(0.000,0.000) Imperf (0.000,0.000) ect (0.000,0.000) Forwar (0.000,0.000) d (0.000,0.000) Secrec (0.000,0.000) y: (0.000,0.000) Ho (0.000,0.000) w (0.000,0.000) Diffie-Hellman (0.000,0.000) F (0.000,0.000) ails (0.000,0.000) in (0.000,0.000) Practice (0.000,0.000) Da (0.000,0.000) vid (0.000,0.000) Adr (0.000,0.000) ian (0.000,0.000) ¶ (0.000,0.000) Kar (0.000,0.000) thik (0.000,0.000) e (0.000,0.000) y (0.000,0.000) an (0.000,0.000) Bharga (0.000,0.000) v (0.000,0.000) an (0.000,0.000) ∗ (0.000,0.000) Zakir (0.000,0.000) Dur (0.000,0.000) umer (0.000,0.000) ic (0.000,0.000) ¶ (0.000,0.000) Pierr (0.000,0.000) ic (0.000,0.000) k (0.000,0.000) Gaudr (0.000,0.000) y (0.000,0.000) † (0.000,0.000) Matthe (0.000,0.000) w (0.000,0.000) Green (0.000,0.000) § (0.000,0.000) J (0.000,0.000) . (0.000,0.000) Ale (0.000,0.000) x (0.000,0.000) Halder (0.000,0.000) man (0.000,0.000) ¶ (0.000,0.000) Nadia (0.000,0.000) Heninger (0.000,0.000) ‡ (0.000,0.000) Dre (0.000,0.000) w (0.000,0.000) Spr (0.000,0.000) ingall (0.000,0.000) ¶ (0.000,0.000) Emman (0.000,0.000) uel (0.000,0.000) Thomé (0.000,0.000) † (0.000,0.000) Luk (0.000,0.000) e (0.000,0.000) V (0.000,0.000) alenta (0.000,0.000) ‡ (0.000,0.000) Benjamin (0.000,0.000) V (0.000,0.000) anderSloot (0.000,0.000) ¶ (0.000,0.000) Er (0.000,0.000) ic (0.000,0.000) W (0.000,0.000) ustro (0.000,0.000) w (0.000,0.000) ¶ (0.000,0.000) Santiago (0.000,0.000) Zanella-Béguelin (0.000,0.000) (0.000,0.000) P (0.000,0.000) aul (0.000,0.000) Zimmer (0.000,0.000) mann (0.000,0.000) † (0.000,0.000) ∗ (0.000,0.000) INRIA (0.000,0.000) P (0.000,0.000) ar (0.000,0.000) is-Rocquencour (0.000,0.000) t (0.000,0.000) † (0.000,0.000) INRIA (0.000,0.000) Nancy-Gr (0.000,0.000) and (0.000,0.000) Est, (0.000,0.000) CNRS (0.000,0.000) , (0.000,0.000) and (0.000,0.000) Univ (0.000,0.000) ersité (0.000,0.000) de (0.000,0.000) Lorr (0.000,0.000) aine (0.000,0.000) (0.000,0.000) Microsoft (0.000,0.000) Research (0.000,0.000) ‡ (0.000,0.000) Univ (0.000,0.000) ersity (0.000,0.000) of (0.000,0.000) P (0.000,0.000) ennsylv (0.000,0.000) ania (0.000,0.000) § (0.000,0.000) Johns (0.000,0.000) Hopkins (0.000,0.000) ¶ (0.000,0.000) Univ (0.000,0.000) ersity (0.000,0.000) of (0.000,0.000) Michigan (0.000,0.000) F (0.000,0.000) or (0.000,0.000) additional (0.000,0.000) mater (0.000,0.000) ials (0.000,0.000) and (0.000,0.000) contact (0.000,0.000) inf (0.000,0.000) or (0.000,0.000) mation, (0.000,0.000) visit (0.000,0.000) W (0.000,0.000) eakDH.org. (0.000,0.000) ABSTRA (0.000,0.000) CT (0.000,0.000) W (0.000,0.000) e (0.000,0.000) in (0.000,0.000) v (0.000,0.000) estigate (0.000,0.000) the (0.000,0.000) securit (0.000,0.000) y (0.000,0.000) of (0.000,0.000) Diffi (0.000,0.000) e- (0.000,0.000) Hellman (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) exc (0.000,0.000) hange (0.000,0.000) as (0.000,0.000) used (0.000,0.000) in (0.000,0.000) p (0.000,0.000) opular (0.000,0.000) In (0.000,0.000) ternet (0.000,0.000) proto (0.000,0.000) cols (0.000,0.000) and (0.000,0.000) find (0.000,0.000) it (0.000,0.000) to (0.000,0.000) b (0.000,0.000) e (0.000,0.000) less (0.000,0.000) secure (0.000,0.000) than (0.000,0.000) widely (0.000,0.000) b (0.000,0.000) eliev (0.000,0.000) ed. (0.000,0.000) First, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) presen (0.000,0.000) t (0.000,0.000) Log (0.000,0.000) jam, (0.000,0.000) a (0.000,0.000) no (0.000,0.000) v (0.000,0.000) el (0.000,0.000) fla (0.000,0.000) w (0.000,0.000) in (0.000,0.000) TLS (0.000,0.000) that (0.000,0.000) lets (0.000,0.000) a (0.000,0.000) man-in-the-middle (0.000,0.000) do (0.000,0.000) wngrade (0.000,0.000) connections (0.000,0.000) to (0.000,0.000) “exp (0.000,0.000) ort-grade” (0.000,0.000) Diffie-Hellman. (0.000,0.000) T (0.000,0.000) o (0.000,0.000) carry (0.000,0.000) out (0.000,0.000) this (0.000,0.000) attac (0.000,0.000) k, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) implemen (0.000,0.000) t (0.000,0.000) the (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) field (0.000,0.000) siev (0.000,0.000) e (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) algorithm. (0.000,0.000) After (0.000,0.000) a (0.000,0.000) w (0.000,0.000) eek-long (0.000,0.000) precomputation (0.000,0.000) f (0.000,0.000) or (0.000,0.000) a (0.000,0.000) sp (0.000,0.000) ecified (0.000,0.000) 512-bit (0.000,0.000) group, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) can (0.000,0.000) compute (0.000,0.000) arbitrary (0.000,0.000) discret (0.000,0.000) e (0.000,0.000) logs (0.000,0.000) in (0.000,0.000) that (0.000,0.000) group (0.000,0.000) in (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) a (0.000,0.000) min (0.000,0.000) ute. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) find (0.000,0.000) that (0.000,0.000) 82% (0.000,0.000) of (0.000,0.000) vulnerable (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) use (0.000,0.000) a (0.000,0.000) single (0.000,0.000) 512-bit (0.000,0.000) group, (0.000,0.000) allo (0.000,0.000) wing (0.000,0.000) us (0.000,0.000) to (0.000,0.000) compromise (0.000,0.000) connect (0.000,0.000) ions (0.000,0.000) to (0.000,0.000) 7% (0.000,0.000) of (0.000,0.000) Alexa (0.000,0.000) T (0.000,0.000) op (0.000,0.000) Million (0.000,0.000) HTTPS (0.000,0.000) sites. (0.000,0.000) In (0.000,0.000) resp (0.000,0.000) onse, (0.000,0.000) ma (0.000,0.000) jor (0.000,0.000) bro (0.000,0.000) wsers (0.000,0.000) are (0.000,0.000) b (0.000,0.000) eing (0.000,0.000) c (0.000,0.000) hanged (0.000,0.000) to (0.000,0.000) reject (0.000,0.000) short (0.000,0.000) groups. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) go (0.000,0.000) on (0.000,0.000) to (0.000,0.000) consider (0.000,0.000) Diffie-Hellman (0.000,0.000) with (0.000,0.000) 768- (0.000,0.000) and (0.000,0.000) 1024-bit (0.000,0.000) groups. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) estimate (0.000,0.000) that (0.000,0.000) ev (0.000,0.000) en (0.000,0.000) in (0.000,0.000) the (0.000,0.000) 1024-bit (0.000,0.000) ca (0.000,0.000) s (0.000,0.000) e (0.000,0.000) , (0.000,0.000) the (0.000,0.000) com- (0.000,0.000) putations (0.000,0.000) are (0.000,0.000) plausible (0.000,0.000) giv (0.000,0.000) en (0.000,0.000) nation-state (0.000,0.000) resources. (0.000,0.000) A (0.000,0.000) small (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) of (0.000,0.000) fixed (0.000,0.000) or (0.000,0.000) standardized (0.000,0.000) groups (0.000,0.000) are (0.000,0.000) used (0.000,0.000) b (0.000,0.000) y (0.000,0.000) millions (0.000,0.000) of (0.000,0.000) serv (0.000,0.000) ers; (0.000,0.000) p (0.000,0.000) erforming (0.000,0.000) precomputation (0.000,0.000) for (0.000,0.000) a (0.000,0.000) single (0.000,0.000) 1024-bit (0.000,0.000) group (0.000,0.000) w (0.000,0.000) ould (0.000,0.000) allo (0.000,0.000) w (0.000,0.000) passiv (0.000,0.000) e (0.000,0.000) ea (0.000,0.000) v (0.000,0.000) e (0.000,0.000) sdropping (0.000,0.000) o (0.000,0.000) n (0.000,0.000) 18% (0.000,0.000) of (0.000,0.000) p (0.000,0.000) opular (0.000,0.000) HTTPS (0.000,0.000) sites, (0.000,0.000) and (0.000,0.000) a (0.000,0.000) second (0.000,0.000) group (0.000,0.000) w (0.000,0.000) ould (0.000,0.000) allo (0.000,0.000) w (0.000,0.000) decryption (0.000,0.000) of (0.000,0.000) traffic (0.000,0.000) to (0.000,0.000) 66% (0.000,0.000) of (0.000,0.000) IPsec (0.000,0.000) VPNs (0.000,0.000) and (0.000,0.000) 26% (0.000,0.000) of (0.000,0.000) SSH (0.000,0.000) serv (0.000,0.000) e (0.000,0.000) rs. (0.000,0.000) A (0.000,0.000) close (0.000,0.000) reading (0.000,0.000) of (0.000,0.000) published (0.000,0.000) NSA (0.000,0.000) leaks (0.000,0.000) sho (0.000,0.000) ws (0.000,0.000) that (0.000,0.000) the (0.000,0.000) agency’s (0.000,0.000) attac (0.000,0.000) ks (0.000,0.000) on (0.000,0.000) VPNs (0.000,0.000) are (0.000,0.000) consisten (0.000,0.000) t (0.000,0.000) with (0.000,0.000) ha (0.000,0.000) ving (0.000,0.000) ac (0.000,0.000) hiev (0.000,0.000) ed (0.000,0.000) suc (0.000,0.000) h (0.000,0.000) a (0.000,0.000) break. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) conclude (0.000,0.000) that (0.000,0.000) mo (0.000,0.000) ving (0.000,0.000) to (0.000,0.000) stronger (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) exc (0.000,0.000) hange (0.000,0.000) metho (0.000,0.000) ds (0.000,0.000) should (0.000,0.000) b (0.000,0.000) e (0.000,0.000) a (0.000,0.000) priorit (0.000,0.000) y (0.000,0.000) for (0.000,0.000) the (0.000,0.000) In (0.000,0.000) ternet (0.000,0.000) comm (0.000,0.000) unit (0.000,0.000) y (0.000,0.000) . (0.000,0.000) 1. (0.000,0.000) INTR (0.000,0.000) ODUCTION (0.000,0.000) Diffie-Hellman (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) exc (0.000,0.000) hange (0.000,0.000) is (0.000,0.000) widely (0.000,0.000) used (0.000,0.000) to (0.000,0.000) establish (0.000,0.000) session (0.000,0.000) k (0.000,0.000) eys (0.000,0.000) in (0.000,0.000) In (0.000,0.000) ternet (0.000,0.000) proto (0.000,0.000) cols. (0.000,0.000) It (0.000,0.000) is (0.000,0.000) the (0.000,0.000) main (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) exc (0.000,0.000) hange (0.000,0.000) mec (0.000,0.000) hanism (0.000,0.000) in (0.000,0.000) SSH (0.000,0.000) and (0.000,0.000) IPsec (0.000,0.000) a (0.000,0.000) nd (0.000,0.000) a (0.000,0.000) p (0.000,0.000) opular (0.000,0.000) option (0.000,0.000) in (0.000,0.000) TLS. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) e (0.000,0.000) x (0.000,0.000) amine (0.000,0.000) ho (0.000,0.000) w (0.000,0.000) Diffie-Hellman (0.000,0.000) is (0.000,0.000) commonly (0.000,0.000) implemen (0.000,0.000) ted (0.000,0.000) and (0.000,0.000) deplo (0.000,0.000) y (0.000,0.000) ed (0.000,0.000) with (0.000,0.000) these (0.000,0.000) proto (0.000,0.000) cols (0.000,0.000) and (0.000,0.000) find (0.000,0.000) that, (0.000,0.000) in (0.000,0.000) practice, (0.000,0.000) it (0.000,0.000) frequen (0.000,0.000) tly (0.000,0.000) offers (0.000,0.000) less (0.000,0.000) securit (0.000,0.000) y (0.000,0.000) than (0.000,0.000) widely (0.000,0.000) b (0.000,0.000) eliev (0.000,0.000) ed. (0.000,0.000) There (0.000,0.000) are (0.000,0.000) t (0.000,0.000) w (0.000,0.000) o (0.000,0.000) reasons (0.000,0.000) for (0.000,0.000) this. (0.000,0.000) First, (0.000,0.000) a (0.000,0.000) surprising (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) of (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) use (0.000,0.000) w (0.000,0.000) eak (0.000,0.000) Diffie-Hellman (0.000,0.000) parameters (0.000,0.000) or (0.000,0.000) main (0.000,0.000) tain (0.000,0.000) supp (0.000,0.000) ort (0.000,0.000) for (0.000,0.000) obsolete (0.000,0.000) 1990s-era (0.000,0.000) exp (0.000,0.000) ort-grade (0.000,0.000) crypto. (0.000,0.000) More (0.000,0.000) critically (0.000,0.000) , (0.000,0.000) the (0.000,0.000) common (0.000,0.000) practice (0.000,0.000) of (0.000,0.000) using (0.000,0.000) standardized, (0.000,0.000) hard- (0.000,0.000) Permission (0.000,0.000) to (0.000,0.000) mak (0.000,0.000) e (0.000,0.000) digital (0.000,0.000) or (0.000,0.000) hard (0.000,0.000) copies (0.000,0.000) of (0.000,0.000) part (0.000,0.000) or (0.000,0.000) all (0.000,0.000) of (0.000,0.000) this (0.000,0.000) w (0.000,0.000) ork (0.000,0.000) for (0.000,0.000) personal (0.000,0.000) or (0.000,0.000) classroom (0.000,0.000) use (0.000,0.000) is (0.000,0.000) granted (0.000,0.000) without (0.000,0.000) fee (0.000,0.000) pro (0.000,0.000) vided (0.000,0.000) that (0.000,0.000) copies (0.000,0.000) are (0.000,0.000) not (0.000,0.000) made (0.000,0.000) or (0.000,0.000) distrib (0.000,0.000) uted (0.000,0.000) for (0.000,0.000) profit (0.000,0.000) or (0.000,0.000) commercial (0.000,0.000) adv (0.000,0.000) antage (0.000,0.000) and (0.000,0.000) that (0.000,0.000) copies (0.000,0.000) bear (0.000,0.000) this (0.000,0.000) notice (0.000,0.000) and (0.000,0.000) the (0.000,0.000) full (0.000,0.000) cita- (0.000,0.000) tion (0.000,0.000) on (0.000,0.000) the (0.000,0.000) first (0.000,0.000) page. (0.000,0.000) Cop (0.000,0.000) yrights (0.000,0.000) for (0.000,0.000) third-party (0.000,0.000) components (0.000,0.000) of (0.000,0.000) this (0.000,0.000) w (0.000,0.000) ork (0.000,0.000) must (0.000,0.000) be (0.000,0.000) honored. (0.000,0.000) F (0.000,0.000) or (0.000,0.000) all (0.000,0.000) ot (0.000,0.000) her (0.000,0.000) uses, (0.000,0.000) contact (0.000,0.000) the (0.000,0.000) Owner/Author(s). (0.000,0.000) Cop (0.000,0.000) yright (0.000,0.000) is (0.000,0.000) held (0.000,0.000) by (0.000,0.000) the (0.000,0.000) o (0.000,0.000) wner/author(s). (0.000,0.000) CCS’15, (0.000,0.000) October (0.000,0.000) 12–16, (0.000,0.000) 2015, (0.000,0.000) Den (0.000,0.000) v (0.000,0.000) er (0.000,0.000) , (0.000,0.000) Colorado, (0.000,0.000) USA. (0.000,0.000) A (0.000,0.000) CM (0.000,0.000) 978-1-4503-3832-5/15/10. (0.000,0.000) DOI: (0.000,0.000) http://dx.doi.or (0.000,0.000) g/10.1145/2810103.2813707. (0.000,0.000) co (0.000,0.000) ded, (0.000,0.000) or (0.000,0.000) widely (0.000,0.000) shared (0.000,0.000) Diffie-Hellman (0.000,0.000) parameters (0.000,0.000) has (0.000,0.000) the (0.000,0.000) effect (0.000,0.000) of (0.000,0.000) dramatically (0.000,0.000) reducing (0.000,0.000) the (0.000,0.000) cost (0.000,0.000) of (0.000,0.000) large-scale (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) s, (0.000,0.000) bringing (0.000,0.000) some (0.000,0.000) within (0.000,0.000) range (0.000,0.000) of (0.000,0.000) feasibilit (0.000,0.000) y (0.000,0.000) to (0.000,0.000) da (0.000,0.000) y (0.000,0.000) . (0.000,0.000) The (0.000,0.000) curren (0.000,0.000) t (0.000,0.000) b (0.000,0.000) est (0.000,0.000) tec (0.000,0.000) hnique (0.000,0.000) for (0.000,0.000) attac (0.000,0.000) king (0.000,0.000) Diffie-He (0.000,0.000) llm (0.000,0.000) a (0.000,0.000) n (0.000,0.000) relies (0.000,0.000) on (0.000,0.000) compromising (0.000,0.000) one (0.000,0.000) of (0.000,0.000) the (0.000,0.000) priv (0.000,0.000) ate (0.000,0.000) exp (0.000,0.000) onen (0.000,0.000) ts (0.000,0.000) ( (0.000,0.000) a (0.000,0.000) , (0.000,0.000) b (0.000,0.000) ) (0.000,0.000) b (0.000,0.000) y (0.000,0.000) computing (0.000,0.000) the (0.000,0.000) discret (0.000,0.000) e (0.000,0.000) log (0.000,0.000) of (0.000,0.000) the (0.000,0.000) co (0.000,0.000) rresp (0.000,0.000) onding (0.000,0.000) public (0.000,0.000) v (0.000,0.000) alue (0.000,0.000) ( (0.000,0.000) g (0.000,0.000) a (0.000,0.000) mo (0.000,0.000) d (0.000,0.000) p (0.000,0.000) , (0.000,0.000) g (0.000,0.000) b (0.000,0.000) mo (0.000,0.000) d (0.000,0.000) p (0.000,0.000) ). (0.000,0.000) With (0.000,0.000) state-of-the-a (0.000,0.000) rt (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) field (0.000,0.000) siev (0.000,0.000) e (0.000,0.000) algo (0.000,0.000) rithms (0.000,0.000) , (0.000,0.000) computing (0.000,0.000) a (0.000,0.000) single (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) is (0.000,0.000) more (0.000,0.000) difficult (0.000,0.000) than (0.000,0.000) factoring (0.000,0.000) an (0.000,0.000) RSA (0.000,0.000) mo (0.000,0.000) dulus (0.000,0.000) of (0.000,0.000) the (0.000,0.000) same (0.000,0.000) size. (0.000,0.000) Ho (0.000,0.000) w (0.000,0.000) ev (0.000,0.000) er (0.000,0.000) , (0.000,0.000) an (0.000,0.000) adv (0.000,0.000) ersary (0.000,0.000) who (0.000,0.000) p (0.000,0.000) erforms (0.000,0.000) a (0.000,0.000) large (0.000,0.000) precomputation (0.000,0.000) for (0.000,0.000) a (0.000,0.000) prime (0.000,0.000) p (0.000,0.000) can (0.000,0.000) then (0.000,0.000) quic (0.000,0.000) kly (0.000,0.000) calculate (0.000,0.000) arbitrary (0.000,0.000) discrete (0.000,0.000) logs (0.000,0.000) in (0.000,0.000) that (0.000,0.000) group, (0.000,0.000) amortizing (0.000,0.000) the (0.000,0.000) cost (0.000,0.000) o (0.000,0.000) v (0.000,0.000) er (0.000,0.000) all (0.000,0.000) targets (0.000,0.000) t (0.000,0.000) h (0.000,0.000) a (0.000,0.000) t (0.000,0.000) share (0.000,0.000) this (0.000,0.000) paramet (0.000,0.000) er. (0.000,0.000) Although (0.000,0.000) this (0.000,0.000) fact (0.000,0.000) is (0.000,0.000) w (0.000,0.000) ell (0.000,0.000) kno (0.000,0.000) wn (0.000,0.000) among (0.000,0.000) mathematical (0.000,0.000) cryptographers, (0.000,0.000) it (0.000,0.000) seems (0.000,0.000) to (0.000,0.000) ha (0.000,0.000) v (0.000,0.000) e (0.000,0.000) b (0.000,0.000) een (0.000,0.000) lost (0.000,0.000) among (0.000,0.000) practitioners (0.000,0.000) deplo (0.000,0.000) ying (0.000,0.000) cryptosystems. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) exploit (0.000,0.000) it (0.000,0.000) to (0.000,0.000) obt (0.000,0.000) ain (0.000,0.000) the (0.000,0.000) follo (0.000,0.000) wing (0.000,0.000) results: (0.000,0.000) A (0.000,0.000) ctiv (0.000,0.000) e (0.000,0.000) attac (0.000,0.000) ks (0.000,0.000) on (0.000,0.000) exp (0.000,0.000) ort (0.000,0.000) ciphers (0.000,0.000) in (0.000,0.000) TLS. