003(of)-327.999(this)-328.988(w)9.995(ork)-328(for)-329(personal)-328(or)]TJ 0 -8.966 TD [(classroom)-277(use)-277(is)-277.998(granted)-277.008(without)-276.994(fee)-277.008(pro)15.013(vided)-278.012(that)-276.994(copies)-277(are)-277.008(not)-277.998(made)-276.994(or)-277.008(distrib)20.003(uted)]TJ 0 -8.967 TD [(for)-316(pro\002t)-316.999(or)-315.997(commercial)-316.011(adv)25.008(antage)-316.999(and)-315.997(that)-317.001(copies)-315.997(bear)-316.011(this)-317.001(notice)-315.997(and)-315.997(the)-316.999(full)-315.997(cita-)]TJ 0 -8.966 TD [(tion)-355(on)-356(the)-355(\002rst)-356(page.)-626(Cop)10(yrights)-355(for)-356(third-party)-355(components)-355(of)-356.004(this)-355(w)10.009(ork)-356.004(must)-355(be)]TJ T* [(honored.)-556(F)15(or)-332(all)-333.003(ot)1.004(her)-333.003(uses,)-352.003(contact)-332(the)-332(Owner/Author\(s\).)-556.999(Cop)10.009(yright)-332(is)-332(held)-332(by)-332(the)] TJ 0 -8.967 TD [(o)25.001(wner/author\(s\).)]TJ /T1_6 6.974 Tf 0 -8.966 TD (CCS'15,)Tj /T1_5 6.974 Tf 25.573 0 Td [(October)-250(12\22616,)-250(2015,)-250(Den)40(v)15(er)40(,)-250(Colorado,)-250(USA.)]TJ -25.573 -8.966 Td [(A)40(CM)-250(978-1-4503-3832-5/15/10.)]TJ 0 -8.967 TD [(DOI:)-250(http://dx.doi.or)18(g/10.1145/2810103.2813707.)]TJ /T1_4 8.966 Tf 1.013 0 0 1 316.812 566.271 Tm [(co)-28.005(ded,)-336.991(or)-337.003(widely)-335.999(shared)-337.003(Di\036e-Hellman)-337.003(parameters)-335.999(has)-337.003(the)]TJ 0.98 0 0 1 316.812 555.81 Tm [(e\033ect)-319.002(of)-317.998(dramatically)-319.002(reducing)-319.002(the)-318.991(cost)-318.009(of)-318.991(large-scale)-319.002(attac)30.001(k)-1.004(s,)]TJ 1 0 0 1 316.812 545.349 Tm [(bringing)-343.003(some)-341.999(within)-343.003(range)-341.999(of)-342.992(feasibilit)28.997(y)-343.003(to)-28.005(da)28.005(y)85.999(.)]TJ 1.02 0 0 1 325.778 534.888 Tm [(The)-358.003(curren)28.005(t)-359.007(b)-27.993(est)-358.003(tec)28.005(hnique)-359.007(for)-357.992(attac)27.993(king)-358.996(Di\036e-He)1.004(llm)-1.004(a)1.004(n)]TJ -8.79 -10.46 Td [(relies)-355.003(on)-354.992(compromising)-355.003(one)-355.003(of)-355.003(the)-354.992(priv)55.998(ate)-355.003(exp)-28.005(onen)28.005(ts)-355.003(\()]TJ /T1_7 8.966 Tf 1 0 0 1 538.606 524.428 Tm (a)Tj /T1_4 8.966 Tf 1.02 0 0 1 543.488 524.428 Tm (,)Tj /T1_7 8.966 Tf 1 0 0 1 549.389 524.428 Tm (b)Tj /T1_4 8.966 Tf 1.02 0 0 1 553.338 524.428 Tm (\))Tj -231.888 -10.461 Td [(b)28.005(y)-361.003(computing)-360(the)-361.003(discret)1.004(e)-361.003(log)-360(of)-361.003(the)-360.992(co)0.993(rresp)-27.993(onding)-361.003(public)]TJ -0.235 -10.461 Td [(v)55.998(alue)-376.004(\()]TJ /T1_7 8.966 Tf 1 0 0 1 344.833 503.506 Tm (g)Tj /T1_8 5.978 Tf 4.716 3.809 Td (a)Tj /T1_9 8.966 Tf 7.092 -3.809 Td [(mo)-29(d)]TJ /T1_7 8.966 Tf 20.223 0 Td (p)Tj /T1_4 8.966 Tf 1.02 0 0 1 381.49 503.506 Tm (,)Tj /T1_7 8.966 Tf 1 0 0 1 387.636 503.506 Tm (g)Tj /T1_8 5.978 Tf 4.716 3.809 Td (b)Tj /T1_9 8.966 Tf 6.332 -3.809 Td [(mo)-29(d)]TJ /T1_7 8.966 Tf 20.222 0 Td (p)Tj /T1_4 8.966 Tf 1.02 0 0 1 423.532 503.506 Tm [(\).)-569.002(With)-376.996(state-of-the-a)0.993(rt)-376.996(n)28.005(um)27.993(b)-27.993(er)]TJ 0.98 0 0 1 316.812 493.045 Tm [(\034eld)-302.998(siev)28.997(e)-302.998(algo)0.993(rithms)-0.993(,)-311.998(computing)-303.009(a)-301.994(single)-302.998(discrete)-302.998(log)-303.009(is)-302.998(more)]TJ 1.02 0 0 1 316.812 482.585 Tm [(di\036cult)-391.004(than)-391.997(factoring)-391.004(an)-391.997(RSA)-391.004(mo)-27.993(dulus)-391.004(of)-391.997(the)-391.004(same)-391.997(size.)] TJ 0.98 0 0 1 316.812 472.124 Tm [(Ho)28.997(w)28.997(ev)29.008(er)0.993(,)-317.998(an)-308.998(adv)28.997(ersary)-310.002(who)-308.998(p)-28.997(erforms)-308.998(a)-310.002(large)-308.998(precomputation)]TJ 0 -10.461 TD [(for)-251.004(a)-250(prime)]TJ /T1_7 8.966 Tf 1 0 0 1 361.34 461.663 Tm (p)Tj /T1_4 8.966 Tf 0.98 0 0 1 368.167 461.663 Tm [(can)-250(then)-251.004(quic)29.008(kly)-250(calculate)-251.004(arbitrary)-250(discrete)-251.004(logs)]TJ -52.403 -10.461 Td [(in)-334.002(that)-334.002(group,)-336.991(amortizing)-334.002(the)-334.002(cost)-334.002(o)29.008(v)28.997(er)-334.002(all)-334.002(targets)-333.991(t)0.993(h)-1.004(a)1.004(t)-334.002(share)]TJ 1.02 0 0 1 316.812 440.742 Tm [(this)-433.005(paramet)1.004(er.)-738(Although)-432.994(this)-432.002(fact)-433.005(is)-432.002(w)28.005(ell)-433.005(kno)28.005(wn)-432.994(among)]TJ T* [(mathematical)-447.002(cryptographers,)-474.003(it)-446.991(seems)-447.002(to)-447.002(ha)28.005(v)27.993(e)-447.002(b)-27.993(een)-447.002(lost)]TJ 0.992 0 0 1 316.812 419.82 Tm [(among)-344.999(practitioners)-344.007(deplo)28.005(ying)-343.995(cryptosystems.)-460.999(W)86.991(e)-344.999(exploit)-344.999(it)]TJ 1 0 0 1 316.812 409.359 Tm [(to)-343.003(obt)1.004(ain)-343.003(the)-343.003(follo)29.008(wing)-343.003(results:)]TJ /T1_10 8.966 Tf 1.02 0 0 1 316.121 393.706 Tm [(A)28.005(ctiv)27.993(e)-430.998(attac)28.005(ks)-431.009(on)-431.991(exp)-28.005(ort)-430.998(ciphers)-430.998(in)-431.009(TLS.)]TJ /T1_4 8.966 Tf 180.5 0 Td [(W)84.003(e)-430.998(in)27.993(tro)-27.993(duce)]TJ 0.98 0 0 1 316.812 383.245 Tm [(Log)-28.997(jam,)-331.002(a)-326.999(new)-326.999(at)0.993(tac)29.008(k)-327.01(on)-326.999(TLS)-325.995(b)28.997(y)-326.999(whic)30.001(h)-326.999(a)-326.999(man-in-the-middle)]TJ 1.008 0 0 1 316.812 372.784 Tm [(attac)28.005(k)28.997(er)-338.999(can)-338.999(do)27.993(wngrade)-338.999(a)-338.999(connection)-338.999(to)-338.999(exp)-28.005(ort-grade)-338.999(cryp-)]TJ 0.98 0 0 1 316.812 362.323 Tm [(tograph)28.997(y)88.006(.)-439.006(This)-265.993(attac)28.997(k)-266.004(is)-266.997(reminiscen)30.001(t)-267.008(of)-265.993(the)-266.004(FREAK)-266.997(attac)30.001(k)-266.997([7])]TJ 0 -10.46 TD [(but)-325.002(applies)-325.002(to)-325.995(the)-325.002(ephemeral)-325.002(Di\036e-Hellman)-325.002(ciphersuites)-324.991(and)]TJ 0 -10.461 TD [(is)-299.005(a)-298.994(TLS)-298.001(proto)-28.997(col)-299.005(\035a)28.997(w)-298.994(rather)-299.005(than)-297.99(an)-299.005(implemen)28.997(tation)-298.994(vulner-)]TJ T* [(abilit)28.997(y)88.006(.)-460.006(W)87.003(e)-329.999(presen)28.997(t)-329.999(measuremen)28.997(ts)-329.999(that)-329.999(sho)28.997(w)-329.999(that)-329.999(this)-331.002(a)1.004(ttac)28.997(k)] TJ T* [(applies)-346.995(to)-347.007(8.4%)-346.995(of)-347.999(Alexa)-347.007(T)88.006(op)-347.007(Million)-347.999(HTT)1.004(PS)-347.999(sites)-347.007(and)-346.995(3.4%)]TJ 0.999 0 0 1 316.812 310.02 Tm [(of)-341.999(all)-343.003(H)1.004(TTPS)-343.003(serv)28.997(ers)-341.999(that)-343.003(ha)29.008(v)28.997(e)-343.003(bro)28.997(wser-trusted)-341.999(certi\034cates.)]TJ 1.015 0 0 1 325.778 299.559 Tm [(T)84.003(o)-335.999(exploit)-335.999(this)-337.003(att)0.993(ac)28.005(k,)-337.003(w)28.005(e)-335.999(implemen)27.993(ted)-335.999(the)-335.999(n)28.005(um)27.993(b)-27.993(er)-337.003(\034eld)]TJ 0.99 0 0 1 316.812 289.098 Tm [(siev)28.997(e)-344.999(discrete)-344.999(log)-344.999(algorithm)-344.999(and)-346.003(c)1.004(arried)-346.003(out)-344.999(precomputat)1.004(ion)]TJ 1.02 0 0 1 316.812 278.637 Tm [(for)-418.998(t)27.993(w)28.005(o)-420.001(512-bit)-418.998(Di\036e-Hellman)-418.998(groups)-419.009(used)-419.99(b)27.993(y)-418.998(more)-418.998(than)]TJ T* [(92%)-376.004(of)-376.996(the)-376.004(vulnerable)-375.993(serv)27.993(ers.)-569.002(This)-376.996(a)1.004(llo)27.993(ws)-376.996(us)-376.004(to)-375.993(compute)]TJ 0.98 0 0 1 316.812 257.716 Tm [(individual)-287.005(discrete)-286.994(logs)-287.005(in)-286.994(ab)-29.008(out)-286.994(a)-287.005(min)29.008(ute.)-445.006(Using)-287.005(our)-286.994(discrete)]TJ T* [(log)-302.998(oracle,)-313.002(w)30.001(e)-304.002(can)-302.998(compromise)-302.998(connections)-303.009(to)-302.998(o)28.997(v)29.008(er)-302.998(7%)-304.002(of)-303.009(T)88.006(op)]TJ 1.003 0 0 1 316.812 236.794 Tm [(Million)-341.999(HTTPS)-341.006(sites.)-456.995(Disc)1.004(rete)-341.999(logs)-342.01(o)29.008(v)27.993(er)-341.999(larger)-341.999(groups)-340.995(ha)27.993(v)29.008(e)]TJ 1.015 0 0 1 316.812 226.333 Tm [(b)-28.005(een)-337.995(computed)-338.006(b)-27.993(efore)-338.006([8],)-337.995(but,)-337.995(as)-338.006(far)-337.995(as)-338.006(w)29.008(e)-338.006(are)-337.995(a)27.993(w)28.005(are,)-338.006(this)]TJ 0.982 0 0 1 316.812 215.873 Tm [(is)-349.003(the)-349.003(\034rst)-348.992(time)-349.003(they)-349.003(ha)29.008(v)28.997(e)-349.003(b)-28.997(een)-349.003(exploited)-349.003(to)-348.992(exp)-29.008(ose)-348.992(concrete)]TJ 1 0 0 1 316.572 205.412 Tm [(vulnerabilities)-343.003(in)-341.999(real-w)28.005(orld)-341.999(systems.)]TJ 0.982 0 0 1 325.778 194.951 Tm [(W)87.003(e)-349.003(w)28.997(e)1.004(re)-349.003(also)-349.003(able)-348.992(to)-349.003(compromise)-347.999(Di\036e-Hellman)-349.003(for)-349.003(man)29.008(y)]TJ 0.98 0 0 1 316.812 184.49 Tm [ (other)-278.005(serv)30.001(ers)-277.993(b)-29.008(ecause)-277.993(of)-277.001(design)-278.005(and)-277.993(implemen)28.997(tation)-277.001(\035a)28.997(ws)-277.993(and)]TJ 0 -10.46 TD [(con\034guration)-301.002(mistak)28.997(es.)-449.991(These)-301.002(include)-301.002(use)-301.002(of)-302.005(comp)-28.997(osite-order)]TJ 1.02 0 0 1 316.812 163.569 Tm [(subgroups)-411.001(in)-412.005(com)28.005(bination)-411.001(with)-411.001(short)-411.001(exp)-27.993(onen)27.993(ts,)-429.994(whic)27.993(h)-411.994(is)]TJ 0.98 0 0 1 316.572 153.108 Tm [(vulnerable)-239.003(to)-238.992(a)-240.007(kno)30.001(wn)-239.996(attac)30.001(k)-240.007(of)-238.992(v)57.994(an)-239.003(Oorsc)29.008(hot)-239.003(and)-239.003(Wiener)-238.992([51],)]TJ 0.245 -10.461 Td [(and)-260.997(the)-262(inabilit)28.997(y)-260.997(of)-261.008(clien)29.008(ts)-262(to)-261.008(prop)-28.997(erly)-260.997(v)57.994(alidate)-260.997(Di\036)-1.004(e)1.004(-Hellman)]TJ 0 -10.461 TD [(parameters)-329.006(without)-328.995(kno)28.997(wing)-328.995(the)-328.002(subgroup)-328.995(order,)-333.01(whic)29.008(h)-329.006(TLS)]TJ 1.02 0 0 1 316.812 121.726 Tm [(has)-503(no)-501.996(pro)27.993(vision)-503(to)-503(comm)28.005(unicate.)-948.006(W)84.003(e)-503(implemen)28.005(t)-503(these)]TJ 0.982 0 0 1 316.812 111.265 Tm [(attac)28.997(ks)-347.999(to)-28.997(o)-349.003(and)-347.999(disco)28.997(v)29.008(er)-347.999(sev)28.997(eral)-349.003(vulnerable)-347.999(implemen)28.997(tations.)]TJ /T1_10 8.966 Tf 1.02 0 0 1 316.305 95.611 Tm [(Risks)-369(from)-367.996(common)-369(1024-bit)-368.007(groups.)]TJ /T1_4 8.966 Tf 158.624 0 Td [(W)84.003(e)-369(explore)-368.007(the)-369(im-)]TJ -158.126 -10.46 Td [(plications)-334.995(of)-335.006(precomputation)-334.002(attac)28.005(ks)-335.006(for)-334.995(768-)-334.995(and)-335.006(1024-bit)]TJ 0.98 0 0 1 316.812 74.69 Tm [(groups,)-307.002(whic)28.997(h)-296.998(are)-296.998(widely)-296.005(used)-296.998(in)-296.998(practice)-296.998(and)-296.005(still)-296.998(considered)]TJ ET  q 1.178 0 0 1.178 53.798 624.528 cm /Fm0 Do Q BT /T1_0 8.966 Tf 1.014 0 0 1 53.798 609.235 Tm [(Figure)-337.995(1:)]TJ /T1_1 8.966 Tf 1 0 0 1 94.606 609.235 Tm [(The)-394.997(n)33.001(um)32.99(b)-32.99(er)-394.004(\034eld)-394.997(siev)33.001(e)-394.004(algorithm)-394.997(for)-394.004(discrete)-394.997(log)]TJ /T1_0 8.966 Tf 1.014 0 0 1 325.206 609.235 Tm [(consists)-337.995(of)-338.006(a)-337.995(precomputation)-338.006(stage)-337.995(t)0.993(hat)-337.995(dep)-28.005(ends)-337.995(only)-337.995(on)]TJ 0.986 0 0 1 53.798 598.775 Tm [(the)-346.995(prime)]TJ /T1_2 8.966 Tf 1 0 0 1 95.29 598.775 Tm (p)Tj /T1_0 8.966 Tf 0.986 0 0 1 102.98 598.775 Tm [(and)-346.995(a)-346.003(descen)28.997(t)-346.995(stage)-346.003(that)-347.007(computes)-345.992(individual)-347.007(logs.)-462.995(With)-347.007(su\036cie)1.004(n)28.005(t)-346.003(precomputation,)-346.995(an)-346.003(attac)28.997(k)28.997(er)-346.995(can)-346.995(quic)28.997(kly)-346.003(break)]TJ 1 0 0 1 53.798 588.314 Tm [(an)28.997(y)-343.003(Di\036e-Hellman)-342.992(instances)-341.999(that)-343.003(use)-341.999(a)-343.003(particular)]TJ /T1_2 8.966 Tf 204.097 0 Td (p)Tj /T1_0 8.966 Tf (.)Tj 0.998 0 0 1 53.798 557.28 Tm [(secure.)-456.995(W)85.999(e)-343.003(pro)28.997(vide)-341.999(new)-341.999(estimates)-343.003(for)-341.999(the)-341.999(computational)-341.999(re-)]TJ 0.98 0 0 1 53.798 546.819 Tm [(sources)-326.999(necessary)-326.999(to)-326.999(compute)-327.01(discrete)-326.999(logs)-326.999(in)-326.999(groups)-326.999(of)-326.999(these)]TJ 0 -10.46 TD [(sizes,)-331.995(concluding)-327.01(that)-326.999(768-bit)-328.002(groups)-326.999(are)-327.991(wit)0.993(hin)-328.002(range)-326.999(of)-328.002(aca-)]TJ 1.011 0 0 1 53.798 525.898 Tm [(demic)-340.003(teams,)-338.999(and)-340.003(1024-bit)-338.999(groups)-340.003(ma)28.005(y)-340.003(plausibly)-338.999(b)-27.993(e)-340.003(within)]TJ 0.997 0 0 1 53.798 515.437 Tm [(range)-344.999(o)1.004(f)-344.999(state-lev)28.997(el)-344.999(attac)28.997(k)27.993(e)1.004(rs.)-460.999(In)-344.999(b)-28.997(oth)-344.007(cases,)-344.999(individual)-343.995(logs)]TJ 1 0 0 1 53.798 504.976 Tm [(can)-343.003(b)-27.993(e)-343.003(quic)28.997(kly)-343.003(computed)-341.999(after)-342.992(the)-342.01(initial)-342.992(precomputation.)]TJ 0.988 0 0 1 62.765 494.516 Tm [(W)87.003(e)-346.003(then)-344.999(examine)-344.999(evidence)-344.999(from)-346.003(published)-344.999(Sno)28.997(wden)-344.999(do)-28.997(cu-)]TJ 0.98 0 0 1 53.798 484.055 Tm [(men)28.997(ts)-325.002(that)-325.995(suggests)-325.002(NSA)-325.002(ma)29.008(y)-326.006(already)-325.002(b)-28.997(e)-325.995(exploiting)-325.002(1024-bit)]TJ 0 -10.461 TD [(Di\036e-Hellman)-334.995(to)-336.01(decrypt)-334.995(VPN)-334.995(tra\036c.)-460.999(W)86.991(e)-334.995(p)-30.001(e)0.993(rform)-335.999(measure-)]TJ 1.01 0 0 1 53.798 463.133 Tm [(men)28.005(ts)-338.006(to)-337.003(understand)-337.995(the)-338.006(implications)-337.995(of)-337.003(suc)28.005(h)-338.006(an)-337.995(attac)28.997(k)-337.995(for)]TJ 0.98 0 0 1 53.798 452.672 Tm [(p)-28.997(opular)-238(proto)-29.008(cols,)-259.993(\034nding)-238(that)-238(an)-238(attac)28.997(k)28.997(er)-238(who)-238(could)-238(p)-28.997(erform)]TJ 0.996 0 0 1 53.798 442.212 Tm [(precomputations)-346.003(for)-344.999(ten)-346.003(1024-bit)-344.999(groups)-345.992(could)-346.003(passiv)28.997(ely)-346.003(de-)]TJ 0.98 0 0 1 53.798 431.751 Tm [(crypt)-305.998(tra\036c)-307.002(to)-305.998(ab)-29.008(out)-305.998(66%)-305.998(of)-307.002(IKE)-305.998(VPNs,)-314.998(26%)-305.998(of)-305.998(SSH)-307.002(serv)28.997(ers,)]TJ 1 0 0 1 53.337 421.29 Tm [(16%)-343.003(of)-341.999(SMTP)-343.003(serv)29.008(ers,)-343.003(and)-341.999(24%)-343.003(of)-343.003(p)-27.993(opular)-343.003(HTTPS)-341.999(sites.)]TJ /T1_3 8.966 Tf 1.02 0 0 1 53.236 407.774 Tm [(Mitigations)-338.999(and)-338.999(lessons.)]TJ /T1_0 8.966 Tf 105.276 0 Td [(As)-338.999(a)-338.999(short-term)-340.003(co)1.004(un)27.001(t)0.993(ermeasure)]TJ 1.01 0 0 1 53.798 397.313 Tm [(in)-338.999(resp)-28.005(onse)-338.999(to)-337.995(the)-338.999(Log)-28.005(jam)-338.999(attac)28.005(k,)-339.01(all)-337.995(mainstream)-338.999(bro)28.005(wsers)]TJ 1.02 0 0 1 53.798 386.853 Tm [(are)-427.998(implemen)27.993(ting)-427.998(a)-427.998(more)-427.998(rest)0.993(rictiv)28.005(e)-427.998(p)-28.005(olicy)-427.998(on)-427.998(the)-427.998(size)-428.009(of)]TJ 1.011 0 0 1 53.798 376.392 Tm [(Di\036e-Hellman)-337.003(groups)-335.999(they)-337.003(accept.)-450.995(W)84.995(e)-336.991(further)-336.01(recommend)]TJ 1.02 0 0 1 53.798 365.931 Tm [(that)-471.003(TLS)-471.995(serv)27.993(ers)-470.992(disable)-471.003(exp)-28.005(ort-grade)-471.995(cryptograph)27.993(y)-470.992(and)]TJ T* [(carefully)-456.995(v)27.993(et)-457.999(the)-456.995(Di\036e-Hellman)-457.006(groups)-456.995(they)-457.999(use.)-812.009(In)-456.995(the)]TJ 0.987 0 0 1 53.798 345.01 Tm [(longer)-346.995(term,)-346.003(w)28.997(e)-346.995(adv)28.997(o)-28.997(cate)-346.003(that)-347.007(proto)-28.997(cols)-346.003(migrate)-346.995(to)-346.003(s)-0.993(t)0.993(ronger)]TJ 0.98 0 0 1 53.798 334.549 Tm [(Di\036e-Hellman)-257.997(groups,)-276.008(suc)29.008(h)-258.008(as)-259(t)1.004(hose)-259(base)1.004(d)-259(on)-257.997(elliptic)-258.008(curv)28.997(es.)]TJ /T1_4 11.955 Tf 1 0 0 1 53.798 310.373 Tm [(2.)-1000(DIFFIE-HELLMAN)-250(CR)34.997(YPT)90.003(AN)20(AL)92.002(YSIS)]TJ /T1_0 8.966 Tf 0.98 0 0 1 62.765 297.421 Tm [(Di\036e-Hellman)-302.998(k)28.997(ey)-302.998(exc)28.997(hange)-302.998(w)28.997(as)-302.998(the)-302.998(\034rst)-302.998(published)-303.009(public-)]TJ 1.02 0 0 1 53.798 286.961 Tm [(k)28.005(ey)-489.003(algorithm)-489.003([14].)-905.993(In)-489.003(the)-489.003(simple)-489.003(ca)1.004(se)-489.003(of)-488.992(prime)-489.003(groups,)]TJ -0.334 -10.461 Td [(Alice)-397.997(and)-399.001(Bob)-398.008(agree)-397.997(on)-397.997(a)-399.001(prime)]TJ /T1_2 8.966 Tf 1 0 0 1 190.894 276.5 Tm (p)Tj /T1_0 8.966 Tf 1.02 0 0 1 199.163 276.5 Tm [(and)-397.997(a)-399.001(generat)0.993(or)]TJ /T1_2 8.966 Tf 1 0 0 1 268.628 276.5 Tm (g)Tj /T1_0 8.966 Tf 1.02 0 0 1 276.987 276.5 Tm [(of)-397.997(a)]TJ -218.813 -10.461 Td [(m)28.005(ultiplicativ)27.993(e)-436.998(subgroup)-436.998(mo)-28.005(dulo)]TJ /T1_2 8.966 Tf 1 0 0 1 190.151 266.039 Tm (p)Tj /T1_0 8.966 Tf 1.02 0 0 1 194.777 266.039 Tm [(.)-751.004(Alice)-436.998(se)1.004(nds)]TJ /T1_2 8.966 Tf 1 0 0 1 254.915 266.039 Tm (g)Tj /T1_5 5.978 Tf 4.716 3.809 Td (a)Tj /T1_6 8.966 Tf 7.092 -3.809 Td [(mo)-29(d)]TJ /T1_2 8.966 Tf 20.222 0 Td (p)Tj /T1_0 8.966 Tf 1.02 0 0 1 291.571 266.039 Tm (,)Tj -233.111 -10.461 Td [(Bob)-478.999(sends)]TJ /T1_2 8.966 Tf 1 0 0 1 101.179 255.578 Tm (g)Tj /T1_5 5.978 Tf 4.716 3.809 Td (b)Tj /T1_6 8.966 Tf 6.332 -3.809 Td [(mo)-29(d)]TJ /T1_2 8.966 Tf 20.222 0 Td (p)Tj /T1_0 8.966 Tf 1.02 0 0 1 137.075 255.578 Tm [(,)-515(and)-478.999(eac)28.005(h)-478.007(computes)-478.999(a)-478.999(shared)-478.999(secret)]TJ /T1_2 8.966 Tf 1 0 0 1 53.798 245.117 Tm (g)Tj /T1_5 5.978 Tf 4.716 3.809 Td (ab)Tj /T1_6 8.966 Tf 10.366 -3.809 Td [(mo)-29(d)]TJ /T1_2 8.966 Tf 20.223 0 Td (p)Tj /T1_0 8.966 Tf 1.02 0 0 1 93.729 245.117 Tm [(.)-662.005(While)-406.997(there)-406.997(is)-406.997(also)-407.008(a)-406.997(Di\036e-Hellman)-406.997(exc)27.993(hange)]TJ 0.98 0 0 1 53.798 234.657 Tm [(o)28.997(v)28.997(er)-343.995(elliptic)-343.995(curv)28.997(e)-344.007(groups,)-344.999(w)29.008(e)-344.007(address)-344.999(only)-343.995(the)-344.007(\020mo)-28.997(d)]TJ /T1_2 8.966 Tf 1 0 0 1 264.152 234.657 Tm (p)Tj /T1_0 8.966 Tf 0.98 0 0 1 268.778 234.657 Tm [(\021)-343.995(case.)]TJ 0.997 0 0 1 62.765 224.196 Tm [(The)-344.999(securit)28.997(y)-344.999(of)-344.999(Di\036e-Hellman)-344.999(is)-344.999(not)-344.007(kno)28.005(wn)-344.999(to)-344.999(b)-28.005(e)-344.999(equiv)57.002(a-)]TJ 0.98 0 0 1 53.798 213.735 Tm [(len)28.997(t)-311.998(to)-313.002(t)1.004(he)-313.002(discrete)-311.998(log)-311.998(problem)-313.002(\(except)-311.998(in)-311.998(certain)-313.002(groups)-311.998([13,)]TJ -0.235 -10.461 Td [(33,)-122(34]\),)-337.003(but)-334.995(c)0.993(om)-0.993(put)0.993(ing)-334.995(discre)1.004(te)-334.002(logs)-335.006(remains)-333.991(the)-334.002(b)-28.997(est)-334.002(kno)28.997(wn)]TJ 0.995 0 0 1 53.798 192.814 Tm [(cryptanalytic)-343.003(attac)28.005(k.)-457.999(An)-344.007(attac)29.008(k)28.997(er)-344.007(who)-342.992(can)-344.007(\034nd)-343.003(the)-342.992(discrete)]TJ 1 0 0 1 53.798 182.353 Tm (log)Tj /T1_2 8.966 Tf 14.847 0 Td (x)Tj /T1_0 8.966 Tf 8.296 0 Td (from)Tj /T1_2 8.966 Tf 21.779 0 Td (y)Tj /T1_6 8.966 Tf 7.42 0 Td (=)Tj /T1_2 8.966 Tf 9.727 0 Td (g)Tj /T1_5 5.978 Tf 4.716 3.809 Td (x)Tj /T1_6 8.966 Tf 7.23 -3.809 Td [(mo)-29(d)]TJ /T1_2 8.966 Tf 20.222 0 Td (p)Tj /T1_0 8.966 Tf 7.698 0 Td [(can)-343.001(easily)-342(\034nd)-343.003(the)-341.999(shared)-343.003(secret.)]TJ 1.02 0 0 1 62.765 171.892 Tm [(T)84.003(extb)-28.005(o)-27.993(ok)-381(descriptions)-380.008(of)-381(discrete)-381(log)-381(c)1.004(an)-381(b)-28.005(e)-381(misleading)]TJ 0.98 0 0 1 53.798 161.431 Tm [(ab)-28.997(out)-329.006(the)-328.002(computational)-328.995(trade)1.004(o\033s,)-332.999(for)-329.006(example)-328.002(b)29.008(y)-329.006(balancing)]TJ 1.02 0 0 1 53.798 150.971 Tm [(parameters)-435.002(to)-435.002(minim)-0.993(iz)0.993(e)-435.994(o)27.993(v)28.005(erall)-435.002(time)-435.002(to)-435.002(compute)-435.994(a)]TJ /T1_7 8.966 Tf 211.833 0 Td (single)Tj /T1_0 8.966 Tf 0.982 0 0 1 53.798 140.51 Tm [(discrete)-349.003(log.)-465.003(In)-348.992(fact,)-347.999(as)-349.003(illustrated)-349.003(in)-349.003(Figure)-348.992(1,)-347.999(a)-349.003(single)-349.003(large)]TJ 1.02 0 0 1 53.798 130.049 Tm [(precomputation)-447.995(on)]TJ /T1_2 8.966 Tf 1 0 0 1 136.686 130.049 Tm (p)Tj /T1_0 8.966 Tf 1.02 0 0 1 145.406 130.049 Tm [(can)-447.995(b)-28.005(e)-447.002(used)-447.995(to)-447.002(e\036cien)27.993(tly)-447.995(break)]TJ /T1_7 8.966 Tf 134.244 0 Td [(al)-76.999(l)]TJ /T1_0 8.966 Tf 1 0 0 1 53.798 119.588 Tm [(Di\036e-Hellman)-343.003(exc)28.997(hanges)-342.992(made)-341.999(with)-343.003(that)-341.999(prime.)]TJ /T1_1 8.966 Tf -0.371 -13.516 Td [(The)-304(t)33(ypical)-304.002(case)]TJ /T1_0 8.966 Tf 0.98 0 0 1 138.619 106.072 Tm [(Di\036e-Hellman)-269.004(is)-268.993(t)28.997(ypically)-269.997(implemen)30.001(ted)]TJ 1.02 0 0 1 53.467 95.611 Tm [(with)-356.999(prime)-356.999(\034elds)-358.003(and)-356.999(large)-356.999(group)-356.999(orders.)-512(In)-356.999(this)-356.999(case,)-363(the)]TJ 0.98 0 0 1 53.798 85.151 Tm [(most)-329.999(e\036cien)28.997(t)-329.999(discrete)-329.999(log)-329.999(algo)0.993(rithm)-329.999(is)-329.999(the)-329.999(n)28.997(um)29.008(b)-29.008(er)-329.999(\034eld)-329.999(siev)28.997(e)]TJ 1.02 0 0 1 52.72 74.69 Tm [(\(NFS\))-360([21,)-146.001(24,)-144.997(43].)]TJ /T1_8 5.978 Tf 1 0 0 1 125.646 78.499 Tm (1)Tj /T1_0 8.966 Tf 1.02 0 0 1 134.558 74.69 Tm [(There)-360(is)-360(a)-360(closely)-360(related)-360(n)27.993(um)28.005(b)-28.005(er)-360(\034eld)]TJ 0.98 0 0 1 316.812 557.28 Tm [(siev)28.997(e)-250.993(algorithm)-252.007(for)-250.993(factoring)-251.004([12,)-48.001(31],)-271.001(and)-251.004(in)-251.996(fact)-251.004(man)29.008(y)-251.004(parts)-251.996(of)]TJ T* [(the)-311.006(implemen)29.008(tations)-311.998(can)-311.006(b)-28.997(e)-311.998(share)0.993(d.)-453.995(The)-311.006(general)-311.998(tec)30.001(hnique)-311.998(is)]TJ 0 -10.46 TD [(called)-242.003(index)-241.992(calculus)-241(and)-242.003(has)-242.003(four)-242.003(stages)-241.992(with)-242.003(di\033)1.004(eren)28.997(t)-242.003(compu-)]TJ 0.983 0 0 1 316.812 525.898 Tm [(tational)-349.003(prop)-28.997(erties.)-465.003(The)-349.003(\034rst)-348.992(three)-349.003(steps)-347.999(are)-349.003(only)-349.003(dep)-28.997(enden)28.997(t)]TJ 1 0 0 1 316.812 515.437 Tm [(on)-343.003(the)-341.999(prime)]TJ /T1_2 8.966 Tf 54.808 0 Td (p)Tj /T1_0 8.966 Tf 7.698 0 Td [(and)-343.001(comprise)-342(most)-343.003(of)-341.999(the)-343.003(computation.)]TJ 0.999 0 0 1 325.778 504.976 Tm [(First)-343.995(is)]TJ /T1_7 8.966 Tf 31.764 0 Td [(p)52.998(ol)-1.004(ynomial)-367.996(sele)52.005(ction)]TJ /T1_0 8.966 Tf 80.46 0 Td [(,)-343.995(in)-344.999(w)0.993(hic)28.005(h)-344.007(one)-343.995(\034nds)-344.007(a)-343.995(p)-28.997(olyno-)]TJ 0.98 0 0 1 316.812 494.516 Tm (mial)Tj /T1_2 8.966 Tf 1 0 0 1 336.479 494.516 Tm (f)Tj /T1_6 8.966 Tf 0.98 0 0 1 341.927 494.516 Tm (\()Tj /T1_2 8.966 Tf 1 0 0 1 345.439 494.516 Tm (z)Tj /T1_6 8.966 Tf 0.98 0 0 1 350.112 494.516 Tm (\))Tj /T1_0 8.966 Tf 6.245 0 Td [(de\034ning)-296.998(a)-296.998(n)28.997(um)30.001(b)-30.001(er)-296.005(\034eld)]TJ /T1_9 8.966 Tf 1 0 0 1 448.724 494.516 Tm (Q)Tj /T1_6 8.966 Tf 0.98 0 0 1 455.698 494.516 Tm (\()Tj /T1_2 8.966 Tf 1 0 0 1 459.21 494.516 Tm (z)Tj /T1_6 8.966 Tf 0.98 0 0 1 463.883 494.516 Tm (\))Tj /T1_2 8.966 Tf 1 0 0 1 467.395 494.516 Tm (=f)Tj /T1_6 8.966 Tf 0.98 0 0 1 477.451 494.516 Tm (\()Tj /T1_2 8.966 Tf 1 0 0 1 480.963 494.516 Tm (z)Tj /T1_6 8.966 Tf 0.98 0 0 1 485.636 494.516 Tm (\))Tj /T1_0 8.966 Tf 6.245 0 Td [(for)-296.998(the)-296.998(computa-)]TJ 0.997 0 0 1 316.812 484.055 Tm [(tion.)-459.002(\(F)85.999(or)-343.995(our)-344.007(cases,)]TJ /T1_2 8.966 Tf 1 0 0 1 401.358 484.055 Tm (f)Tj /T1_6 8.966 Tf 0.997 0 0 1 406.806 484.055 Tm (\()Tj /T1_2 8.966 Tf 1 0 0 1 410.379 484.055 Tm (z)Tj /T1_6 8.966 Tf 0.997 0 0 1 415.052 484.055 Tm (\))Tj /T1_0 8.966 Tf 6.667 0 Td [(t)28.997(ypically)-343.995(has)-344.007(degree)-343.995(5)-343.995(or)-343.003(6.\))-459.002(This)]TJ 1 0 0 1 316.812 473.594 Tm [(parallelizes)-341.999(w)27.993(ell)-341.999(and)-342.992(is)-343.003(only)-341.999(a)-343.003(small)-341.999(p)-28.997(ortion)-343.003(of)-341.999(the)-343.003(run)28.997(time.)]TJ 0.984 0 0 1 325.778 463.133 Tm [(In)-347.999(the)-347.999(second)-347.999(stage,)]TJ /T1_7 8.966 Tf 83.504 0 Td (sieving)Tj /T1_0 8.966 Tf [(,)-347.999(one)-347.999(factors)-348.01(ranges)-347.999(of)-347.999(in)29.008(tegers)]TJ 0.98 0 0 1 316.812 452.672 Tm [(and)-245.996(n)28.997(um)28.997(b)-28.997(er)-247(\034eld)-245.996(elemen)28.997(ts)-247(in)-246.007(batc)29.008(hes)-246.007(to)-247(\034nd)-245.996(man)28.997(y)-247(relations)-245.996(of)]TJ T* [(elemen)28.997(ts,)-295.994(all)-283.001(of)-283.001(whose)-283.001(prime)-283.001(factors)-283.001(are)-281.997(less)-283.001(than)-283.001(some)-283.001(b)-28.997(ound)]TJ /T1_2 8.966 Tf 1 0 0 1 316.812 431.751 Tm (B)Tj /T1_0 8.966 Tf 0.98 0 0 1 327.213 431.751 Tm (\(called)Tj /T1_2 8.966 Tf 1 0 0 1 356.288 431.751 Tm (B)Tj /T1_0 8.966 Tf 0.98 0 0 1 363.708 431.751 Tm [(-smo)-28.997(oth\).)-463.006(Mo)-28.997(dern)-338.999(implemen)28.997(tations)-338.999(use)]TJ /T1_7 8.966 Tf 162.45 0 Td [(sp)54.002(e)52.998(cial-)]TJ /T1_2 8.966 Tf 1 0 0 1 551.476 431.751 Tm (q)Tj /T1_0 8.966 Tf 1.02 0 0 1 316.812 421.29 Tm [(lattice)-388.004(sie)1.004(v)-1.004(ing,)-399.993(whic)27.993(h)-387.993(for)-387(eac)27.993(h)-387.993(sp)-28.005(ecial)]TJ /T1_2 8.966 Tf 1 0 0 1 474.905 421.29 Tm (q)Tj /T1_0 8.966 Tf 1.02 0 0 1 482.89 421.29 Tm [(explores)-388.004(a)-387(sieving)]TJ -162.822 -10.461 Td [(region)-388.997(of)]TJ /T1_6 8.966 Tf 38.992 0 Td (2)Tj /T1_10 5.978 Tf 1 0 0 1 361.283 414.638 Tm (2)Tj /T1_5 5.978 Tf (I)Tj /T1_0 8.966 Tf 1.02 0 0 1 372.725 410.829 Tm [(candidates,)-402.001(where)]TJ /T1_2 8.966 Tf 1 0 0 1 450.014 410.829 Tm (I)Tj /T1_0 8.966 Tf 1.02 0 0 1 458.299 410.829 Tm [(is)-388.997(a)-388.004(parameter.)-605.996(Sieving)]TJ 0.98 0 0 1 316.812 400.369 Tm [(parallelizes)-299.005(w)29.008(ell)-299.005(since)-298.994(eac)30.001(h)-299.005(sp)-30.001(e)1.004(cial)]TJ /T1_2 8.966 Tf 1 0 0 1 451.302 400.369 Tm (q)Tj /T1_0 8.966 Tf 0.98 0 0 1 458.368 400.369 Tm [(is)-299.005(handled)-298.994(indep)-28.997(enden)28.997(tly)]TJ 0.997 0 0 1 316.812 389.908 Tm [(of)-341.999(the)-341.999(others,)-341.999(but)-341.999(is)-343.003(co)1.004(m)-1.004(puta)1.004(tionally)-343.003(exp)-28.005(ensiv)28.005(e,)-341.999(b)-29.008(eca)1.004(use)-343.003(w)29.008(e)]TJ 1.01 0 0 1 316.812 379.447 Tm [(m)28.005(ust)-338.006(searc)28.005(h)-338.006(through)-337.995(and)-338.006(attempt)-337.995(to)-338.999(factor)-338.006(man)28.005(y)-337.995(elemen)27.993(t)1.004(s.)]TJ 1.02 0 0 1 316.48 368.986 Tm [(The)-459.002(time)-457.999(for)-459.002(this)-457.999(step)-459.002(dep)-27.993(ends)-457.999(on)-459.002(heuristic)-457.999(estimates)-459.002(of)]TJ 0.325 -10.46 Td [(the)-352.003(probabilit)28.005(y)-353.007(of)-351.992(encoun)27.993(tering)]TJ /T1_2 8.966 Tf 1 0 0 1 447.783 358.526 Tm (B)Tj /T1_0 8.966 Tf 1.02 0 0 1 455.203 358.526 Tm [(-smo)-28.005(oth)-351.992(n)27.993(um)28.005(b)-28.005(ers)-352.996(in)-352.003(this)]TJ 0.998 0 0 1 316.812 348.065 Tm [(searc)28.997(h;)-343.003(it)-342.992(also)-341.999(dep)-29.008(ends)-341.999(on)]TJ /T1_2 8.966 Tf 1 0 0 1 423.273 348.065 Tm (I)Tj /T1_0 8.966 Tf 0.998 0 0 1 431.069 348.065 Tm [(and)-343.003(on)-341.999(the)-343.003(n)29.008(um)28.997(b)-28.997(er)-341.999(of)-343.003(sp)-28.997(ecial)]TJ /T1_2 8.966 Tf 1 0 0 1 551.476 348.065 Tm (q)Tj /T1_0 8.966 Tf -234.664 -10.461 Td [(to)-343.001(conside)1(r)-343.001(b)-28.997(efore)-341.999(ha)27.993(ving)-341.999(enough)-343.003(relations.)]TJ 1.02 0 0 1 325.778 327.143 Tm [(In)-424.005(the)-424.998(third)-423.994(stage,)]TJ /T1_7 8.966 Tf 79.752 0 Td [(line)51.002(ar)-441.002(algebr)51.002(a)]TJ /T1_0 8.966 Tf 54.552 0 Td [(,)-447.002(w)28.005(e)-424.005(construct)-423.994(a)-425.009(large,)]TJ -143.094 -10.461 Td [(sparse)-340.003(matrix)-340.003(consisting)-339.992(of)-341.006(the)-340.003(co)-27.993(e\036cien)27.993(t)-339.992(v)27.993(ectors)-339.992(of)-340.003(prime)]TJ 0.98 0 0 1 316.812 306.222 Tm [(factorizations)-343.995(w)28.997(e)-343.003(ha)28.997(v)29.008(e)-344.007(found.)-463.999(A)-343.995(nonzero)-344.007(k)28.997(ernel)-342.992(v)28.997(ector)-343.995(of)-344.007(the)]TJ 1.01 0 0 1 316.812 295.761 Tm [(matrix)-340.003(mo)-27.993(dulo)-340.003(the)-340.003(order)]TJ /T1_2 8.966 Tf 1 0 0 1 420.715 295.761 Tm (q)Tj /T1_0 8.966 Tf 1.01 0 0 1 428.232 295.761 Tm [(of)-340.003(the)-340.003(group)-339.992(will)-338.999(giv)27.993(e)-340.003(us)-339.992(logs)-340.003(of)]TJ 1.004 0 0 1 316.812 285.3 Tm [(man)28.005(y)-341.006(small)-340.995(elemen)28.997(ts.)-454.999(This)-341.006(database)-341.999(of)-340.995(logs)-341.006(serv)29.008(es)-341.999(as)-341.006(input)]TJ 0.98 0 0 1 316.812 274.839 Tm [(to)-292.001(the)-290.997(\034nal)-292.001(stage.)-447.002(The)-290.997(di\036cult)28.997(y)-292.001(dep)-28.997(ends)-292.001(on)]TJ /T1_2 8.966 Tf 1 0 0 1 490.569 274.839 Tm (q)Tj /T1_0 8.966 Tf 0.98 0 0 1 497.571 274.839 Tm [(and)-292.001(the)-290.997(matrix)]TJ 1 0 0 1 316.812 264.379 Tm [(size)-343.003(and)-341.999(can)-343.003(b)-27.993(e)-343.003(parallelized)-341.999(in)-343.003(a)-341.999(limited)-343.003(fashion.)]TJ 0.995 0 0 1 325.778 253.918 Tm [(The)-344.999(\034nal)-344.999(stage,)]TJ /T1_7 8.966 Tf 65.663 0 Td [(desc)52.998(ent)]TJ /T1_0 8.966 Tf [(,)-344.999(actually)-345.992(deduces)-345.01(the)-344.999(discrete)-344.999(log)]TJ 0.98 0 0 1 316.812 243.457 Tm [(of)-275.004(the)-274.001(target)]TJ /T1_2 8.966 Tf 1 0 0 1 367.479 243.457 Tm (y)Tj /T1_0 8.966 Tf 0.98 0 0 1 372.339 243.457 Tm [(.)-441.002(W)87.003(e)-274.001(re-siev)28.997(e)-274.993(un)28.997(til)-274.001(w)28.997(e)-274.993(can)-275.004(\034nd)-274.001(a)-275.004(set)-274.993(of)-274.001(relations)]TJ -56.66 -10.461 Td [(that)-338.999(allo)30.001(w)-338.999(us)-338.999(to)-338.006(write)-338.999(the)-338.999(log)-337.995(of)]TJ /T1_2 8.966 Tf 1 0 0 1 445.552 232.996 Tm (y)Tj /T1_0 8.966 Tf 0.98 0 0 1 453.388 232.996 Tm [(in)-338.999(terms)-338.006(of)-338.999(the)-338.999(logs)-337.995(in)-338.999(the)]TJ 1.02 0 0 1 316.812 222.535 Tm [(precomputed)-335.999(database.)-450.002(This)-337.003(step)-335.999(is)-337.003(accomplished)-335.999(in)-336.991(three)]TJ 0.98 0 0 1 316.812 212.075 Tm [(phases:)-427.998(an)-273.008(initialization)-272.997(phase)1.004(,)-289.001(whic)28.997(h)-272.997(trie)1.004(s)-273.008(to)-272.997(write)-272.997(the)-272.997(target)]TJ 1.009 0 0 1 316.812 201.614 Tm [(in)-337.995(terms)-339.01(of)-337.995(medium-sized)-337.995(primes,)-339.01(a)-337.995(middle)-338.999(phase)1.004(,)-339.01(in)-337.995(whic)28.005(h)]TJ 0.99 0 0 1 316.812 191.153 Tm [(these)-346.995(medium-sized)-347.007(primes)-346.995(are)-347.007(further)-346.995(siev)28.997(ed)-346.995(un)27.993(til)-346.995(they)-346.995(can)]TJ 1.02 0 0 1 316.812 180.692 Tm [(b)-28.005(e)-353.999(represen)28.005(t)1.004(ed)-353.999(b)27.993(y)-353.999(elemen)28.005(ts)-353.007(in)-353.999(the)-353.999(database)-352.996(of)-353.999(kno)27.993(wn)-353.999(logs,)]TJ 0.983 0 0 1 316.812 170.232 Tm [(and)-349.003(a)-349.996(\034nal)-349.003(phase)-349.003(that)-348.992(actually)-350.007(rec)1.004(onstructs)-350.007(the)-348.992(target)-349.003(using)]TJ 1.02 0 0 1 316.812 159.771 Tm [(the)-346.995(log)-347.007(database.)-480.996(Crucially)84.003(,)-350.007(descen)28.005(t)-347.007(is)-346.995(the)-347.007(only)-346.995(NFS)-346.995(stage)]TJ 1.005 0 0 1 316.812 149.31 Tm [(that)-340.003(in)28.005(v)28.997(olv)28.005(es)]TJ /T1_2 8.966 Tf 1 0 0 1 371.624 149.31 Tm (y)Tj /T1_0 8.966 Tf 1.005 0 0 1 379.549 149.31 Tm (\(or)Tj /T1_2 8.966 Tf 1 0 0 1 394.468 149.31 Tm (g)Tj /T1_0 8.966 Tf 1.005 0 0 1 399.184 149.31 Tm [(\),)-340.003(so)-340.003(p)-28.997(olynomial)-340.003(selection,)-339.992(sieving,)-340.003(and)]TJ 0.991 0 0 1 316.812 138.849 Tm [(linear)-346.003(algebra)-346.995(can)-346.003(b)-28.997(e)-346.003(done)-346.003(once)-346.995(for)-346.003(a)-346.003(prime)]TJ /T1_2 8.966 Tf 1 0 0 1 493.779 138.849 Tm (p)Tj /T1_0 8.966 Tf 0.991 0 0 1 501.483 138.849 Tm [(and)-346.003(reused)-346.995(to)]TJ 1 0 0 1 316.812 128.389 Tm [(compute)-343.003(t)1.004(he)-343.003(discrete)-343.003(lo)1.004(gs)-343.003(of)-342.992(man)28.997(y)-343.003(targets.)]TJ ET 0.398 w  q 1 0 0 1 316.812 111.973 cm 0 0 m 119.552 0 l S Q BT /T1_8 5.978 Tf 317.269 105.398 Td (1)Tj /T1_0 8.966 Tf 1.02 0 0 1 321.42 101.589 Tm [(Recen)28.005(t)-530.001(sp)-28.005(ectacular)-530.001(adv)55.998(ances)-530.001(in)-530.993(discrete)-530.001(log)-530.001(algorithms)]TJ -4.518 -8.966 Td [(ha)28.005(v)27.993(e)-495.996(resulted)-497(in)-496.007(a)-497(quasi-p)-27.993(olynomial)-496.007(algorithm)-497(for)-495.996(small-)]TJ 0.98 0 0 1 316.812 83.656 Tm [(c)28.997(haracteristic)-341.999(\034elds)-343.003([3],)-343.995(but)-343.003(these)-341.999(adv)58.005(ances)-343.003(are)-341.999(not)-343.003(kno)28.997(wn)-341.999(to)]TJ 1 0 0 1 316.812 74.69 Tm [(apply)-343.003(to)-341.999(the)-343.003(prime)-341.999(\034elds)-342.992(used)-342.01(in)-342.992(practice.)]TJ -14.259 -29.888 Td (2)Tj ET BT /T1_0 8.966 Tf 0.98 0 0 1 62.765 728.239 Tm [(The)-301.002(running)-301.994(time)-301.002(of)-302.005(t)1.004(his)-302.005(algorithm)-301.002(is)]TJ /T1_1 8.966 Tf 1 0 0 1 211.149 728.239 Tm (L)Tj /T1_2 5.978 Tf 6.27 -0.996 Td (p)Tj /T1_3 8.966 Tf 0.98 0 0 1 221.758 728.239 Tm (\(1)Tj /T1_1 8.966 Tf 1 0 0 1 229.785 728.239 Tm (=)Tj /T1_3 8.966 Tf 0.98 0 0 1 234.393 728.239 Tm (3)Tj /T1_1 8.966 Tf 1 0 0 1 238.909 728.239 Tm (;)Tj /T1_3 8.966 Tf 0.98 0 0 1 243.004 728.239 Tm (\(64)Tj /T1_1 8.966 Tf 1 0 0 1 255.547 728.239 Tm (=)Tj /T1_3 8.966 Tf 0.98 0 0 1 260.155 728.239 Tm (9\))Tj /T1_4 5.978 Tf 1 0 0 1 268.183 732.048 Tm (1)Tj /T1_2 5.978 Tf (=)Tj /T1_4 5.978 Tf (3)Tj /T1_3 8.966 Tf 0.98 0 0 1 279.806 728.239 Tm [(\))-290.997(=)]TJ 1 0 0 1 53.798 716.709 Tm (exp)Tj /T1_5 9.963 Tf 15.619 7.821 Td (\000)Tj /T1_3 8.966 Tf 4.566 -7.821 Td (\(1)Tj /T1_1 8.966 Tf (:)Tj /T1_3 8.966 Tf [(923)-228.007(+)]TJ /T1_1 8.966 Tf 35.838 0 Td (o)Tj /T1_3 8.966 Tf (\(1\)\)\(log)Tj /T1_1 8.966 Tf 36.83 0 Td (p)Tj /T1_3 8.966 Tf (\))Tj /T1_4 5.978 Tf 8.209 3.809 Td (1)Tj /T1_2 5.978 Tf (=)Tj /T1_4 5.978 Tf (3)Tj /T1_3 8.966 Tf 11.623 -3.809 Td [(\(log)-184(log)]TJ /T1_1 8.966 Tf 30.437 0 Td (p)Tj /T1_3 8.966 Tf (\))Tj /T1_4 5.978 Tf 8.21 3.809 Td (2)Tj /T1_2 5.978 Tf (=)Tj /T1_4 5.978 Tf (3)Tj /T1_5 9.963 Tf 11.623 4.012 Td (\001)Tj /T1_0 8.966 Tf 0.997 0 0 1 221.319 716.709 Tm [(.)-457.999(This)-343.003(is)-343.003(obtained)]TJ 1.014 0 0 1 53.798 706.248 Tm [(b)28.005(y)-338.006(tuning)-337.995(man)27.993(y)-337.995(parameters,)-338.006(including)-337.995(the)-338.999(degre)1.004(e)-339.01(of)]TJ /T1_1 8.966 Tf 1 0 0 1 268.801 706.248 Tm (f)Tj /T1_0 8.966 Tf 1.014 0 0 1 274.249 706.248 Tm [(,)-337.995(the)]TJ 1.02 0 0 1 53.798 695.787 Tm [(sieving)-533.001(region)-531.997(parameter)]TJ /T1_1 8.966 Tf 1 0 0 1 163.324 695.787 Tm (I)Tj /T1_0 8.966 Tf 1.02 0 0 1 168.054 695.787 Tm [(,)-581.995(and,)-582.006(most)-531.997(imp)-28.005(ortan)28.005(tly)84.003(,)-582.006(the)]TJ 1.004 0 0 1 53.798 685.327 Tm [(smo)-28.005(othness)-341.999(b)-28.997(ound)]TJ /T1_1 8.966 Tf 1 0 0 1 131.557 685.327 Tm (B)Tj /T1_0 8.966 Tf 1.004 0 0 1 138.977 685.327 Tm [(.)-456.995(Early)-342.01(articles)-340.995(\(e.g.)-341.999([21]\))-341.999(encoun)27.993(te)1.004(red)]TJ 0.98 0 0 1 53.798 674.866 Tm [(tec)28.997(hnical)-326.999(di\036culties)-326.999(with)-326.999(desce)0.993(n)29.008(t)-326.999(and)-327.01(rep)-28.997(orted)-326.999(that)-326.999(the)-326.999(com-)]TJ 0.992 0 0 1 53.798 664.405 Tm [(plexit)28.997(y)-346.003(of)-345.992(this)-347.007(st)1.004(ep)-346.995(w)28.997(ould)-346.003(equal)-346.003(that)-345.992(of)-346.003(the)-346.003(precomputation;)]TJ 0.98 0 0 1 53.798 653.944 Tm [(this)-239.996(m)-1.004(a)30.001(y)-241(ha)28.997(v)28.997(e)-239.996(con)28.997(tributed)-239.996(to)-241(misconceptions)-239.996(ab)-29.008(out)-241(the)-239.996(p)-28.997(erfor-)]TJ 0 -10.46 TD [(mance)-248.004(of)-248.996(the)-248.004(NFS)-247.993(f)-1.004(o)1.004(r)-249.007(discrete)-247.993(logs.)-433.005(More)-248.004(recen)29.008(t)-248.004(analyses)-248.004(ha)29.008(v)28.997(e)]TJ 1.02 0 0 1 53.798 633.023 Tm [(impro)28.005(v)27.993(ed)-376.996(the)-377.007(complexit)28.005(y)-376.996(of)-377.007(descen)28.005(t)-376.996(to)]TJ /T1_1 8.966 Tf 1 0 0 1 216.118 633.023 Tm (L)Tj /T1_2 5.978 Tf 6.271 -0.996 Td (p)Tj /T1_3 8.966 Tf 1.02 0 0 1 226.728 633.023 Tm (\(1)Tj /T1_1 8.966 Tf 1 0 0 1 235.083 633.023 Tm (=)Tj /T1_3 8.966 Tf 1.02 0 0 1 239.691 633.023 Tm (3)Tj /T1_1 8.966 Tf 1 0 0 1 244.391 633.023 Tm (;)Tj /T1_3 8.966 Tf 1.02 0 0 1 248.486 633.023 Tm (1)Tj /T1_1 8.966 Tf 1 0 0 1 253.186 633.023 Tm (:)Tj /T1_3 8.966 Tf 1.02 0 0 1 255.746 633.023 Tm (442\))Tj /T1_0 8.966 Tf 20.787 0 Td ([10],)Tj 1.004 0 0 1 53.798 622.562 Tm [(and)-341.999(later)-341.999(to)]TJ /T1_1 8.966 Tf 1 0 0 1 104.694 622.562 Tm (L)Tj /T1_2 5.978 Tf 6.27 -0.996 Td (p)Tj /T1_3 8.966 Tf 1.004 0 0 1 115.303 622.562 Tm (\(1)Tj /T1_1 8.966 Tf 1 0 0 1 123.527 622.562 Tm (=)Tj /T1_3 8.966 Tf 1.004 0 0 1 128.135 622.562 Tm (3)Tj /T1_1 8.966 Tf 1 0 0 1 132.761 622.562 Tm (;)Tj /T1_3 8.966 Tf 1.004 0 0 1 136.857 622.562 Tm (1)Tj /T1_1 8.966 Tf 1 0 0 1 141.483 622.562 Tm (:)Tj /T1_3 8.966 Tf 1.004 0 0 1 144.043 622.562 Tm (232\))Tj /T1_0 8.966 Tf 20.473 0 Td [([2],)-341.999(whic)27.993(h)-341.999(is)-341.999(m)29.008(uc)27.993(h)-341.999(c)28.997(heap)-28.997(er)-341.999(than)]TJ 1 0 0 1 53.798 612.101 Tm [(the)-343.003(prec)1.004(om)-1.004(put)1.004(ation)-343.003(in)-343.003(practice)1.004(.)]TJ 1.02 0 0 1 62.765 601.641 Tm [(The)-421.005(n)28.005(um)-1.004(e)1.004(rous)-421.998(parameters)-421.005(of)-421.998(the)-421.998(algorithm)-421.005(allo)28.005(w)-421.998(some)]TJ 0.98 0 0 1 53.798 591.18 Tm [(\035exibilit)28.997(y)-314.998(to)-314.998(reduce)-314.998(time)-316.002(on)-314.998(some)-314.998(computational)-315.009(steps)-314.998(at)-314.998(the)]TJ 1.016 0 0 1 53.798 580.719 Tm [(exp)-28.005(ense)-337.995(of)-338.006(others.)-451.999(F)84.003(or)-337.995(example,)-338.006(sieving)-337.995(more)-338.006(will)-337.995(result)-337.995(in)]TJ 1.002 0 0 1 53.798 570.258 Tm [(a)-340.995(smaller)-341.006(matrix,)-340.995(making)-341.006(linear)-340.003(algebra)-340.995(c)28.005(heap)-28.005(er,)-340.995(and)-341.006(doing)]TJ 1.02 0 0 1 53.798 559.797 Tm [(more)-373.996(w)27.993(ork)-375(in)-373.996(the)-373.996(precomputation)-375(mak)27.993(es)-373.996(the)-374.007(\034nal)-375(descen)28.005(t)]TJ 1.002 0 0 1 53.798 549.337 Tm [(step)-340.995(easier.)-455.01(In)-340.995(\2373.3,)-340.995(w)28.997(e)-341.006(sho)28.005(w)-340.003(ho)28.005(w)-341.006(exploiting)-339.992(these)-341.006(tradeo\033s)]TJ 1.02 0 0 1 53.798 538.876 Tm [(allo)28.005(ws)-337.003(us)-337.003(to)-337.995(quic)27.993(kly)-337.003(compute)-336.991(512-bit)-337.003(discrete)-337.003(logs)-337.995(in)-337.003(order)]TJ 1 0 0 1 53.798 528.415 Tm [(to)-343.003(p)-27.993(erform)-343.003(an)-341.999(e\033ectiv)27.993(e)-341.999(man-in-the-middle)-342.992(attac)28.997(k)-343.003(on)-341.999(TLS.)]TJ /T1_6 8.966 Tf 0 -13.935 TD [(Improp)-33(erly)-550(g)1(enera)-1(t)1(ed)-550(groups)]TJ /T1_0 8.966 Tf 1.02 0 0 1 205.875 514.48 Tm [(A)-468.003(di\033eren)28.005(t)-468.003(family)-468.003(of)]TJ 0.98 0 0 1 53.798 504.019 Tm [(algorithms)-314.998(runs)-314.998(in)-316.002(time)-314.998(exp)-29.008(onen)29.008(tial)-315.009(in)-314.998(group)-314.998(order,)-322.002(and)-314.998(they)]TJ 1.01 0 0 1 53.798 493.558 Tm [(are)-338.999(practical)-338.006(ev)28.005(en)-338.999(for)-338.006(large)-338.999(primes)-338.999(when)-338.999(t)1.004(he)-338.999(group)-338.999(order)-338.999(is)]TJ 1.003 0 0 1 53.798 483.097 Tm [(small)-341.999(or)-341.999(has)-341.999(man)28.997(y)-341.999(small)-341.999(prime)-341.999(factors.)-456.002(T)84.995(o)-341.999(a)28.997(v)28.005(oid)-341.999(this,)-341.999(most)]TJ 0.985 0 0 1 53.798 472.637 Tm [(implemen)28.997(tations)-349.003(use)-347.999(\020safe\021)-348.992(primes,)-349.003(whic)28.997(h)-349.003(ha)29.008(v)28.997(e)-347.999(the)-349.003(prop)-28.997(ert)28.997(y)]TJ 1.011 0 0 1 53.798 462.176 Tm (that)Tj /T1_1 8.966 Tf 1 0 0 1 73.945 462.176 Tm (p)Tj /T1_7 8.966 Tf 6.663 0 Td (\000)Tj /T1_3 8.966 Tf 1.011 0 0 1 89.813 462.176 Tm [(1)-281.997(=)-283.001(2)]TJ /T1_1 8.966 Tf 1 0 0 1 111.496 462.176 Tm (q)Tj /T1_0 8.966 Tf 1.011 0 0 1 119.001 462.176 Tm [(for)-337.995(some)-339.01(prime)]TJ /T1_1 8.966 Tf 1 0 0 1 182.907 462.176 Tm (q)Tj /T1_0 8.966 Tf 1.011 0 0 1 187.346 462.176 Tm [(,)-337.995(so)-339.01(that)-337.995(the)-337.995(only)-338.006(p)-28.997(ossible)]TJ 1.02 0 0 1 53.798 451.715 Tm [(subgroups)-367.003(ha)28.005(v)27.993(e)-366.992(order)]TJ /T1_3 8.966 Tf 89.666 0 Td (2)Tj /T1_0 8.966 Tf (,)Tj /T1_1 8.966 Tf 1 0 0 1 155.996 451.715 Tm (q)Tj /T1_0 8.966 Tf 1.02 0 0 1 160.435 451.715 Tm [(,)-375(or)]TJ /T1_3 8.966 Tf 17.424 0 Td (2)Tj /T1_1 8.966 Tf 1 0 0 1 182.907 451.715 Tm (q)Tj /T1_0 8.966 Tf 1.02 0 0 1 187.346 451.715 Tm [(.)-540.997(Ho)27.993(w)28.005(ev)28.005(er,)-375(as)-367.003(w)27.993(e)-366.992(sho)27.993(w)-366.992(in)]TJ -130.929 -10.461 Td [(\2373.5,)-436.998(improp)-28.005(erly)-417.994(generat)0.993(ed)-417.994(groups)-417.001(are)-417.001(sometimes)-417.001(used)-417.001(in)]TJ 1 0 0 1 53.798 430.793 Tm [(practice)-341.999(and)-343.003(susceptible)-343.003(t)1.004(o)-343.003(attac)29.008(k.)]TJ 1.02 0 0 1 62.765 420.333 Tm [(The)-379.004(bab)28.005(y-step)-378(gian)27.993(t-step)-378.993([45])-379.004(and)-378(P)28.005(ollard)-379.004(rho)-379.004([42])-378.993(algo-)]TJ 1.011 0 0 1 53.798 409.872 Tm [(rithms)-338.999(b)-28.997(oth)-338.999(tak)27.993(e)]TJ /T1_7 8.966 Tf 1 0 0 1 125.473 415.473 Tm (p)Tj ET 0.379 w  q 1 0 0 1 133.153 415.663 cm 0 0 m 4.439 0 l S Q BT /T1_1 8.966 Tf 133.153 409.872 Td (q)Tj /T1_0 8.966 Tf 1.011 0 0 1 140.668 409.872 Tm [(time)-338.999(to)-340.003(compute)-338.999(a)-338.999(discrete)-338.999(log)-340.003(in)-338.999(an)28.005(y)]TJ 1.02 0 0 1 52.72 399.411 Tm [(\(sub\)group)-403.005(of)-403.997(order)]TJ /T1_1 8.966 Tf 1 0 0 1 137.803 399.411 Tm (q)Tj /T1_0 8.966 Tf 1.02 0 0 1 142.242 399.411 Tm [(,)-420.001(while)-403.997(P)27.993(ollard)-402.993(lam)27.993(b)-27.993(da)-403.997([42])-403.005(can)-403.997(\034nd)]TJ /T1_1 8.966 Tf 1 0 0 1 53.798 388.95 Tm [(x)-346.995(<)-346.003(t)]TJ /T1_0 8.966 Tf 1.02 0 0 1 79.135 388.95 Tm [(in)-372(time)]TJ /T1_7 8.966 Tf 1 0 0 1 112.051 396.251 Tm (p)Tj ET q 1 0 0 1 119.73 396.44 cm 0 0 m 3.328 0 l S Q BT /T1_1 8.966 Tf 119.73 388.95 Td (t)Tj /T1_0 8.966 Tf 1.02 0 0 1 123.058 388.95 Tm [(.)-555.998(These)-372(parallelize)-371.007(w)28.005(ell)-372([50],)-381(and)-372(precom-)]TJ -67.902 -10.46 Td [(putation)-424.998(can)-424.998(sp)-28.005(eed)-424.998(up)-426.002(individual)-424.998(log)-425.009(calculations.)-715.995(If)-424.998(the)]TJ 0 -10.461 TD [(factorization)-477.996(of)-478.007(the)-477.996(subgroup)-478.007(order)]TJ /T1_1 8.966 Tf 1 0 0 1 206.877 368.029 Tm (q)Tj /T1_0 8.966 Tf 1.02 0 0 1 215.689 368.029 Tm [(is)-477.996(kno)27.993(wn,)-513.997(one)-478.007(can)]TJ -158.717 -10.461 Td [(use)-436.998(an)27.993(y)-437.991(of)-437.009(the)-436.998(ab)-27.993(o)27.993(v)28.005(e)-436.998(algorithms)-438.002(to)-436.998(compute)-437.009(the)-436.998(discrete)]TJ T* [(log)-394.997(in)-394.004(eac)28.005(h)-395.008(subgroup)-393.993(of)-395.008(order)]TJ /T1_1 8.966 Tf 1 0 0 1 180.021 347.107 Tm (q)Tj /T1_2 5.978 Tf 4.439 4.35 Td (e)Tj /T1_8 4.981 Tf 3.521 -1.261 Td (i)Tj /T1_2 5.978 Tf -3.842 -5.555 Td (i)Tj /T1_0 8.966 Tf 1.02 0 0 1 195.244 347.107 Tm (dividing)Tj /T1_1 8.966 Tf 1 0 0 1 232.014 347.107 Tm (q)Tj /T1_0 8.966 Tf 1.02 0 0 1 236.453 347.107 Tm [(,)-409.005(and)-394.997(then)-394.004(re-)]TJ -179.074 -10.461 Td [(co)28.005(v)27.993(er)]TJ /T1_1 8.966 Tf 1 0 0 1 78.283 336.646 Tm (x)Tj /T1_0 8.966 Tf 1.02 0 0 1 86.808 336.646 Tm [(using)-361.003(the)-360.992(Chinese)-361.003(re)1.004(m)-1.004(ainde)1.004(r)-361.003(theorem.)-522.997(This)-361.003(is)-361.003(the)]TJ 1.007 0 0 1 53.798 326.186 Tm [(P)28.005(ohlig-Hellman)-339.01(algorithm)-339.992([41],)-340.003(whic)28.005(h)-340.003(costs)]TJ /T1_5 9.963 Tf 1 0 0 1 231.025 333.409 Tm (P)Tj /T1_2 5.978 Tf 10.516 -10.461 Td (i)Tj /T1_1 8.966 Tf 4.698 3.238 Td (e)Tj /T1_2 5.978 Tf 4.284 -0.997 Td (i)Tj /T1_7 8.966 Tf 3.162 6.598 Td (p)Tj ET q 1 0 0 1 261.364 331.976 cm 0 0 m 7.279 0 l S Q BT /T1_1 8.966 Tf 261.364 326.186 Td (q)Tj /T1_2 5.978 Tf 4.118 -0.997 Td (i)Tj /T1_0 8.966 Tf 1.007 0 0 1 271.712 326.186 Tm (using)Tj 1 0 0 1 53.798 315.725 Tm [(bab)28.997(y)-0.993(-)0.993(s)-0.993(t)0.993(ep)-343.003(gian)29.008(t-step)-343.003(or)-343.003(P)28.997(ollard)-342.992(rho.)]TJ /T1_6 8.966 Tf 0 -13.936 TD [(Standard)-316(primes)]TJ /T1_0 8.966 Tf 0.98 0 0 1 141.823 301.789 Tm [(Generating)-280.001(primes)-281.005(with)-279.99(sp)-29.008(ecial)-280.001(prop)-30.001(er-)]TJ -89.821 -10.46 Td [(ties)-319.002(can)-319.002(b)-30.001(e)-318.991(computationally)-319.002(burdensome,)-325.002(so)-320.006(man)30.001(y)-319.995(implemen-)]TJ 0.991 0 0 1 53.798 280.868 Tm [(tations)-346.995(use)-346.003(\034x)-1.004(e)1.004(d)-347.007(or)-346.995(standardized)-346.995(Di\036e-Hellman)-346.003(parameters.)]TJ 1.003 0 0 1 53.457 270.407 Tm [(A)-341.999(prominen)27.993(t)-341.999(example)-342.992(is)-341.999(the)-342.01(Oakley)-342.992(groups)-341.999([40],)-343.003(whic)28.997(h)-343.003(giv)29.008(e)]TJ 0.99 0 0 1 52.49 259.946 Tm [(\020safe\021)-346.003(primes)-346.003(of)-345.992(length)-346.003(768)-346.003(\(Oakley)-346.003(Group)-345.992(1\),)-346.003(1024)-346.003(\(Oakley)]TJ 1.02 0 0 1 53.798 249.486 Tm [(Group)-334.995(2\),)-334.002(and)-335.006(1536)-333.991(\(Oakley)-335.006(Group)-334.995(5\))0.993(.)-447.995(These)-334.002(groups)-334.995(w)27.993(ere)]TJ 0.981 0 0 1 53.798 239.025 Tm [(published)-349.996(in)-351.01(1998)-349.996(and)-349.996(ha)28.997(v)28.997(e)-349.996(b)-28.997(een)-351.01(used)-349.996(for)-349.996(man)28.997(y)-349.996(applications)]TJ 1 0 0 1 53.798 228.564 Tm [(since,)-343.003(including)-341.999(IKE,)-343.003(SSH,)-341.999(T)85.006(or,)-341.999(and)-343.003(OTR.)]TJ 0.997 0 0 1 62.765 218.103 Tm [(When)-343.003(primes)-343.995(are)-343.003(of)-343.995(su\036cien)28.997(t)-344.007(strength,)-342.992(there)-344.007(see)1.004(m)-1.004(s)-342.992(to)-344.007(b)-27.993(e)]TJ 0.98 0 0 1 53.798 207.642 Tm [(no)-308.998(disadv)58.998(an)28.997(tage)-308.998(to)-307.994(reusing)-309.009(them.)-451.999(Ho)28.997(w)29.008(ev)28.997(er,)-317.006(widespread)-307.994(reuse)]TJ 0.987 0 0 1 53.798 197.182 Tm [(of)-346.003(Di\036)-0.993(e)0.993(-Hellman)-346.995(groups)-346.003(can)-346.995(con)28.997(v)28.997(ert)-346.003(attac)29.008(ks)-347.007(t)1.004(hat)-346.995(are)-346.003(at)-347.007(the)]TJ 0.996 0 0 1 53.798 186.721 Tm [(limits)-343.995(of)-344.007(an)-343.995(adv)28.997(ersary's)-343.995(capabilities)-344.007(in)28.005(to)-344.007(dev)58.005(astating)-344.007(breaks,)]TJ 1.015 0 0 1 53.798 176.26 Tm [(since)-337.003(it)-337.003(allo)28.005(ws)-337.003(the)-337.003(attac)28.005(k)28.005(er)-337.003(to)-337.003(amortize)-337.003(the)-336.991(cost)-337.003(of)-337.003(discrete)]TJ 0.98 0 0 1 53.798 165.799 Tm [(log)-320.006(precomputation)-318.991(am)-1.004(ong)-319.002(v)58.005(ast)-320.006(n)28.997(um)29.008(b)-29.008(ers)-319.995(of)-319.002(p)-30.001(o)1.004(ten)28.997(tial)-319.995(targets.)]TJ /T1_9 11.955 Tf 1 0 0 1 53.798 139.945 Tm [(3.)-1000(A)94.996(TT)90.003(A)54.997(CKING)-250(TLS)]TJ /T1_0 8.966 Tf 1.02 0 0 1 62.765 126.994 Tm [(TLS)-432.002(supp)-27.993(orts)-432.002(Di\036e-Hellman)-433.005(as)-432.002(one)-432.002(of)-431.991(sev)27.993(eral)-432.994(p)-28.005(ossible)]TJ -8.791 -10.461 Td [(k)28.005(ey)-480.003(e)0.993(x)-0.993(c)27.993(hang)1.004(e)-480.003(metho)-27.993(ds,)-515(and)-480.003(ab)-28.005(out)-478.999(t)28.005(w)28.005(o-thirds)-478.999(of)-480.003(p)-28.005(opular)]TJ 0.98 0 0 1 53.798 106.072 Tm [(HTTPS)-326.006(sites)-326.999(allo)29.008(w)-326.006(it,)-331.002(m)-0.993(ost)-326.006(commonly)-326.999(using)-325.995(1024-bit)-326.999(primes.)]TJ 1.02 0 0 1 53.798 95.611 Tm [(Ho)28.005(w)27.993(ev)28.005(er,)-406.005(a)-391.997(smaller)-393.001(n)27.993(um)28.005(b)-28.005(er)-391.997(of)-391.997(serv)28.005(ers)-392.008(also)-391.997(supp)-28.005(ort)-393.001(legacy)]TJ 0.995 0 0 1 52.49 85.151 Tm [(\020exp)-28.997(ort-grade\021)-344.999(Di\036e-Hellman)-344.999(using)-344.999(512-bit)-345.01(primes)-344.999(that)-345.992(are)]TJ 0.997 0 0 1 53.467 74.69 Tm [(w)28.997(ell)-343.003(within)-342.992(reac)27.993(h)-342.992(of)-343.003(NFS-based)-343.003(cryptanalysis.)-457.999(F)85.999(urthermore,)]TJ ET 0.737 w  q 1 0 0 1 317.209 737.833 cm 0 0 m 238.31 0 l S Q BT /T1_10 7.97 Tf 322.589 728.683 Td [(Source)-2245(P)29(opularit)30(y)-1349.997(Prime)]TJ ET 0.46 w  q 1 0 0 1 317.209 724.22 cm 0 0 m 238.31 0 l S Q BT 322.589 715.207 Td [(Apac)30(he)-1894.001(8)1.004(2%)]TJ /T1_11 7.97 Tf 92.06 0 Td [(9fdb8b8a004)1(544f0045f1737d0ba2e0)1(b)]TJ 0 -8.966 TD [(274cdf1a9f5)1(88218fb435316a16e3741)]TJ T* [(71fd19d8d8f)1(37c39bf863fd60e3e3006)]TJ 0 -8.967 TD [(80a3030c6e4)1(c3757d08f70e6aa871033)]TJ /T1_10 7.97 Tf -92.06 -11.955 Td [(mo)-29(d_ssl)-1351.001(1)1(0%)]TJ /T1_11 7.97 Tf 92.06 0 Td [(d4bcd52406f)1(69b35994b88de5db89682)]TJ 0 -8.966 TD [(c8157f62d8f)1(33633ee5772f11f05ab22)]TJ 0 -8.967 TD [(d6b5145b9f24)1(1e5acc31ff090a4bc711)]TJ 0 -8.966 TD [(48976f76795094e)1(71e7903529f5a824b)]TJ /T1_10 7.97 Tf -92.06 -11.955 Td (\()Tj /T1_12 7.97 Tf (others)Tj /T1_10 7.97 Tf 26.158 0 Td [(\))-1975(8%)-4463.999(\(463)-353.998(distinct)-353.998(primes\))]TJ ET 0.737 w  q 1 0 0 1 317.209 632.898 cm 0 0 m 238.31 0 l S Q BT /T1_0 8.966 Tf 0.98 0 0 1 316.48 617.237 Tm [(T)87.003(able)-271.001(1:)]TJ /T1_6 8.966 Tf 1 0 0 1 351.457 617.237 Tm [(T)99.003(op)-307.002(512-bit)-305.998(DH)-306.009(primes)-306.991(for)-306.009(TLS.)]TJ /T1_0 8.966 Tf 0.98 0 0 1 502.223 617.237 Tm [(8.4%)-272.004(of)-271.001(Alexa)]TJ 1.02 0 0 1 316.48 606.777 Tm [(T)84.003(op)-487.007(1M)-486.996(HTTPS)-486.996(domains)-487.007(allo)28.005(w)]TJ /T1_13 7.97 Tf 136.254 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf [(,)-486.996(of)-487.007(whic)28.005(h)]TJ 0.995 0 0 1 316.812 596.316 Tm [(92.3%)-343.995(use)-344.999(one)-344.007(of)-343.995(the)-344.007(t)28.005(w)28.997(o)-343.995(most)-344.999(p)-28.005(opular)-344.999(primes,)-344.007(sho)29.008(wn)-344.007(here.)]TJ 1.02 0 0 1 316.812 565.448 Tm [(for)-337.003(b)-27.993(oth)-337.003(normal)-337.003(and)-337.003(exp)-27.993(ort-grade)-335.999(Di\036e-Hellman,)-337.003(the)-337.003(v)55.998(ast)]TJ 1 0 0 1 316.812 554.987 Tm [(ma)-28.997(jorit)28.997(y)-343.003(of)-341.999(serv)28.005(ers)-341.999(use)-343.003(a)-341.999(handful)-343.003(of)-343.003(common)-341.999(groups.)]TJ 0.988 0 0 1 325.778 544.526 Tm [(In)-347.999(this)-347.999(sectio)0.993(n,)-348.992(w)28.997(e)-346.995(exploit)-347.999(these)-348.01(facts)-347.999(to)-346.995(construct)-347.999(a)-347.999(no)28.997(v)28.997(el)]TJ -9.075 -10.461 Td [(attac)28.997(k)-346.995(against)-347.007(TLS,)-346.995(whic)28.997(h)-347.999(w)28.997(e)-346.995(call)-346.995(the)-347.007(Log)-28.997(jam)-346.995(attac)28.997(k.)-463.006(First,)]TJ 0.995 0 0 1 316.48 523.605 Tm [(w)28.997(e)-343.995(p)-28.997(erform)-344.007(NFS)-343.995(precomputations)-344.007(for)-344.999(the)-343.995(t)28.997(w)28.997(o)-343.995(most)-344.999(p)-28.005(opular)]TJ 1.002 0 0 1 316.812 513.144 Tm [(512-bit)-340.995(prim)-1.004(e)1.004(s)-342.01(on)-341.999(the)-340.995(w)28.005(eb,)-341.006(so)-341.999(that)-340.995(w)27.993(e)-340.995(can)-341.999(quic)28.997(kly)-341.999(compute)]TJ 0.991 0 0 1 316.812 502.683 Tm [(the)-346.995(discre)0.993(te)-346.995(log)-347.007(for)-345.992(an)28.997(y)-347.007(k)29.008(ey-exc)27.993(hange)-345.992(message)-347.007(that)-346.003(uses)-346.995(one)]TJ 0.98 0 0 1 316.812 492.222 Tm [(of)-347.999(them.)