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) in (0.000,0.000) tro (0.000,0.000) duce (0.000,0.000) Log (0.000,0.000) jam, (0.000,0.000) a (0.000,0.000) new (0.000,0.000) at (0.000,0.000) tac (0.000,0.000) k (0.000,0.000) on (0.000,0.000) TLS (0.000,0.000) b (0.000,0.000) y (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) a (0.000,0.000) man-in-the-middle (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) can (0.000,0.000) do (0.000,0.000) wngrade (0.000,0.000) a (0.000,0.000) connection (0.000,0.000) to (0.000,0.000) exp (0.000,0.000) ort-grade (0.000,0.000) cryp- (0.000,0.000) tograph (0.000,0.000) y (0.000,0.000) . (0.000,0.000) This (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) is (0.000,0.000) reminiscen (0.000,0.000) t (0.000,0.000) of (0.000,0.000) the (0.000,0.000) FREAK (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) [7] (0.000,0.000) but (0.000,0.000) applies (0.000,0.000) to (0.000,0.000) the (0.000,0.000) ephemeral (0.000,0.000) Diffie-Hellman (0.000,0.000) ciphersuites (0.000,0.000) and (0.000,0.000) is (0.000,0.000) a (0.000,0.000) TLS (0.000,0.000) proto (0.000,0.000) col (0.000,0.000) fla (0.000,0.000) w (0.000,0.000) rather (0.000,0.000) than (0.000,0.000) an (0.000,0.000) implemen (0.000,0.000) tation (0.000,0.000) vulner- (0.000,0.000) abilit (0.000,0.000) y (0.000,0.000) . (0.000,0.000) W (0.000,0.000) e (0.000,0.000) presen (0.000,0.000) t (0.000,0.000) measuremen (0.000,0.000) ts (0.000,0.000) that (0.000,0.000) sho (0.000,0.000) w (0.000,0.000) that (0.000,0.000) this (0.000,0.000) a (0.000,0.000) ttac (0.000,0.000) k (0.000,0.000) applies (0.000,0.000) to (0.000,0.000) 8.4% (0.000,0.000) of (0.000,0.000) Alexa (0.000,0.000) T (0.000,0.000) op (0.000,0.000) Million (0.000,0.000) HTT (0.000,0.000) PS (0.000,0.000) sites (0.000,0.000) and (0.000,0.000) 3.4% (0.000,0.000) of (0.000,0.000) all (0.000,0.000) H (0.000,0.000) TTPS (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) that (0.000,0.000) ha (0.000,0.000) v (0.000,0.000) e (0.000,0.000) bro (0.000,0.000) wser-trusted (0.000,0.000) certificates. (0.000,0.000) T (0.000,0.000) o (0.000,0.000) exploit (0.000,0.000) this (0.000,0.000) att (0.000,0.000) ac (0.000,0.000) k, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) implemen (0.000,0.000) ted (0.000,0.000) the (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) field (0.000,0.000) siev (0.000,0.000) e (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) algorithm (0.000,0.000) and (0.000,0.000) c (0.000,0.000) arried (0.000,0.000) out (0.000,0.000) precomputat (0.000,0.000) ion (0.000,0.000) for (0.000,0.000) t (0.000,0.000) w (0.000,0.000) o (0.000,0.000) 512-bit (0.000,0.000) Diffie-Hellman (0.000,0.000) groups (0.000,0.000) used (0.000,0.000) b (0.000,0.000) y (0.000,0.000) more (0.000,0.000) than (0.000,0.000) 92% (0.000,0.000) of (0.000,0.000) the (0.000,0.000) vulnerable (0.000,0.000) serv (0.000,0.000) ers. (0.000,0.000) This (0.000,0.000) a (0.000,0.000) llo (0.000,0.000) ws (0.000,0.000) us (0.000,0.000) to (0.000,0.000) compute (0.000,0.000) individual (0.000,0.000) discrete (0.000,0.000) logs (0.000,0.000) in (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) a (0.000,0.000) min (0.000,0.000) ute. (0.000,0.000) Using (0.000,0.000) our (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) oracle, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) can (0.000,0.000) compromise (0.000,0.000) connections (0.000,0.000) to (0.000,0.000) o (0.000,0.000) v (0.000,0.000) er (0.000,0.000) 7% (0.000,0.000) of (0.000,0.000) T (0.000,0.000) op (0.000,0.000) Million (0.000,0.000) HTTPS (0.000,0.000) sites. (0.000,0.000) Disc (0.000,0.000) rete (0.000,0.000) logs (0.000,0.000) o (0.000,0.000) v (0.000,0.000) er (0.000,0.000) larger (0.000,0.000) groups (0.000,0.000) ha (0.000,0.000) v (0.000,0.000) e (0.000,0.000) b (0.000,0.000) een (0.000,0.000) computed (0.000,0.000) b (0.000,0.000) efore (0.000,0.000) [8], (0.000,0.000) but, (0.000,0.000) as (0.000,0.000) far (0.000,0.000) as (0.000,0.000) w (0.000,0.000) e (0.000,0.000) are (0.000,0.000) a (0.000,0.000) w (0.000,0.000) are, (0.000,0.000) this (0.000,0.000) is (0.000,0.000) the (0.000,0.000) first (0.000,0.000) time (0.000,0.000) they (0.000,0.000) ha (0.000,0.000) v (0.000,0.000) e (0.000,0.000) b (0.000,0.000) een (0.000,0.000) exploited (0.000,0.000) to (0.000,0.000) exp (0.000,0.000) ose (0.000,0.000) concrete (0.000,0.000) vulnerabilities (0.000,0.000) in (0.000,0.000) real-w (0.000,0.000) orld (0.000,0.000) systems. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) w (0.000,0.000) e (0.000,0.000) re (0.000,0.000) also (0.000,0.000) able (0.000,0.000) to (0.000,0.000) compromise (0.000,0.000) Diffie-Hellman (0.000,0.000) for (0.000,0.000) man (0.000,0.000) y (0.000,0.000) other (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) b (0.000,0.000) ecause (0.000,0.000) of (0.000,0.000) design (0.000,0.000) and (0.000,0.000) implemen (0.000,0.000) tation (0.000,0.000) fla (0.000,0.000) ws (0.000,0.000) and (0.000,0.000) configuration (0.000,0.000) mistak (0.000,0.000) es. (0.000,0.000) These (0.000,0.000) include (0.000,0.000) use (0.000,0.000) of (0.000,0.000) comp (0.000,0.000) osite-order (0.000,0.000) subgroups (0.000,0.000) in (0.000,0.000) com (0.000,0.000) bination (0.000,0.000) with (0.000,0.000) short (0.000,0.000) exp (0.000,0.000) onen (0.000,0.000) ts, (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) is (0.000,0.000) vulnerable (0.000,0.000) to (0.000,0.000) a (0.000,0.000) kno (0.000,0.000) wn (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) of (0.000,0.000) v (0.000,0.000) an (0.000,0.000) Oorsc (0.000,0.000) hot (0.000,0.000) and (0.000,0.000) Wiener (0.000,0.000) [51], (0.000,0.000) and (0.000,0.000) the (0.000,0.000) inabilit (0.000,0.000) y (0.000,0.000) of (0.000,0.000) clien (0.000,0.000) ts (0.000,0.000) to (0.000,0.000) prop (0.000,0.000) erly (0.000,0.000) v (0.000,0.000) alidate (0.000,0.000) Diffi (0.000,0.000) e (0.000,0.000) -Hellman (0.000,0.000) parameters (0.000,0.000) without (0.000,0.000) kno (0.000,0.000) wing (0.000,0.000) the (0.000,0.000) subgroup (0.000,0.000) order, (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) TLS (0.000,0.000) has (0.000,0.000) no (0.000,0.000) pro (0.000,0.000) vision (0.000,0.000) to (0.000,0.000) comm (0.000,0.000) unicate. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) implemen (0.000,0.000) t (0.000,0.000) these (0.000,0.000) attac (0.000,0.000) ks (0.000,0.000) to (0.000,0.000) o (0.000,0.000) and (0.000,0.000) disco (0.000,0.000) v (0.000,0.000) er (0.000,0.000) sev (0.000,0.000) eral (0.000,0.000) vulnerable (0.000,0.000) implemen (0.000,0.000) tations. (0.000,0.000) Risks (0.000,0.000) from (0.000,0.000) common (0.000,0.000) 1024-bit (0.000,0.000) groups. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) explore (0.000,0.000) the (0.000,0.000) im- (0.000,0.000) plications (0.000,0.000) of (0.000,0.000) precomputation (0.000,0.000) attac (0.000,0.000) ks (0.000,0.000) for (0.000,0.000) 768- (0.000,0.000) and (0.000,0.000) 1024-bit (0.000,0.000) groups, (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) are (0.000,0.000) widely (0.000,0.000) used (0.000,0.000) in (0.000,0.000) practice (0.000,0.000) and (0.000,0.000) still (0.000,0.000) considered (0.000,0.000) Figure (0.000,0.000) 1: (0.000,0.000) The (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) field (0.000,0.000) siev (0.000,0.000) e (0.000,0.000) algorithm (0.000,0.000) for (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) consists (0.000,0.000) of (0.000,0.000) a (0.000,0.000) precomputation (0.000,0.000) stage (0.000,0.000) t (0.000,0.000) hat (0.000,0.000) dep (0.000,0.000) ends (0.000,0.000) only (0.000,0.000) on (0.000,0.000) the (0.000,0.000) prime (0.000,0.000) p (0.000,0.000) and (0.000,0.000) a (0.000,0.000) descen (0.000,0.000) t (0.000,0.000) stage (0.000,0.000) that (0.000,0.000) computes (0.000,0.000) individual (0.000,0.000) logs. (0.000,0.000) With (0.000,0.000) sufficie (0.000,0.000) n (0.000,0.000) t (0.000,0.000) precomputation, (0.000,0.000) an (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) can (0.000,0.000) quic (0.000,0.000) kly (0.000,0.000) break (0.000,0.000) an (0.000,0.000) y (0.000,0.000) Diffie-Hellman (0.000,0.000) instances (0.000,0.000) that (0.000,0.000) use (0.000,0.000) a (0.000,0.000) particular (0.000,0.000) p (0.000,0.000) . (0.000,0.000) secure. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) pro (0.000,0.000) vide (0.000,0.000) new (0.000,0.000) estimates (0.000,0.000) for (0.000,0.000) the (0.000,0.000) computational (0.000,0.000) re- (0.000,0.000) sources (0.000,0.000) necessary (0.000,0.000) to (0.000,0.000) compute (0.000,0.000) discrete (0.000,0.000) logs (0.000,0.000) in (0.000,0.000) groups (0.000,0.000) of (0.000,0.000) these (0.000,0.000) sizes, (0.000,0.000) concluding (0.000,0.000) that (0.000,0.000) 768-bit (0.000,0.000) groups (0.000,0.000) are (0.000,0.000) wit (0.000,0.000) hin (0.000,0.000) range (0.000,0.000) of (0.000,0.000) aca- (0.000,0.000) demic (0.000,0.000) teams, (0.000,0.000) and (0.000,0.000) 1024-bit (0.000,0.000) groups (0.000,0.000) ma (0.000,0.000) y (0.000,0.000) plausibly (0.000,0.000) b (0.000,0.000) e (0.000,0.000) within (0.000,0.000) range (0.000,0.000) o (0.000,0.000) f (0.000,0.000) state-lev (0.000,0.000) el (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) e (0.000,0.000) rs. (0.000,0.000) In (0.000,0.000) b (0.000,0.000) oth (0.000,0.000) cases, (0.000,0.000) individual (0.000,0.000) logs (0.000,0.000) can (0.000,0.000) b (0.000,0.000) e (0.000,0.000) quic (0.000,0.000) kly (0.000,0.000) computed (0.000,0.000) after (0.000,0.000) the (0.000,0.000) initial (0.000,0.000) precomputation. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) then (0.000,0.000) examine (0.000,0.000) evidence (0.000,0.000) from (0.000,0.000) published (0.000,0.000) Sno (0.000,0.000) wden (0.000,0.000) do (0.000,0.000) cu- (0.000,0.000) men (0.000,0.000) ts (0.000,0.000) that (0.000,0.000) suggests (0.000,0.000) NSA (0.000,0.000) ma (0.000,0.000) y (0.000,0.000) already (0.000,0.000) b (0.000,0.000) e (0.000,0.000) exploiting (0.000,0.000) 1024-bit (0.000,0.000) Diffie-Hellman (0.000,0.000) to (0.000,0.000) decrypt (0.000,0.000) VPN (0.000,0.000) traffic. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) p (0.000,0.000) e (0.000,0.000) rform (0.000,0.000) measure- (0.000,0.000) men (0.000,0.000) ts (0.000,0.000) to (0.000,0.000) understand (0.000,0.000) the (0.000,0.000) implications (0.000,0.000) of (0.000,0.000) suc (0.000,0.000) h (0.000,0.000) an (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) for (0.000,0.000) p (0.000,0.000) opular (0.