-465.003(Next,)-347.999(w)28.997(e)-346.995(sho)28.997(w)-347.999(ho)28.997(w)-346.995(a)-347.999(man-in-the-middle,)-347.999(so)-347.007(armed,)]TJ 1.02 0 0 1 316.812 481.761 Tm [(can)-346.995(attac)27.993(k)-346.995(connections)-347.007(b)-27.993(et)27.993(w)28.005(een)-346.995(p)-28.005(opular)-346.003(bro)28.005(wsers)-347.007(and)-346.995(an)28.005(y)]TJ 0 -10.46 TD [(serv)28.005(er)-355.003(that)-355.003(allo)28.005(ws)-355.003(exp)-28.005(ort-grade)-354.992(Di\036e-Hellman,)-359.007(b)28.005(y)-355.003(using)-355.003(a)]TJ -0.325 -10.461 Td [(TLS)-346.995(prot)0.993(o)-27.993(col)-347.007(\035a)28.005(w)-347.007(t)1.004(o)-346.995(do)27.993(wngrade)-346.995(the)-346.003(connection)-346.003(to)-346.995(exp)-28.005(ort-)]TJ 1.016 0 0 1 316.812 450.379 Tm [(strength)-335.999(and)-337.003(then)-335.999(reco)28.005(v)27.993(ering)-335.999(the)-337.003(session)-335.999(k)28.005(ey)84.003(.)-449.01(W)84.003(e)-335.999(\034nd)-337.003(that)]TJ 0.98 0 0 1 316.812 439.918 Tm [(this)-334.995(attac)28.997(k)-335.999(with)-335.006(our)-334.995(precomputations)-335.999(can)-335.006(compromise)-335.999(ab)-28.997(out)]TJ 1 0 0 1 316.582 429.458 Tm [(7.8%)-343.003(of)-341.999(HTTPS)-343.003(serv)29.008(ers)-343.003(among)-341.999(Alexa)-343.003(T)85.999(op)-343.003(Million)-341.999(domains.)]TJ /T1_9 11.955 Tf 0.23 -18.39 Td [(3.1)-1000(TLS)-250(and)-250(Dif\002e-Hellman)]TJ /T1_0 8.966 Tf 0.98 0 0 1 325.778 398.117 Tm [(The)-254.004(TLS)-254.996(handshak)28.997(e)-253.993(b)-29.008(egins)-254.996(with)-254.004(a)-254.996(ne)1.004(gotiation)-255.008(to)-253.993(determine)]TJ -9.149 -10.461 Td [(the)-287.997(crypto)-288.009(algorithms)-287.997(used)-287.997(for)-287.997(the)-287.997(session.)-445.006(The)-287.997(clien)28.997(t)-287.997(sends)-287.997(a)]TJ 0 -10.461 TD [(list)-274.001(of)-275.004(supp)-28.997(orted)-274.001(ciphersuites)-274.993(\()0.993(and)-274.993(a)-274.001(random)-275.004(nonce)]TJ /T1_1 8.966 Tf 1 0 0 1 516.502 377.195 Tm (cr)Tj /T1_0 8.966 Tf 0.98 0 0 1 524.906 377.195 Tm [(\))-274.001(within)]TJ -212.341 -10.461 Td (the)Tj /T1_14 8.966 Tf 15.143 0 Td (ClientHello)Tj /T1_0 8.966 Tf 44.432 0 Td [(message,)-278.997(where)-261.008(eac)30.001(h)-260.997(ciphersuite)-260.997(sp)-29.008(eci\034es)-260.997(a)-260.997(k)28.997(ey)]TJ 0.989 0 0 1 316.812 356.274 Tm [(exc)28.997(hange)-346.995(algorithm)-347.007(and)-346.995(other)-346.995(primitiv)28.997(es.)-463.006(The)-346.995(serv)28.005(e)0.993(r)-346.995(selects)]TJ 0.98 0 0 1 316.812 345.813 Tm [(a)-340.995(ciphersuite)-341.006(from)-340.995(the)-341.006(clien)29.008(t's)-341.006(list)-341.999(and)-340.995(signals)-341.006(its)-340.995(selection)-341.006(in)]TJ 1 0 0 1 316.812 335.352 Tm (a)Tj /T1_14 8.966 Tf 7.777 0 Td (ServerHello)Tj /T1_0 8.966 Tf 46.547 0 Td [(message)-343.001(\(con)29(taining)-342(a)-343.001(random)-343.003(nonce)]TJ /T1_1 8.966 Tf 151.42 0 Td (sr)Tj /T1_0 8.966 Tf 8.707 0 Td (\).)Tj 0.988 0 0 1 325.778 324.891 Tm [(TLS)-346.995(sp)-29.008(eci\034es)-346.995(ciphersuites)-347.007(supp)-28.997(ort)1.004(ing)-347.007(m)28.005(ultiple)-346.995(v)57.994(arieties)-346.995(of)]TJ 1.013 0 0 1 316.812 314.43 Tm [(Di\036e-Hellman.)-454.999(T)84.995(extb)-28.997(o)-28.005(ok)-338.999(Di\036e-Hellman)-339.992(with)-339.01(unrestricted)]TJ 1.009 0 0 1 316.812 303.97 Tm [(strength)-340.003(is)-340.003(called)-339.992(\020ephemeral\021)-340.003(Di\036e-Hellman,)-340.003(or)]TJ /T1_13 7.97 Tf 199.343 0 Td (DHE)Tj /T1_0 8.966 Tf [(,)-340.003(and)]TJ 0.995 0 0 1 316.812 293.509 Tm [(is)-343.003(iden)28.005(ti\034ed)-343.003(b)28.997(y)-342.992(ciphersuites)-344.007(that)-343.003(b)-28.997(egin)-343.003(with)]TJ /T1_15 8.966 Tf 1 0 0 1 494.354 293.509 Tm (TLS_DHE_*)Tj /T1_0 8.966 Tf 0.995 0 0 1 536.72 293.509 Tm (.)Tj /T1_16 5.978 Tf 1 0 0 1 539.267 297.318 Tm (2)Tj /T1_0 8.966 Tf 0.995 0 0 1 547.511 293.509 Tm (In)Tj /T1_13 7.97 Tf 0.98 0 0 1 316.812 283.048 Tm (DHE)Tj /T1_0 8.966 Tf [(,)-292.994(the)-293.005(serv)28.997(er)-292.994(is)-293.005(resp)-28.997(onsible)-293.005(for)-292.994(selec)0.993(ting)-292.994(the)-293.005(Di\036e-Hellman)]TJ T* [(parameters.)-438.002(It)-266.997(c)28.997(ho)-28.997(oses)-266.004(a)-266.997(group)]TJ /T1_3 8.966 Tf 125.069 0 Td (\()Tj /T1_1 8.966 Tf 1 0 0 1 442.891 272.587 Tm [(p;)-171.005(g)]TJ /T1_3 8.966 Tf 0.98 0 0 1 456.329 272.587 Tm (\))Tj /T1_0 8.966 Tf [(,)-283.001(computes)]TJ /T1_1 8.966 Tf 1 0 0 1 504.361 272.587 Tm (g)Tj /T1_2 5.978 Tf 4.716 3.809 Td (b)Tj /T1_0 8.966 Tf 0.98 0 0 1 512.849 272.587 Tm [(,)-283.001(and)-266.997(sends)]TJ -200.038 -10.46 Td (a)Tj /T1_14 8.966 Tf 7.429 0 Td (ServerKeyExchange)Tj /T1_0 8.966 Tf 77.863 0 Td [(message)-302.998(con)28.997(taining)-304.002(a)-302.998(signature)-304.002(o)28.997(v)29.008(e)0.993(r)-304.002(the)]TJ 1.02 0 0 1 316.812 251.666 Tm (tuple)Tj /T1_3 8.966 Tf 23.936 0 Td (\()Tj /T1_1 8.966 Tf 1 0 0 1 344.883 251.666 Tm [(cr)28.997(;)-171.998(sr)28.997(;)-171.998(p;)-170.994(g)-36.001(;)-171.005(g)]TJ /T1_2 5.978 Tf 46.527 3.809 Td (b)Tj /T1_3 8.966 Tf 1.02 0 0 1 395.182 251.666 Tm (\))Tj /T1_0 8.966 Tf 7.038 0 Td [(using)-385.004(the)-384.993(long-term)-386.008(signing)-384.993(k)27.993(ey)-384.993(from)]TJ 0.984 0 0 1 316.812 241.205 Tm [(its)-349.003(certi\034cate)1.004(.)-466.006(The)-348.992(clien)28.997(t)-349.003(v)28.997(eri\034es)-347.999(the)-348.992(signature)-347.999(and)-349.003(resp)-28.997(onds)]TJ 1 0 0 1 316.48 230.744 Tm [(with)-343.003(a)]TJ /T1_14 8.966 Tf 28.768 0 Td (ClientKeyExchange)Tj /T1_0 8.966 Tf 76.829 0 Td [(message)-343.001(con)29(taining)]TJ /T1_1 8.966 Tf 80.232 0 Td (g)Tj /T1_2 5.978 Tf 4.716 3.809 Td (a)Tj /T1_0 8.966 Tf 4.533 -3.809 Td (.)Tj 0.995 0 0 1 325.778 220.284 Tm [(T)85.999(o)-343.995(ensure)-344.999(a)0.993(greemen)28.005(t)-344.007(on)-343.995(the)-344.999(negotia)1.004(tion)-344.999(messages,)-344.007(and)-343.995(to)]TJ 1.02 0 0 1 316.812 209.823 Tm [(prev)28.005(en)27.993(t)-405.001(do)28.005(wngrade)-405.001(attac)27.993(ks)-404.99([52],)-422.009(eac)28.005(h)-405.001(part)28.005(y)-405.001(computes)-405.001(the)]TJ 0.98 0 0 1 316.48 199.362 Tm [(TLS)-302.005(master)-300.99(secret)-302.005(from)]TJ /T1_1 8.966 Tf 1 0 0 1 411.923 199.362 Tm (g)Tj /T1_2 5.978 Tf 4.716 3.809 Td (ab)Tj /T1_0 8.966 Tf 0.98 0 0 1 427.097 199.362 Tm [(and)-302.005(calculates)-300.99(a)-302.005(MA)28.997(C)-301.994(of)-302.005(its)-301.002(view)]TJ 1.02 0 0 1 316.812 188.901 Tm [(of)-400.004(the)-399.993(handshak)27.993(e)-400.997(transc)1.004(ript.)-641.004(These)-399.993(MA)27.993(Cs)-400.997(are)-400.004(exc)28.005(hanged)]TJ 0.995 0 0 1 316.812 178.44 Tm [(in)-343.995(a)-344.007(pair)-343.995(of)]TJ /T1_14 8.966 Tf 48.654 0 Td (Finished)Tj /T1_0 8.966 Tf 34.669 0 Td [(messages)-343.995(and)-344.007(v)28.997(eri\034ed)-343.995(b)28.997(y)-343.995(the)-344.007(recipien)29.008(ts.)]TJ 1.02 0 0 1 316.48 167.98 Tm [(Thereafter,)-412.997(clien)27.993(t)-396.993(and)-397.004(serv)28.005(er)-398.008(start)-396.993(exc)27.993(hanging)-396.993(application)]TJ 0.98 0 0 1 316.812 157.519 Tm [(data,)-349.996(prote)0.993(cted)-349.996(b)28.997(y)-349.996(an)-349.003(authen)28.997(ticated)-349.003(encryption)-349.996(sc)28.997(heme)-348.992(with)]TJ 1 0 0 1 316.812 147.058 Tm [(k)28.997(eys)-343.003(also)-342.992(deriv)28.997(ed)-343.003(from)]TJ /T1_1 8.966 Tf 92.82 0 Td (g)Tj /T1_2 5.978 Tf 4.716 3.809 Td (ab)Tj /T1_0 8.966 Tf 7.806 -3.809 Td (.)Tj 0.98 0 0 1 325.778 136.597 Tm [(T)87.003(o)-323.006(comply)-322.995(with)-323.006(1990s-era)-322.995(U.S.)-323.006(e)1.004(x)-1.004(p)-28.997(ort)-322.995(restrict)0.993(ions)-322.995(on)-323.998(c)0.993(ry)-0.993(p-)]TJ 1 0 0 1 316.812 126.137 Tm [(tograph)28.997(y)85.006(,)-344.007(SSL)-343.003(3.0)-343.995(and)-343.995(TLS)-343.003(1.0)-344.007(supp)-28.997(orted)-343.003(reduced-strength)]TJ ET 0.398 w  q 1 0 0 1 316.812 120.939 cm 0 0 m 119.552 0 l S Q BT /T1_16 5.978 Tf 317.269 114.364 Td (2)Tj /T1_0 8.966 Tf 1.02 0 0 1 321.42 110.555 Tm [(TLS)-439.006(also)-439.998(supp)-27.993(orts)-439.998(a)-439.006(rarely)-439.998(used)-439.998(\020st)0.993(atic\021)-439.998(Di\036e-Hellman)]TJ -4.518 -8.966 Td [(format,)-346.003(where)-343.995(the)-344.999(serv)27.993(er's)-343.995(k)27.993(ey)-343.995(exc)28.005(hange)-344.007(v)55.998(alue)-343.995(is)-344.999(\034xed)-343.995(and)]TJ 0.98 0 0 1 316.812 92.623 Tm [(con)28.997(tained)-317.998(in)-319.002(its)-317.998(certi\034cate.)-456.002(New)-319.002(c)1.004(iphersuites)-319.002(that)-317.998(use)-319.002(elliptic)]TJ 0.986 0 0 1 316.812 83.656 Tm [(curv)28.997(e)-349.003(Di\036e-Hellman)-347.999(\()]TJ /T1_13 7.97 Tf (ECDHE)Tj /T1_0 8.966 Tf [(\))-349.003(are)-347.999(gaining)-349.003(in)-348.992(p)-29.008(opularit)28.997(y)87.003(,)-348.992(but)]TJ 1 0 0 1 316.48 74.69 Tm [(w)28.997(e)-343.003(fo)-28.997(cus)-341.999(exclusiv)28.005(ely)-341.999(on)-343.003(the)-341.999(traditional)-343.003(prime)-341.999(\034eld)-343.003(v)57.002(ariet)28.997(y)85.006(.)]TJ -13.927 -29.888 Td (3)Tj ET q 239.10075 0 0 145.13835 53.798 593.065 cm /Im0 Do Q BT /T1_0 8.966 Tf 1.018 0 0 1 53.798 577.772 Tm [(Figure)-335.999(2:)]TJ /T1_1 8.966 Tf 1 0 0 1 94.729 577.772 Tm [(The)-394.004(Log)-33.001(jam)-393.001(attac)33.001(k.)]TJ /T1_0 8.966 Tf 1.018 0 0 1 190.083 577.772 Tm [(A)-335.999(man-in-the-middle)-335.999(can)]TJ 0.982 0 0 1 53.798 567.311 Tm [(force)-347.999(TLS)-347.999(clien)28.997(ts)-346.995(to)-347.999(use)-347.999(exp)-29.008(ort-strength)-347.999(DH)-347.999(with)-346.995(an)28.997(y)-347.999(serv)28.997(er)]TJ 0.998 0 0 1 53.798 556.851 Tm [(that)-341.999(allo)27.993(ws)]TJ /T1_2 7.97 Tf 47.403 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf [(.)-341.999(Then,)-343.003(b)28.997(y)-341.999(\034nding)-343.003(the)-341.999(512-bit)-341.999(dis-)]TJ 0.98 0 0 1 53.798 546.39 Tm [(crete)-238(log,)-260.997(the)-239.003(attac)28.997(k)30.001(er)-239.003(can)-238.992(le)0.993(arn)-238.992(the)-239.003(session)-238(k)28.997(ey)-239.003(and)-238(arbitrarily)]TJ 0 -10.461 TD [(read)-310.002(or)-310.002(mo)-28.997(dify)-310.002(the)-310.002(con)29.008(ten)28.997(ts.)]TJ /T1_3 8.966 Tf 1 0 0 1 168.866 535.929 Tm (Data)Tj /T1_4 5.978 Tf 18.829 3.809 Td [(f)-114.999(s)]TJ /T1_0 8.966 Tf 0.98 0 0 1 198.688 535.929 Tm [(refers)-310.002(to)-310.002(F)87.003(alse)-310.002(Start)-310.002([30])]TJ -147.847 -10.461 Td [(application)-326.999(data)-328.002(that)-326.999(some)-328.002(TLS)-326.999(clien)28.997(ts)-326.999(send)-328.002(b)-28.997(efore)-326.999(receiving)]TJ 1 0 0 1 53.798 515.008 Tm [(the)-343.003(serv)28.997(er's)]TJ /T1_5 8.966 Tf 48.791 0 Td (Finished)Tj /T1_0 8.966 Tf 34.659 0 Td (message.)Tj /T1_2 7.97 Tf 0.983 0 0 1 53.798 483.317 Tm (DHE_EXPORT)Tj /T1_0 8.966 Tf 59.591 0 Td [(ciphersuites)-347.999(that)-347.999(w)28.997(ere)-347.999(restricted)-347.999(to)-347.999(primes)-347.999(no)]TJ 1.02 0 0 1 53.798 472.856 Tm [(longer)-390(than)-388.997(512)-390(bits.)-609.007(In)-390(all)-390(other)-388.997(resp)-27.993(ects,)]TJ /T1_2 7.97 Tf 178.227 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf 0.989 0 0 1 53.798 462.395 Tm [(proto)-28.997(col)-347.007(messages)-346.995(are)-347.999(iden)28.997(tical)-346.995(to)]TJ /T1_2 7.97 Tf 139.166 0 Td (DHE)Tj /T1_0 8.966 Tf [(.)-347.007(The)-347.999(relev)58.005(an)28.997(t)-347.007(exp)-28.997(ort)]TJ 1.02 0 0 1 53.798 451.935 Tm [(restrictions)-352.996(are)-353.999(no)-353.007(longer)-352.996(in)-353.999(e\033ect)0.993(,)-357.992(but)-353.999(man)27.993(y)-352.996(libraries)-353.007(and)]TJ 0.98 0 0 1 53.798 441.474 Tm [(serv)28.997(ers)-349.003(main)29.008(tain)-347.999(supp)-30.001(ort)-347.999(for)-349.003(bac)28.997(kw)28.997(ards)-348.992(compatibilit)28.997(y)87.995(.)-465.995(Man)28.997(y)]TJ 1.02 0 0 1 53.467 431.013 Tm [(TLS)-355.996(serv)27.993(ers)-355.996(are)-356.007(still)-355.996(con\034gured)-356.999(with)-355.996(t)27.993(w)28.005(o)-356.007(groups:)-488(a)-355.996(strong)]TJ 0.994 0 0 1 53.337 420.552 Tm [(1024-bit)-344.999(group)-344.999(for)-346.003(regular)]TJ /T1_2 7.97 Tf 107.439 0 Td (DHE)Tj /T1_0 8.966 Tf 20.268 0 Td [(k)28.997(ey)-346.003(exc)29.008(hanges)-344.999(and)-344.999(a)-344.999(512-bit)]TJ 1.02 0 0 1 53.798 410.092 Tm [(group)-388.004(for)-387(legacy)]TJ /T1_2 7.97 Tf 69.398 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf [(.)-388.004(This)-387(has)-387.993(b)-28.005(een)-388.004(considered)]TJ 0.98 0 0 1 53.798 399.631 Tm [(safe)-340.995(b)-29.008(ecause)-340.995(most)-341.006(mo)-28.997(dern)-340.995(TLS)-341.006(clien)29.008(ts)-341.006(do)-340.995(not)-341.006(o\033er)-340.995(or)-341.006(accept)]TJ /T1_2 7.97 Tf 1 0 0 1 53.798 389.17 Tm (DHE_EXPORT)Tj /T1_0 8.966 Tf 59.542 0 Td (ciphersuites.)Tj 0.994 0 0 1 62.765 378.709 Tm [(T)85.999(o)-343.995(understand)-344.007(ho)28.997(w)-343.995(HTTPS)-343.995(se)0.993(rv)28.005(ers)-344.007(in)-343.995(the)-343.003(wild)-343.995(use)-344.007(Di\036e-)]TJ 0.997 0 0 1 53.798 368.248 Tm [(Hellman,)-344.999(w)28.997(e)-344.999(mo)-28.005(di\034ed)-344.999(the)-344.999(ZMap)-343.995([15])-344.999(to)-28.005(olc)28.005(hain)-344.007(to)-344.999(o\033er)]TJ /T1_2 7.97 Tf 222.651 0 Td (DHE)Tj /T1_0 8.966 Tf 1.02 0 0 1 53.798 357.788 Tm (and)Tj /T1_2 7.97 Tf 18.428 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf 60.049 0 Td [(ciphersuites)-399.001(and)-400.004(scanne)1.004(d)-400.004(TCP/443)-398.99(on)]TJ -78.477 -10.461 Td [(b)-28.005(oth)-546.998(the)-546.998(full)-548.001(public)-546.998(IPv4)-546.998(address)-547.009(space)-547.99(and)-547.009(the)-546.998(Alexa)]TJ 1.012 0 0 1 53.467 336.866 Tm [(T)84.995(op)-338.999(1M)-337.995(dom)-1.004(ains.)-450.995(The)-338.999(scans)-338.006(to)-27.993(ok)-338.999(place)-339.01(in)-337.995(Marc)28.005(h)-339.01(2015.)-450.995(Of)]TJ 0.98 0 0 1 53.798 326.405 Tm [(539,000)-290.997(HTTPS)-290.005(sites)-290.997(among)-290.997(T)87.995(op)-290.997(1M)-290.997(domains,)-302.998(w)29.99(e)-290.997(found)-290.997(that)]TJ 1.02 0 0 1 53.798 315.945 Tm [(68.3%)-391.997(supp)-28.005(orted)]TJ /T1_2 7.97 Tf 71.35 0 Td (DHE)Tj /T1_0 8.966 Tf 20.685 0 Td [(and)-391.997(8.4%)-392.008(supp)-27.993(orted)]TJ /T1_2 7.97 Tf 85.103 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf (.)Tj -177.138 -10.461 Td [(Of)-344.999(14)1.004(.3)-344.999(million)-344.007(IPv4)-344.999(HTTPS)-343.995(serv)27.993(ers)-344.999(with)-343.995(bro)27.993(wser-trusted)]TJ 1 0 0 1 53.798 295.023 Tm [(certi\034cates,)-341.999(23.9%)-343.003(supp)-28.997(orte)1.004(d)]TJ /T1_2 7.97 Tf 119.186 0 Td (DHE)Tj /T1_0 8.966 Tf 20.244 0 Td [(and)-343.001(4.9%)]TJ /T1_2 7.97 Tf 40.446 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf (.)Tj 0.98 0 0 1 62.765 284.562 Tm [(While)-233.996(the)-234.007(TLS)-233.996(proto)-28.997(col)-234.007(allo)28.997(ws)-233.996(serv)28.997(ers)-233.996(to)-235(gene)1.004(rate)-235(the)0.993(ir)-235(o)28.997(w)1.004(n)]TJ 1.016 0 0 1 53.798 274.102 Tm [(Di\036e-Hellman)-337.003(parameters,)-337.003(the)-335.999(o)28.005(v)27.993(erwhelming)-336.991(ma)-28.005(jorit)28.005(y)-337.003(use)]TJ 0.98 0 0 1 53.798 263.641 Tm [(one)-275.004(of)-274.001(a)-274.993(handful)-275.004(of)-274.993(primes.)-441.002(As)-275.004(sho)30.001(wn)-274.993(in)-275.004(T)87.003(a)0.993(b)-0.993(l)0.993(e)-274.993(1,)-290.005(just)-274.993(t)29.99(w)29.008(o)-275.004(512-)]TJ T* [(bit)-343.995(primes)-344.999(accoun)29.99(t)-344.999(for)-343.995(92.3%)-344.999(of)-344.007(Alexa)-343.995(T)87.003(op)-344.007(1M)-343.995(dom)-1.004(ains)-343.995(that)]TJ T* [(supp)-28.997(ort)]TJ /T1_2 7.97 Tf 33.561 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf [(,)-280.001(and)-280.001(92.5%)-280.001(of)-278.997(all)-280.001(serv)28.997(ers)-280.001(with)-280.001(bro)29.008(wser-)]TJ 0.981 0 0 1 53.798 232.258 Tm [(trusted)-350.999(certi\034cates)-350.999(that)-352.003(supp)-28.997(ort)]TJ /T1_2 7.97 Tf 132.376 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf [(.)-350.999(\(Non-exp)-28.997(ort)]TJ /T1_2 7.97 Tf 0.995 0 0 1 53.798 221.798 Tm (DHE)Tj /T1_0 8.966 Tf 20.259 0 Td [(follo)28.997(ws)-344.999(a)-343.995(similar)-344.007(distribution)-344.999(with)-343.995(longer)-344.007(primes.\))-458.991(The)]TJ 1.009 0 0 1 53.798 211.337 Tm [(most)-338.999(p)-28.005(opular)-338.999(512-bit)-337.995(prime)-338.999(w)27.993(as)-337.995(hard-co)-28.005(ded)-338.999(in)28.005(to)-338.006(man)28.005(y)-338.999(v)27.993(er-)]TJ 1.02 0 0 1 53.798 200.876 Tm [(sions)-356.999(of)-356.999(Apac)27.993(he.)-510.997(In)28.005(tro)-28.005(duced)-356.999(in)-356.999(2005)-356.999(with)-356.999(Apac)28.005(he)-357.011(2.1.5,)-363(it)]TJ 0.982 0 0 1 53.467 190.415 Tm [(w)28.997(as)-349.996(used)-350.007(un)29.008(til)-350.999(2.4.7,)-350.007(whic)28.997(h)-349.996(disabled)-350.999(exp)-28.997(ort)-350.007(ciphersuites.)-468.995(W)87.003(e)]TJ 0.98 0 0 1 53.798 179.955 Tm [(found)-287.997(it)-287.005(in)-287.997(use)-287.997(b)28.997(y)-287.005(ab)-28.997(out)-287.997(564,000)-287.997(serv)30.001(ers)-288.009(with)-287.997(bro)28.997(w)1.004(s)-1.004(e)1.004(r-trusted)]TJ 1.02 0 0 1 53.798 169.494 Tm [(certi\034cates.)-460.999(The)-341.006(second)-339.992(most)-341.006(p)-27.993(opular)-340.003(512-bit)-340.003(prime)-340.995(is)-340.003(the)]TJ 1.005 0 0 1 53.798 159.033 Tm [(default)-340.995(used)-341.006(for)]TJ /T1_2 7.97 Tf 66.081 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf 59.528 0 Td [(when)-340.995(using)]TJ /T1_3 8.966 Tf 1 0 0 1 228.543 159.033 Tm (mod_ssl)Tj /T1_0 8.966 Tf 1.005 0 0 1 261.495 159.033 Tm [(.)-454.999(It)-341.006(w)29.008(as)]TJ 1.02 0 0 1 53.798 148.572 Tm [(in)28.005(tro)-28.005(duced)-352.996(in)-353.999(v)27.993(ersion)-352.996(2.3.0)-353.999(in)-353.007(1999.)-500.993(W)83.991(e)-352.996(found)-353.999(it)-352.996(in)-353.007(use)-353.999(b)28.005(y)]TJ 1 0 0 1 53.798 138.112 Tm [(ab)-28.997(out)-341.999(89,000)-343.003(serv)28.997(ers)-343.003(with)-341.999(bro)28.005(wser-trust)1.004(ed)-343.003(certi\034cates.)]TJ /T1_6 11.955 Tf 0 -19.088 TD [(3.2)-1000(Acti)10(v)10(e)-250(Do)10(wngrade)-250(to)-250(Export-Grade)-250(DHE)]TJ /T1_0 8.966 Tf 0.98 0 0 1 62.765 106.072 Tm [(Giv)28.997(en)-289.994(the)-291.009(widespread)-289.994(use)-290.997(of)-291.009(these)-289.994(primes,)-302.998(an)-290.005(attac)28.997(k)29.008(er)-290.005(with)]TJ 1.002 0 0 1 53.798 95.611 Tm [(the)-340.995(abilit)28.997(y)-341.006(to)-339.992(compute)-341.006(discrete)-340.003(logs)-340.995(in)-340.003(512-bit)-340.995(groups)-341.006(could)]TJ 1.003 0 0 1 53.798 85.151 Tm [(e\036cien)28.005(t)0.993(ly)-341.999(break)]TJ /T1_2 7.97 Tf 66.906 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf 59.531 0 Td [(handshak)28.005(es)-341.006(for)-340.995(ab)-29.008(out)-340.995(8%)-341.999(of)]TJ 1.02 0 0 1 53.457 74.69 Tm [(Alexa)-429.002(T)84.003(op)-429.002(1M)-429.002(H)1.004(TTPS)-429.002(sites,)-451.999(but)-429.002(mo)-28.005(dern)-428.99(bro)27.993(wsers)-429.002(nev)28.005(er)]TJ 0.997 0 0 1 316.812 728.239 Tm [(negotiate)-340.995(exp)-29.008(ort-grade)-340.995(ciphersuites.)-457.999(T)85.999(o)-341.006(circum)28.005(v)28.997(en)29.008(t)-342.01(this,)-341.999(w)29.008(e)]TJ 1.02 0 0 1 316.812 717.778 Tm [(sho)28.005(w)-457.006(ho)28.005(w)-457.006(an)-456.995(attac)27.993(k)28.005(er)-456.995(who)-457.006(can)-456.995(compute)-456.002(512-bit)-457.006(discrete)]TJ 0 -10.46 TD (logs)Tj /T1_7 8.966 Tf 18.551 0 Td [(in)-373.004(r)51.002(e)51.002(al)-373.004(time)]TJ /T1_0 8.966 Tf 50.053 0 Td [(can)-349.996(do)27.993(wngrade)-350.999(a)-349.996(regular)]TJ /T1_2 7.97 Tf 102.489 0 Td (DHE)Tj /T1_0 8.966 Tf 20.313 0 Td (connection)Tj -191.406 -10.461 Td [(to)-343.003(use)-343.003(a)]TJ /T1_2 7.97 Tf 34.98 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf 59.547 0 Td [(group,)-344.999(and)-343.003(thereb)28.005(y)-343.003(break)-343.995(b)-28.005(ot)1.004(h)-344.007(the)]TJ 1 0 0 1 316.812 686.396 Tm [(con\034den)28.997(tialit)28.005(y)-341.999(and)-343.003(in)28.997(tegrit)28.005(y)-341.999(of)-343.003(application)-341.999(data.)]TJ 0.987 0 0 1 325.778 675.935 Tm [(The)-346.995(attac)28.997(k,)-347.007(whic)29.008(h)-346.003(w)28.997(e)-346.995(call)-347.007(Log)-28.997(jam,)-346.995(is)-346.003(depicted)-346.995(in)-347.007(Figure)-346.995(2)]TJ 1.02 0 0 1 316.812 665.474 Tm [(and)-457.999(relies)-457.999(on)-457.006(a)-457.999(\035a)28.005(w)-457.999(in)-457.999(the)-457.006(w)28.005(a)27.993(y)-457.999(TLS)-457.999(comp)-28.005(oses)]TJ /T1_2 7.97 Tf 198.292 0 Td (DHE)Tj /T1_0 8.966 Tf 21.275 0 Td (and)Tj /T1_2 7.97 Tf -219.568 -10.46 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf [(.)-406.005(When)-406.997(a)-405.993(serv)27.993(er)-405.993(selects)]TJ /T1_2 7.97 Tf 155.024 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf 60.113 0 Td [(for)-406.005(a)]TJ 0.98 0 0 1 316.812 644.553 Tm [(handshak)28.997(e,)-280.993(it)-265(pro)-29.008(ceeds)-263.997(b)28.997(y)-265(issuing)-263.997(a)-265(signed)]TJ /T1_5 8.966 Tf 168.842 0 Td (ServerKeyExchange)Tj /T1_0 8.966 Tf 1.003 0 0 1 316.812 634.092 Tm [(message)-340.995(con)27.993(taining)-340.995(a)-341.006(512-bit)]TJ /T1_8 8.966 Tf 1 0 0 1 436.267 634.092 Tm (p)Tj /T1_9 5.978 Tf 4.626 -0.996 Td (512)Tj /T1_0 8.966 Tf 1.003 0 0 1 452.35 634.092 Tm [(,)-340.995(but)-342.01(the)-340.995(structure)-340.995(of)-341.006(this)]TJ 0.98 0 0 1 316.812 623.631 Tm [(message)-287.005(is)-286.994(iden)30.001(tical)-287.005(to)-286.994(the)-287.005(message)-287.005(sen)30.001(t)-286.994(during)-287.005(standard)]TJ /T1_2 7.97 Tf 226.811 0 Td (DHE)Tj /T1_0 8.966 Tf 1.02 0 0 1 316.812 613.171 Tm [(ciphersuites.)-650.997(Crit)0.993(ically)82.999(,)-419.99(the)-403.005(signed)-403.997(p)-28.005(ortion)-402.993(of)-404.008(the)-402.993(serv)27.993(er's)]TJ 0.984 0 0 1 316.812 602.71 Tm [(message)-346.995(fails)-347.007(to)-346.995(include)-347.007(an)29.008(y)-347.007(indication)-346.995(of)-347.007(the)-346.995(sp)-28.997(eci\034c)-347.007(cipher-)]TJ 0.98 0 0 1 316.812 592.249 Tm [(suite)-305.998(that)-305.998(the)-306.009(serv)29.008(er)-305.005(has)-305.998(c)28.997(hosen.)-451.999(Pro)28.997(vided)-305.998(that)-305.998(a)-305.005(clien)29.008(t)-305.998(o\033ers)]TJ /T1_2 7.97 Tf 0 -10.461 TD (DHE)Tj /T1_0 8.966 Tf [(,)-314.998(an)-314.006(activ)29.008(e)-314.998(att)0.993(ac)29.008(k)28.997(er)-314.998(can)-314.006(rewrite)-314.998(the)-314.006(clien)29.008(t's)]TJ /T1_5 8.966 Tf 190.88 0 Td (ClientHello)Tj /T1_0 8.966 Tf 44.912 0 Td (to)Tj 0.99 0 0 1 316.812 571.328 Tm [(o\033er)-346.995(a)-347.007(corresp)-28.997(onding)]TJ /T1_2 7.97 Tf 87.911 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf 59.584 0 Td [(ciphersuite)-346.995(accepted)-347.007(b)28.997(y)]TJ 0.98 0 0 1 316.812 560.867 Tm [(the)-269.004(serv)29.008(er)-269.004(and)-269.004(remo)29.008(v)28.997(e)-269.004(other)-268.993(ciphersuites)-269.004(that)-269.004(could)-268.993(b)-28.997(e)-269.004(c)28.997(hosen)]TJ 1.02 0 0 1 316.812 550.406 Tm [(instead.)-528.005(The)-361.996(attac)28.005(k)27.993(er)-361.996(rewrites)-363(the)]TJ /T1_5 8.966 Tf 142.077 0 Td (ServerHello)Tj /T1_0 8.966 Tf 46.725 0 Td [(resp)-28.005(onse)-361.996(to)]TJ 0.98 0 0 1 316.812 539.945 Tm [(replace)-268.001(the)-268.001(c)28.997(hosen)]TJ /T1_2 7.97 Tf 74.656 0 Td (DHE_EXPORT)Tj /T1_0 8.966 Tf 58.874 0 Td [(ciphersuite)-268.001(with)-268.001(a)-269.004(matc)29.008(hing)]TJ 0.995 0 0 1 316.812 529.484 Tm [(non-exp)-28.997(ort)-344.999(ciphersuite)-344.999(and)-344.999(forw)28.997(ards)-344.999(the)]TJ /T1_5 8.966 Tf 165.164 0 Td (ServerKeyExchange)Tj /T1_0 8.966 Tf 1.02 0 0 1 316.812 519.024 Tm [(message)-441.002(to)-439.998(the)-441.002(clien)28.005(t)-439.998(as)-441.002(is.)-762(The)-441.002(clien)28.005(t)-440.009(will)-440.991(in)27.993(terpret)-439.998(the)]TJ 0.983 0 0 1 316.812 508.563 Tm [(exp)-28.997(ort-grade)-349.003(tuple)]TJ /T1_10 8.966 Tf 77.989 0 Td (\()Tj /T1_8 8.966 Tf 1 0 0 1 396.997 508.563 Tm (p)Tj /T1_9 5.978 Tf 4.626 -0.996 Td (512)Tj /T1_8 8.966 Tf 11.457 0.996 Td [(;)-171(g)-36(;)-171(g)]TJ /T1_4 5.978 Tf 17.624 3.809 Td (b)Tj /T1_10 8.966 Tf 0.983 0 0 1 434.476 508.563 Tm (\))Tj /T1_0 8.966 Tf 6.712 0 Td [(as)-349.003(v)58.005(alid)]TJ /T1_2 7.97 Tf 33.69 0 Td (DHE)Tj /T1_0 8.966 Tf 20.3 0 Td [(parameters)-349.003(c)28.997(ho-)]TJ 1.02 0 0 1 316.812 498.102 Tm [(sen)-439.006(b)28.005(y)-439.998(the)-439.006(serv)27.001(e)1.004(r)-439.998(and)-439.006(pro)-27.993(ceed)-439.998(with)-439.006(the)-439.998(handshak)28.005(e.)-759(T)0.993(he)]TJ 0.98 0 0 1 316.812 487.641 Tm [(clien)28.997(t)-333.991(and)-335.006(serv)28.997(er)-333.991(ha)28.997(v)28.997(e)-334.002(di\033eren)28.997(t)-334.995(handshak)28.997(e)-333.991(transcripts)-334.002(at)-335.006(this)]TJ 1.02 0 0 1 316.812 477.181 Tm [(stage,)-385.004(but)-375(an)-375.993(attac)27.993(k)28.005(er)-375(who)-375(can)-375(compute)]TJ /T1_8 8.966 Tf 1 0 0 1 487.502 477.181 Tm (b)Tj /T1_0 8.966 Tf 1.02 0 0 1 494.883 477.181 Tm [(in)-375(close)-376.004(to)-375(real)]TJ 0.998 0 0 1 316.812 466.72 Tm [(time)-341.999(can)-343.003(then)-341.999(deriv)28.005(e)-341.999(the)-342.01(m)-0.993(ast)0.993(er)-342.992(secret)-341.999(and)-343.003(connection)-341.999(k)28.997(eys)]TJ 1.015 0 0 1 316.812 456.259 Tm [(to)-337.003(complete)-335.999(the)-337.003(handshak)28.005(e)-335.999(with)-337.003(the)-335.999(clien)28.005(t,)-337.003(and)-337.003(then)-335.999(freely)]TJ 0.992 0 0 1 316.812 445.798 Tm [(read)-344.999(and)-346.003(write)-344.999(application)-344.999(data)-344.999(pretending)-346.003(to)-344.999(b)-28.997(e)-344.999(the)-344.999(serv)27.993(er.)]TJ 1.005 0 0 1 325.778 435.337 Tm [(There)-341.999(are)-341.006(t)28.005(w)28.997(o)-341.999(remaining)-341.999(c)28.997(hallenges)-341.999(in)-341.999(implemen)28.997(ting)-341.999(this)]TJ 0.992 0 0 1 316.812 424.877 Tm [(activ)28.997(e)-346.003(do)29.008(wngrade)-346.003(attac)28.997(k.)-462.003(The)-345.992(\034rst)-346.003(is)-346.003(to)-346.003(compute)-345.992(individual)]TJ 0.983 0 0 1 316.812 414.416 Tm [(discrete)-347.999(logs)-347.999(in)-347.999(close)-347.999(to)-347.999(real)-347.999(time,)-348.01(and)-347.999(the)-347.999(second)-347.999(is)-349.003(to)-347.999(dela)29.008(y)]TJ 0.98 0 0 1 316.812 403.955 Tm [(handshak)28.997(e)-316.002(completio)1.004(n)-316.002(un)28.997(til)-315.991(the)-315.009(discrete)-315.991(log)-316.002(computation)-314.998(has)]TJ T* [(had)-340.995(time)-341.006(to)-340.995(\034nish.)-463.006(W)87.003(e)-340.995(address)-341.006(these)-340.995(in)-341.006(the)-340.995(ne)1.004(x)-1.004(t)-340.003(subs)-1.004(e)1.004(ctions.)]TJ /T1_1 8.966 Tf 1 0 0 1 316.812 378.052 Tm [(Comparison)-491(with)-492.003(prev)1.004(ious)-492.003(attac)33.001(ks)]TJ /T1_0 8.966 Tf 1.02 0 0 1 491.114 378.052 Tm [(Log)-28.005(jam)-417.994(is)-418.998(remi-)]TJ 0.98 0 0 1 316.812 367.592 Tm [(niscen)28.997(t)-310.002(of)-310.994(the)-311.006(rec)1.004(en)28.997(t)-310.994(FREAK)-311.006([7])-310.002(attac)29.008(k,)-317.998(in)-311.006(whic)28.997(h)-310.002(an)-310.994(attac)28.997(k)28.997(er)]TJ 1.02 0 0 1 316.812 357.131 Tm [(do)28.005(wngrades)-378(a)-378(regular)-379.004(RSA)-378(k)27.993(ey)-377.989(exc)27.993(hange)-379.004(to)-378(one)-378(that)-378(uses)]TJ 0.995 0 0 1 316.812 346.67 Tm [(exp)-28.997(ort-grade)-344.007(512-bit)-344.999(ephemeral)-344.999(RSA)-344.999(k)28.997(eys,)-344.999(relying)-344.999(on)-344.999(a)-344.999(bug)]TJ 1.02 0 0 1 316.812 336.209 Tm [(in)-370.996(sev)27.993(eral)-372(TLS)-370.996(clien)27.993(t)-370.996(im)-1.004(ple)1.004(m)-1.004(en)28.005(t)1.004(ations.)-555.005(The)-370.996(attac)27.993(k)28.005(er)-372(then)]TJ 1.003 0 0 1 316.812 325.748 Tm [(factors)-340.995(the)-340.003(ephemeral)-341.006(k)28.005(ey)-340.995(t)0.993(o)-340.995(hijac)27.993(k)-340.995(future)-340.003(connections)-340.995(that)]TJ 1.005 0 0 1 316.812 315.288 Tm [(use)-340.995(the)-342.01(same)-340.995(k)28.005(ey)85.999(.)-456.002(The)-341.999(cryptanalysis)-341.006(tak)28.005(es)-340.995(sev)27.993(eral)-340.995(hours)-341.006(on)]TJ 0.98 0 0 1 316.812 304.827 Tm [(commo)-28.997(dit)28.997(y)-323.998(hardw)28.997(are)-323.998(and)-325.002(is)-323.998(usable)-323.998(un)28.997(til)-323.998(the)-323.998(serv)28.997(er)-325.002(genera)1.004(tes)]TJ 1 0 0 1 316.812 294.366 Tm [(a)-343.003(fresh)-341.999(ephemeral)-343.003(RSA)-341.999(k)28.005(ey)-341.999(\(t)27.993(ypically)-341.999(when)-342.992(it)-342.01(restarts\).)]TJ 0.995 0 0 1 325.778 283.905 Tm [(In)-344.999(con)28.997(trast,)-346.003(Log)-27.993(jam)-344.999(is)-344.999(due)-344.999(to)-344.999(a)-345.01(proto)-28.997(col)-344.999(\035a)28.997(w)-344.999(in)-346.003(TLS,)-344.999(not)]TJ -9.011 -10.46 Td [(an)-343.003(implemen)28.997(tation)-342.992(bug.)-459.002(F)85.999(rom)-343.003(a)-342.992(clie)0.993(n)28.005(t)-343.003(p)-28.005(ersp)-28.997(ectiv)28.997(e,)-342.992(the)-343.003(only)]TJ 0.999 0 0 1 316.812 262.984 Tm [(defense)-343.995(is)-343.003(to)-344.007(reject)-342.992(small)-344.007(primes)-343.995(in)]TJ /T1_2 7.97 Tf 142.693 0 Td (DHE)Tj /T1_0 8.966 Tf 20.253 0 Td [(handshak)28.997(es.)-459.995(\(Prior)]TJ 0.98 0 0 1 316.812 252.523 Tm [(to)-320.006(this)-320.998(w)29.008(ork,)-326.006(most)-320.998(p)-28.997(opular)-320.006(bro)28.997(wsers)-320.998(ac)1.004(cepted)]TJ /T1_8 8.966 Tf 1 0 0 1 498.42 252.523 Tm (p)Tj /T1_0 8.966 Tf 0.98 0 0 1 505.862 252.523 Tm [(of)-320.998(size)]TJ /T1_11 8.966 Tf 1 0 0 1 532.872 252.523 Tm (\025)Tj /T1_10 8.966 Tf 0.98 0 0 1 542.599 252.523 Tm (512)Tj /T1_0 8.966 Tf 0.982 0 0 1 316.812 242.062 Tm [(bits.\))-465.003(Log)-28.997(jam)-347.999(a\033ects)-349.003(few)28.997(er)-347.999(serv)29.008(ers)-348.01(than)-348.992(FREAK,)-347.999(but,)-347.999(as)-349.003(w)28.997(e)]TJ 1.007 0 0 1 316.812 231.601 Tm [(shall)-340.003(see,)-340.003(t)1.004(he)-340.003(cost)-339.992(p)-28.005(er)-340.003(compromised)-340.003(connection)-338.999(is)-339.992(far)-340.003(lo)27.993(w)29.008(er,)]TJ 0.98 0 0 1 316.812 221.141 Tm [(since)-334.002(the)-334.995(pre)0.993(computation)-334.995(for)-334.002(eac)28.997(h)-333.991(512-bit)-334.002(group)-335.006(can)-333.991(b)-29.008(e)-333.991(used)]TJ T* [(inde\034nitely)-331.995(against)-332.006(all)-331.995(serv)28.997(ers)-332.006(that)-331.995(use)-331.995(that)-332.006(group,)-335.999(and)-331.995(since)]TJ 1 0 0 1 316.812 200.219 Tm [(eac)28.997(h)-343.003(individual)-342.992(discret)0.993(e)-342.992(log)-343.003(only)-341.999(tak)27.993(es)-341.999(ab)-28.997(out)-341.999(a)-343.003(min)28.997(ute.)]TJ 0.98 0 0 1 325.778 189.758 Tm [(Log)-28.997(jam)-281.005(and)-280.993(FREAK)-280.001(b)-30.001(ot)0.993(h)-280.993(follo)28.997(w)-281.005(the)-280.993(same)-280.001(pattern)-281.005(as)-280.993(other)]TJ -9.149 -10.46 Td [(cross-proto)-28.997(col)-265(attac)28.997(ks)-266.004(disco)30.001(v)29.008(ered)-266.004(in)-265(TLS.)-438.002(As)-265(early)-265.993(as)-265(SSL)-266.004(3.0,)]TJ T* [(Sc)28.997(hneier)-346.003(and)-346.995(W)87.003(agner)-346.003(noted)-346.995(a)-347.007(related)-345.992(vulnerabilit)28.997(y)-347.007(that)-346.995(the)1.004(y)]TJ 1.011 0 0 1 316.812 158.376 Tm (called)Tj /T1_7 8.966 Tf 26.084 0 Td [(key)-364.003(exchange)-363(r)52.005(ol)-78.002(lb)51.994(ac)-0.993(k)]TJ /T1_0 8.966 Tf 89.334 0 Td [([52].)-453.002(Ma)28.005(vrogiannop)-28.005(oulos)-338.999(et)-338.999(al.)]TJ 0.98 0 0 1 316.812 147.915 Tm [(sho)28.997(w)28.997(ed)-317.998(ho)29.008(w)-319.002(explicit)0.993(-curv)29.008(e)-319.002(ECDHE)-317.998(handshak)28.997(es)-319.002(could)-317.998(b)-28.997(e)-319.002(con-)]TJ 1.02 0 0 1 316.812 137.455 Tm [(fused)-391.997(with)-392.008(DHE)-391.997(handshak)28.005(es)-391.004([35].)-616(All)-391.997(these)-392.008(attac)28.005(ks)-391.997(could)]TJ 1.015 0 0 1 316.812 126.994 Tm [(b)-28.005(e)-336.991(prev)27.993(en)28.005(ted)-338.006(b)29.008(y)-338.006(additionally)-337.003(signing)-337.995(the)-337.003(ciphersuite)-337.003(in)-337.995(the)]TJ /T1_5 8.966 Tf 0.98 0 0 1 316.812 116.533 Tm (ServerKeyExchange)Tj /T1_0 8.966 Tf 78.087 0 Td [(message.)-459.002(W)87.003(e)-328.002(exp)-28.997(ect)-329.006(that)-327.991(TLS)-328.002(1.3)-329.006(will)-327.991(\034x)]TJ 0.981 0 0 1 316.812 106.072 Tm [(this)-349.003(proto)-28.997(col)-347.999(\035a)28.997(w.)-465.995(More)-347.999(generally)86.991(,)-348.992(Log)-29.008(jam)-348.992(can)-349.003(a)1.004(l)-1.004(so)-347.999(b)-28.997(e)-349.003(in)28.997(ter-)]TJ 1.02 0 0 1 316.812 95.611 Tm [(preted)-334.995(as)-335.006(a)-335.999(bac)28.005(kw)27.993(ards)-334.995(compatibilit)27.993(y)-334.995(attac)27.993(k)-335.999([23])-334.995(where)-335.006(one)]TJ 0.992 0 0 1 316.812 85.151 Tm [(part)28.997(y)-346.995(uses)-346.003(only)-346.003(strong)-346.995(cryptograph)28.997(y)-346.003(but)-346.995(the)-346.003(other)-345.992(supp)-29.008(orts)]TJ 1 0 0 1 316.812 74.69 Tm [(b)-28.997(oth)-341.999(strong)-343.003(and)-341.999(w)27.993(eak)-341.999(ciphersuites.)]TJ -14.259 -29.888 Td (4)Tj ET BT /T1_0 11.955 Tf 53.798 728.239 Td [(3.3)-1000(512-bit)-250(Discr)18(ete)-250(Log)-250(Computations)]TJ /T1_1 8.966 Tf 0.98 0 0 1 62.765 715.288 Tm [(W)87.003(e)-254.004(mo)-28.997(di\034ed)-255.008(CADO-NFS)-253.993([1])-254.004(to)-254.996(implemen)28.997(t)-254.004(the)-254.996(n)28.997(um)30.001(b)-30.001(er)-253.993(\034eld)]TJ 1.006 0 0 1 53.798 704.827 Tm [(siev)28.005(e)-340.003(discrete)-340.003(log)-340.003(algorithm)-340.995(from)-340.003(\2372)-340.003(and)-340.995(applied)-340.003(it)-340.003(to)-339.992(three)]TJ 0.999 0 0 1 53.798 694.366 Tm [(512-bit)-341.999(primes,)-341.999(including)-341.006(the)-341.999(top)-341.999(t)28.997(w)29.008(o)]TJ /T1_2 7.97 Tf 153.111 0 Td (DHE_EXPORT)Tj /T1_1 8.966 Tf 59.535 0 Td (primes)Tj 0.98 0 0 1 53.798 683.905 Tm [(sho)28.997(wn)-247(in)-247.993(T)87.995(able)-248.004(1.)-432.002(Precomputation)-246.989(to)-29.008(ok)-248.004(7)-246.989(da)28.997(ys)-247(for)-248.004(eac)28.997(h)-247(prime,)]TJ 0 -10.46 TD [(after)-248.004(whic)30.001(h)-247.993(computing)-248.004(individual)-247(logs)-248.004(to)-28.997(ok)-248.004(a)-247(median)-247.993(of)-247(70)-248.004(sec-)]TJ 0.984 0 0 1 53.798 662.984 Tm [(onds.)-468.003(W)87.003(e)-349.003(list)-349.003(the)-348.992(run)28.997(time)-349.996(for)-349.003(eac)28.997(h)-349.003(stage)-348.992(of)-350.007(the)-348.992(computation)]TJ 1 0 0 1 53.798 652.523 Tm [(b)-28.997(elo)28.997(w.)-456.995(The)-342.01(times)-342.992(w)28.997(ere)-343.003(ab)-27.993(out)-343.003(the)-341.999(same)-343.003(for)-343.003(eac)28.997(h)-342.992(prime.)]TJ /T1_3 8.966 Tf 0 -16.936 TD (Precomputation)Tj /T1_1 8.966 Tf 0.983 0 0 1 140.794 635.587 Tm [(As)-349.003(illustrated)-349.003(in)-349.996(Figure)-349.003(1,)-348.992(the)-350.007(precom-)]TJ 0.98 0 0 1 53.798 625.126 Tm [(putation)-244(phase)-242.996(includes)-244(the)-243.007(p)-28.997(olynomial)-244(selection,)-265(sieving,)-263.997(and)]TJ 0 -10.461 TD [(linear)-257.004(algebra)-256.993(steps.)-435.002(F)87.003(or)-257.004(this)-257.004(precomputation,)-275.997(w)30.001(e)-257.997(delib)-29.008(erately)]TJ 1.012 0 0 1 53.798 604.204 Tm [(siev)28.005(ed)-337.003(more)-338.006(t)1.004(han)-337.995(strictly)-337.003(necessary)84.995(.)-450.995(This)-338.006(enabled)-336.991(t)27.993(w)28.005(o)-337.003(opti-)]TJ T* [(mizations:)-451.006(\034rst,)-337.995(with)-337.003(more)-337.995(relations)-337.003(obtained)-337.995(from)-337.003(sieving,)]TJ 0.985 0 0 1 53.467 583.283 Tm [(w)28.997(e)-349.003(ev)29.008(en)28.997(tually)-349.003(obtain)-348.992(a)-349.003(larger)-349.003(database)-349.003(of)-348.992(kno)28.997(wn)-349.003(logs,)-349.003(whic)29.008(h)]TJ 0.98 0 0 1 53.798 572.822 Tm [(mak)28.997(es)-319.995(the)-319.002(descen)28.997(t)-319.995(faster.)-456.002(Second,)-326.006(more)-319.995(sieving)-319.002(relations)-319.995(also)]TJ -0.244 -10.461 Td [(yield)-308.998(a)-308.998(smaller)-308.005(linear)-308.998(algebra)-308.998(step,)-317.006(whic)30.001(h)-308.998(is)-308.998(desirable)-308.998(b)-29.008(ecause)]TJ 1 0 0 1 53.798 551.9 Tm [(sieving)-343.003(is)-341.999(m)28.005(uc)28.997(h)-343.003(easier)-341.999(to)-343.003(parallelize)-341.999(than)-342.992(linear)-342.01(algebra.)]TJ 1.02 0 0 1 62.765 541.44 Tm [(F)84.003(or)-376.004(the)-376.004(p)-27.993(olynomial)-376.004(se)1.004(lection)-376.004(and)-376.004(sieving)-375.993(steps,)-385.997(w)27.993(e)-375(used)]TJ 0.98 0 0 1 53.798 530.979 Tm [(idle)-343.003(t)1.004(im)-1.004(e)-341.999(on)-343.003(2)1.004(000\0253000)-343.003(CPU)-341.999(cores)-343.003(in)-341.999(parallel,)-343.995(of)-343.003(whic)28.997(h)-341.999(most)]TJ 1.02 0 0 1 53.798 520.518 Tm [(CPUs)-403.005(w)28.005(ere)-403.005(In)28.005(tel)-403.005(Sandy)-402.993(Bridge.)-650.004(P)28.005(olynomial)-403.005(selection)-402.993(ran)]TJ 1.001 0 0 1 53.798 510.057 Tm [(for)-343.003(ab)-27.993(out)-343.003(3)-343.003(hours,)-343.003(whic)29.008(h)-343.003(in)-343.003(total)-343.003(corresp)-27.993(onds)-343.003(to)-343.003(7,600)-343.003(core-)]TJ 1.02 0 0 1 53.798 499.596 Tm [(hours.)-703.002(Sieving)-420.001(ran)-420.994(for)-421.005(15)-420.994(hours,)-442.006(corresp)-27.993(onding)-420.001(to)-421.005(21,400)]TJ 0 -10.46 TD [(core-hours.)-555.998(This)-372(su\036ced)-372(to)-372(collect)-372(40,003)0.993(,519)-372(relations)-372(of)]TJ 1.014 0 0 1 53.467 478.675 Tm [(whic)28.005(h)-337.003(28,372,442)-338.006(w)28.005(ere)-337.003(unique,)-337.995(in)27.993(v)28.005(olving)-337.003(15,207,865)-337.995(primes)]TJ 1 0 0 1 53.798 468.214 Tm [(of)-343.003(at)-341.999(most)-343.003(27)-341.999(bits)-342.992(\(hence)-342.01(b)-28.997(ound)]TJ /T1_4 8.966 Tf 132.197 0 Td (B)Tj /T1_1 8.966 Tf 10.491 0 Td [(from)-343.001(\2372)-342(is)]TJ /T1_5 8.966 Tf 43.195 0 Td (2)Tj /T1_6 5.978 Tf 4.608 3.809 Td (27)Tj /T1_1 8.966 Tf 7.804 -3.809 Td (\).)Tj 1.02 0 0 1 62.765 457.753 Tm [(F)84.003(rom)-456.002(this)-457.006(data)-455.991(set,)-487.007(w)28.005(e)-456.002(obtained)-456.002(a)-456.995(square)-456.002(matrix)-456.002(with)]TJ 0.98 0 0 1 53.568 447.293 Tm [(2,157,378)-260.997(ro)28.997(ws)-262(and)-260.997(columns,)-279.008(with)-260.997(113)-262(nonzero)-260.997(co)-28.997(e\036cien)28.997(ts)-262(p)-28.997(er)]TJ 0.235 -10.461 Td [(ro)28.997(w)-238.992(on)-238(a)28.997(v)28.997(erage.)-429.002(W)87.003(e)-239.003(solv)30.001(ed)-239.003(the)-238.992(corresp)-29.008(onding)-238.992(linear)-238(system)-239.003(on)]TJ 0.987 0 0 1 53.798 426.371 Tm [(a)-347.999(36-no)-28.997(de)-347.999(cluster)-348.01(with)-348.992(t)28.997(w)28.997(o)-347.999(8-core)-347.999(In)28.997(tel)-347.999(Xeon)-347.999(E5-2650)-349.003(CPUs)]TJ 0.98 0 0 1 53.798 415.91 Tm [(p)-28.997(er)-265(no)-29.008(de,)-281.997(connected)-265(with)-265.993(In\034niband)-265(FDR.)-438.002(W)87.995(e)-265(used)-265.993(the)-265(blo)-29.008(c)29.008(k)]TJ 1 0 0 1 53.328 405.45 Tm [(Wiedemann)-343.003(algorithm)-341.999([11,)-134(49])-341.999(with)-343.003(parameters)]TJ /T1_4 8.966 Tf 192.032 0 Td (m)Tj /T1_5 8.966 Tf 10.679 0 Td [(=)-286(18)]TJ /T1_1 8.966 Tf 22.015 0 Td (and)Tj /T1_4 8.966 Tf -224.256 -10.461 Td (n)Tj /T1_5 8.966 Tf 0.993 0 0 1 61.93 394.989 Tm [(=)-289.001(6)]TJ /T1_1 8.966 Tf [(.)-462.995(Using)-344.999(the)-346.003(unoptimized)-346.003(implemen)28.997(tation)-345.992(from)-346.003(CADO-)]TJ 1.02 0 0 1 53.798 384.528 Tm [(NFS)-503([1])-503(for)-503(linear)-503(algebra)-501.996(o)27.993(v)28.005(er)]TJ /T1_5 8.966 Tf 1 0 0 1 190.77 384.528 Tm (GF)Tj 1.02 0 0 1 204.017 384.528 Tm (\()Tj /T1_4 8.966 Tf 1 0 0 1 207.672 384.528 Tm (p)Tj /T1_5 8.966 Tf 1.02 0 0 1 212.298 384.528 Tm (\))Tj /T1_1 8.966 Tf [(,)-545.001(the)-503(c)1.004(om)-1.004(put)1.004(ation)]TJ -155.392 -10.461 Td [(\034nished)-399.001(in)-399.001(120)-399.001(hours,)-414.001(corresp)-27.993(onding)-399.001(to)-399.001(60,000)-399.001(core-hours.)]TJ 0.99 0 0 1 53.328 363.606 Tm [(W)85.999(e)-344.999(exp)-28.997(ect)-346.003(that)-346.003(optimizations)-344.999(could)-346.003(bring)-345.992(this)-346.003(cost)-346.003(do)28.997(wn)-344.999(b)28.005(y)]TJ 1 0 0 1 53.798 353.146 Tm [(at)-343.003(least)-341.999(a)-343.003(factor)-341.999(of)-342.992(three.)]TJ 0.993 0 0 1 62.765 342.685 Tm [(In)-346.003(total,)-346.003(the)-345.992(w)28.997(all-clo)-28.997(c)28.997(k)-346.995(t)0.993(im)-0.993(e)-346.003(for)-346.003(eac)28.997(h)-345.992(precomputation)-346.003(w)28.997(as)]TJ 1.02 0 0 1 53.798 332.224 Tm [(sligh)28.005(tly)-379.004(o)27.993(v)28.005(er)-379.996(one)-379.004(w)28.005(eek.)-579.006(E)1.004(ac)27.993(h)-379.996(resulting)-378.993(database)-379.004(of)-379.996(kno)27.993(wn)]TJ 0.983 0 0 1 53.798 321.763 Tm [(logs)-347.999(for)-347.007(the)-347.999(desce)1.004(n)28.997(t)-347.999(o)-28.997(ccupies)-346.995(ab)-29.008(out)-347.999(2.5)-346.995(GB)-347.999(in)-347.999(ASCI)-29.008(I)-346.995(format.)]TJ /T1_3 8.966 Tf 1 0 0 1 53.798 304.827 Tm [(Descen)33.001(t)]TJ /T1_1 8.966 Tf 0.98 0 0 1 102.557 304.827 Tm [(Once)-346.995(this)-347.007(precomputation)-346.995(w)28.997(as)-346.995(\034nished,)-348.01(w)29.008(e)-347.007(w)29.008(ere)]TJ 0.992 0 0 1 53.798 294.366 Tm [(able)-344.999(to)-344.999(run)-344.999(the)-344.999(\034nal)-346.003(desce)1.004(n)27.993(t)-344.999(step)-344.999(to)-344.999(compute)-344.999(individual)-344.999(dis-)]TJ 0.98 0 0 1 53.798 283.905 Tm [(crete)-242.996(logs)-242.003(in)-242.996(ab)-29.008(out)-242.996(a)-242.996(min)28.997(ute)-243.007(for)-241.992(targets)-243.007(in)-242.996(eac)28.997(h)-241.992(of)-243.007(these)-242.996(groups.)]TJ 0.992 0 0 1 53.798 273.445 Tm [(In)-346.003(order)-346.003(to)-345.992(sa)28.997(v)28.997(e)-346.003(time)-345.992(on)-346.003(individual)-346.003(computations,)-345.992(w)28.997(e)-346.003(imple-)]TJ 1.013 0 0 1 53.798 262.984 Tm [(men)28.005(ted)-338.006(a)-337.003(clien)28.005(t-serv)28.005(er)-338.006(arc)28.997(hitecture)-337.995(using)-338.006(the)-337.995(Zero)1.004(MQ)-338.006(mes-)]TJ 1.005 0 0 1 53.798 252.523 Tm [(saging)-340.003(library)85.999(.)-454.999(The)-338.999(serv)28.005(er)-340.003(main)28.997(tains)-340.003(the)-338.999(precomputed)-339.992(data)]TJ 1 0 0 1 53.798 242.062 Tm [(in)-343.003(RAM)-341.999(and)-343.003(returns)-341.999(logs)-342.992(for)-342.01(v)57.002(alues)-342.992(passed)-343.003(t)0.993(o)-342.992(it)-343.003(b)28.997(y)-343.003(clien)29.008(ts.)]TJ 0.98 0 0 1 62.765 231.601 Tm [(W)87.003(e)-252.007(implemen)29.008(ted)-253(the)-253(descen)30.001(t)-253(calculation)-253(in)-253(a)-253(mix)-252.007(of)-253(Python)]TJ 0.996 0 0 1 53.798 221.141 Tm [(and)-343.995(C.)-460.006(The)-343.995(\034rst)-344.007(and)-343.995(second)-344.007(stages)-343.995(are)-343.995(parallelized)-344.999(and)-344.007(run)]TJ 0.983 0 0 1 53.798 210.68 Tm [(sieving)-347.999(in)-347.999(C,)-347.999(and)-347.999(the)-347.007(\034nal)-347.999(discrete)-347.999(log)-347.999(is)-347.999(deduced)-347.999(in)-347.999(Python.)]TJ 0.98 0 0 1 53.328 200.219 Tm [(W)87.003(e)-349.003(ran)-349.003(the)-348.992(serv)28.997(er)-349.003(on)-349.003(a)-349.996(mac)30.001(hine)-350.007(wit)1.004(h)-349.996(t)28.997(w)30.001(o)-350.007(18-c)1.004(ore)-349.996(In)28.997(t)1.004(el)-350.007(Xeon)]TJ 0.48 -10.461 Td [(E5-2699)-308.998(CPUs)-308.005(and)-308.998(128)-307.994(GB)-309.009(of)-308.998(RAM.)-451.999(On)-308.998(a)28.997(v)28.997(erage,)-316.995(c)1.004(om)-1.004(put)1.004(ing)]TJ 1.018 0 0 1 53.798 179.298 Tm [(individual)-335.999(logs)-335.006(to)-27.993(ok)-335.999(ab)-28.005(out)-334.995(70)-335.999(seconds,)-336.01(but)-334.995(the)-335.999(time)-335.006(v)56.009(aried)]TJ 0.981 0 0 1 53.798 168.837 Tm [(from)-349.003(34)-349.003(to)-348.992(206)-347.999(seconds)-349.003(\(see)-349.003(Fig.)-349.003(3\).)-464.992(This)-349.003(is)-349.003(divided)-349.003(b)-28.997(et)28.997(w)30.001(een)]TJ 0.98 0 0 1 53.798 158.376 Tm [(ab)-28.997(out)-307.002(20)-305.998(seconds)-307.002(for)-307.002(descen)30.001(t)-307.002(initialization)-307.002(and)-305.998(the)-307.002(remainder)]TJ 0.999 0 0 1 53.798 147.915 Tm [(on)-340.995(the)-342.01(middle)-340.995(phase.)-456.995(F)85.999(urther)-341.006(optimizations)-123.996(\026)-123.004(suc)28.005(h)-341.006(as)-340.995(more)]TJ 1.02 0 0 1 53.798 137.455 Tm [(e\033ectiv)28.005(e)-384(parallelization)-385.004(on)-384(the)-384(middle)-385.004(phase)-384(or)-384.993(additional)]TJ 0.984 0 0 1 53.798 126.994 Tm [(sieving)-125(\026)-126.004(should)-347.999(bring)-347.999(the)-347.999(median)-347.999(time)-347.999(w)28.997(ell)-347.999(b)-28.997(elo)28.997(w)-349.003(a)-347.999(min)29.008(ute.)]TJ 1.011 0 0 1 62.765 116.533 Tm [(F)84.995(or)-338.999(purp)-28.997(oses)-338.999(of)-338.999(comparison,)-338.999(a)-338.999(single)-338.999(512-bit)-339.01(RSA)-338.999(factor-)]TJ 1.02 0 0 1 53.798 106.072 Tm [(ization)-338.999(using)-338.999(the)-338.999(CADO-NFS)-338.999(implemen)27.993(tation)-338.999(tak)28.005(es)-338.999(ab)-28.005(out)]TJ 1.018 0 0 1 53.798 95.611 Tm [(eigh)28.005(t)-336.01(da)28.005(ys)-337.003(of)-335.999(w)28.005(all-clo)-28.005(c)28.005(k)-337.003(time)-335.999(on)-335.999(the)-337.003(computer)-335.999(used)-337.003(for)-335.999(the)]TJ 0.98 0 0 1 53.798 85.151 Tm [(descen)28.997(t,)-295.994(and)-282.008(ab)-28.997(out)-283.001(three)-281.997(hours)-281.997(parallelized)-283.001(across)-281.997(1,800)-283.001(co)0.993(res)]TJ 1 0 0 1 53.798 74.69 Tm [(of)-343.003(Amazon)-341.999(EC2)]TJ /T1_7 8.966 Tf 67.193 0 Td (c4.8xlarge)Tj /T1_1 8.966 Tf 50.146 0 Td (instances.)Tj ET q 1.0223 0 0 1.0223 316.812 641.546 cm /T1_1 8.966 Tf /Fm0 Do Q BT 0.98 0 0 1 316.812 626.254 Tm [(Figure)-323.006(3:)]TJ /T1_3 8.966 Tf 1 0 0 1 356.142 626.254 Tm [(Individual)-364.996(discrete)-364.003(log)-364.996(time)-365.007(for)-364.003(512-bit)-364.996(DH.)]TJ /T1_1 8.966 Tf 1.02 0 0 1 316.471 615.793 Tm [(After)-367.003(a)-366.992(w)27.993(eek-long)-366(precomputation)-367.003(for)-366.992(eac)27.993(h)-366.992(of)-367.003(the)-367.003(t)28.005(w)27.993(o)-366(top)]TJ 0.334 -10.461 Td [(exp)-28.005(ort-grade)-455.991(primes)-455.01(\(see)-455.991(T)83.991(able)-455.991(1\),)-485(w)27.993(e)-456.002(can)-455.991(quic)27.993(kly)-454.999(break)]TJ 0 -10.461 TD [(an)28.005(y)-347.007(k)28.005(ey)-347.007(exc)28.005(hange)-346.995(that)-347.007(uses)-346.995(them.)-481.999(Here)-347.007(w)28.005(e)-347.007(sho)28.005(w)-346.995(times)-347.007(for)]TJ 1 0 0 1 316.812 584.411 Tm [(computing)-343.003(3,500)-341.999(individual)-343.003(logs;)-341.999(the)-342.992(median)-342.01(is)-342.992(70)-343.003(sec)1.004(onds.)]TJ /T1_0 11.955 Tf 0 -33.817 TD [(3.4)-1000(Acti)10(v)10(e)-250(Attack)-250(Implementation)]TJ /T1_1 8.966 Tf 1.02 0 0 1 325.778 537.643 Tm [(W)84.003(e)-404.008(implemen)28.005(ted)-403.005(a)-403.997(man-in-the-middle)-403.997(ne)1.004(t)27.993(w)28.005(ork)-403.997(attac)27.993(k)28.005(er)]TJ 0.98 0 0 1 316.812 527.182 Tm [(that)-343.003(sits)-343.995(b)-28.997(et)29.99(w)29.008(een)-344.007(a)-342.992(TLS)-343.003(clien)28.997(t)-343.003(\(w)29.008(eb)-343.003(bro)28.997(wser\))-343.003(and)-343.995(an)30.001(y)-344.007(serv)29.008(er)]TJ 0 -10.46 TD [(that)-323.006(supp)-28.997(orts)]TJ /T1_2 7.97 Tf 57.374 0 Td (DHE_EXPORT)Tj /T1_1 8.966 Tf 59.366 0 Td [(and)-323.006(uses)-322.995(the)-322.995(most)-323.006(common)-322.995(512-)]TJ 0.996 0 0 1 316.812 506.261 Tm [(bit)-341.999(Apac)27.993(he)-341.999(group.)-457.999(Our)-341.999(implemen)28.997(tation)-342.992(follo)28.997(ws)-341.999(the)-343.003(message)]TJ 0.988 0 0 1 316.812 495.8 Tm [(sequence)-346.003(in)-346.003(Figure)-345.992(2:)-462.003(it)-346.003(do)28.997(wngrades)-344.999(the)-345.992(connection)-346.003(to)28.997(w)28.997(ards)]TJ 1.02 0 0 1 316.812 485.339 Tm [(the)-402.001(serv)28.005(er,)-418.005(computes)-402.001(the)-402.001(session)-402.001(k)28.005(eys,)-418.998(a)0.993(nd)-402.001(tak)28.005(es)-402.001(o)28.005(v)27.993(er)-402.001(the)]TJ 1 0 0 1 316.812 474.878 Tm [(connection)-341.999(to)27.993(w)29.008(ards)-343.003(the)-341.999(clien)27.993(t)-341.999(b)28.005(y)-341.999(imp)-28.997(ersonating)-341.999(the)-343.003(serv)28.997(er.)]TJ 1.02 0 0 1 325.778 464.418 Tm [(The)-373.004(main)-372.992(c)27.993(hallenge)-372.992(is)-373.004(t)1.004(o)-373.004(compute)-373.004(the)-373.004(shared)-372.992(secret)]TJ /T1_4 8.966 Tf 1 0 0 1 543.393 464.418 Tm (g)Tj /T1_8 5.978 Tf 4.716 3.809 Td (ab)Tj /T1_1 8.966 Tf 0.998 0 0 1 316.812 453.957 Tm [(b)-28.997(efore)-343.003(the)-343.995(handshak)28.997(e)-344.007(completes)-342.992(in)-344.007(order)-343.003(to)-343.995(forge)-343.995(a)]TJ /T1_9 8.966 Tf 207.996 0 Td (Finished)Tj /T1_1 8.966 Tf 0.995 0 0 1 316.812 443.496 Tm [(message)-344.999(from)-344.007(the)-344.999(serv)29.008(er.)-460.999(With)-344.007(our)-344.999(descen)28.997(t)-344.999(implemen)28.997(tation,)]TJ 1.019 0 0 1 316.812 433.035 Tm [(the)-334.995(computation)-336.01(tak)28.005(es)-334.995(an)-335.006(a)28.005(v)27.993(erage)-335.999(of)-334.995(70)-335.006(seconds,)-335.999(but)-334.995(there)]TJ 1 0 0 1 316.812 422.575 Tm [(are)-343.003(sev)28.997(eral)-342.992(w)28.997(a)28.997(ys)-343.003(an)-342.992(attac)28.997(k)28.997(er)-343.003(can)-342.992(w)28.997(ork)-343.003(around)-341.999(this)-343.003(dela)29.008(y:)]TJ /T1_10 8.966 Tf 0.989 0 0 1 316.296 407.734 Tm [(Non-bro)28.997(wser)-346.995(clien)28.997(ts.)]TJ /T1_1 8.966 Tf 90.668 0 Td [(Di\033eren)28.997(t)-346.995(TLS)-347.007(clien)28.005(ts)-346.995(imp)-29.008(ose)-346.995(di\033eren)28.997(t)]TJ 1.02 0 0 1 316.812 397.273 Tm [(time)-497(limits)-497(for)-497(the)-497(handshak)28.005(e,)-537.005(after)-497(whic)28.005(h)-497(the)0.993(y)-497(kill)-497(the)]TJ 0 -10.461 TD [(connection.)-796.005(Command-line)-451.999(clien)28.005(ts)-451.999(suc)27.993(h)-451.999(as)]TJ /T1_7 8.966 Tf 1 0 0 1 499.553 386.812 Tm (curl)Tj /T1_1 8.966 Tf 1.02 0 0 1 522.516 386.812 Tm (and)Tj /T1_7 8.966 Tf 1 0 0 1 541.793 386.812 Tm (git)Tj /T1_1 8.966 Tf 0.98 0 0 1 316.812 376.351 Tm [(often)-340.995(run)-341.006(unattended,)-341.999(so)-340.995(they)-341.006(ha)28.997(v)29.008(e)-340.003(long)-341.006(or)-340.995(no)-340.995(timeouts,)-341.999(and)]TJ 1 0 0 1 316.48 365.891 Tm [(w)28.997(e)-343.003(can)-342.992(hijac)28.997(k)-343.003(their)-341.999(connections)-343.003(without)-341.999(di\036cult)28.005(y)85.999(.)]TJ /T1_10 8.966 Tf 1.02 0 0 1 315.347 351.05 Tm [(TLS)-414.001(w)28.005(arning)-414.001(alerts.)]TJ /T1_1 8.966 Tf 92.268 0 Td [(W)84.003(eb)-414.001(bro)27.993(wsers)-413.99(tend)-414.001(to)-414.001(ha)27.993(v)28.005(e)-414.001(shorter)]TJ 0.98 0 0 1 316.812 340.589 Tm [(timeouts,)-331.995(but)-327.01(w)29.008(e)-328.002(can)-326.999(k)28.997(eep)-328.002(their)-326.999(connections)-328.002(a)1.004(liv)28.997(e)-328.002(b)29.008(y)-326.999(sending)]TJ 1.02 0 0 1 316.48 330.128 Tm [(TLS)-346.995(w)27.993(arning)-346.995(alerts,)-349.003(whic)28.005(h)-347.007(are)-346.995(ignored)-346.003(b)28.005(y)-347.007(the)-346.995(bro)27.993(wser)-346.995(but)]TJ 0.98 0 0 1 316.812 319.668 Tm [(reset)-233.003(the)-233.996(handshak)28.997(e)-233.003(timer.)-426.994(F)87.003(or)-234.007(e)1.004(x)-1.004(ample,)-256(this)-233.996(allo)30.001(ws)-234.007(us)-232.992(to)-234.007(k)29.008(eep)]TJ T* [(Firefo)28.997(x's)-319.995(TLS)-320.006(connections)-319.995(aliv)28.997(e)-319.995(inde\034nitely)87.995(.)-456.002(\(Other)-319.995(bro)28.997(wsers)]TJ 1.02 0 0 1 316.48 298.746 Tm [(w)28.005(e)-394.004(tested)-394.004(close)-393.993(the)-394.004(connection)-393.001(af)-1.004(t)1.004(er)-393.993(a)-394.004(min)27.993(ute.\))-622.992(Alt)0.993(hough)]TJ 0.325 -10.461 Td [(the)-430.998(victim)-432.002(co)1.004(nnection)-432.002(still)-430.998(tak)27.993(es)-430.998(m)28.005(uc)27.993(h)-432.002(longe)1.004(r)-432.002(than)-430.998(usual,)]TJ 0 -10.46 TD [(the)-427.005(attac)28.005(k)28.005(er)-427.005(migh)28.005(t)-428.009(c)28.005(ho)-28.005(ose)-426.994(to)-427.005(compromise)-426.994(a)-427.005(request)-427.998(for)-426.994(a)]TJ 0.983 0 0 1 316.812 267.364 Tm [(bac)28.997(kground)-347.999(resource)-346.995(that)-347.999(do)-29.008(es)-346.995(not)-347.999(dela)28.997(y)-347.999(re)1.004(ndering)-347.999(the)-347.999(page.)]TJ /T1_10 8.966 Tf 1.02 0 0 1 316.314 252.523 Tm [(Ephemeral)-385.997(k)27.993(ey)-384.993(cac)27.993(hing.)]TJ /T1_1 8.966 Tf 106.042 0 Td [(Man)28.005(y)-386.008(TLS)-384.993(serv)27.993(ers)-385.997(do)-385.997(not)-385.004(use)-385.997(a)]TJ -105.554 -10.461 Td [(fresh)-384(v)55.998(alue)]TJ /T1_4 8.966 Tf 1 0 0 1 364.655 242.062 Tm (b)Tj /T1_1 8.966 Tf 1.02 0 0 1 372.114 242.062 Tm [(for)-384(eac)28.005(h)-384(conne)0.993(ction,)-396.001(but)-384(instead)-384(compute)]TJ /T1_4 8.966 Tf 1 0 0 1 547.427 242.062 Tm (g)Tj /T1_8 5.978 Tf 4.716 3.809 Td (b)Tj /T1_1 8.966 Tf 0.98 0 0 1 316.812 231.601 Tm [(once)-277.001(and)-277.993(reuse)-277.001(it)-277.001(for)-278.005(m)28.997(ultiple)-277.001(negotiations.)-441.995(Without)-277.001(enabling)]TJ 1.02 0 0 1 316.812 221.141 Tm (the)Tj /T1_7 8.966 Tf 1 0 0 1 333.287 221.141 Tm (SSL_OP_SINGLE_DH_USE)Tj /T1_1 8.966 Tf 1.02 0 0 1 430.851 221.141 Tm [(option,)-382.997(Op)-28.005(enSSL)-373.004(will)-373.996(reuse)]TJ /T1_4 8.966 Tf 1 0 0 1 547.427 221.141 Tm (g)Tj /T1_8 5.978 Tf 4.716 3.809 Td (b)Tj /T1_1 8.966 Tf 1.02 0 0 1 316.812 210.68 Tm [(for)-341.999(the)-341.999(lifetime)-341.006(of)-341.999(a)-341.999(TLS)-341.999(con)28.005(text.)-466.006(While)-340.995(b)-28.005(oth)-341.999(Apac)28.005(he)-341.999(and)]TJ 0 -10.461 TD [(Nginx)-370.004(in)28.005(ternally)-369(apply)-370.004(this)-370.004(option,)-378(certain)-369.992(lo)0.993(ad)-369.992(balancers,)]TJ T* [(suc)28.005(h)-398.008(as)-396.993(stud)-398.008([48],)-412.997(do)-397.997(not.)-632.997(The)-397.004(F5)-397.997(BIG-IP)-398.008(load)-396.993(balancers)]TJ 0.98 0 0 1 316.812 179.298 Tm [(and)-347.999(hardw)30.001(are)-347.999(TLS)-347.999(fron)30.001(tends)-347.999(will)-348.01(reuse)]TJ /T1_4 8.966 Tf 1 0 0 1 474.177 179.298 Tm (g)Tj /T1_8 5.978 Tf 4.716 3.809 Td (b)Tj /T1_1 8.966 Tf 0.98 0 0 1 485.72 179.298 Tm [(unless)-347.999(the)-347.007(\020Single)]TJ -172.355 -10.461 Td [(DH\021)-331.002(option)-329.999(is)-331.002(c)29.008(hec)28.997(k)28.997(ed)-331.002([53].)-459.002(Microsoft)-330.991(Sc)28.997(hannel)-331.002(cac)30.001(h)-1.004(e)1.004(s)]TJ /T1_4 8.966 Tf 1 0 0 1 533.898 168.837 Tm (g)Tj /T1_8 5.978 Tf 4.716 3.809 Td (b)Tj /T1_1 8.966 Tf 0.98 0 0 1 545.292 168.837 Tm (for)Tj 0.983 0 0 1 316.812 158.376 Tm [(t)28.997(w)28.997(o)-348.992(hours)-126.004(\026)-125(this)-349.996(setting)-349.003(is)-349.996(hard-co)-29.008(ded.)-467.992(F)86.991(or)-348.992(these)-350.007(serv)28.997(ers,)-349.996(an)]TJ 0.98 0 0 1 316.812 147.915 Tm [(attac)28.997(k)28.997(er)-341.999(can)-341.999(compute)-342.992(the)-342.01(discrete)-341.999(log)-342.992(of)]TJ /T1_4 8.966 Tf 1 0 0 1 478.452 147.915 Tm (g)Tj /T1_8 5.978 Tf 4.716 3.809 Td (b)Tj /T1_1 8.966 Tf 0.98 0 0 1 489.949 147.915 Tm [(from)-341.999(one)-343.003(connec-)]TJ -176.67 -10.46 Td [(tion)-329.006(and)-328.995(use)-328.995(it)-329.006(to)-329.999(attac)30.001(k)-329.999(late)0.993(r)-329.999(handshak)29.008(e)0.993(s,)-333.991(a)28.997(v)30.001(oiding)-329.999(the)-329.006(need)]TJ 1.006 0 0 1 316.812 126.994 Tm [(to)-340.995(do)-340.003(the)-341.006(computation)-339.992(online.)-455.01(By)-339.992(randomly)-341.006(sampling)-340.995(IPv4)]TJ 0.997 0 0 1 316.812 116.533 Tm [(hosts)-341.999(serving)-341.999(bro)28.997(wser-trusted)-341.999(certi\034cates)-340.995(that)-342.01(supp)-28.997(ort)]TJ /T1_2 7.97 Tf 221.376 0 Td (DHE)Tj /T1_1 8.966 Tf (,)Tj 1.02 0 0 1 316.48 106.072 Tm [(w)28.005(e)-349.003(found)-349.003(that)-349.003(17%)-348.992(reused)]TJ /T1_4 8.966 Tf 1 0 0 1 427.051 106.072 Tm (g)Tj /T1_8 5.978 Tf 4.716 3.809 Td (b)Tj /T1_1 8.966 Tf 1.02 0 0 1 438.732 106.072 Tm [(at)-349.003(least)-349.003(once)-348.992(o)27.993(v)28.005(er)-349.003(the)-349.003(course)]TJ 1.01 0 0 1 316.812 95.611 Tm [(of)-340.003(20)-340.003(handshak)28.005(e)1.004(s)-1.004(,)-340.003(and)-338.999(that)-340.003(15%)-339.992(only)-340.003(used)-340.003(one)-340.003(v)57.002(alue.)-454.999(Ho)28.997(w-)]TJ 0.999 0 0 1 316.812 85.151 Tm [(ev)28.997(er,)-344.999(for)]TJ /T1_2 7.97 Tf 36.172 0 Td (DHE_EXPORT)Tj /T1_1 8.966 Tf [(,)-343.995(only)-343.995(0.1%)-344.999(reuse)0.993(d)]TJ /T1_4 8.966 Tf 1 0 0 1 486.471 85.151 Tm (g)Tj /T1_8 5.978 Tf 4.716 3.809 Td (b)Tj /T1_1 8.966 Tf 0.999 0 0 1 494.959 85.151 Tm [(,)-344.999(lik)28.997(ely)-343.995(b)-29.008(ecause)]TJ 1 0 0 1 316.812 74.69 Tm [(Microsoft)-343.003(I)-27.993(IS)-343.003(do)-28.005(es)-342.992(not)-342.01(supp)-28.997(ort)-341.999(512-bit)-343.003(exp)-27.993(ort)-343.003(ciphersuites.)]TJ -14.259 -29.888 Td (5)Tj ET BT /T1_0 8.966 Tf 1.02 0 0 1 52.333 728.239 Tm [(TLS)-367.003(F)84.003(alse)-367.003(Start.)]TJ /T1_1 8.966 Tf 76.714 0 Td [(Ev)28.005(en)-367.003(when)-367.003(clien)28.005(ts)-367.003(enforce)-367.003(shorter)-366.992(time-)]TJ 1.008 0 0 1 53.798 717.778 Tm [(outs)-338.999(and)-340.003(serv)28.005(ers)-338.999(do)-340.003(n)0.993(ot)-339.992(reuse)-338.999(v)55.998(alues)-338.999(for)]TJ /T1_2 8.966 Tf 1 0 0 1 217.53 717.778 Tm (b)Tj /T1_1 8.966 Tf 1.008 0 0 1 221.479 717.778 Tm [(,)-340.003(the)-338.999(attac)28.005(k)28.997(er)-340.003(can)]TJ 1.02 0 0 1 53.798 707.318 Tm [(still)-385.004(break)-385.997(the)-385.004(con\034den)28.005(tialit)28.005(y)-385.004(of)-385.997(user)-385.004(requests)-385.004(if)-385.997(the)-385.004(clien)28.005(t)]TJ 0.989 0 0 1 53.798 696.857 Tm [(supp)-28.997(orts)-346.003(the)-346.003(TLS)-346.003(F)87.003(alse)-346.003(Start)-345.992(extension)-346.003([30].)-462.003(This)-346.003(extension)]TJ 1.02 0 0 1 53.798 686.396 Tm [(reduces)-340.003(connection)-340.003(latency)-339.992(b)27.993(y)-339.992(ha)27.993(ving)-340.995(the)-340.003(clien)27.993(t)-339.992(send)-340.003(early)]TJ 0.98 0 0 1 53.798 675.935 Tm [(application)-313.994(data)-314.006(\(suc)28.997(h)-313.002(as)-313.994(an)-314.006(HTTP)-313.994(request\))-314.006(without)-313.994(w)30.001(aiting)]TJ 1.013 0 0 1 53.798 665.474 Tm [(for)-337.003(the)-335.999(serv)28.005(er's)]TJ /T1_3 8.966 Tf 62.735 0 Td (Finished)Tj /T1_1 8.966 Tf 34.605 0 Td [(message)-337.003(to)-335.999(arriv)28.005(e.)-450.002(R)-1.004(e)1.004(cen)27.993(t)-336.991(v)27.993(ersions)]TJ 1.003 0 0 1 53.798 655.014 Tm [(of)-343.003(Chrome,)-343.003(In)29.008(ternet)-343.003(Explorer,)-343.003(and)-341.999(F)-1.004(ire)1.004(f)-1.004(o)29.008(x)-343.003(implemen)28.997(t)-343.003(F)85.006(alse)]TJ 1.012 0 0 1 53.798 644.553 Tm [(Start,)-337.995(but)-338.006(their)-337.995(p)-28.005(olicies)-337.995(on)-338.006(when)-337.995(to)-338.006(enable)-337.995(it)-338.006(v)56.009(ary)-338.006(b)-27.993(et)27.993(w)28.005(e)0.993(en)]TJ 0.98 0 0 1 53.559 634.092 Tm [(v)28.997(ersions.)-444.002(Firefo)29.008(x)-285.008(35,)-297.99(Chrome)-285.008(41,)-296.998(and)-284.997(In)28.997(ternet)-284.997(Explorer)-284.997(\(Win-)]TJ 1.006 0 0 1 53.798 623.631 Tm [(do)28.005(ws)-341.006(10\))-340.995(send)-341.006(F)85.999(alse)-340.995(Start)-340.995(data)-341.006(with)]TJ /T1_4 7.97 Tf 148.464 0 Td (DHE)Tj /T1_1 8.966 Tf [(.)-454.999(In)-341.999(t)0.993(hese)-340.995(cases,)-341.999(a)]TJ 0.98 0 0 1 53.798 613.171 Tm [(man-in-the-middle)-284.005(can)-283.994(record)-283.001(the)-284.005(handshak)29.008(e)-284.005(and)-284.005(decrypt)-283.994(the)]TJ 0 -10.461 TD [(F)87.003(alse)-347.007(Start)-347.999(pa)28.997(yload)-347.999(at)-347.999(le)1.004(isure.)-465.995(W)86.991(e)-346.995(note)-347.999(that)-347.999(this)-347.007(initial)-347.999(data)]TJ T* [(sen)28.997(t)-287.997(b)28.997(y)-287.997(a)-287.997(bro)28.997(wser)-287.997(ofte)0.993(n)-288.99(c)0.993(on)28.997(tains)-287.997(sensitiv)28.997(e)-287.997(user)-287.997(authen)28.997(tication)]TJ 1 0 0 1 53.798 581.788 Tm [(information,)-343.003(suc)28.997(h)-342.992(as)-341.999(passw)27.993(ords)-341.999(and)-343.003(co)-27.993(okies.)]TJ /T1_5 11.955 Tf 0 -21.992 TD [(3.5)-1000(Other)-250(W)65(eak)-250(and)-250(Miscon\002gur)18(ed)-250(Gr)18(oups)]TJ /T1_1 8.966 Tf 1.019 0 0 1 62.765 546.844 Tm [(In)-335.999(our)-337.003(scans,)-337.003(w)28.005(e)-335.999(found)-337.003(sev)28.005(era)0.993(l)-336.991(other)-336.01(exploitable)-336.991(securit)27.993(y)]TJ 1 0 0 1 53.798 536.384 Tm [(issues)-343.003(in)-341.999(the)-343.003(DHE)-341.999(con\034gurations)-342.992(used)-342.01(b)28.005(y)-341.999(TLS)-343.003(serv)28.997(ers.)]TJ /T1_6 8.966 Tf 0 -15.231 TD [(512-bit)-538(p)1(r)-1.004(imes)-536.994(in)-538.009(non-exp)-31.997(ort)]TJ /T1_7 7.97 Tf 142.752 0 Td (DHE)Tj /T1_1 8.966 Tf 1.02 0 0 1 227.729 521.153 Tm [(W)84.003(e)-457.999(found)-457.999(2,63)0.993(1)]TJ -170.521 -10.461 Td [(serv)28.005(ers)-486.003(with)-486.003(bro)28.005(wser-truste)0.993(d)-485.992(certi\034cates)-486.003(\(and)-486.003(118)-485.992(in)-485(the)]TJ -0.325 -10.46 Td [(T)84.003(op)-408.001(1M)-408.001(domains\))-408.001(that)-408.001(used)-408.001(512-bit)-408.001(or)-408.001(w)28.005(eak)28.005(er)-408.001(primes)-408.001(f)-1.004(or)]TJ 0.325 -10.461 Td [(non-exp)-28.005(ort)]TJ /T1_4 7.97 Tf 48.325 0 Td (DHE)Tj /T1_1 8.966 Tf [(.)-871.007(In)-476.992(these)-477.003(instances,)-512(activ)28.005(e)-477.003(attac)27.993(ks)-476.992(ma)27.993(y)]TJ -48.325 -10.461 Td [(b)-28.005(e)-360.992(unnecessary)83.991(.)-522.997(If)-361.003(a)-360.992(bro)27.993(w)1.004(ser)-361.003(negotiates)-360.992(a)]TJ /T1_4 7.97 Tf 170.412 0 Td (DHE)Tj /T1_1 8.966 Tf 20.408 0 Td (ciphersuite)Tj -191.144 -10.461 Td [(with)-346.995(one)-348.01(of)-346.995(these)-346.995(serv)27.993(ers,)-349.996(a)]TJ /T1_8 8.966 Tf 112.876 0 Td [(p)51.002(assive)]TJ /T1_1 8.966 Tf 31.208 0 Td [(ea)28.005(v)27.993(esdropp)-27.993(er)-347.007(can)-347.999(later)]TJ -143.76 -10.46 Td [(compute)-364.996(the)-365.007(discrete)-364.996(log)-364.996(and)-365.007(obt)1.004(ain)-365.007(the)-364.996(TLS)-364.996(session)-365.007(k)28.005(eys)]TJ 1.008 0 0 1 53.798 447.928 Tm [(for)-340.003(the)-340.003(connection.)-452.991(An)-340.003(activ)28.997(e)-340.003(attac)28.005(k)-340.003(ma)28.997(y)-339.992(still)-340.003(b)-28.005(e)-339.992(necessary)]TJ 0.98 0 0 1 53.467 437.467 Tm [(when)-343.003(the)-343.995(clien)30.001(t's)-344.007(ordering)-342.992(of)-343.003(ciphersuites)-344.007(w)29.008(ould)-343.003(result)-343.003(in)-343.995(the)]TJ 0.338 -10.461 Td [(serv)28.997(er)-283.994(not)-284.005(selecting)]TJ /T1_4 7.97 Tf 79.07 0 Td (DHE)Tj /T1_1 8.966 Tf [(.)-284.005(In)-283.994(this)-284.005(case,)-296.998(as)-284.005(in)-282.99(the)]TJ /T1_4 7.97 Tf 108.737 0 Td (DHE_EXPORT)Tj /T1_1 8.966 Tf 0.986 0 0 1 53.798 416.546 Tm [(do)28.997(wngrade)-347.999(attac)28.997(k,)-347.999(an)-347.999(activ)29.008(e)-348.01(attac)29.008(k)28.997(er)-347.999(can)-347.999(force)-347.999(the)-347.999(serv)28.997(er)-347.999(to)]TJ 1 0 0 1 53.798 406.085 Tm [(c)28.997(ho)-28.997(ose)-343.003(a)-341.999(vulnerable)]TJ /T1_4 7.97 Tf 81.742 0 Td (DHE)Tj /T1_1 8.966 Tf 20.244 0 Td (ciphersuite.)Tj 1.02 0 0 1 62.765 395.624 Tm [(As)-402.001(a)-403.005(pro)-27.993(of-of-concept,)-418.005(w)28.005(e)-403.005(implemen)28.005(ted)-402.001(a)-402.001(passiv)28.005(e)-403.005(ea)28.005(v)27.993(es-)]TJ 0.998 0 0 1 53.798 385.163 Tm [(dropp)-28.997(er)-341.999(for)-341.999(regular)]TJ /T1_4 7.97 Tf 79.967 0 Td (DHE)Tj /T1_1 8.966 Tf 20.239 0 Td [(connections)-341.999(and)-341.999(used)-341.999(it)-341.999(to)-343.003(decrypt)]TJ 0.98 0 0 1 53.798 374.702 Tm [(test)-280.001(connections)-278.997(to)-280.001(www.fbi.go)28.997(v)-6(.)-442.998(Un)28.997(til)-280.001(April)-280.001(2015,)-292.994(this)-280.001(serv)28.997(er)]TJ 1.02 0 0 1 53.798 364.242 Tm [(used)-394.004(the)-393.001(default)-393.993(512-bit)-394.004(DH)-393.001(group)-393.993(from)-394.004(Op)-28.005(enSSL,)-393.993(whic)27.993(h)]TJ -0.325 -10.461 Td [(w)28.005(as)-370.004(the)-370.004(third)-369.992(group)-370.004(for)-370.004(whic)28.005(h)-370.004(w)28.005(e)-370.004(p)-28.005(erformed)-369.992(the)-370.004(NFS)-370.004(pre-)]TJ 1 0 0 1 53.798 343.32 Tm [(computation.)-456.995(The)-342.01(w)28.005(ebsite)-341.999(no)-343.003(longer)-341.999(supp)-28.997(orts)]TJ /T1_4 7.97 Tf 187.077 0 Td (DHE)Tj /T1_1 8.966 Tf (.)Tj /T1_6 8.966 Tf -187.48 -15.23 Td [(A)33(ttac)33(ks)-595(on)-595(comp)-33.001(osite-order)-593.995(s)-1.004(u)1.004(bgroups)]TJ /T1_1 8.966 Tf 1.02 0 0 1 251.545 328.09 Tm [(F)84.003(ailure)-507.004(t)1.004(o)]TJ 1.016 0 0 1 53.798 317.629 Tm [(generate)-337.003(Di\036e-Hellman)-337.003(primes)-336.991(according)-337.003(to)-337.003(b)-27.993(est)-337.003(practices)]TJ 1.02 0 0 1 53.798 307.168 Tm [(can)-454.999(result)-454.006(in)-454.999(dev)55.998(astating)-454.999(attac)28.005(ks.)-804.002(Not)-454.999(e)1.004(v)27.001(e)0.993(ry)-454.999(TLS)-454.999(serv)28.005(er)]TJ 0 -10.461 TD [(uses)-412.005(\020safe\021)-412.997(primes.)-677.998(Out)-412.005(of)-411.994(appro)27.993(xim)-0.993(at)0.993(ely)-412.997(70,000)-411.994(distinct)]TJ 1.014 0 0 1 53.798 286.247 Tm [(primes)-338.999(seen)-338.999(across)-338.999(b)-29.008(oth)-338.999(exp)-27.993(ort)-338.999(and)-338.999(non-exp)-28.005(ort)-340.003(TL)1.004(S)-340.003(scans,)]TJ 1.007 0 0 1 53.476 275.786 Tm [(4,800)-340.995(w)28.997(ere)-341.006(not)-339.992(safe,)-341.006(meaning)-340.995(that)]TJ /T1_9 8.966 Tf 139.239 0 Td (\()Tj /T1_2 8.966 Tf 1 0 0 1 197.299 275.786 Tm (p)Tj /T1_10 8.966 Tf 6.676 0 Td (\000)Tj /T1_9 8.966 Tf 1.007 0 0 1 213.193 275.786 Tm (1\))Tj /T1_2 8.966 Tf 1 0 0 1 221.442 275.786 Tm (=)Tj /T1_9 8.966 Tf 1.007 0 0 1 226.05 275.786 Tm (2)Tj /T1_1 8.966 Tf 7.662 0 Td [(w)28.005(as)-340.003(comp)-28.997(osite.)]TJ 1.02 0 0 1 52.72 265.325 Tm [(\(Inciden)28.005(tally)83.991(,)-378(w)28.005(e)-369(also)-370.004(found)-369.992(9)-369(comp)-28.005(osite)]TJ /T1_2 8.966 Tf 1 0 0 1 222.3 265.325 Tm (p)Tj /T1_1 8.966 Tf 1.02 0 0 1 226.926 265.325 Tm [(.\))-549.005(These)-369(groups)]TJ 0.98 0 0 1 53.798 254.864 Tm [(are)-310.002(not)-310.002(nece)1.004(s)-1.004(sa)1.004(rily)-310.002(vulnerable,)-317.998(as)-310.002(long)-310.002(as)]TJ /T1_2 8.966 Tf 1 0 0 1 216.198 254.864 Tm (g)Tj /T1_1 8.966 Tf 0.98 0 0 1 223.636 254.864 Tm [(generates)-310.002(a)-310.002(g)1.004(roup)]TJ -173.642 -10.46 Td [(with)-320.998(at)-320.006(least)-320.998(one)-320.998(su\036cien)28.997(tly)-320.998(large)-319.995(subgroup)-320.998(order)-321.01(to)-320.998(rule)-319.995(out)]TJ 1 0 0 1 53.798 233.943 Tm [(the)-343.003(P)28.997(ohlig-Hellman)-342.992(a)0.993(lgorithm)-342.992(as)-343.003(an)-341.999(attac)27.993(k.)]TJ 1.02 0 0 1 62.765 223.482 Tm [(In)-391.004(some)-391.997(real-life)-391.004(con\034gurations,)-405.001(ho)28.005(w)28.005(ev)27.993(er,)-405.001(c)28.005(ho)-28.005(osing)-390.993(suc)27.993(h)]TJ -8.791 -10.461 Td [(primes)-353.999(can)-355.003(le)1.004(ad)-355.003(to)-353.999(an)-353.999(attac)28.005(k.)-503(F)83.991(or)-353.999(e\036ciency)-354.992(reasons,)-358.003(some)]TJ 0.98 0 0 1 53.798 202.56 Tm [(implemen)28.997(tations)-244.992(use)-245.004(ephemeral)-245.004(k)28.997(eys)]TJ /T1_2 8.966 Tf 1 0 0 1 197.057 202.56 Tm (g)Tj /T1_11 5.978 Tf 4.716 3.809 Td (x)Tj /T1_1 8.966 Tf 0.98 0 0 1 208.596 202.56 Tm [(with)-245.004(a)-244.992(short)-245.004(exp)-28.997(onen)28.997(t)]TJ /T1_2 8.966 Tf 1 0 0 1 53.798 192.1 Tm (x)Tj /T1_1 8.966 Tf 0.98 0 0 1 59.022 192.1 Tm [(;)-343.003(commonly)-340.003(suggested)-339.992(sizes)-340.003(for)]TJ /T1_2 8.966 Tf 1 0 0 1 183.098 192.1 Tm (x)Tj /T1_1 8.966 Tf 0.98 0 0 1 191.31 192.1 Tm [(are)-340.003(as)-340.003(small)-339.992(as)-340.003(160)-340.003(or)-340.995(224)]TJ 0.984 0 0 1 53.798 181.639 Tm [(bits,)-349.003(in)28.997(tended)-348.992(to)-347.999(matc)28.997(h)-349.003(the)-349.003(estimated)-347.999(strength)-348.992(of)-349.003(a)-349.003(1024-)-347.999(or)]TJ 1.02 0 0 1 53.568 171.178 Tm [(2048-bit)-375(group.)-567.006(F)84.003(or)-375(safe)]TJ /T1_2 8.966 Tf 1 0 0 1 157.804 171.178 Tm (p)Tj /T1_1 8.966 Tf 1.02 0 0 1 162.431 171.178 Tm [(,)-385.004(suc)28.005(h)-376.004(exp)-27.993(onen)27.993(t)-375(lengths)-375(are)-375.993(not)]TJ 0.999 0 0 1 53.798 160.717 Tm [(kno)28.997(wn)-343.003(to)-341.999(decrease)-342.992(se)0.993(curit)28.005(y)85.999(,)-343.003(as)-341.999(the)-341.999(most)-343.003(e\036cien)29.008(t)-343.003(attac)28.997(k)-341.999(will)]TJ 1.02 0 0 1 53.798 150.257 Tm [(b)-28.005(e)-391.997(the)-393.001(P)28.005(ollard)-392.008(lam)28.005(b)-28.005(da)-393.001(algorithm.)-616.992(But)-393.001(if)-391.997(the)-393.001(order)-392.008(of)-393.001(the)]TJ 0.98 0 0 1 53.798 139.796 Tm [(subgroup)-341.999(generated)-343.003(b)28.997(y)]TJ /T1_2 8.966 Tf 1 0 0 1 146.71 139.796 Tm (g)Tj /T1_1 8.966 Tf 0.98 0 0 1 154.435 139.796 Tm [(has)-341.999(small)-343.003(factors,)-343.995(they)-341.999(can)-343.003(b)-28.997(e)-341.999(used)]TJ 1.02 0 0 1 53.798 129.335 Tm [(to)-350.999(re)1.004(co)27.993(v)27.001(e)1.004(r)-350.999(information)-350.999(ab)-28.005(out)-349.996(exp)-28.005(onen)28.005(ts.)-492.003(F)84.003(rom)-350.007(a)-350.999(subset)-349.996(of)]TJ T* (factors)Tj /T1_10 8.966 Tf 1 0 0 1 85.165 118.874 Tm (f)Tj /T1_2 8.966 Tf (q)Tj /T1_11 5.978 Tf 9.047 4.167 Td (e)Tj /T1_12 4.981 Tf 3.521 -1.078 Td (1)Tj /T1_13 5.978 Tf -3.843 -5.446 Td (1)Tj /T1_2 8.966 Tf 9.765 2.357 Td [(:)-171(:)-172(:)-171.005(q)]TJ /T1_11 5.978 Tf 16.727 4.489 Td (e)Tj /T1_14 4.981 Tf 3.521 -1.4 Td (k)Tj /T1_11 5.978 Tf -3.843 -5.745 Td (k)Tj /T1_10 8.966 Tf 8.696 2.656 Td (g)Tj /T1_1 8.966 Tf 1.02 0 0 1 137.242 118.874 Tm (with)Tj /T1_15 9.963 Tf 1 0 0 1 159.397 126.097 Tm (Q)Tj /T1_11 5.978 Tf 9.409 -10.461 Td (i)Tj /T1_2 8.966 Tf 4.698 3.238 Td (q)Tj /T1_11 5.978 Tf 4.439 4.35 Td (e)Tj /T1_14 4.981 Tf 3.521 -1.261 Td (i)Tj /T1_11 5.978 Tf -3.843 -5.555 Td (i)Tj /T1_9 8.966 Tf 1.02 0 0 1 189.021 118.874 Tm (=)Tj /T1_2 8.966 Tf 1 0 0 1 200.236 118.874 Tm (z)Tj /T1_1 8.966 Tf 1.02 0 0 1 204.909 118.874 Tm [(,)-445.998(P)27.993(ohlig-Hellman)-423.994(can)]TJ 0.98 0 0 1 53.798 107.417 Tm [(reco)28.997(v)28.997(er)]TJ /T1_2 8.966 Tf 1 0 0 1 84.694 107.417 Tm (x)Tj /T1_9 8.966 Tf 11.367 0 Td [(mo)-29(d)]TJ /T1_2 8.966 Tf 20.734 0 Td (z)Tj /T1_1 8.966 Tf 0.98 0 0 1 124.482 107.417 Tm [(in)-343.003(time)]TJ /T1_15 9.963 Tf 1 0 0 1 155.597 114.64 Tm (P)Tj /T1_11 5.978 Tf 10.516 -10.461 Td (i)Tj /T1_2 8.966 Tf 4.698 3.238 Td (e)Tj /T1_11 5.978 Tf 4.284 -0.996 Td (i)Tj /T1_10 8.966 Tf 3.162 6.598 Td (p)Tj ET 0.379 w  q 1 0 0 1 185.936 113.208 cm 0 0 m 7.279 0 l S Q BT /T1_2 8.966 Tf 185.936 107.417 Td (q)Tj /T1_11 5.978 Tf 4.118 -0.996 Td (i)Tj /T1_1 8.966 Tf 0.98 0 0 1 193.215 107.417 Tm [(.)-463.999(If)]TJ /T1_2 8.966 Tf 1 0 0 1 208.832 107.417 Tm (x)Tj /T1_10 8.966 Tf 7.784 0 Td (\024)Tj /T1_2 8.966 Tf 9.727 0 Td (z)Tj /T1_1 8.966 Tf 0.98 0 0 1 231.016 107.417 Tm [(,)-343.995(this)-343.003(su\036ces)-343.003(to)]TJ 1.02 0 0 1 53.798 96.956 Tm [(reco)28.005(v)27.993(er)]TJ /T1_2 8.966 Tf 1 0 0 1 85.996 96.956 Tm (x)Tj /T1_1 8.966 Tf 1.02 0 0 1 91.219 96.956 Tm [(.)-474.996(If)-344.999(not,)-348.01(P)28.005(ollard)-344.999(lam)27.993(b)-27.993(da)-344.999(can)-344.999(use)-344.999(this)-344.999(information)]TJ 1.009 0 0 1 53.798 85.151 Tm [(to)-337.995(reco)27.993(v)28.005(er)]TJ /T1_2 8.966 Tf 1 0 0 1 96.911 85.151 Tm (x)Tj /T1_1 8.966 Tf 1.009 0 0 1 105.197 85.151 Tm [(in)-338.999(time)]TJ /T1_15 9.963 Tf 1 0 0 1 137.154 93.42 Tm (p)Tj ET 0.398 w  q 1 0 0 1 147.117 93.619 cm 0 0 m 14.505 0 l S Q BT /T1_2 8.966 Tf 147.117 85.151 Td (x=z)Tj /T1_1 8.966 Tf 1.009 0 0 1 161.621 85.151 Tm [(.)-451.999(This)-338.999(attac)27.993(k)-337.995(w)27.993(as)-337.995(\034rst)-338.999(describ)-28.005(ed)]TJ 1 0 0 1 53.798 74.69 Tm [(as)-343.003(h)28.997(yp)-28.997(othetical)-341.999(b)28.005(y)-341.999(v)56.991(an)-342.992(Oorsc)28.997(hot)-343.003(and)-341.999(Wiener)-343.003([51].)]TJ 1.018 0 0 1 325.778 728.239 Tm [(T)84.003(o)-335.006(see)-335.999(if)-335.999(TLS)-334.995(serv)27.993(ers)-335.999(in)-334.995(the)-335.999(wild)-335.006(w)28.005(ere)-335.999(vulnerable)-335.006(to)-335.999(this)]TJ 0.98 0 0 1 316.812 717.778 Tm [(attac)28.997(k,)-346.003(w)29.008(e)-344.999(tested)-344.999(v)58.998(arious)-344.999(non-safe)-344.999(prim)-1.004(e)1.004(s)-346.003(found)-344.999(in)-344.999(our)-344.999(scans.)]TJ 1.02 0 0 1 316.812 707.318 Tm [(F)84.003(or)-454.999(eac)27.993(h)-454.999(non-safe)-456.002(prime)]TJ /T1_2 8.966 Tf 1 0 0 1 422.495 707.318 Tm (p)Tj /T1_1 8.966 Tf 1.02 0 0 1 427.121 707.318 Tm [(,)-485(w)28.005(e)-455.01(opp)-27.993(ortunistically)-454.999(factored)]TJ /T1_2 8.966 Tf 1 0 0 1 316.812 696.857 Tm (p)Tj /T1_10 8.966 Tf 6.668 0 Td (\000)Tj /T1_9 8.966 Tf 1.013 0 0 1 332.69 696.857 Tm (1)Tj /T1_1 8.966 Tf 7.637 0 Td [(using)-337.995(Bernstein's)-338.006(batc)28.997(h)-337.995(metho)-28.005(d)-337.995([5].)-451.006(W)84.003(e)-337.003(then)-337.995(ran)-337.995(the)]TJ 0.996 0 0 1 316.812 686.396 Tm [(GMP-ECM)-343.995(implemen)27.993(t)1.004(ations)-344.999(of)-344.007(the)-343.995(P)28.997(ollard)]TJ /T1_2 8.966 Tf 1 0 0 1 493.585 686.396 Tm (p)Tj /T1_10 8.966 Tf 6.675 0 Td (\000)Tj /T1_9 8.966 Tf 0.996 0 0 1 509.477 686.396 Tm (1)Tj /T1_1 8.966 Tf 7.695 0 Td (algorithm)Tj -201.134 -10.461 Td [(and)-344.999(t)1.004(he)-344.999(ECM)-345.01(fact)1.004(oring)-344.999(metho)-28.997(ds)-344.007([54])-344.999(for)-343.995(5)-344.999(da)28.997(ys)-344.999(parallelized)]TJ 1 0 0 1 316.812 665.474 Tm [(across)-343.003(28)-341.999(cores)-343.003(and)-341.999(disco)28.005(v)28.997(ered)-343.003(36,447)-341.999(prime)-342.992(factors.)]TJ 0.98 0 0 1 325.778 655.014 Tm [(W)87.003(e)-275.004(then)-275.997(examined)-275.997(the)-275.004(generators)]TJ /T1_2 8.966 Tf 1 0 0 1 458.655 655.014 Tm (g)Tj /T1_1 8.966 Tf 0.98 0 0 1 465.793 655.014 Tm [(used)-275.997(with)-275.004(eac)28.997(h)-275.997(prime)]TJ /T1_2 8.966 Tf 1 0 0 1 550.568 655.014 Tm (p)Tj /T1_1 8.966 Tf 0.98 0 0 1 555.194 655.014 Tm (.)Tj 1.007 0 0 1 316.342 644.553 Tm [(W)84.995(e)-338.999(classi\034ed)-339.992(a)-339.01(tuple)]TJ /T1_9 8.966 Tf 85.504 0 Td (\()Tj /T1_2 8.966 Tf 1 0 0 1 406.054 644.553 Tm [(p;)-171.005(g)-35.99(;)-171.005(y)]TJ /T1_9 8.966 Tf 1.007 0 0 1 428.448 644.553 Tm (\))Tj /T1_1 8.966 Tf 6.628 0 Td [(sen)28.005(t)-339.01(b)28.005(y)-338.999(a)-340.003(serv)28.997(er)-339.992(as)-338.999(in)27.993(teresting)]TJ 0.98 0 0 1 316.812 634.092 Tm [(if)-334.002(the)-334.002(prime)-333.991(factorization)-334.002(of)]TJ /T1_2 8.966 Tf 1 0 0 1 428.618 634.092 Tm (p)Tj /T1_10 8.966 Tf 6.401 0 Td (\000)Tj /T1_9 8.966 Tf 0.98 0 0 1 443.961 634.092 Tm (1)Tj /T1_1 8.966 Tf 7.603 0 Td [(had)-334.002(rev)28.997(ealed)-333.991(prime)-334.002(factors)]TJ 1.015 0 0 1 316.812 623.631 Tm [(of)-337.995(the)-338.006(order)-337.995(of)]TJ /T1_2 8.966 Tf 1 0 0 1 378.536 623.631 Tm (g)Tj /T1_1 8.966 Tf 1.015 0 0 1 383.252 623.631 Tm [(,)-337.995(and)-338.006(ordered)-337.995(them)-338.999(b)28.997(y)-338.999(the)-338.006(estimated)-337.995(w)27.993(ork)]TJ 0.98 0 0 1 316.812 613.171 Tm [(required)-281.997(using)-283.001(P)28.997(ohlig-Hellman)-281.997(and)-283.001(P)28.997(ollard)-281.997(lam)28.997(b)-28.997(da)-283.001(to)-281.997(reco)28.997(v)28.997(er)]TJ T* [(a)-334.002(target)-334.995(priv)57.994(ate)-333.991(exp)-29.008(onen)28.997(t)]TJ /T1_2 8.966 Tf 1 0 0 1 419.926 602.71 Tm (x)Tj /T1_1 8.966 Tf 0.98 0 0 1 428.088 602.71 Tm [(of)-334.002(length)-334.995(ranging)-334.002(from)]TJ /T1_9 8.966 Tf 93.444 0 Td (64)Tj /T1_1 8.966 Tf 12.214 0 Td (to)Tj /T1_9 8.966 Tf 11.19 0 Td (256)Tj /T1_1 8.966 Tf 1.02 0 0 1 316.812 592.249 Tm [(bits.)-480.003(There)-346.995(w)27.993(ere)-346.995(753)]TJ /T1_9 8.966 Tf 86.7 0 Td (\()Tj /T1_2 8.966 Tf 1 0 0 1 408.902 592.249 Tm [(p;)-171.005(g)]TJ /T1_9 8.966 Tf 1.02 0 0 1 422.339 592.249 Tm (\))Tj /T1_1 8.966 Tf 6.693 0 Td [(pairs)-346.995(where)-346.003(w)27.993(e)-346.995(knew)-346.995(factors)-346.003(of)]TJ 0.98 0 0 1 316.812 581.788 Tm [(the)-331.002(subgroup)-331.995(gene)0.993(rated)-331.995(b)28.997(y)]TJ /T1_2 8.966 Tf 1 0 0 1 424.889 581.788 Tm (g)Tj /T1_1 8.966 Tf 0.98 0 0 1 429.605 581.788 Tm [(;)-337.003(these)-331.995(had)-331.002(b)-28.997(een)-331.002(used)-332.006(for)-330.991(40,903)]TJ 1 0 0 1 316.812 571.328 Tm [(connections)-341.999(across)-343.003(all)-343.003(of)-341.999(our)-342.992(scans.)]TJ 0.98 0 0 1 325.778 560.867 Tm [(W)87.003(e)-239.003(implemen)28.997(ted)-238.992(the)-239.003(v)58.998(an)-239.996(O)0.993(orsc)29.008(hot)-239.003(and)-239.003(Wiener)-239.996(a)1.004(lgorithm)-240.007(in)]TJ -9.149 -10.461 Td [(Sage)-289.001([47])-289.001(using)-289.994(a)-289.001(parallel)-289.001(P)28.997(ollard)-289.001(rho)-289.001(implemen)29.008(tation)-289.001(that)-289.001(w)28.997(e)]TJ -0.339 -10.461 Td [(wrote)-280.001(in)-278.997(C)-280.001(using)-280.001(the)-280.001(GMP)-278.997(library)87.003(.)-443.009(W)88.006(e)-280.001(used)-280.001(the)-278.997(distinguished)]TJ 1.005 0 0 1 316.812 529.484 Tm [(p)-28.005(oin)28.005(ts)-341.999(metho)-28.005(d)-341.999(for)-340.995(collision)-341.999(detection;)-341.999(for)-341.006(a)-341.999(prime)-341.999(kno)28.997(wn)-341.999(in)]TJ 1 0 0 1 316.812 519.024 Tm [(adv)57.002(ance,)-341.999(t)0.993(his)-341.999(implemen)29.008(tation)-342.01(can)-340.995(b)-28.997(e)-341.006(arbitrarily)-340.995(sp)-28.997(ed)-341.006(up)-341.999(b)28.997(y)]TJ T* [(precomputing)-343.001(a)-342(table)-343.003(of)-341.999(distinguished)-343.003(p)-27.993(oin)27.993(ts.)]TJ 1.001 0 0 1 325.778 498.102 Tm [(W)85.999(e)-343.995(computed)-343.003(partial)-344.007(information)-342.992(ab)-29.008(out)-342.992(the)-343.003(serv)28.005(er)-343.003(secret)]TJ 1.02 0 0 1 316.812 487.641 Tm [(exp)-28.005(onen)28.005(t)-400.997(used)-402.001(in)-402.001(460)-400.997(exc)27.993(hanges)-402.001(and)-400.997(w)28.005(ere)-402.001(able)-401.008(to)-402.001(reco)28.005(v)28.005(er)]TJ 0.991 0 0 1 316.812 477.181 Tm [(the)-344.999(whole)-344.999(e)0.993(x)-0.993(p)-28.005(onen)28.997(t)-344.999(used)-344.999(b)29.008(y)-344.999(159)-345.01(di\033eren)29.008(t)-344.999(hosts,)-344.999(53)-344.999(o)0.993(f)-344.999(whic)28.997(h)]TJ 1.004 0 0 1 316.812 466.72 Tm [(authen)28.997(ticated)-340.003(wit)1.004(h)-340.003(v)57.002(alid)-338.999(bro)28.005(wser-trust)0.993(ed)-339.992(certi\034cate)0.993(s.)-454.999(In)-338.999(all)]TJ 0.984 0 0 1 316.812 456.259 Tm [(cases,)-349.003(the)-349.996(vulnerable)-349.003(hosts)-349.003(used)-348.992(512-bit)-349.003(prime)-349.003(mo)-28.997(duli;)-350.007(three)]TJ 1.02 0 0 1 316.812 445.798 Tm [(of)-334.995(them)-335.006(used)-335.999(160-bit)-334.995(exp)-28.005(onen)28.005(ts)-335.006(and)-334.995(the)-335.006(rest)-334.995(used)-335.006(128)-335.999(bits.)]TJ 0.986 0 0 1 316.48 435.337 Tm [(The)-346.995(order)-346.003(of)-347.007(the)-346.995(largest-order)-346.003(subgroup)-346.995(ranged)-347.007(from)-346.995(46)-346.003(bits)]TJ 1.02 0 0 1 315.734 424.877 Tm [(\(whic)28.005(h)-348.01(\034nishes)-347.999(in)-347.999(seconds\))-348.992(t)0.993(o)-348.992(81)-348.01(bits)-347.999(\(whic)28.005(h)-347.999(to)-28.005(ok)-347.999(b)-27.993(et)27.993(w)28.005(een)]TJ 1.057 -10.461 Td [(50)-445.006(and)-445.998(176)-444.995(hours\))-445.006(im)-0.993(ple)0.993(m)-0.993(e)0.993(n)27.001(t)1.004(ation.)-777.001(The)-444.995(P)27.993(ollard)-445.998(lam)28.005(b)-28.005(da)]TJ 1 0 0 1 316.812 403.955 Tm [(calculations)-341.999(used)-343.003(in)28.997(terv)57.002(al)-343.003(width)-341.999(v)57.002(arying)-343.003(from)-342.992(40)-341.999(to)-343.003(70)-341.999(bits.)]TJ 1.02 0 0 1 325.778 393.494 Tm [(Our)-384(computations)-384(w)28.005(ould)-385.004(ha)28.005(v)27.993(e)-384(allo)28.005(w)27.993(ed)-384(us)-384(to)-384(hijac)28.005(k)-385.004(con-)]TJ -8.79 -10.46 Td [(nections)-388.004(to)-387.993(a)-388.004(v)55.998(ariet)28.005(y)-388.004(of)-387.993(vulnerable)-387(TLS)-388.004(serv)28.005(ers,)-401.008(including)]TJ 1.002 0 0 1 316.48 372.573 Tm [(w)28.005(e)0.993(b)-341.999(in)28.005(terfaces)-341.006(for)-341.999(VPN)-340.995(devices)-341.999(\(48)-341.999(hosts\))0.993(,)-341.999(comm)28.005(unications)]TJ 0.98 0 0 1 316.812 362.112 Tm [(soft)28.997(w)28.997(are)-335.999(\(21)-335.999(hosts\),)-338.999(w)28.997(eb)-335.999(conferencing)-335.999(serv)28.997(ers)-335.999(\(27)-335.999(hosts\),)-338.999(and)]TJ 1.02 0 0 1 316.812 351.651 Tm [(FTP)-337.003(serv)28.005(ers)-337.003(\(6)-337.003(hosts\).)-450.995(As)-337.003(a)-337.003(pro)-27.993(of-of-concept,)-337.003(w)27.993(e)-336.991(mo)-28.005(di\034ed)]TJ 0 -10.46 TD [(our)-459.995(man-in-the-middle)-460.006(attac)28.005(k)27.993(er)-459.002(of)-459.995(\2373.3)-459.995(to)-460.006(imp)-27.993(ersonate)-460.006(a)]TJ -0.235 -10.461 Td [(vulnerable)-360(serv)28.005(er)-360.011(and)-360.992(capture)-360(user)-360(creden)27.993(tials.)-521.001(Compared)]TJ 1.01 0 0 1 316.812 320.269 Tm [(to)-338.999(an)-338.999(attac)27.993(k)-338.999(using)-338.999(NFS,)-338.999(w)28.997(e)-338.999(could)-338.999(compute)-338.999(the)-338.999(discrete)-338.999(log)]TJ 1 0 0 1 316.48 309.808 Tm [(with)-343.003(a)-341.999(dela)28.005(y)-341.999(hardly)-343.003(noticeable)-341.999(for)-343.003(bro)28.997(wser)-342.992(users.)]TJ /T1_6 8.966 Tf 0.332 -15.442 Td [(Miscon\034gured)-324(groups)]TJ /T1_1 8.966 Tf 0.98 0 0 1 427.756 294.366 Tm [(The)-287.005(Digital)-287.997(Signat)1.004(ure)-287.997(Algorithm)]TJ 1.013 0 0 1 315.734 283.905 Tm [(\(DSA\))-337.995([38])-338.006(uses)-337.995(primes)]TJ /T1_2 8.966 Tf 1 0 0 1 412.868 283.905 Tm (p)Tj /T1_1 8.966 Tf 1.013 0 0 1 420.566 283.905 Tm [(suc)28.005(h)-338.006(that)]TJ /T1_2 8.966 Tf 1 0 0 1 461.772 283.905 Tm (p)Tj /T1_10 8.966 Tf 6.674 0 Td (\000)Tj /T1_9 8.966 Tf 1.013 0 0 1 477.661 283.905 Tm (1)Tj /T1_1 8.966 Tf 7.641 0 Td [(has)-337.995(a)-338.006(large)-338.999(prime)]TJ 1.008 0 0 1 316.812 273.445 Tm (factor)Tj /T1_2 8.966 Tf 1 0 0 1 343.389 273.445 Tm (q)Tj /T1_1 8.966 Tf 1.008 0 0 1 350.903 273.445 Tm (and)Tj /T1_2 8.966 Tf 1 0 0 1 368.944 273.445 Tm (g)Tj /T1_1 8.966 Tf 1.008 0 0 1 376.735 273.445 Tm [(generates)-340.003(only)-340.003(a)-340.995(subgroup)-340.003(of)-340.003(order)]TJ /T1_2 8.966 Tf 1 0 0 1 520.791 273.445 Tm (q)Tj /T1_1 8.966 Tf 1.008 0 0 1 525.23 273.445 Tm [(.)-454.006(When)]TJ 0.991 0 0 1 316.812 262.984 Tm [(using)-344.999(prop)-28.997(erly)-344.007(generated)-344.999(DSA)-344.999(parameters,)-344.999(these)-343.995(groups)-344.999(are)]TJ 0.98 0 0 1 316.812 252.523 Tm [(secure)-268.001(for)-269.004(use)-268.001(in)-268.001(Di\036e-Hellman)-267.989(k)28.997(ey)-269.004(exc)30.001(hanges.)-438.994(Notably)86.991(,)-284.997(DSA)]TJ 1.02 0 0 1 316.812 242.062 Tm [(groups)-489.996(are)-490.007(hard-co)-27.993(ded)-490.007(in)-489.996(Ja)28.005(v)55.998(a's)]TJ /T1_16 8.966 Tf 1 0 0 1 457.297 242.062 Tm (sun.security.provider)Tj /T1_1 8.966 Tf 1.02 0 0 1 316.812 231.601 Tm [(pac)28.005(kage)-359.007(and)-358.003(are)-358.996(used)-358.996(b)27.993(y)-357.992(default)-359.007(in)-358.996(man)27.993(y)-358.996(Ja)28.005(v)55.998(a-based)-358.003(TLS)]TJ 0.98 0 0 1 316.812 221.141 Tm [(serv)28.997(ers.)-456.995(Ho)30.001(w)28.997(ev)28.997(er,)-326.999(some)-322.002(serv)30.001(ers)-322.002(in)-320.998(our)-322.002(scans)-320.998(used)-320.998(Ja)28.997(v)58.005(a's)-320.998(DSA)]TJ 0 -10.461 TD [(primes)-262(as)]TJ /T1_2 8.966 Tf 1 0 0 1 355.666 210.68 Tm (p)Tj /T1_1 8.966 Tf 0.98 0 0 1 362.598 210.68 Tm [(but)-262(mistak)28.997(enly)-262.993(used)-262(the)-263.004(D)1.004(SA)-263.004(group)-262(order)]TJ /T1_2 8.966 Tf 1 0 0 1 526.791 210.68 Tm (q)Tj /T1_1 8.966 Tf 0.98 0 0 1 533.537 210.68 Tm [(in)-262(the)]TJ -221.148 -10.461 Td [(place)-299.005(of)-298.994(the)-298.001(generator)]TJ /T1_2 8.966 Tf 1 0 0 1 404.383 200.219 Tm (g)Tj /T1_1 8.966 Tf 0.98 0 0 1 409.099 200.219 Tm [(.)-448.998(W)87.003(e)-299.005(found)-298.001(5,741)-298.994(hosts)-299.005(miscon\034gured)]TJ 1 0 0 1 316.812 189.758 Tm [(this)-343.003(w)28.997(a)29.008(y)84.995(.)]TJ 0.98 0 0 1 325.778 179.298 Tm [(This)-296.998(substitution)-296.998(of)]TJ /T1_2 8.966 Tf 1 0 0 1 405.758 179.298 Tm (q)Tj /T1_1 8.966 Tf 0.98 0 0 1 412.808 179.298 Tm (for)Tj /T1_2 8.966 Tf 1 0 0 1 426.225 179.298 Tm (g)Tj /T1_1 8.966 Tf 0.98 0 0 1 433.552 179.298 Tm [(is)-296.998(lik)28.997(ely)-296.998(due)-296.998(to)-297.009(a)-296.998(usabilit)28.997(y)-296.998(prob-)]TJ 1.018 0 0 1 316.812 168.837 Tm [(lem:)-448.998(the)-335.999(canonical)-335.999(ASN.1)-336.01(represen)28.005(tation)-335.999(of)-335.999(Di\036e-Hellman)]TJ 1.02 0 0 1 316.812 158.376 Tm [(k)28.005(ey)-390(exc)27.993(hange)-388.997(parameters)-390(\(coming)-388.997(from)-390(PK)27.993(CS#3\))-388.997(is)-390(a)-390(se-)]TJ T* (quence)Tj /T1_9 8.966 Tf 30.414 0 Td (\()Tj /T1_2 8.966 Tf 1 0 0 1 351.489 147.915 Tm [(p;)-171.005(g)]TJ /T1_9 8.966 Tf 1.02 0 0 1 364.927 147.915 Tm (\))Tj /T1_1 8.966 Tf [(,)-337.003(while)-335.999(that)-335.999(of)-336.991(DSA)-336.01(parameters)-336.991(\(coming)-335.999(from)]TJ 0.988 0 0 1 316.812 137.455 Tm [(PKIX\))-347.999(is)]TJ /T1_9 8.966 Tf 39.69 0 Td (\()Tj /T1_2 8.966 Tf 1 0 0 1 359.566 137.455 Tm [(p;)-171.005(q)-35.99(;)-172.009(g)]TJ /T1_9 8.966 Tf 0.988 0 0 1 381.539 137.455 Tm (\))Tj /T1_1 8.966 Tf [(;)-347.999(w)29.008(e)-347.999(conjecture)-348.01(that)-347.999(the)-347.999(confusion)-346.995(b)-28.997(et)28.997(w)28.997(een)]TJ 1 0 0 1 316.812 126.994 Tm [(these)-341.999(f)-1.004(ormats)-341.999(led)-343.003(to)-341.999(a)-342.992(simple)-342.01(programming)-342.992(error.)]TJ 1.02 0 0 1 325.778 116.533 Tm [(In)-421.998(a)-421.005(DSA)-421.998(group,)-442.998(the)-421.998(subgroup)-422.009(gene)1.004(rated)-421.998(b)27.993(y)]TJ /T1_2 8.966 Tf 1 0 0 1 516.104 116.533 Tm (q)Tj /T1_1 8.966 Tf 1.02 0 0 1 524.4 116.533 Tm [(is)-421.998(lik)27.993(ely)]TJ -203.518 -10.461 Td [(to)-391.997(ha)27.993(v)28.005(e)-393.001(man)27.993(y)-391.997(small)-393.001(prime)-391.997(factors)-393.001(in)-391.997(its)-393.001(order,)-406.005(since)-393.001(for)]TJ /T1_2 8.966 Tf 1 0 0 1 551.289 106.072 Tm (p)Tj /T1_1 8.966 Tf 1.02 0 0 1 316.812 95.611 Tm [(generated)-358.003(according)-356.999(to)-358.003([38],)]TJ /T1_9 8.966 Tf 115.326 0 Td (\()Tj /T1_2 8.966 Tf 1 0 0 1 438.101 95.611 Tm (p)Tj /T1_10 8.966 Tf 6.807 0 Td (\000)Tj /T1_9 8.966 Tf 1.02 0 0 1 454.257 95.611 Tm (1\))Tj /T1_2 8.966 Tf 1 0 0 1 462.612 95.611 Tm (=q)Tj /T1_1 8.966 Tf 1.02 0 0 1 474.932 95.611 Tm [(is)-358.003(a)-357.992(random)-357.011(in)28.005(teger.)]TJ 0.98 0 0 1 316.812 85.151 Tm [(F)87.003(or)-282.008(Ja)29.008(v)57.994(a's)]TJ /T1_16 8.966 Tf 1 0 0 1 358.691 85.151 Tm (sun.security.provider)Tj /T1_1 8.966 Tf 0.98 0 0 1 460.027 85.151 Tm [(512-bit)-281.997(prime,)-296.005(using)]TJ /T1_2 8.966 Tf 1 0 0 1 540.916 85.151 Tm (q)Tj /T1_1 8.966 Tf 0.98 0 0 1 547.837 85.151 Tm (as)Tj -235.74 -10.461 Td [(a)-337.003(generator)-335.999(leaks)-337.003(290)-336.991(bits)-337.003(of)-337.003(information)-337.003(ab)-28.997(out)-335.999(exp)-30.001(onen)30.001(ts)-337.003(at)]TJ 1 0 0 1 302.553 44.802 Tm (6)Tj ET BT /T1_0 8.966 Tf 0.992 0 0 1 53.798 728.239 Tm [(a)-346.003(cost)-346.003(of)-345.992(roughly)]TJ /T1_1 8.966 Tf 70.844 0 Td (2)Tj /T1_2 5.978 Tf 1 0 0 1 128.646 732.048 Tm (40)Tj /T1_0 8.966 Tf 0.992 0 0 1 139.527 728.239 Tm [(op)-28.997(erations.)-462.003(Luc)28.997(kily)85.999(,)-345.992(since)-346.003(the)-346.003(pro)28.997(vider)]TJ 1.02 0 0 1 53.798 717.778 Tm [(generates)-494(exp)-28.005(onen)28.005(ts)-495.004(of)-494(length)]TJ /T1_1 8.966 Tf 1 0 0 1 184.307 717.778 Tm (max)Tj 1.02 0 0 1 201.578 717.778 Tm (\()Tj /T1_3 8.966 Tf 1 0 0 1 205.233 717.778 Tm (n=)Tj /T1_1 8.966 Tf 1.02 0 0 1 215.4 717.778 Tm (2)Tj /T1_3 8.966 Tf 1 0 0 1 220.1 717.778 Tm (;)Tj /T1_1 8.966 Tf 1.02 0 0 1 224.195 717.778 Tm (384\))Tj /T1_0 8.966 Tf 21.84 0 Td (for)Tj /T1_3 8.966 Tf 1 0 0 1 262.243 717.778 Tm (n)Tj /T1_0 8.966 Tf 1.02 0 0 1 267.802 717.778 Tm (-bit)Tj /T1_3 8.966 Tf 1 0 0 1 286.945 717.778 Tm (p)Tj /T1_0 8.966 Tf 1.02 0 0 1 291.571 717.778 Tm (,)Tj -233.111 -10.46 Td [(this)-385.004(do)-27.993(es)-385.004(not)-385.004(su\036ce)-384.993(to)-385.004(reco)28.005(v)27.993(er)-384.993(a)-385.004(full)-385.004(exp)-27.993(onen)27.993(t.)-595.992(Still,)-397.004(this)]TJ 1.004 0 0 1 53.798 696.857 Tm [(miscon\034guration)-341.999(bug)-343.003(results)-341.999(in)-343.003(a)-341.999(s)-0.993(ig)0.993(ni\034can)28.005(t)-343.003(lo)1.004(s)-1.004(s)-341.999(of)-343.003(securit)28.997(y)]TJ 1 0 0 1 53.798 686.396 Tm [(and)-343.003(serv)28.997(es)-342.992(as)-341.999(a)-343.003(cautionary)-341.999(tale)-343.003(for)-341.999(programmers.)]TJ /T1_4 11.955 Tf 0 -23.578 TD [(4.)-1000(ST)90(A)95(TE-LEVEL)-250(THREA)95(TS)-250(T)18.001(O)-250(DH)]TJ /T1_0 8.966 Tf 0.984 0 0 1 62.765 649.866 Tm [(The)-347.999(previous)-347.999(sections)-349.003(demonstrate)-347.999(the)-347.999(existence)-347.999(of)-349.003(pract)1.004(i-)]TJ 0.985 0 0 1 53.798 639.406 Tm [(cal)-347.999(attac)28.997(ks)-347.999(against)-347.999(Di\036e-Hellman)-347.999(k)28.997(ey)-349.003(exc)29.008(hange)-347.999(as)-347.999(curren)28.997(tly)]TJ 1.011 0 0 1 53.798 628.945 Tm [(used)-337.995(b)27.993(y)-337.995(TLS.)-451.999(Ho)27.993(w)28.005(e)0.993(v)28.005(er,)-338.999(these)-338.006(attac)28.005(ks)-337.995(rely)-338.006(on)-338.999(the)-337.995(abilit)27.993(y)-337.995(to)]TJ 0.98 0 0 1 53.798 618.484 Tm [(do)28.997(wngrade)-349.996(connections)-350.999(to)-350.007(exp)-28.997(ort-grade)-350.999(crypto)-349.996(or)-350.999(on)-351.01(t)1.004(he)-350.999(use)]TJ 0 -10.461 TD [(of)-278.997(unsafe)-279.008(parameters.)-441.995(In)-278.997(this)-279.008(section)-277.993(w)28.997(e)-278.997(address)-278.997(the)-279.008(follo)30.001(wing)]TJ 1.019 0 0 1 53.798 597.562 Tm [(question:)-447.995(ho)28.997(w)-335.006(secure)-334.995(is)-335.006(Di\036e-Hellman)-333.991(in)-335.006(broader)-334.995(practice,)]TJ 0.98 0 0 1 53.798 587.102 Tm [(as)-305.005(used)-305.998(in)-304.994(other)-305.005(proto)-28.997(cols)-305.998(that)-305.005(do)-305.998(no)1.004(t)-305.998(su\033er)-305.005(from)-305.998(do)30.001(wngrade,)]TJ 1 0 0 1 53.798 576.641 Tm [(and)-343.003(when)-341.999(applied)-343.003(with)-341.999(stronger)-342.992(groups?)]TJ 1.02 0 0 1 62.765 566.18 Tm [(T)84.003(o)-384(answ)27.993(er)-384(this)-384(question)-382.997(w)28.005(e)-384(m)27.993(ust)-384(\034rst)-384(examine)-384(ho)28.005(w)-384(the)]TJ 0.98 0 0 1 53.798 555.719 Tm [(n)28.997(um)28.997(b)-28.997(er)-322.995(\034eld)-322.002(siev)28.997(e)-322.995(for)-322.002(discrete)-323.006(log)-321.991(scales)-323.006(to)-322.995(768-)-322.002(and)-323.006(1024-bit)]TJ 0 -10.46 TD [(groups.)-457.999(As)-326.006(w)30.001(e)-325.995(argue)-325.002(b)-28.997(elo)28.997(w,)-329.999(768-bit)-326.006(groups,)-329.999(whic)29.008(h)-325.002(are)-326.006(still)-324.991(in)]TJ 0 -10.461 TD [(relativ)28.997(ely)-328.995(widespread)-328.002(use,)-332.999(are)-329.006(no)29.008(w)-328.002(within)-329.006(reac)29.008(h)-329.006(for)-328.002(academic)]TJ 1.017 0 0 1 53.798 524.337 Tm [(computational)-337.995(resources,)-339.01(and)-337.995(p)-28.005(erforming)-337.995(precomputations)]TJ 1.02 0 0 1 53.798 513.876 Tm [(for)-402.001(a)-402.001(small)-400.997(n)27.993(um)28.005(b)-28.005(er)-402.001(of)-401.99(1024-bit)-402.001(groups)-402.001(is)-401.008(plausibly)-401.99(within)]TJ 0 -10.46 TD [(the)-334.995(resources)-336.01(of)-334.995(state-lev)28.005(el)-336.01(attac)28.005(k)28.005(ers.)-447.002(The)-335.999(precomputation)]TJ 0.98 0 0 1 53.467 492.955 Tm [(w)28.997(ould)-307.002(lik)29.008(ely)-307.002(require)-307.002(sp)-28.997(ecial-purp)-29.008(ose)-306.991(hardw)28.997(are,)-314.998(but)-307.002(w)28.997(ould)-307.002(not)]TJ 0.338 -10.461 Td [(require)-343.995(an)28.997(y)-344.007(ma)-28.997(jor)-343.995(algorithmic)-343.003(impro)28.997(v)28.997(emen)29.008(ts)-344.007(b)-28.997(ey)28.997(ond)-343.995(what)-344.007(is)]TJ 0 -10.461 TD [(kno)28.997(wn)-295.994(in)-296.005(the)-295.994(acade)0.993(m)-0.993(ic)-295.001(literature.)-448.006(W)87.003(e)-295.994(further)-296.005(sho)28.997(w)-295.994(that)-295.001(ev)28.997(en)]TJ 1.02 0 0 1 53.798 461.572 Tm [(in)-349.003(the)-349.996(1024-bit)-349.003(case,)-352.996(the)-349.003(descen)28.005(t)-350.007(time)-120.004(\026)-120.996(necessary)-349.996(to)-349.003(solv)28.005(e)]TJ 1.001 0 0 1 53.798 451.112 Tm [(an)28.997(y)-343.995(sp)-28.005(eci\034c)-343.003(discrete)-343.995(log)-343.003(instance)-342.992(within)-343.003(a)-343.003(common)-343.995(group)-123.004(\026)]TJ 1.016 0 0 1 53.467 440.651 Tm [(w)28.005(ould)-336.01(b)-27.993(e)-337.003(fast)-335.999(enough)-335.999(to)-335.999(break)-337.003(individual)-335.999(k)27.993(ey)-335.999(exc)28.005(hanges)-335.999(in)]TJ 1 0 0 1 53.798 430.19 Tm [(close)-343.003(to)-341.999(real)-343.003(time.)]TJ 0.98 0 0 1 62.765 419.729 Tm [(In)-301.002(ligh)28.997(t)-299.998(of)-301.002(these)-301.002(results,)-309.991(w)28.997(e)-301.002(examine)-301.002(sev)28.997(e)1.004(ral)-301.002(standard)-301.002(In)29.008(ter-)]TJ 0.988 0 0 1 53.798 409.269 Tm [(net)-347.999(securit)28.997(y)-349.003(proto)-28.997(cols)-123.996(\026)-125(IKE,)-349.003(SSH,)-347.999(and)-347.999(TLS)-125(\026)-125(to)-347.999(determine)]TJ 0.98 0 0 1 53.798 398.808 Tm [(the)-239.003(vulnerabilit)29.008(y)-239.003(of)-239.003(their)-239.003(k)30.001(ey)-238.992(exc)28.997(hanges)-239.003(to)-238.992(attac)28.997(ks)-239.003(b)28.997(y)-238.992(resource-)]TJ T* [(ful)-346.995(attac)28.997(k)28.997(e)1.004(rs.)-466.006(Although)-345.992(the)-347.007(cost)-346.995(of)-347.007(the)-345.992(precomputation)-347.007(for)-346.995(a)]TJ 1.008 0 0 1 53.337 377.886 Tm [(1024-bit)-340.003(group)-340.995(is)-340.003(sev)28.005(eral)-340.003(times)-341.006(higher)-339.992(than)-341.006(for)-340.003(an)-340.995(RSA)-340.003(k)28.005(ey)]TJ 0.98 0 0 1 53.798 367.425 Tm [(of)-302.998(equal)-302.998(size,)-312.009(w)29.008(e)-302.005(observ)28.997(e)-302.998(that)-302.998(a)-302.005(one-time)-302.998(in)29.008(v)28.997(estmen)28.997(t)-302.998(c)1.004(ould)-303.009(b)-28.997(e)]TJ 1.001 0 0 1 53.798 356.965 Tm [(used)-341.999(to)-341.006(attac)28.005(k)-340.995(millions)-341.999(of)-342.01(hosts,)-340.995(due)-341.999(to)-341.999(widespread)-341.006(reuse)-341.999(of)]TJ 0.98 0 0 1 53.798 346.504 Tm [(the)-322.002(most)-322.002(c)1.004(om)-1.004(mon)-320.998(Di\036e-Hellman)-322.002(parameters.)-456.995(Unfortunately)87.995(,)]TJ 0.987 0 0 1 53.798 336.043 Tm [(our)-346.995(measuremen)28.997(ts)-347.007(also)-347.999(indicate)-346.995(that)-347.007(it)-346.995(ma)28.997(y)-346.995(b)-28.997(e)-347.007(v)28.005(e)1.004(ry)-348.01(di\036cult)]TJ 0.98 0 0 1 53.798 325.582 Tm [(to)-299.998(sunset)-299.998(the)-301.002(use)-300.009(of)-299.998(\034xed)-299.998(1024-bit)-301.002(Di\036e-Hellman)-299.998(groups)-299.998(that)]TJ 0 -10.46 TD [(ha)28.997(v)28.997(e)-335.999(long)-336.991(b)-29.008(een)-335.999(em)28.997(b)-28.997(edded)-337.003(in)-335.999(standards)-335.999(and)-337.003(implemen)29.008(tations.)]TJ 1.02 0 0 1 62.765 304.661 Tm [(Finally)84.003(,)-386.008(w)29.008(e)-376.004(apply)-376.004(this)-375(new)-375.993(underst)0.993(anding)-375.993(to)-375(a)-376.004(set)-375(of)-376.004(re-)]TJ 0.983 0 0 1 53.798 294.2 Tm [(cen)28.997(tly)-347.999(published)-346.995(do)-29.008(cumen)29.008(ts)-347.999(leak)28.997(ed)-346.995(b)28.997(y)-347.999(Edw)28.997(ard)-346.995(Sno)28.997(wden)-347.999([46])]TJ 0.98 0 0 1 53.798 283.739 Tm [(to)-295.994(ev)57.994(aluate)-296.005(the)-295.994(h)28.997(yp)-28.997(othesis)-296.005(that)-295.994(the)-296.005(National)-295.994(Securit)28.997(y)-296.005(Agency)]TJ 1.02 0 0 1 53.798 273.279 Tm (has)Tj /T1_5 8.966 Tf 16.731 0 Td [(alr)51.002(e)51.994(ady)]TJ /T1_0 8.966 Tf 31.496 0 Td [(implemen)28.005(ted)-376.004(suc)27.993(h)-375(a)-375.993(capabilit)27.993(y)84.003(.)-566.995(W)83.991(e)-375.993(sho)27.993(w)-375(that)]TJ -48.227 -10.461 Td [(this)-396.001(h)28.005(yp)-28.005(othesis)-397.004(is)-396.001(consisten)28.005(t)-396.001(with)-396.001(the)-396.993(published)-396.001(details)-396.001(of)]TJ 0.992 0 0 1 53.798 252.357 Tm [(the)-343.003(in)28.997(telligence)-342.992(comm)27.993(unit)29.008(y's)-343.003(cryptanalytic)-343.003(capabilities,)-343.003(and,)]TJ 1.02 0 0 1 53.798 241.896 Tm [(indeed,)-397.997(matc)27.993(hes)-384.993(the)-385.004(kno)28.005(wn)-386.008(capabilities)-384.993(more)-385.004(closely)-385.997(than)]TJ 0 -10.461 TD [(other)-338.999(prop)-28.005(osed)-338.999(explanations,)-340.995(suc)27.993(h)-338.999(as)-338.999(no)28.005(v)27.993(el)-338.999(breaks)-340.003(on)-338.999(R)28.005(C4)]TJ 0 -10.46 TD [(or)-343.995(AES.)-474.003(W)84.003(e)-344.007(b)-27.993(eliev)27.993(e)-343.995(that)-344.999(this)-344.007(analysis)-344.999(ma)28.005(y)-344.007(help)-343.995(shed)-344.999(ligh)27.993(t)]TJ 0 -10.461 TD [(on)-370.996(unansw)27.993(ered)-370.996(questions)-370.996(ab)-28.005(out)-370.996(ho)27.993(w)-370.996(NSA)-371.007(ma)28.005(y)-372(b)-28.005(e)-370.996(gaining)]TJ 1 0 0 1 53.798 200.053 Tm [(access)-343.003(t)1.004(o)-343.003(VPN,)-343.003(SSH,)-341.999(and)-342.992(TLS)-342.01(tra\036c.)]TJ /T1_4 11.955 Tf 0 -18.265 TD [(4.1)-1000(Scaling)-250(NFS)-250(to)-250(768-)-250(and)-250(1024-bit)-250(DH)]TJ /T1_0 8.966 Tf 0.98 0 0 1 62.765 168.837 Tm [(Estimating)-317.998(the)-319.002(cost)-317.998(for)-319.002(discrete)-317.998(log)-317.998(cryptanalysis)-319.002(at)-317.998(longer)]TJ 1.02 0 0 1 53.798 158.376 Tm [(k)28.005(ey)-472.007(sizes)-471.003(is)-471.995(far)-471.003(from)-471.995(straigh)27.993(tforw)28.005(ard,)-504.996(due)-472.007(in)-470.992(part)-471.003(to)-472.007(the)]TJ 0.98 0 0 1 53.798 147.915 Tm [(complexit)28.997(y)-316.002(of)-315.991(parameter)-317.006(t)1.004(uning)-317.006(and)-315.991(to)-316.002(tradeo\033s)-316.002(b)-28.997(et)28.997(w)28.997(een)-316.002(the)]TJ 1.02 0 0 1 53.798 137.455 Tm [(sieving)-361.996(and)-361.003(linear)-361.996(algebra)-361.003(steps,)-368.007(whic)28.005(h)-361.996(ha)27.993(v)28.005(e)-362.007(v)28.005(ery)-361.003(di\033eren)28.005(t)]TJ 0 -10.461 TD [(computational)-409.005(c)28.005(haracteristics.)-668.998(\(Muc)27.993(h)-409.997(more)-408.994(atten)27.993(tion)-409.997(has)]TJ 0.98 0 0 1 53.798 116.533 Tm [(gone)-284.997(to)-284.005(understanding)-284.997(1024-bit)-284.997(factorization,)-297.009(but,)-297.99(ev)28.997(en)-284.005(there,)]TJ 1.02 0 0 1 53.798 106.072 Tm [(man)28.005(y)-390(published)-390(estimates)-390(are)-390(crude)-389.008(extrap)-27.993(olations)-390(of)-390(the)]TJ 0.99 0 0 1 53.798 95.611 Tm [(asymptotic)-346.003(complexit)28.997(y)87.003(.\))-462.003(W)87.003(e)-346.003(attempt)-345.992(estimates)-344.999(for)-346.003(768-)-346.003(and)]TJ 1.02 0 0 1 53.337 85.151 Tm [(1024-bit)-433.998(discrete)-433.998(lo)0.993(g)-433.998(based)-433.998(on)-433.998(the)-433.998(existing)-434.009(lit)1.004(erature)-433.998(and)]TJ 0.985 0 0 1 53.798 74.69 Tm [(our)-349.003(o)28.997(wn)-347.999(exp)-28.997(erimen)28.997(ts,)-348.992(but)-347.999(further)-349.003(w)28.997(ork)-347.999(is)-349.003(needed)-347.999(for)-349.003(greater)]TJ 0.98 0 0 1 316.812 728.239 Tm [(con\034dence,)-329.006(particularly)-324.991(for)-323.998(the)-324.01(1024-bit)-324.991(case.)-457.006(W)87.003(e)-323.998(summarize)]TJ 1 0 0 1 316.812 717.778 Tm [(all)-343.003(the)-341.999(costs,)-343.003(measured)-341.999(or)-342.992(estimated,)-342.01(in)-342.992(T)85.999(able)-343.003(2.)]TJ /T1_6 8.966 Tf 0 -14.409 TD [(DH-768:)-511(F)98(easible)-365(with)-365(academic)-365(p)-33.001(o)33.001(w)33.001(er)]TJ /T1_0 8.966 Tf 0.98 0 0 1 509.489 703.369 Tm [(F)87.003(or)-323.006(the)-323.998(768-)]TJ 1.02 0 0 1 316.812 692.909 Tm [(bit)-399.001(case,)-415.005(w)28.005(e)-399.001(base)-399.001(our)-399.001(estimates)-399.001(on)-399.001(the)-399.001(recen)28.005(t)-399.001(discrete)-399.001(log)]TJ 0.993 0 0 1 316.812 682.448 Tm [(record)-344.999(at)-344.999(596)-344.999(bits)-344.999([8])-346.003(and)-344.999(the)-344.999(in)28.997(teger)-344.999(factorization)-344.999(record)-344.999(of)]TJ 0.98 0 0 1 316.582 671.987 Tm [(768)-236.003(bits)-236.996(from)-236.996(2009)-236.003([29].)-429.002(While)-236.003(the)-236.996(algorithms)-236.003(for)-236.996(factorization)]TJ 1.02 0 0 1 316.812 661.526 Tm [(and)-343.995(discrete)-344.007(log)-343.995(are)-344.007(similar,)-345.992(the)-344.007(discrete)-343.995(log)-344.007(linear)-344.999(alg)1.004(ebra)]TJ 0.991 0 0 1 316.812 651.066 Tm [(stage)-346.003(is)-346.003(man)29.008(y)-346.003(times)-346.003(more)-344.999(di\036)-1.004(c)1.004(ult,)-346.003(as)-345.992(the)-346.003(matrix)-346.003(en)28.997(tries)-345.992(are)]TJ 1.02 0 0 1 316.812 640.605 Tm [(no)-364.003(longer)-363.992(Bo)-28.005(olean.)-531.997(W)83.991(e)-363(can)-363.992(reduce)-364.003(o)28.005(v)27.993(erall)-363.992(time)-364.003(b)27.993(y)-363.992(sieving)]TJ 0 -10.461 TD [(more,)-341.999(th)27.993(us)-340.995(generating)-340.995(a)-341.006(smaller)-340.995(input)-341.006(matrix)-340.995(to)-341.006(the)-340.995(linear)]TJ T* [(algebra)-415.997(ste)0.993(p)-0.993(.)-686.998(Since)-415.005(sieving)-415.997(parallelizes)-415.005(b)-27.993(etter)-416.009(than)-414.994(linear)]TJ 1 0 0 1 316.812 609.222 Tm [(algebra,)-343.003(t)1.004(his)-343.003(tradeo\033)-343.003(is)-341.999(desirable)-342.992(for)-342.01(large)-342.992(inputs.)]TJ 1.02 0 0 1 325.778 598.762 Tm [(A)-469.999(596-bit)-469.999(factorization)-469.999(tak)27.993(es)-469.999(ab)-27.993(out)-471.003(5)-469.999(core-y)27.993(ears,)-503.993(most)]TJ -8.79 -10.461 Td [(of)-424.998(it)-424.005(sp)-27.993(en)27.993(t)-424.998(on)-424.998(sieving.)-713.999(In)-424.998(comparison,)-446.01(the)-424.998(record)-424.998(596-bit)]TJ T* [(discrete)-408.001(log)-409.005(e\033ort)-407.99(tuned)-408.001(parameters)-409.005(suc)28.005(h)-408.001(that)-408.001(they)-409.005(sp)-27.993(en)27.993(t)]TJ T* [(50)-340.003(core-y)28.005(ears)-340.003(on)-340.003(sieving.)-460.999(This)-340.003(reduced)-339.992(their)-340.003(linear)-340.003(algebra)]TJ 1.005 0 0 1 316.812 556.919 Tm [(calculation)-340.003(t)1.004(o)-340.003(80)-340.003(core-y)29.008(ears.)-454.006(W)85.006(e)-340.003(used)-338.999(this)-340.003(same)-338.999(strategy)-340.003(in)]TJ 1 0 0 1 316.812 546.458 Tm [(our)-343.003(512-bit)-341.999(exp)-28.997(erimen)28.997(ts)-343.003(in)-341.999(\2373.3.)]TJ 1.02 0 0 1 325.778 535.997 Tm [(Similarly)84.003(,)-424.005(the)-405.993(768-bit)-406.005(RSA)-406.005(factoring)-405.993(record)-406.005(sp)-27.993(en)27.993(t)-405.993(more)]TJ -8.79 -10.461 Td [(time)-340.003(on)-338.999(sieving)-340.003(in)-339.992(order)-339.01(to)-339.992(sa)27.993(v)28.005(e)-340.003(t)1.004(im)-1.004(e)-338.999(on)-340.003(the)-338.999(linear)-340.003(algebra)]TJ 0 -10.46 TD [(step.)-506(T)1.004(he)-356.007(cost)-354.992(of)-355.003(sieving)-355.003(w)28.005(as)-355.003(around)-355.003(1500)-354.992(core-y)27.993(ears,)-360(and)]TJ 0.997 0 0 1 316.812 504.615 Tm [(the)-343.003(matrix)-341.999(that)-343.003(w)29.008(as)-343.003(pro)-28.005(duced)-342.992(had)-342.01(200M)-342.992(ro)28.997(ws)-343.003(and)-343.003(columns.)]TJ 1.005 0 0 1 316.471 494.154 Tm [(As)-340.995(a)-342.01(result,)-341.999(the)-340.995(linear)-341.999(alge)0.993(bra)-341.999(to)-27.993(ok)-341.999(150)-341.006(core-y)28.005(ears,)-341.999(but)-341.006(tak-)]TJ 1.02 0 0 1 316.812 483.693 Tm [(ing)-338.999(algorithmic)-338.006(impro)28.005(v)28.005(emen)27.993(ts)-338.999(since)-338.999(2009)-337.995(in)27.993(to)-338.999(accoun)28.005(t)-338.999(and)]TJ 0.98 0 0 1 316.812 473.232 Tm [(optimizing)-340.003(for)-338.999(the)-340.003(total)-339.992(time,)]TJ /T1_7 5.978 Tf 1 0 0 1 432.386 477.041 Tm (3)Tj /T1_0 8.966 Tf 0.98 0 0 1 439.54 473.232 Tm [(w)28.997(e)-340.003(est)1.004(im)-1.004(at)1.004(e)-340.003(that)-339.992(factoring)-340.003(an)]TJ 1 0 0 1 316.812 462.772 Tm [(RSA-768)-343.003(in)28.997(teger)-341.999(w)28.005(ould)-341.999(tak)27.993(e)-341.999(900)-342.992(core-y)28.997(ears)-343.003(in)-343.003(tota)1.004(l.)]TJ 0.98 0 0 1 325.778 452.311 Tm [(F)87.003(or)-340.003(a)-340.003(768-bit)-340.003(discrete)-339.992(log,)-341.999(w)30.001(e)-340.003(can)-340.003(exp)-30.001(ect)-340.003(that)-339.992(te)0.993(n)-340.995(times)-340.003(as)]TJ 1.02 0 0 1 316.812 441.85 Tm [(m)28.005(uc)27.993(h)-349.003(sieving)-349.996(as)-349.003(the)-348.992(RSA)-349.003(case)-350.007(w)28.005(ould)-349.003(reduce)-348.992(the)-349.003(matrix)-350.007(to)]TJ 1.009 0 0 1 316.812 431.389 Tm [(around)-337.995(150M)-338.006(ro)28.997(ws.)-451.999(W)85.006(e)-338.006(extrap)-27.993(olate)-338.006(from)-337.995(exp)-28.005(erimen)28.005(ts)-338.006(with)]TJ 1.004 0 0 1 316.812 420.929 Tm [(existing)-340.003(soft)28.005(w)28.997(are)-340.003(that)-339.992(this)-340.003(linear)-340.003(algebra)-340.003(w)28.005(ould)-340.003(tak)28.005(e)-340.003(28,500)]TJ 1.02 0 0 1 316.812 410.468 Tm [(core-y)28.005(ears,)-382.004(for)-373.004(a)-372.992(total)-373.004(of)-373.004(36,500)-372.992(core-y)27.993(ears.)-558.998(This)-373.004(is)-373.996(w)1.004(ithin)]TJ 1 0 0 1 316.812 400.007 Tm [(reac)28.997(h)-343.003(b)29.008(y)-343.003(computing)-343.003(p)-27.993(o)27.993(w)28.997(er)-342.992(a)28.997(v)57.002(ailable)-341.999(to)-343.003(academics.)]TJ 1.02 0 0 1 325.778 389.546 Tm [(The)-364.996(descen)27.993(t)-364.996(step)-365.007(tak)28.005(es)-364.996(relativ)27.993(ely)-364.996(little)-364.996(time.)-536.001(W)83.991(e)-364.996(exp)-28.005(eri-)]TJ -8.79 -10.46 Td [(men)28.005(ted)-341.006(with)-340.995(b)-28.005(oth)-341.999(CADO-NFS)-340.995(and)-341.006(a)-340.995(new)-341.999(implemen)27.993(t)1.004(ation)]TJ 0.98 0 0 1 316.48 368.625 Tm [(with)-319.002(GMP-ECM)-317.998(based)-319.002(on)-319.002(the)-318.991(early-ab)-29.008(ort)-317.998(strategy)-319.002(describ)-28.997(ed)]TJ 0.983 0 0 1 316.812 358.164 Tm [(in)-349.003([6].)-465.995(Using)-347.999(these)-349.003(tec)28.997(hniques,)-349.003(the)-348.992(initial)-349.003(descen)30.001(t)-349.003(phase)-349.003(to)-28.997(ok)]TJ 1 0 0 1 316.812 347.703 Tm [(an)-343.003(a)28.997(v)28.005(erage)-341.999(of)-343.003(around)-343.003(1)-341.999(core-da)28.005(y)85.999(.)-456.995(The)-343.003(remaining)-341.999(phase)-343.003(uses)]TJ 1.006 0 0 1 316.812 337.242 Tm [(sieving)-341.999(m)28.997(uc)28.005(h)-341.999(as)-341.006(in)-341.999(the)-340.995(precomputation;)-341.999(extrap)-29.008(olating)-340.995(from)]TJ 1.02 0 0 1 316.812 326.782 Tm [(exp)-28.005(erimen)28.005(ts,)-460.999(the)-436.006(rest)-435.994(of)-436.998(the)-436.006(descen)28.005(t)-436.006(should)-435.994(tak)27.993(e)-435.994(at)-436.006(most)]TJ -0.452 -10.461 Td [(1)-442.998(core-da)27.993(y)84.003(.)-768.993(In)-443.009(total,)-469.999(after)-442.998(precomputa)1.004(tion,)-469.999(the)-442.998(cost)-443.009(of)-442.998(a)]TJ 0.98 0 0 1 316.812 305.86 Tm [(single)-328.002(768-bit)-328.995(discrete)-328.002(log)-329.006(computat)1.004(i)-1.004(o)1.004(n)-328.995(is)-328.002(around)-329.006(2)-327.991(core-da)28.997(ys)]TJ 1 0 0 1 316.812 295.399 Tm [(and)-343.003(is)-341.999(easily)-343.003(parallelizable.)]TJ /T1_6 8.966 Tf 0 -14.409 TD [(DH-1024:)-601(Plausible)-433(with)-431.999(state-lev)33(el)-431.999(resources)]TJ /T1_0 8.966 Tf 1.02 0 0 1 542.964 280.99 Tm (Ex-)Tj 0.98 0 0 1 316.812 270.53 Tm [(p)-28.997(erimen)28.997(tally)-263.004(extrap)-28.997(olating)-263.004(sieving)-262.993(parameters)-263.004(to)-262.993(the)-263.004(1024-bit)]TJ 0.983 0 0 1 316.812 260.069 Tm [(case)-347.999(is)-347.999(di\036cult)-347.007(due)-347.999(to)-347.999(the)-347.999(tradeo\033s)-346.995(b)-28.997(et)28.997(w)28.997(een)-347.999(the)-347.999(steps)-347.999(o)0.993(f)-347.999(the)]TJ 1.02 0 0 1 316.812 249.608 Tm [(algorithm)-447.995(and)-449.01(their)-447.995(relativ)27.993(e)-448.998(parallelism.)-786.001(The)-447.995(prior)-448.998(w)27.993(ork)]TJ 0 -10.461 TD [(prop)-28.005(osing)-390(parameters)-388.997(for)-390(factoring)-390(a)-388.997(1024-bit)-390(RSA)-390(k)28.005(ey)-390(is)]TJ 0 -10.46 TD [(thin:)-379.996([28])-381(prop)-28.005(o)1.004(s)-1.004(e)1.004(s)-381(smo)-28.005(othness)-379.996(b)-28.005(ounds)-379.996(of)-381(42)-379.996(bits,)-391.004(but)-381(t)1.004(he)]TJ 0 -10.461 TD [(prop)-28.005(osed)-338.999(v)55.998(alue)-338.999(of)-338.999(the)-338.999(sieving)-338.999(region)-338.999(parameter)]TJ /T1_8 8.966 Tf 1 0 0 1 512.11 218.226 Tm (I)Tj /T1_0 8.966 Tf 1.02 0 0 1 519.918 218.226 Tm [(is)-338.999(clearly)]TJ -199.124 -10.461 Td [(to)-28.005(o)-432.994(small,)-457.006(giving)-432.994(to)-28.005(o)-432.994(few)-432.002(smo)-28.005(oth)-432.994(results)-433.005(p)-27.993(er)-433.005(sieving)-432.994(sub-)]TJ 0.986 0 0 1 316.812 197.304 Tm [(task.)-465.995(Since)-348.01(no)-347.999(publicly)-347.999(a)29.008(v)57.994(ailable)-349.003(soft)29.008(w)28.997(are)-347.999(can)-347.999(curren)28.997(tly)-347.999(deal)]TJ 1.02 0 0 1 316.48 186.844 Tm [(with)-379.004(v)55.998(alues)-378(of)]TJ /T1_8 8.966 Tf 1 0 0 1 377.588 186.844 Tm (I)Tj /T1_0 8.966 Tf 1.02 0 0 1 385.758 186.844 Tm [(larger)-378(than)-379.004(those)-378.993(prop)-28.005(ose)1.004(d,)-390(w)27.993(e)-378(could)-378.993(not)]TJ 0.98 0 0 1 316.812 176.383 Tm [(exp)-28.997(erimen)28.997(tally)-325.002(up)-28.997(date)-325.002(the)-325.002(estimates)-325.995(of)-325.002(this)-325.002(pap)-28.997(er)-325.002(with)-325.002(more)]TJ 1 0 0 1 316.812 165.922 Tm [(relev)57.002(an)28.997(t)-343.003(parameter)-341.999(c)28.005(hoices.)]TJ 0.98 0 0 1 325.778 155.461 Tm [(Without)-319.002(b)-30.001(e)1.004(tter)-320.006(parameter)-318.991(c)28.997(hoices,)-325.002(w)28.997(e)-319.995(resort)-319.002(to)-319.002(extrap)-28.997(olat-)]TJ 0.994 0 0 1 316.812 145 Tm [(ing)-343.995(f)-1.004(rom)-344.007(asymptotic)-344.999(complexit)29.008(y)85.999(.)-459.002(F)85.999(or)-344.999(the)-343.995(n)28.997(um)27.993(b)-27.993(er)-344.999(\034eld)-344.007(siev)28.005(e,)]TJ 1.02 0 0 1 316.812 134.54 Tm [(the)-423.001(complexit)28.005(y)-424.005(is)]TJ /T1_1 8.966 Tf 1 0 0 1 392.467 134.54 Tm (exp)Tj /T1_9 9.963 Tf 15.619 7.82 Td (\000)Tj /T1_1 8.966 Tf 1.02 0 0 1 412.652 134.54 Tm (\()Tj /T1_3 8.966 Tf 1 0 0 1 416.308 134.54 Tm (k)Tj /T1_1 8.966 Tf 1.02 0 0 1 423.951 134.54 Tm (+)Tj /T1_3 8.966 Tf 1 0 0 1 433.844 134.54 Tm (o)Tj /T1_1 8.966 Tf 1.02 0 0 1 438.305 134.54 Tm (\(1\)\)\()Tj 1 0 0 1 457.626 134.54 Tm (log)Tj /T1_3 8.966 Tf 13.427 0 Td (N)Tj /T1_1 8.966 Tf 1.02 0 0 1 479.388 134.54 Tm (\))Tj /T1_2 5.978 Tf 1 0 0 1 483.044 138.349 Tm (1)Tj /T1_10 5.978 Tf (=)Tj /T1_2 5.978 Tf (3)Tj /T1_1 8.966 Tf 1.02 0 0 1 494.667 134.54 Tm (\()Tj 1 0 0 1 498.322 134.54 Tm [(log)-183.998(log)]TJ /T1_3 8.966 Tf 26.854 0 Td (N)Tj /T1_1 8.966 Tf 1.02 0 0 1 533.511 134.54 Tm (\))Tj /T1_2 5.978 Tf 1 0 0 1 537.166 138.349 Tm (2)Tj /T1_10 5.978 Tf (=)Tj /T1_2 5.978 Tf (3)Tj /T1_9 9.963 Tf 11.623 4.011 Td (\001)Tj /T1_3 8.966 Tf 4.566 -7.82 Td (;)Tj /T1_0 8.966 Tf 1.02 0 0 1 316.48 124.079 Tm (where)Tj /T1_3 8.966 Tf 1 0 0 1 343.872 124.079 Tm (N)Tj /T1_0 8.966 Tf 1.02 0 0 1 355.55 124.079 Tm [(is)-366(t)1.004(he)-366(in)27.993(teger)-364.996(to)-366(factor)-365.007(or)-366(the)-364.996(prime)-366(mo)-28.005(dulus)-364.996(for)]TJ -37.978 -10.461 Td [(discrete)-367.003(log,)-373.996(and)]TJ /T1_3 8.966 Tf 1 0 0 1 388.126 113.618 Tm (k)Tj /T1_0 8.966 Tf 1.02 0 0 1 396.542 113.618 Tm [(is)-367.003(an)-366.992(algorithm-sp)-28.005(eci\034c)-366(constan)28.005(t.)-541.009(This)]TJ -78.167 -10.461 Td [(form)28.005(ula)-341.006(is)-340.995(inheren)27.993(tly)-340.995(imprecise,)-343.003(since)-340.995(the)]TJ /T1_3 8.966 Tf 1 0 0 1 488.278 103.157 Tm (o)Tj /T1_1 8.966 Tf 1.02 0 0 1 492.739 103.157 Tm (\(1\))Tj /T1_0 8.966 Tf 14.833 0 Td [(in)-340.995(the)-341.006(exp)-27.993(o-)]TJ ET 0.398 w  q 1 0 0 1 316.812 94.04 cm 0 0 m 119.552 0 l S Q BT /T1_7 5.978 Tf 317.269 87.465 Td (3)Tj /T1_0 8.966 Tf 1.02 0 0 1 321.42 83.656 Tm [(W)84.003(e)-341.999(w)27.993(ould)-343.003(lo)28.005(w)28.005(er)-341.999(the)-343.003(smo)-28.005(othness)-341.999(b)-27.993(ounds)-343.003(compared)-341.999(to)-343.003(the)]TJ 1 0 0 1 316.812 74.69 Tm [(parameters)-341.999(in)-343.003([29].)]TJ -14.259 -29.888 Td (7)Tj ET 0.737 w  q 1 0 0 1 62.169 737.833 cm 0 0 m 485.375 0 l S Q BT /T1_0 7.97 Tf 147.965 728.683 Td [(Sieving)-6346(Linear)-354(Algebra)-2598(Descen)30(t)]TJ ET 0.276 w  q 1 0 0 1 109.966 724.312 cm 0 0 m 97.976 0 l S Q q 1 0 0 1 212.546 724.312 cm 0 0 m 75.95 0 l S Q q 1 0 0 1 293.099 724.312 cm 0 0 m 45.111 0 l S Q BT /T1_1 7.97 Tf 119.58 715.392 Td (I)Tj /T1_2 7.97 Tf 14.993 0 Td (log)Tj /T1_3 5.978 Tf 10.913 -2.048 Td (2)Tj /T1_4 7.97 Tf 5.562 2.048 Td (B)Tj /T1_0 7.97 Tf 19.36 0 Td [(core-y)29(ears)-1814(ro)30(ws)-1579.003(core-y)30(ears)-1349.997(core-time)]TJ ET 0.46 w  q 1 0 0 1 62.169 710.929 cm 0 0 m 485.375 0 l S Q BT 71.783 701.917 Td [(RSA-512)-1350.001(14)-3205(29)-4833.005(0.5)-1585.992(4.3M)-4301.004(0.33)]TJ /T1_5 6.974 Tf 279.75 0 Td [(Timings)-385(with)-385(default)-384.998(CADO-NFS)-384.998(parameters.)]TJ /T1_0 7.97 Tf -275.28 -8.967 Td [(DH-512)-1350.001(15)-3205(27)-4833.005(2)1.004(.)-1.004(5)-1585.992(2.1M)-4832.001(7.7)-2231.003(1)1.004(0)-178.003(mins)]TJ /T1_5 6.974 Tf 275.28 0 Td [(F)92(or)-385(the)-385(computations)-384.998(in)-384.998(this)-384.009(pap)-31.002(er;)-384.998(ma)31.002(y)-384.998(b)-31(e)-385(sub)-31(optimal.)]TJ ET 0.276 w  q 1 0 0 1 62.169 688.58 cm 0 0 m 485.375 0 l S Q BT /T1_0 7.97 Tf 71.783 679.659 Td [(RSA-768)-1350.001(16)-3205(37)-4595.994(800)-1350.009(250M)-4596.998(100)]TJ /T1_5 6.974 Tf 279.75 0 Td [(Est.)-385(based)-385(on)-384.998([29])-384.998(with)-385.012(less)-384.998(sieving.)]TJ /T1_0 7.97 Tf -275.28 -8.966 Td [(DH-768)-1350.001(17)-3205(35)-3769.994(8,000)-1350.009(150M)-3238.996(28,50)1(0)-2880(2)-177(da)28.996(ys)]TJ /T1_5 6.974 Tf 275.28 0 Td [(Est.)-385(based)-385(on)-384.998([8,)-147.997(29])-385.012(and)-384.998(our)-384.998(o)31.002(wn)-384.998(exp)-31.002(erimen)31(ts.)]TJ ET q 1 0 0 1 62.169 666.323 cm 0 0 m 485.375 0 l S Q BT /T1_0 7.97 Tf 67.549 657.402 Td [(RSA-1024)-1350.001(18)-3205(42)-1880.994(1,000,000)-1807.005(8.7B)-2706.995(120,000)]TJ /T1_5 6.974 Tf 283.984 0 Td [(Est.)-385(based)-385(on)-384.998(complexit)31.002(y)-385.012(form)31.002(ula.)]TJ /T1_0 7.97 Tf -279.514 -8.966 Td [(DH-1024)-1350.001(19)-3205(40)-1349.997(10,000,000)-1806.002(5.2B)-1349.997(35,000,000)-2349.007(30)-176.999(da)30(ys)]TJ /T1_5 6.974 Tf 279.514 0 Td [(Est.)-385(based)-385(on)-384.998(complexit)31.002(y)-385.012(form)31.002(ula)-384.998(and)-384.998(our)-384.998(exp)-31(erimen)31.002(ts.)]TJ ET 0.737 w  q 1 0 0 1 62.169 643.835 cm 0 0 m 485.375 0 l S Q BT /T1_6 8.966 Tf 0.98 0 0 1 53.467 628.174 Tm [(T)87.003(able)-338.006(2:)]TJ /T1_7 8.966 Tf 1 0 0 1 89.331 628.174 Tm [(Estimating)-382.004(costs)-382.997(for)-382.004(factoring)-381.993(and)-383.008(discrete)-381.993(log)]TJ /T1_6 8.966 Tf 0.98 0 0 1 303.393 628.174 Tm [(.)-462.995(F)87.995(or)-338.999(sieving,)-341.006(w)29.008(e)-338.999(giv)28.997(e)-338.999(t)30.001(w)28.997(o)-338.999(imp)-28.997(ortan)28.997(t)-338.999(parameters:)-460.999(the)-338.006(n)28.997(um)29.008(b)-29.008(er)-338.999(of)]TJ 0.981 0 0 1 53.798 617.714 Tm [(bits)-349.003(of)-347.999(the)-349.003(smo)-28.997(othness)-349.003(b)-28.997(ound)]TJ /T1_8 8.966 Tf 1 0 0 1 173.567 617.714 Tm (B)Tj /T1_6 8.966 Tf 0.981 0 0 1 181.341 617.714 Tm [(and)-349.003(the)-347.999(sieving)-349.003(region)-348.992(parameter)]TJ /T1_8 8.966 Tf 1 0 0 1 315.083 617.714 Tm (I)Tj /T1_6 8.966 Tf 0.981 0 0 1 319.79 617.714 Tm [(.)-349.003(F)88.006(or)-349.003(linear)-349.003(algebra,)-349.003(a)1.004(ll)-349.003(costs)-348.992(for)-349.003(DH)-347.999(are)-349.003(for)-349.003(safe)-347.999(primes;)-348.992(for)]TJ 1 0 0 1 53.798 607.253 Tm [(DSA)-343.003(primes)-341.999(with)]TJ /T1_9 8.966 Tf 72.9 0 Td (q)Tj /T1_6 8.966 Tf 7.511 0 Td [(of)-343.001(160)-342(bits,)-343.003(this)-341.999(should)-343.003(b)-27.993(e)-343.003(divided)-343.003(b)29.008(y)-343.003(6.4)-341.999(for)-343.003(1024)-342(bits,)-343.001(4.8)-343.003(for)-341.999(768)-343.003(bits,)-341.999(and)-342.992(3.2)-341.999(for)-343.003(512)-343.003(bits.)]TJ 1.002 0 0 1 53.798 576.219 Tm [(nen)28.005(t)-340.003(can)-341.006(hide)-340.995(p)-28.005(olynomial)-340.995(factors.)-456.002(This)-340.003(complexit)28.005(y)-340.995(form)28.997(ula,)]TJ 1.011 0 0 1 53.467 565.758 Tm (with)Tj /T1_9 8.966 Tf 1 0 0 1 74.653 565.758 Tm (k)Tj /T1_10 8.966 Tf 1.011 0 0 1 82.274 565.758 Tm [(=)-281.997(1)]TJ /T1_9 8.966 Tf 1 0 0 1 96.739 565.758 Tm (:)Tj /T1_10 8.966 Tf 1.011 0 0 1 99.299 565.758 Tm (923)Tj /T1_6 8.966 Tf [(,)-338.999(describ)-27.993(es)-338.999(the)-338.006(o)28.005(v)27.993(erall)-338.999(time)-337.995(for)-338.999(b)-28.005(oth)-338.999(discrete)]TJ 1.004 0 0 1 53.798 555.298 Tm [(log)-341.999(and)-343.003(factoriza)1.004(tion,)-343.003(whic)28.005(h)-341.999(are)-342.01(b)-28.997(o)1.004(th)-343.003(dominated)-341.999(b)28.005(y)-341.999(sieving)]TJ 1.02 0 0 1 53.798 544.837 Tm [(and)-344.999(linear)-344.007(algebra)-344.999(in)-343.995(the)-344.999(precomputation.)-474.003(The)-344.999(space)-343.995(com-)]TJ 0.98 0 0 1 53.798 534.376 Tm [(plexit)28.997(y)-340.003(\(the)-339.992(size)-341.006(of)-339.992(the)-340.003(matrix)-340.003(in)-340.995(memory\))-340.003(is)-340.003(the)-340.003(square)-340.995(ro)-28.997(ot)]TJ 1.02 0 0 1 53.798 523.915 Tm [(of)-343.995(this)-343.003(function,)-344.999(i.e.,)-346.003(the)-343.003(same)-343.995(function,)-344.999(taking)]TJ /T1_9 8.966 Tf 1 0 0 1 248.295 523.915 Tm (k)Tj /T1_10 8.966 Tf 1.02 0 0 1 256.032 523.915 Tm [(=)-293.005(0)]TJ /T1_9 8.966 Tf 1 0 0 1 270.719 523.915 Tm (:)Tj /T1_10 8.966 Tf 1.02 0 0 1 273.279 523.915 Tm (9615)Tj /T1_6 8.966 Tf 18.43 0 Td (.)Tj -233.608 -10.461 Td [(Discrete)-350.999(log)-350.999(descen)27.993(t)-350.999(has)-350.999(a)-350.999(complexit)28.005(y)-350.999(of)-350.999(the)-350.999(same)-350.999(form)-351.01(as)]TJ -0.325 -10.46 Td [(w)28.005(ell;)-408.001([2,)-408.001(Chapter)-408.001(4])-408.001(giv)27.993(es)]TJ /T1_9 8.966 Tf 1 0 0 1 161.262 502.994 Tm (k)Tj /T1_10 8.966 Tf 1.02 0 0 1 169.985 502.994 Tm [(=)-400.004(1)]TJ /T1_9 8.966 Tf 1 0 0 1 185.658 502.994 Tm (:)Tj /T1_10 8.966 Tf 1.02 0 0 1 188.218 502.994 Tm (232)Tj /T1_6 8.966 Tf [(,)-425.99(using)-408.001(an)-409.005(early-ab)-28.005(ort)]TJ 1 0 0 1 53.798 492.533 Tm [(strategy)-343.003(similar)-341.999(to)-343.003(the)-341.999(one)-342.992(in)-342.01([6])-342.992(men)28.997(tioned)-343.003(ab)-27.993(o)27.993(v)28.997(e.)]TJ 1.018 0 0 1 62.765 482.072 Tm [(Ev)55.998(aluating)-335.999(the)-335.999(form)28.005(ula)-336.01(for)-336.991(768-)-335.999(and)-336.01(1024-bit)]TJ /T1_9 8.966 Tf 1 0 0 1 249.651 482.072 Tm (N)Tj /T1_6 8.966 Tf 1.018 0 0 1 261.055 482.072 Tm [(giv)28.005(es)-336.01(us)]TJ 0.98 0 0 1 53.798 471.611 Tm [(estimated)-298.001(m)28.997(ultiplicativ)30.001(e)-298.001(factors)-297.99(b)28.997(y)-298.001(whic)28.997(h)-296.998(time)-298.001(and)-298.001(space)-298.001(will)]TJ 1.014 0 0 1 53.798 461.151 Tm [(increase)-338.999(from)-338.006(the)-338.999(768-)-337.995(to)-338.999(the)-338.999(102)0.993(4-bit)-338.999(case.)-453.002(F)85.006(or)-338.999(precompu-)]TJ 1.02 0 0 1 53.798 450.69 Tm [(tation,)-390(the)-379.996(tot)0.993(al)-379.996(time)-379.004(complexit)28.005(y)-379.996(will)-379.004(increase)-379.004(b)28.005(y)-379.996(a)-379.004(factor)]TJ 1.012 0 0 1 53.798 440.229 Tm [(of)-337.995(1220,)-338.006(while)-337.995(spac)0.993(e)-337.995(complexit)27.993(y)-337.995(will)-337.995(increase)-337.003(b)27.993(y)-337.995(a)-337.995(factor)-338.006(of)]TJ 1.02 0 0 1 53.568 429.768 Tm [(35.)-469.999(These)-344.007(are)-342.992(v)55.998(alid)-344.007(for)-342.992(b)-28.005(oth)-343.995(factoriz)0.993(ation)-343.995(and)-343.003(discrete)-343.995(log,)]TJ 0.225 -10.46 Td [(since)-356.999(they)-356.999(ha)27.993(v)28.005(e)-355.996(the)-356.999(same)-356.999(asymptotic)-356.999(b)-28.005(eha)28.005(vior.)-510.004(Hence,)-362.007(for)]TJ 0.98 0 0 1 53.798 408.847 Tm [(DH-1024,)-299.998(w)28.997(e)-287.997(ge)0.993(t)-287.997(a)-287.997(total)-287.005(cost)-287.997(for)-287.997(the)-287.005(precomputation)-287.997(of)-287.997(ab)-28.997(out)]TJ 1.02 0 0 1 53.476 398.386 Tm [(45M)-409.005(core-y)28.005(ears.)-668.005(The)-408.994(time)-409.005(complexit)28.005(y)-409.997(for)-409.005(eac)28.005(h)-409.005(individual)]TJ 0.316 -10.461 Td [(log)-439.006(after)-439.998(the)-438.994(precomputation)-439.998(should)-439.006(b)-27.993(e)-439.006(m)28.005(ultiplied)-440.009(b)28.005(y)-438.994(95.)]TJ 1.002 0 0 1 53.467 377.464 Tm [(This)-343.003(last)-343.003(n)29.008(um)27.993(b)-27.993(er)-343.003(do)-28.005(es)-342.992(not)-343.003(corresp)-28.005(ond)-342.992(to)-343.003(what)-343.003(w)28.997(e)-342.992(observ)27.993(ed)]TJ 1.02 0 0 1 53.798 367.004 Tm [(in)-378(practice;)-399.001(w)28.005(e)-379.004(at)1.004(tribute)-379.004(that)-378(to)-378(the)-378(fact)-378(that)-378(the)-378(descen)28.005(t)]TJ 0.981 0 0 1 53.798 356.543 Tm [(step)-349.996(has)-350.007(b)-28.997(een)-349.003(far)-349.996(less)-350.007(studied)-349.996(b)-28.997(oth)-349.003(in)-349.996(theory)-350.007(and)-349.996(in)-349.003(practice)]TJ 1 0 0 1 53.798 346.082 Tm [(compared)-343.003(to)-341.999(the)-343.003(other)-341.999(steps.)]TJ 1.02 0 0 1 62.765 335.621 Tm [(F)84.003(or)-477.003(102)1.004(4-bit)-477.003(descen)28.005(t,)-512(w)27.993(e)-475.999(exp)-28.005(erimen)28.005(ted)-475.999(with)-477.003(our)-475.999(early-)]TJ -8.791 -10.46 Td [(ab)-28.005(ort)-385.997(implemen)28.005(tation)-386.008(to)-385.997(inform)-385.997(our)-387(estimate)0.993(s)-387(for)-385.997(descen)28.005(t)]TJ 0.986 0 0 1 53.798 314.7 Tm [(initialization,)-346.003(whic)28.997(h)-346.995(should)-346.003(dominate)-345.992(the)-347.007(individual)-346.003(discrete)]TJ 1.02 0 0 1 53.798 304.239 Tm [(log)-344.999(computation.)-477.003(F)84.003(or)-344.999(a)-346.003(random)-344.999(target)-346.003(in)-344.999(Oakley)-346.003(Gro)1.004(up)-346.003(2,)]TJ 1.009 0 0 1 53.798 293.778 Tm [(initialization)-340.003(to)-27.993(ok)-338.999(22)-340.003(core-da)27.993(ys,)-338.999(yielding)-340.003(a)-339.992(few)-338.999(primes)-340.003(of)-340.003(at)]TJ 1.02 0 0 1 53.798 283.317 Tm [(most)-364.996(130)-364.003(bits)-364.003(to)-364.996(b)-28.005(e)-363.992(descended)-365.007(further.)-533.001(In)-364.996(t)28.005(wice)-364.003(this)-365.007(time,)]TJ 0.988 0 0 1 53.467 272.857 Tm [(w)28.997(e)-346.995(reac)28.997(hed)-346.995(primes)-347.007(of)-347.999(ab)-27.993(out)-348.01(110)-346.995(bits.)-462.995(A)28.997(t)-346.995(this)-347.007(p)-28.997(oin)28.997(t,)-347.999(w)28.997(e)-346.995(w)28.997(ere)]TJ 0.98 0 0 1 53.798 262.396 Tm [(certain)-296.998(to)-296.005(ha)28.997(v)29.008(e)-296.998(b)-29.008(o)-28.997(otstrapp)-28.997(ed)-296.998(the)-296.005(descen)28.997(t,)-307.002(and)-296.998(could)-295.994(con)28.997(tin)28.997(ue)]TJ 1.02 0 0 1 53.798 251.935 Tm [(do)28.005(wn)-359.007(to)-358.996(the)-359.007(smo)-27.993(othness)-358.003(b)-27.993(ound)-359.007(in)-358.996(a)-359.007(few)-358.996(more)-358.996(core-da)27.993(ys)-358.996(if)]TJ 0 -10.461 TD [(prop)-28.005(er)-399.993(sieving)-399.001(soft)27.993(w)28.005(are)-400.004(w)28.005(ere)-399.001(a)28.005(v)55.998(ailable.)-638.997(Th)27.993(us)-399.993(w)27.993(e)-399.001(estimate)]TJ 0.984 0 0 1 53.798 231.014 Tm [(that)-347.999(a)-347.999(1024-bit)-347.999(descen)28.997(t)-347.999(w)28.997(ould)-347.999(tak)28.997(e)-347.999(ab)-28.997(out)-347.999(30)-349.003(core)1.004(-da)28.997(y)-1.004(s,)-347.999(once)]TJ 1 0 0 1 53.798 220.553 Tm [(again)-343.003(easily)-341.999(parallelizable.)]TJ /T1_7 8.966 Tf 0 -20.334 TD [(Costs)-395(in)-395(hardw)33(are)]TJ /T1_6 8.966 Tf 1.017 0 0 1 150.573 200.219 Tm [(Although)-337.003(45M)-337.995(core-y)27.993(e)1.004(ars)-337.995(is)-337.003(a)-338.006(h)29.008(uge)]TJ 1.003 0 0 1 53.798 189.758 Tm [(computational)-340.003(e\033ort,)-340.995(it)-341.006(is)-339.992(not)-341.006(nece)1.004(ssarily)-341.006(out)-340.995(of)-340.003(reac)28.005(h)-340.003(for)-340.995(a)]TJ 0.981 0 0 1 53.798 179.298 Tm [(nation)-347.999(state.)-465.003(Moreo)28.997(v)29.008(er,)-347.999(at)-348.01(this)-347.999(scale)1.004(,)-349.003(signi\034can)29.008(t)-347.007(cost)-347.999(sa)28.997(vings)]TJ 0.98 0 0 1 53.798 168.837 Tm [(could)-289.001(b)-28.997(e)-289.001(realized)-289.001(b)28.997(y)-289.001(dev)30.001(eloping)-289.001(application-sp)-28.997(eci\034c)-289.001(hardw)28.997(are.)]TJ 1.019 0 0 1 62.765 158.376 Tm [(Sieving)-335.999(is)-335.999(a)-335.999(natural)-335.999(target)-336.01(for)-335.999(hardw)28.005(are)-335.999(im)-1.004(ple)1.004(m)-1.004(e)1.004(n)27.993(tation.)]TJ 1.02 0 0 1 53.467 147.915 Tm [(T)84.003(o)-426.002(our)-426.002(k)-1.004(no)28.005(w)1.004(ledge,)-449.01(the)-425.99(b)-28.005(est)-427.005(prior)-425.99(description)-426.002(of)-426.002(an)-427.005(ASIC)]TJ 0.98 0 0 1 53.798 137.455 Tm [(implemen)28.997(tation)-292.994(of)-292.001(1024-bit)-293.005(sieving)-292.994(is)-292.001(the)-293.005(2007)-292.994(w)28.997(ork)-292.001(of)-293.005(Geisel-)]TJ 0 -10.461 TD [(mann)-329.999(and)-329.999(Stein)28.997(w)28.997(andt)-329.999([18].)-459.995(In)-329.999(the)-330.01(follo)29.008(wing,)-334.002(w)28.997(e)-329.999(up)-28.997(date)-331.002(t)1.004(heir)]TJ 1.006 0 0 1 53.798 116.533 Tm [(estimates)-340.995(for)-342.01(mo)-27.993(dern)-341.006(tec)28.005(hniques)-340.995(and)-342.01(adjust)-340.995(parameters)-340.995(f)-1.004(or)]TJ 0.98 0 0 1 53.798 106.072 Tm [(discrete)-266.997(log.)-439.006(W)87.003(e)-266.997(increase)-268.001(their)-267.008(c)29.008(hip)-267.008(coun)29.008(t)-268.001(b)28.997(y)-266.997(a)-268.001(fact)0.993(or)-268.001(of)-266.997(ten)-268.001(to)]TJ T* [(siev)28.997(e)-289.994(more)-290.005(and)-289.994(sa)28.997(v)28.997(e)-290.005(on)-289.994(linear)-290.005(algebra)-289.994(as)-290.005(ab)-28.997(o)28.997(v)28.997(e,)-301.994(giving)-290.005(an)-289.994(esti-)]TJ 0 -10.46 TD [(mate)-346.003(of)-346.995(3M)-346.003(c)28.997(hips)-346.995(to)-346.003(complete)-346.995(sieving)-346.003(in)-346.995(one)-346.003(y)28.997(ear.)-465.003(Shrinking)]TJ 0 -10.461 TD [(the)-241(dies)-242.003(from)-241(the)-241(130)-241(nm)-242.003(tec)29.008(hnology)-241(no)-29.008(de)-241(used)-241.992(in)-241(the)-241(pap)-29.008(er)-241.992(t)0.993(o)]TJ 0.985 0 0 1 316.812 576.219 Tm [(a)-347.999(more)-347.999(mo)-28.997(dern)-348.01(size)-347.999(reduces)-347.999(costs,)-347.999(as)-347.999(transistors)-347.999(are)-347.999(c)28.997(heap)-28.997(er)]TJ 0.98 0 0 1 316.812 565.758 Tm [(at)-251.004(new)29.008(er)-251.004(tec)28.997(hnologie)1.004(s.)-433.998(With)-251.004(standard)-251.004(transistor)-250.993(costs)-251.004(and)-251.004(uti-)]TJ 0 -10.46 TD [(lization,)-290.997(this)-275.004(w)28.997(ould)-275.997(cost)-275.997(ab)-28.997(out)-276.008($2)-275.997(p)-28.997(er)-275.997(c)28.997(hip)-275.997(to)-276.008(man)29.008(ufacture,)-290.005(af-)]TJ 0 -10.461 TD [(ter)-313.994(\034x)-1.004(e)0.993(d)-314.998(design)-314.998(and)-313.994(tap)-29.008(e-out)-314.998(costs)-313.994(of)-314.998(roughly)-314.006($2M)-314.998([32].)-454.006(This)]TJ 1.002 0 0 1 316.812 534.376 Tm [(suggests)-343.003(that)-343.003(an)-342.992($8M)-343.003(in)28.005(v)28.997(estmen)27.993(t)-342.992(w)28.997(ould)-343.003(buy)-343.003(enough)-343.995(ASIC)1.004(s)]TJ 0.98 0 0 1 316.812 523.915 Tm [(to)-301.002(complete)-301.002(the)-301.002(DH)1.004(-1024)-301.002(sieving)-301.002(precomputation)-301.002(in)-300.99(one)-301.002(y)28.997(ear.)]TJ T* [(Since)-301.002(a)-299.998(step)-301.002(of)-301.002(descen)28.997(t)-299.998(uses)-301.002(sieving,)-309.991(the)-301.002(same)-301.002(hardw)28.997(are)-299.998(could)]TJ 1 0 0 1 316.812 502.994 Tm [(lik)28.997(ely)-343.003(b)-28.997(e)-341.999(reused)-343.003(to)-341.999(sp)-28.997(eed)-341.999(calculations)-343.003(of)-341.999(individual)-343.003(logs.)]TJ 0.98 0 0 1 325.778 492.533 Tm [(Estimating)-326.006(the)-326.999(\034nancial)-325.995(cost)-326.006(for)-326.999(the)-325.995(linear)-326.006(algebra)-326.999(is)-325.995(more)]TJ 1.001 0 0 1 316.812 482.072 Tm [(di\036cult,)-343.003(since)-343.003(there)-341.999(has)-342.992(b)-29.008(een)-341.999(little)-342.992(w)28.997(ork)-343.003(on)-343.003(designing)-342.992(c)28.997(hips)]TJ 0.983 0 0 1 316.812 471.611 Tm [(that)-349.003(are)-349.003(suitable)-348.992(for)-349.003(the)-349.003(larger)-348.992(\034elds)-349.003(in)28.997(v)28.997(olv)29.008(ed)-349.003(in)-349.003(discrete)-349.003(log.)]TJ 0.98 0 0 1 316.48 461.151 Tm [(T)87.003(o)-236.003(deriv)28.997(e)-236.996(a)-236.003(rough)-236.996(estimate,)-259(w)28.997(e)-236.003(can)-236.996(b)-28.997(egin)-236.003(with)-236.996(general)-236.003(purp)-28.997(ose)]TJ 1.02 0 0 1 316.812 450.69 Tm [(hardw)28.005(are)-450.002(and)-448.998(the)-450.002(core-y)27.993(ear)-449.991(estimate)-450.002(from)-448.998(T)83.991(able)-449.991(2.)-790.005(The)]TJ 0.982 0 0 1 316.48 440.229 Tm [(Titan)-350.999(sup)-28.997(ercomputer)-350.007([39])-125.993(\026)-125(at)-350.999(300,000)-350.007(CPU)-350.999(cores,)-350.999(curren)28.997(tly)]TJ 1.007 0 0 1 316.812 429.768 Tm [(the)-338.999(m)-1.004(o)1.004(s)-1.004(t)-338.999(p)-27.993(o)27.993(w)28.005(erful)-338.999(sup)-29.008(e)1.004(rcomputer)-340.003(in)-338.999(the)-340.003(U.S.)-122(\026)-122.993(w)28.997(ould)-340.003(tak)28.005(e)]TJ 0.98 0 0 1 316.351 419.308 Tm [(117)-266.997(y)28.997(ears)-266.997(to)-267.008(complete)-268.001(the)-266.997(1024-bit)-266.997(linear)-266.997(algebra)-267.008(stage.)-438.994(Titan)]TJ 0.132 -10.461 Td [(w)28.997(as)-347.999(co)1.004(ns)-1.004(t)1.004(ructed)-347.999(in)-347.999(2012)-347.007(for)-347.999($94M,)-347.999(suggesting)-346.995(a)-347.999(cost)-347.999(o)0.993(f)-347.999($11B)]TJ 0.339 -10.461 Td [(in)-283.001(sup)-30.001(e)1.004(rcomputers)-284.005(to)-283.001(\034nish)-283.001(this)-283.994(step)-283.001(in)-284.005(a)-283.001(y)29.008(ear.)-444.002(In)-283.001(the)-283.001(con)28.997(text)]TJ 0.988 0 0 1 316.812 387.925 Tm [(of)-344.999(factorization,)-346.003(mo)28.997(ving)-344.999(linear)-344.999(algebra)-344.999(from)-344.999(general)-346.003(purp)-27.993(ose)]TJ 1.02 0 0 1 316.812 377.464 Tm [(CPUs)-421.998(to)-421.998(ASICs)-423.001(has)-422.009(b)-27.993(een)-421.998(estimated)-422.009(to)-421.998(reduce)-421.998(costs)-423.001(b)28.005(y)-421.998(a)]TJ 1.01 0 0 1 316.812 367.004 Tm [(factor)-337.995(of)-339.01(80)-337.995([17].)-451.999(If)-338.999(w)27.993(e)-337.995(optimistically)-338.006(assume)-338.999(that)-337.995(a)-338.999(similar)]TJ 0.98 0 0 1 316.812 356.543 Tm [(reduction)-332.999(can)-334.002(b)-28.997(e)-332.999(ac)28.997(hiev)28.997(ed)-333.991(for)-333.01(discrete)-332.999(log,)-337.003(the)-332.999(hardw)29.008(are)-334.002(cost)]TJ 1.02 0 0 1 316.812 346.082 Tm [(to)-432.002(p)-27.993(erform)-433.005(the)-432.002(linear)-432.994(algebra)-432.002(for)-433.005(DH-1024)-432.002(in)-432.994(one)-432.002(y)28.005(ear)-432.002(is)]TJ 1 0 0 1 316.812 335.621 Tm [(plausibly)-343.003(on)-341.999(the)-343.003(order)-341.999(of)-342.992(h)28.997(undreds)-343.003(of)-341.999(m)-1.004(illions)-341.999(of)-343.003(dollars.)]TJ 1.02 0 0 1 325.778 325.161 Tm [(T)84.003(o)-469.999(put)-471.003(this)-469.999(dollar)-469.999(\034gure)-469.999(in)-471.003(con)28.005(text,)-504.004(t)1.004(he)-471.003(FY)-168.005(2012)-469.999(bud-)]TJ 1.016 0 0 1 316.812 314.7 Tm [(get)-334.995(f)-1.004(or)-335.006(the)-335.999(U.S.)-334.995(Consolidated)-335.999(C)0.993(ry)-0.993(pto)0.993(logic)-335.999(Program)-335.999(\(w)1.004(hic)27.993(h)]TJ 1.02 0 0 1 316.812 304.239 Tm [(includes)-453.002(the)-453.995(N)0.993(SA\))-453.995(w)28.005(as)-453.002($10.5)-453.002(billion)]TJ /T1_11 5.978 Tf 1 0 0 1 468.468 308.048 Tm (4)Tj /T1_6 8.966 Tf 1.02 0 0 1 476.765 304.239 Tm [([57].)-799.998(The)-453.002(agency's)]TJ 0.998 0 0 1 316.812 293.778 Tm [(classi\034ed)-340.995(2013)-342.01(budget)-340.995(request,)-341.999(whic)28.997(h)-341.999(prioritized)-340.995(in)28.997(v)28.005(estmen)28.997(t)]TJ 1.017 0 0 1 316.812 283.317 Tm [(in)-337.003(\020groundbreaking)-337.003(cryptanalytic)-336.991(capabilities)-337.003(to)-337.003(defeat)-337.003(ad-)]TJ 0.98 0 0 1 316.572 272.857 Tm [(v)28.997(ersarial)-349.003(cryptograph)29.008(y)-349.003(and)-349.003(exploit)-348.992(in)28.997(ternet)-349.003(tra\036c,\021)-349.003(included)]TJ 0.245 -10.461 Td [(notable)-263.004($100M)-263.997(increases)-263.004(in)-262.993(t)28.997(w)28.997(o)-263.997(progra)1.004(m)-1.004(s)-263.004([57]:)-423.001(\020cryptanalytic)]TJ T* [(IT)-302.005(services\021)-300.99(\(to)-302.005($247M\),)-301.994(and)-301.002(a)-302.005(cryptically)-301.994(named)-301.002(\020cryptanal-)]TJ -0.245 -10.461 Td [(ysis)-299.005(and)-298.994(exploitation)-299.005(services)-298.994(program)-299.005(C\021)-298.994(\(to)-299.005($360M\).)-298.994(NSA's)]TJ 0.245 -10.46 Td [(leak)28.997(ed)-346.995(strategic)-346.003(plan)-346.995(for)-347.007(the)-346.995(p)-28.997(erio)-29.008(d)-346.995(called)-347.007(for)-346.995(it)-346.995(to)-347.007(\020c)1.004(on)28.997(tin)28.997(ue)]TJ 1.02 0 0 1 316.812 220.553 Tm [(to)-396.001(in)28.005(v)27.993(est)-396.001(in)-396.001(the)-396.001(industrial)-396.001(base)-396.993(and)-396.001(driv)27.993(e)-395.989(the)-396.001(state)-396.001(of)-396.001(the)]TJ 0.98 0 0 1 316.812 210.092 Tm [(art)-320.998(for)-320.998(high)-320.006(p)-30.001(erformance)-319.995(computing)-320.998(to)-321.01(main)29.008(tain)-320.998(pre-eminen)30.001(t)]TJ 1 0 0 1 316.812 199.631 Tm [(cryptanalytic)-343.003(ca)1.004(pabilit)27.993(y)-342.992(for)-341.999(the)-343.003(nation\021)-341.999([63].)]TJ /T1_12 11.955 Tf 0 -20.663 TD [(4.2)-1000(Is)-250(NSA)-250(Br)18(eaking)-250(1024-bit)-250(DH?)]TJ /T1_6 8.966 Tf 0.986 0 0 1 325.778 166.016 Tm [(Our)-347.999(calculations)-347.999(suggest)-347.999(that)-347.999(it)-347.999(is)-347.999(plausibly)-348.01(within)-346.995(NSA's)]TJ 0.992 0 0 1 316.812 155.556 Tm [(resources)-343.995(to)-344.999(ha)28.997(v)28.997(e)-344.999(p)-28.005(erformed)-344.999(n)28.997(um)29.008(b)-29.008(er)-344.999(\034e)1.004(ld)-344.999(siev)28.997(e)-344.999(preco)1.004(m)-1.004(put)1.004(a-)]TJ 1 0 0 1 316.812 145.095 Tm [(tions)-341.999(for)-341.999(at)-341.006(least)-341.999(a)-341.999(small)-341.999(n)28.997(um)28.005(b)-28.005(er)-341.999(of)-341.999(1024-bit)-341.999(Di\036e-He)1.004(llm)-1.004(an)]TJ 0.999 0 0 1 316.812 134.634 Tm [(groups.)-457.999(This)-343.003(w)28.997(ould)-342.992(allo)27.993(w)-343.003(the)1.004(m)-343.995(to)-343.003(break)-343.003(an)28.997(y)-342.992(k)27.993(ey)-342.992(exc)28.997(hanges)]TJ 1.02 0 0 1 316.812 124.173 Tm [(made)-360(with)-360(those)-360(groups)-361.003(in)-360(close)-360(to)-360(real)-360(time.)-521.001(If)-360(true,)-367.003(this)]TJ 0.98 0 0 1 316.48 113.712 Tm [(w)28.997(ould)-265(answ)30.001(er)-265(one)-265(of)-265(the)-263.997(ma)-28.997(j)-1.004(or)-263.997(cryptographic)-265(questions)-265(raised)]TJ 1.02 0 0 1 316.812 103.252 Tm [(b)28.005(y)-361.003(the)-361.003(Edw)28.005(ard)-361.003(Sno)28.005(wden)-361.003(leaks:)-498.004(Ho)28.005(w)-361.003(is)-361.003(NSA)-360.992(defeating)-361.003(the)]TJ 1 0 0 1 316.812 92.791 Tm [(encryption)-343.003(for)-341.999(widely)-343.003(used)-341.999(VPN)-342.992(proto)-28.005(cols?)]TJ ET 0.398 w  q 1 0 0 1 316.812 85.074 cm 0 0 m 119.552 0 l S Q BT /T1_11 5.978 Tf 317.269 78.499 Td (4)Tj /T1_6 8.966 Tf 4.151 -3.809 Td [(The)-342(National)-343.001(Science)-341.999(F)85(oundation's)-342(budget)-343.001(w)28.997(as)-342.992($7)-342.01(billion.)]TJ -18.867 -29.888 Td (8)Tj ET BT /T1_0 8.966 Tf 1.02 0 0 1 62.765 728.239 Tm [(Classi\034ed)-353.999(do)-28.005(cumen)28.005(ts)-353.999(published)-353.999(b)27.993(y)-353.999(Der)-353.999(Spiegel)-353.999([46])-353.999(indi-)]TJ 1.008 0 0 1 53.798 717.778 Tm [(cate)-338.999(that)-338.999(NSA)-338.999(is)-338.006(passiv)28.005(ely)-338.999(decrypting)-338.999(IPsec)-338.999(connections)-339.01(at)]TJ 1.005 0 0 1 53.798 707.318 Tm [(signi\034can)28.005(t)-340.003(scale.)-454.006(The)-339.992(do)-29.008(cumen)29.008(ts)-341.006(do)-340.003(not)-339.992(describ)-28.005(e)-340.995(the)-340.003(crypt-)]TJ 0.98 0 0 1 53.798 696.857 Tm [(analytic)-328.002(tec)28.997(hniques)-327.991(used,)-332.006(but)-328.002(they)-327.991(do)-328.002(pro)28.997(vide)-328.002(an)-328.002(o)30.001(v)29.008(erview)-328.002(of)]TJ 1.019 0 0 1 53.798 686.396 Tm [(the)-334.995(attac)27.993(k)-334.995(system)-335.006(arc)28.005(hitec)0.993(ture.)-447.995(After)-334.995(reviewing)-335.006(ho)28.005(w)-335.006(IPsec)]TJ 0.994 0 0 1 53.798 675.935 Tm [(k)28.997(ey)-344.999(establishmen)28.997(t)-343.995(w)28.005(orks,)-344.007(w)28.997(e)-344.999(will)-343.995(use)-344.007(the)-344.999(published)-343.995(informa-)]TJ 1.019 0 0 1 53.798 665.474 Tm [(tion)-335.999(to)-335.006(ev)56.009(aluate)-336.01(the)-334.995(h)28.005(yp)-29.008(ot)1.004(hesis)-335.999(that)-335.999(the)-335.006(NSA)-335.999(is)-335.999(lev)28.005(eraging)]TJ 1 0 0 1 53.798 655.014 Tm [(precomputation)-341.999(to)-343.003(calculate)-341.999(discrete)-343.003(logs)-342.992(at)-342.01(scale.)]TJ /T1_1 8.966 Tf 0 -12.952 TD (IKE)Tj /T1_0 8.966 Tf 1.02 0 0 1 86.107 642.062 Tm [(In)28.005(ternet)-418.005(Key)-418.998(Exc)27.993(hange)-418.998(\(IKE\))-417.994(is)-419.009(the)-417.994(main)-418.998(k)27.993(ey)-417.994(es-)]TJ -31.675 -10.461 Td [(tablishmen)28.005(t)-357.011(proto)-27.993(col)-356.999(used)-358.003(for)-356.999(IPsec)-356.999(VPNs.)-512(There)-356.999(are)-356.999(t)28.005(w)27.993(o)]TJ -0.234 -10.46 Td [(v)28.005(ersions,)-422.009(IKEv1)-403.997([22])-405.001(and)-403.997(IKEv2)-405.001([25],)-421.998(whic)27.993(h)-403.997(di\033er)-405.001(in)-403.997(mes-)]TJ 1 0 0 1 53.798 610.68 Tm [(sage)-343.003(structure)-343.003(but)-343.995(are)-343.003(conceptually)-342.992(similar.)-459.002(F)84.995(or)-343.003(the)-342.992(sak)27.993(e)-342.992(of)]TJ 0 -10.461 TD [(brevit)29(y)85(,)-342(w)28(e)-342(will)-343.001(use)-343.003(IKEv1)-341.999(terminology)85.999(.)]TJ 1.02 0 0 1 62.765 589.758 Tm [(Eac)28.005(h)-409.005(IKE)-409.005(session)-408.994(b)-28.005(egins)-409.997(with)-409.005(a)-408.994(Phase)-409.005(1)-408.994(handshak)27.993(e,)-427.998(in)]TJ -9.116 -10.46 Td [(whic)28.005(h)-427.005(the)-427.005(clien)28.005(t)-426.994(and)-428.009(serv)28.005(er)-427.005(select)-426.994(a)-427.005(Di\036e-Hellman)-426.994(group)]TJ 1.006 0 0 1 53.798 568.837 Tm [(from)-340.003(a)-340.003(small)-339.992(set)-340.003(of)-338.999(standardized)-340.003(parameters)-340.003(and)-339.992(p)-28.005(erform)-340.003(a)]TJ 0.981 0 0 1 53.798 558.376 Tm [(k)28.997(ey)-349.996(exc)28.997(hange)-349.996(to)-350.007(establish)-349.996(a)-350.007(shared)-349.996(secret.)-468.003(The)-349.996(shared)-349.996(secret)]TJ 0.987 0 0 1 53.798 547.915 Tm [(is)-347.999(com)28.997(bined)-347.999(with)-347.999(other)-347.999(cleart)1.004(ext)-347.999(v)56.991(alues)-346.995(transmitted)-347.999(b)28.997(y)-347.999(eac)28.997(h)]TJ 1.02 0 0 1 53.798 537.455 Tm [(side,)-427.005(suc)28.005(h)-409.005(as)-408.994(nonces)-409.005(and)-408.994(co)-28.005(okies,)-426.994(to)-409.005(deriv)28.005(e)-408.001(a)-409.005(v)55.998(alue)-408.994(called)]TJ /T1_2 7.97 Tf T* (SKEYID)Tj /T1_0 8.966 Tf [(.)-509(IKE)-355.996(pro)28.005(vides)-356.007(sev)28.005(eral)-356.007(authen)28.005(tication)-355.996(mec)27.993(hanisms,)]TJ 0.991 0 0 1 53.798 516.533 Tm [(including)-343.995(sy)-1.004(mmetric)-344.007(pre-shared)-343.995(k)28.005(eys)-344.007(\(PSK\);)-343.995(when)-344.999(IKEv1)-344.007(is)]TJ 1.02 0 0 1 53.798 506.072 Tm [(authen)28.005(ticated)-380.008(with)-379.996(a)-381(PSK,)-379.996(this)-380.008(v)55.998(alue)-381(is)-379.996(incorp)-27.993(orated)-380.008(in)28.005(to)]TJ 1 0 0 1 53.798 495.611 Tm [(the)-343.003(deriv)58.005(ation)-343.003(of)]TJ /T1_2 7.97 Tf 70.37 0 Td (SKEYID)Tj /T1_0 8.966 Tf (.)Tj 0.987 0 0 1 62.765 485.151 Tm [(The)-346.995(resulting)]TJ /T1_2 7.97 Tf 57.104 0 Td (SKEYID)Tj /T1_0 8.966 Tf 32.891 0 Td [(is)-346.995(used)-347.007(to)-346.995(encrypt)-347.007(and)-346.995(authen)28.997(ticate)]TJ 1.02 0 0 1 53.798 474.69 Tm [(a)-373.004(Phase)-372.992(2)-373.004(handshak)28.005(e.)-559.009(Phase)-372.992(2)-373.004(establishes)-373.004(the)-372.992(parameters)]TJ T* [(and)-382.997(k)27.993(ey)-382.997(material,)]TJ /T1_2 7.97 Tf 74.69 0 Td [(KEYMA)87(T)]TJ /T1_0 8.966 Tf [(,)-382.997(for)-382.997(a)-383.008(cryptographic)-382.997(transp)-28.005(ort)]TJ 0.98 0 0 1 53.798 453.768 Tm [(proto)-28.997(col)-340.003(used)-340.003(to)-338.999(protect)-340.003(subsequen)29.008(t)-340.003(tra)0.993(\036)-0.993(c,)-341.006(suc)29.008(h)-340.003(as)-340.003(Encapsu-)]TJ 0.986 0 0 1 53.798 443.308 Tm [(lating)-347.999(Securit)28.997(y)-347.999(P)28.997(a)29.008(yload)-347.999(\(ESP\))-348.01([27])-347.999(or)-347.999(A)29.008(uthen)28.997(ticated)-347.999(Header)]TJ 1.02 0 0 1 52.72 432.847 Tm [(\(AH\))-400.997([26].)-645.008(In)-400.997(some)-400.997(circumstances,)-418.005(this)-400.997(phase)-402.001(include)1.004(s)-402.001(an)]TJ 1.009 0 0 1 53.798 422.386 Tm [(additional)-338.999(round)-338.999(of)-338.999(Di\036e-Hellman.)-453.002(Ultimately)84.995(,)]TJ /T1_2 7.97 Tf 193.011 0 Td [(KEYMA)88.004(T)]TJ /T1_0 8.966 Tf 37.765 0 Td (is)Tj 1.02 0 0 1 53.798 411.925 Tm [(deriv)28.005(ed)-372(from)]TJ /T1_2 7.97 Tf 54.629 0 Td (SKEYID)Tj /T1_0 8.966 Tf [(,)-372(additional)-372(nonces,)-381(and)-372(the)-370.996(result)-372(of)]TJ 1 0 0 1 53.798 401.464 Tm [(the)-343.003(optio)1.004(nal)-343.003(Phase)-343.003(2)-341.999(Di\036e-Hellman)-342.992(exc)28.997(hange.)]TJ /T1_1 8.966 Tf 0 -12.951 TD [(NSA's)-275(VPN)-274(exploitation)-275(pro)-33(cess)]TJ /T1_0 8.966 Tf 0.98 0 0 1 214.344 388.513 Tm [(The)-242.996(do)-30.001(cumen)30.001(ts)-244(pub-)]TJ 1.013 0 0 1 53.798 378.052 Tm [(lished)-337.995(b)27.993(y)-337.003(Der)-337.995(Spiegel)-337.003(describ)-28.997(e)-337.003(a)-337.995(system)-338.006(named)-337.003(TURMOIL)]TJ 0.98 0 0 1 53.798 367.592 Tm [(that)-293.005(is)-292.994(used)-292.001(to)-293.005(collect)-292.994(and)-293.005(decrypt)-292.994(VPN)-292.001(tra\036c.)-447.002(The)-293.005(evidence)]TJ 1.02 0 0 1 53.798 357.131 Tm [(indicates)-445.006(that)-445.998(this)-444.995(decryption)-445.998(is)-445.006(p)-27.993(erformed)-446.01(using)-444.995(passiv)28.005(e)]TJ 0 -10.461 TD [(ea)28.005(v)27.993(esdropping)-462.003(and)-460.999(do)-27.993(es)-462.003(not)-462.003(re)1.004(q)-1.004(uire)-460.999(message)-462.003(injection)-460.999(or)]TJ T* [(man-in-the-middle)-388.004(attac)28.005(ks)-387(on)-388.004(IPsec)-387(or)-387.993(IKE.)-603.007(Figure)-387.993(4,)-400.004(an)]TJ 1.005 0 0 1 53.798 325.748 Tm [(excerpt)-341.999(from)-341.999(one)-341.006(of)-341.999(the)-341.999(do)-27.993(cumen)27.993(ts)-341.999([67],)-341.999(illustrates)-340.995(the)-342.01(\035o)28.005(w)]TJ 1 0 0 1 53.798 315.288 Tm [(of)-343.003(information)-341.999(through)-343.003(the)-341.999(TURMOIL)-342.992(system)]TJ 0.98 0 0 1 62.765 304.827 Tm [(The)-328.002(initial)-328.995(pha)0.993(s)-0.993(e)0.993(s)-328.995(of)-328.002(the)-328.002(attac)29.008(k)-329.006(in)30.001(v)28.997(olv)29.008(e)-329.006(c)1.004(ollecting)-329.006(IKE)-327.991(and)]TJ 1.004 0 0 1 53.798 294.366 Tm [(ESP)-340.995(pa)27.993(yloads)-340.995(and)-341.006(dete)1.004(rm)-1.004(ining)-340.995(w)1.004(hether)-341.006(the)-340.995(tra\036c)-341.006(matc)28.005(hes)]TJ 1.02 0 0 1 53.798 283.905 Tm [(an)28.005(y)-438.002(task)27.993(ed)-436.998(selector)-436.998([65].)-753(If)-438.002(so)1.004(,)-463.006(TURMOIL)-437.991(transmits)-437.009(the)]TJ 0.99 0 0 1 53.798 273.445 Tm [(complete)-346.995(IKE)-347.007(handshak)28.005(e)-347.007(and)-346.995(ma)28.997(y)-346.995(transmit)-347.999(a)-347.007(small)-346.995(amoun)28.997(t)]TJ 0.992 0 0 1 53.798 262.984 Tm [(of)-343.995(ESP)-344.007(ciphertext)-343.995(to)-343.003(NSA's)-343.995(Cryptanalysis)-344.007(and)-343.995(Exploitation)]TJ 1.013 0 0 1 53.798 252.523 Tm [(Services)-338.999(\(CES\))-338.999([56,)-132.004(65])-338.999(via)-338.999(a)-338.006(secure)-338.999(tunnel.)-452.991(Within)-339.01(CES,)-338.999(a)]TJ 0.98 0 0 1 53.798 242.062 Tm [(sp)-28.997(ecialized)-264.008(VPN)-263.997(A)28.997(ttac)29.008(k)-264.008(Orc)29.008(he)0.993(strator)-263.997(\(V)116(A)28.997(O\))-263.997(system)-263.997(manages)]TJ 1.02 0 0 1 53.798 231.601 Tm [(a)-361.003(collection)-360.992(of)-361.003(high-p)-28.005(erformance)-360.992(grid)-361.003(computing)-361.003(resources)]TJ 0 -10.46 TD [(lo)-28.005(cated)-339.992(at)-340.003(NSA)-340.003(Headquarters)-340.995(and)-340.003(in)-340.003(a)-340.003(data)-339.992(cen)27.993(ter)-340.003(at)-340.995(Oak)]TJ 0.988 0 0 1 53.798 210.68 Tm [(Ridge)-347.999(National)-347.007(Lab)-28.997(oratory)87.003(,)-347.999(whic)28.997(h)-347.999(p)-28.997(erform)-347.999(the)-347.007(computation)]TJ 1.02 0 0 1 53.798 200.219 Tm [(required)-340.003(to)-338.999(generate)-340.003(the)-338.999(ESP)-340.003(session)-338.999(k)28.005(ey)-340.003([61,)-132.997(62,)-134(67].)-459.002(V)112.007(A)27.993(O)]TJ 1 0 0 1 53.798 189.758 Tm [(also)-341.999(main)27.993(tains)-341.999(a)-341.999(database,)-341.999(CORALREEF,)-341.999(that)-341.999(stores)-343.003(cryp-)]TJ 1.02 0 0 1 53.798 179.298 Tm [(tographic)-412.005(v)56.009(alues,)-430.005(including)-412.005(a)-411.994(set)-412.005(of)-411.001(kno)28.005(wn)-412.005(PSKs)-411.994(and)-412.005(the)]TJ 1 0 0 1 53.798 168.837 Tm [(resulting)-343.003(\020re)1.004(co)27.993(v)29.008(ered\021)-343.003(ESP)-341.999(session)-343.003(k)28.005(e)0.993(y)-0.993(s)-341.999([60,)-134(61,)-133.008(67].)]TJ 0.98 0 0 1 62.765 158.376 Tm [(The)-343.995(ESP)-344.007(tra\036c)-343.995(itself)-344.007(is)-344.999(bu\033)1.004(ered)-344.999(for)-344.007(up)-343.995(to)-343.995(15)-344.007(min)28.997(utes)-343.995([64],)]TJ 1.001 0 0 1 53.798 147.915 Tm [(un)28.005(t)0.993(il)-343.995(CES)-343.003(can)-343.003(resp)-28.997(ond)-343.003(with)-342.992(the)-343.003(reco)28.997(v)28.005(ered)-343.003(ESP)-343.003(k)28.005(eys)-343.003(if)-343.003(they)]TJ 0.98 0 0 1 53.467 137.455 Tm [(w)28.997(ere)-347.999(generated)-347.999(correctly)87.995(.)-465.995(Once)-347.999(k)28.997(eys)-347.999(ha)28.997(v)29.008(e)-347.999(b)-29.008(een)-347.999(returned,)-348.992(the)]TJ 1.02 0 0 1 53.798 126.994 Tm [(ESP)-397.004(tra\036c)-397.997(is)-397.997(decrypted)-397.004(via)-397.997(hardw)28.005(are)-397.004(accelerators)-397.997([5)0.993(9])-397.997(or)]TJ 1 0 0 1 53.798 116.533 Tm [(in)-340.995(soft)27.993(w)28.997(are)-340.995([68,)-132.997(69].)-456.002(F)84.995(rom)-340.995(this)-341.006(p)-28.997(oin)28.997(t,)-341.999(decrypted)-340.995(VPN)-340.995(tra\036c)]TJ 1.015 0 0 1 53.798 106.072 Tm [(is)-337.995(reinjected)-338.006(in)28.997(to)-337.995(TURMOIL)-338.006(pro)-27.993(cessing)-338.006(infrastructure)-337.995(and)]TJ 1.02 0 0 1 53.798 95.611 Tm [(passed)-343.995(to)-343.003(other)-344.007(systems)-343.995(for)-343.995(storag)0.993(e)-343.995(and)-344.007(analysis)-343.995([69].)-471.003(The)]TJ 0.98 0 0 1 53.798 85.151 Tm [(do)-28.997(cumen)28.997(ts)-295.994(indicate)-296.005(that)-295.001(NSA)-295.994(is)-296.005(reco)28.997(v)28.997(ering)-295.994(ESP)-295.001(k)28.997(eys)-295.994(at)-296.005(large)]TJ 1 0 0 1 53.798 74.69 Tm [(scale,)-343.003(wit)1.004(h)-343.003(a)-343.003(target)-341.999(of)-342.992(100,000)-342.01(p)-28.997(er)-341.999(hour)-343.003([64].)]TJ ET q 239.1096 0 0 124.908 316.812 613.297 cm /Im0 Do Q BT 0.98 0 0 1 316.812 598.004 Tm [(Figure)-295.994(4:)]TJ /T1_1 8.966 Tf 1 0 0 1 355.78 598.004 Tm [(NSA's)-334.002(VPN)-332.999(decryption)-334.002(infrastructure.)]TJ /T1_0 8.966 Tf 0.98 0 0 1 538.304 598.004 Tm (This)Tj 1.02 0 0 1 316.812 587.543 Tm [(classi\034ed)-415.005(illustration)-414.994(published)-415.005(b)28.005(y)-415.005(Der)-414.994(Spiegel)-415.005([67])-414.994(sho)27.993(ws)]TJ 0 -10.461 TD [(captured)-341.999(IKE)-341.999(handshak)27.993(e)-340.995(messages)-341.999(b)-28.005(eing)-341.999(passed)-341.999(to)-340.995(a)-341.999(high-)]TJ 0.98 0 0 1 316.812 566.622 Tm [(p)-28.997(erformance)-278.005(computing)-277.001(system,)-292.001(whic)29.008(h)-278.005(returns)-277.001(the)-277.993(symmetric)]TJ 1.02 0 0 1 316.812 556.161 Tm [(k)28.005(eys)-356.007(f)-1.004(o)1.004(r)-356.999(ESP)-355.996(session)-356.999(tra\036c.)-509(The)-356.007(details)-356.999(of)-355.996(this)-356.999(att)0.993(ac)28.005(k)-356.999(are)]TJ 0.98 0 0 1 316.812 545.7 Tm [(consisten)28.997(t)-301.994(with)-302.005(an)-301.002(e\036cien)29.008(t)-302.005(break)-302.005(for)-301.994(1024-bit)-302.005(Di\036e-Hellman.)]TJ /T1_1 8.966 Tf 1 0 0 1 316.812 514.042 Tm [(Evidence)-421.005(for)-421.998(a)-420.994(discrete)-421.005(log)-421.998(attac)33.001(k)]TJ /T1_0 8.966 Tf 1.02 0 0 1 486.235 514.042 Tm [(While)-358.996(the)-358.003(abilit)27.993(y)]TJ -166.101 -10.46 Td [(to)-352.996(decrypt)-352.003(VPN)-353.007(tra\036c)-352.996(do)-28.005(es)-352.996(not)-352.003(b)28.005(y)-352.996(itself)-353.007(indicate)-352.996(a)-352.003(defeat)]TJ 1 0 0 1 316.812 493.121 Tm [(of)-343.003(Di\036e-Hellman,)-343.995(there)-343.003(are)-343.003(sev)28.005(eral)-343.003(features)-343.003(of)-342.992(IKE)-344.007(and)-343.003(the)]TJ -0.341 -10.461 Td [(V)114(A)29(O's)-343.001(op)-28(eration)-343.001(that)-341.999(supp)-29(ort)-342(this)-343.001(h)28.997(yp)-28.997(othesis.)]TJ 1.02 0 0 1 325.778 472.199 Tm [(The)-390(IKE)-388.997(proto)-28.005(col)-390(has)-388.997(b)-28.005(een)-390(extensiv)28.005(ely)-390(analyzed)-388.997([9,)-164.001(36],)]TJ -8.79 -10.461 Td [(and)-406.005(is)-406.997(not)-405.993(b)-28.005(eliev)28.005(ed)-406.005(to)-406.005(b)-27.993(e)-406.997(exploitable)-406.005(in)-406.005(standard)-405.993(con\034gu-)]TJ 0 -10.46 TD [(rations)-430.998(under)-430.005(passiv)27.001(e)-429.994(ea)27.993(v)28.005(esdropping)-430.998(attac)27.993(ks.)-731.999(In)-430.998(order)-430.998(to)]TJ 0 -10.461 TD [(reco)28.005(v)27.993(er)-367.996(the)-368.007(session)-367.996(k)28.005(eys)-368.007(for)-369(t)1.004(he)-369(ESP)-367.996(or)-368.007(AH)-367.996(proto)-28.005(cols,)-375.993(the)]TJ T* [(attac)28.005(k)27.993(er)-411.001(m)28.005(ust)-409.997(at)-411.001(minim)27.993(um)-411.001(reco)28.005(v)28.005(er)-410.008(the)]TJ /T1_2 7.97 Tf 162.015 0 Td (SKEYID)Tj /T1_0 8.966 Tf 33.46 0 Td (generated)Tj 1 0 0 1 316.812 419.895 Tm [(b)28.997(y)-343.995(the)-343.003(Phase)-343.003(1)-343.995(exc)28.997(hange.)-459.002(Absen)29.008(t)-344.007(a)-343.003(vulnerabilit)29.008(y)-344.007(in)-342.992(the)-343.003(k)27.993(ey)]TJ 1.02 0 0 1 316.812 409.435 Tm [(deriv)55.998(ation)-430.998(function)-432.002(or)-430.998(transp)-28.005(ort)-430.998(encryption,)-456.002(this)-430.998(requires)]TJ 1.01 0 0 1 316.812 398.974 Tm [(the)-338.999(attac)28.997(k)28.005(er)-338.999(to)-338.999(reco)27.993(v)28.005(e)0.993(r)-338.999(a)-338.999(Di\036e-Hellman)-338.999(shared)-338.999(secret)-338.999(after)]TJ 1 0 0 1 316.812 388.513 Tm [(passiv)28.997(ely)-343.003(observing)-342.992(an)-341.999(IKE)-343.003(handshak)28.997(e.)]TJ 0.98 0 0 1 325.778 378.052 Tm [(While)-278.005(IKE)-277.001(is)-277.993(designed)-278.005(to)-277.001(supp)-28.997(ort)-277.993(a)-278.005(range)-277.001(of)-278.005(Di\036e-Hellman)]TJ 1.02 0 0 1 316.812 367.592 Tm [(groups,)-403.997(our)-390(In)27.993(ternet-wide)-390(scans)-390.993(\(\2374.3\))-390(sho)27.993(w)-390(that)-390.993(the)-390(v)55.998(ast)]TJ 1.013 0 0 1 316.812 357.131 Tm [(ma)-28.005(jorit)28.005(y)-338.999(of)-338.999(IKE)-338.999(systems)-338.999(select)-339.01(one)-338.999(particular)-338.999(1024-bit)-338.999(DH)]TJ 1 0 0 1 316.812 346.67 Tm [(group,)-343.003(Oakley)-341.999(Group)-343.003(2,)-341.999(ev)28.005(en)-341.999(when)-343.003(o\033ered)-341.999(stronger)-343.003(groups.)]TJ 0.982 0 0 1 325.778 336.209 Tm [(Giv)28.997(en)-347.999(an)-347.999(e\036cien)28.997(t)-346.995(oracle)-347.999(for)-347.999(solving)-347.999(the)-347.999(discrete)-347.999(logarit)0.993(hm)]TJ 1.02 0 0 1 316.812 325.748 Tm [(problem,)-527.001(attac)28.005(ks)-489.003(on)-489.003(IKE)-488.992(a)0.993(re)-489.003(p)-27.993(ossible)-489.003(pro)28.005(vided)-489.003(that)-489.003(the)]TJ 1.001 0 0 1 316.812 315.288 Tm [(attac)28.997(k)28.005(er)-341.999(can)-341.006(obtain)-341.999(the)-341.999(follo)28.997(wing:)]TJ /T1_3 8.966 Tf 139.503 0 Td (\(1\))Tj /T1_0 8.966 Tf 14.839 0 Td [(a)-341.999(complete)-341.006(t)28.005(w)28.997(o-sided)]TJ 0.982 0 0 1 316.812 304.827 Tm [(IKE)-349.996(transcript,)-349.003(including)-350.007(the)-348.992(Di\036e-Hellman)-350.007(ephemeral)-349.996(k)30.001(ey)-1.004(s)]TJ /T1_4 8.966 Tf 1 0 0 1 316.812 294.366 Tm (g)Tj /T1_5 5.978 Tf 4.716 3.809 Td (a)Tj /T1_0 8.966 Tf 1.005 0 0 1 329.139 294.366 Tm (and)Tj /T1_4 8.966 Tf 1 0 0 1 347.139 294.366 Tm (g)Tj /T1_5 5.978 Tf 4.716 3.809 Td (b)Tj /T1_0 8.966 Tf 1.005 0 0 1 358.706 294.366 Tm [(as)-341.999(w)28.997(ell)-341.999(as)-340.995(the)-341.999(nonces)-342.01(and)-340.995(co)-28.997(okies)-341.006(transmitted)-341.999(b)28.997(y)]TJ 0.98 0 0 1 316.812 283.905 Tm [(b)-28.997(oth)-302.005(sides)-302.998(of)-302.005(the)-301.994(connection,)-311.998(and)]TJ /T1_3 8.966 Tf 134.734 0 Td (\(2\))Tj /T1_0 8.966 Tf 14.486 0 Td [(in)-302.005(IKEv1)-302.998(only)88.006(,)-312.009(the)-301.994(PSK)]TJ 1 0 0 1 316.812 273.445 Tm [(used)-343.003(in)-341.999(deriving)]TJ /T1_2 7.97 Tf 67.519 0 Td (SKEYID)Tj /T1_0 8.966 Tf (.)Tj 1.02 0 0 1 325.778 262.984 Tm [(Both)-415.005(of)-414.994(the)-415.005(ab)-27.993(o)27.993(v)28.005(e)-415.005(requiremen)28.005(ts)-415.005(are)-414.001(also)-414.994(presen)27.993(t)-414.994(in)-415.005(the)]TJ 1.018 0 0 1 316.812 252.523 Tm [(NSA's)-337.003(VPN)-335.999(attac)28.005(k)-337.003(system.)-448.998(As)-337.003(Figure)-335.999(4)-337.003(illustrates,)-335.999(a)-337.003(hard)]TJ 1.008 0 0 1 316.812 242.062 Tm [(requiremen)28.005(t)-339.01(of)-339.992(the)-340.003(V)113(A)28.997(O)-340.003(is)-339.992(the)-340.003(need)-340.003(to)-340.003(obtain)-338.999(the)]TJ /T1_6 8.966 Tf 202.623 0 Td [(c)51.994(omplete)]TJ /T1_0 8.966 Tf 1.02 0 0 1 316.812 231.601 Tm [(t)28.005(w)27.993(o-sided)-430.998(IKE)-430.998(transcript)-430.998([60].)-734.007(The)-430.998(published)-430.998(do)-28.005(cumen)28.005(ts)]TJ 0 -10.46 TD [(indicate)-430.005(that)-429.994(this)-430.005(requiremen)28.005(t)-430.005(substan)28.005(tially)-429.994(increases)-430.005(t)1.004(he)]TJ 0 -10.461 TD [(complexit)28.005(y)-399.001(of)-399.001(the)-399.001(attac)27.993(k)-399.001(execution,)-414.994(since)-399.001(IKE)-399.001(transcripts)]TJ T* [(m)28.005(ust)-422.009(b)-27.993(e)-421.005(reassem)28.005(bled)-421.005(\(\020paired\021\))-421.998(whenev)28.005(er)-421.005(the)-421.998(in)27.993(teraction)]TJ 1 0 0 1 316.812 189.758 Tm [(tra)28.997(v)28.005(erses)-341.999(m)27.993(ultiple)-341.999(net)28.005(w)28.997(ork)-343.003(paths)-341.999([55,)-134(56,)-134(58,)-132.997(66].)]TJ 0.988 0 0 1 325.778 179.298 Tm [(The)-347.999(attac)28.997(k)-347.999(system)-347.999(also)-347.999(seems)-347.999(to)-347.999(require)-347.999(kno)28.997(wledge)-347.999(of)-347.999(the)]TJ 1.02 0 0 1 316.812 168.837 Tm [(PSK.)-623.004(Sev)28.005(eral)-394.997(do)-28.005(c)1.004(um)-1.004(e)1.004(n)27.993(ts)-394.997(describ)-28.005(e)-393.993(tec)27.993(hniques)-393.993(for)-395.008(analysts)]TJ T* [(to)-349.996(lo)-28.005(cate)-349.996(a)-350.007(P)1.004(SK)-1.004(,)-349.003(including)-349.996(using)-349.996(a)-350.007(database)-349.996(of)-350.007(router)-349.996(con-)]TJ T* [(\034gurations)-394.004([70,)-167.001(71],)-408.994(the)-394.004(CORALREEF)-393.993(database)-395.008(of)-393.993(kno)27.993(wn)]TJ 1.006 0 0 1 316.812 137.455 Tm [(PSKs)-341.999([60],)-341.999(previously)-341.999(decrypted)-341.999(SSH)-341.999(tra\036c)-341.006([60],)-343.003(or)-340.995(system)]TJ 0.982 0 0 1 316.812 126.994 Tm [(administrator)-349.003(\020c)28.997(hatte)1.004(r\021)-349.003([70].)-464.992(A)28.997(dditionally)87.003(,)-349.003(NSA)-347.999(is)-349.003(willing)-349.003(to)]TJ 1 0 0 1 315.503 116.533 Tm [(\020[r]un)-343.003(attac)28.997(ks)-342.992(to)-341.999(reco)27.993(v)28.997(er)-342.992(PSK\021)-341.999([60].)]TJ 1.017 0 0 1 325.778 106.072 Tm [(Of)-337.003(course,)-337.003(this)-336.991(explanation)-337.003(is)-337.003(not)-337.003(disp)-27.993(ositiv)27.993(e.)-449.991(The)-337.003(p)-28.005(ossi-)]TJ 0.98 0 0 1 316.812 95.611 Tm [(bilit)28.997(y)-341.999(remains)-341.999(that)-341.999(NSA)-341.999(could)-341.999(defeat)-341.999(IPsec)-341.999(using)-342.01(alterna)1.004(tiv)28.997(e)]TJ 1.02 0 0 1 316.812 85.151 Tm [(means.)-869(Certain)-475.999(published)-475.999(NSA)-475.999(do)-28.005(cumen)28.005(ts)-477.003(refer)-475.999(to)-475.999(soft-)]TJ 0.995 0 0 1 316.48 74.69 Tm [(w)28.997(are)-344.999(\020implan)28.005(ts\021)-344.999(on)-344.999(VPN)-344.999(devices,)-345.01(indicating)-344.999(that)-344.999(the)-344.999(use)-344.999(of)]TJ 1 0 0 1 302.553 44.802 Tm (9)Tj ET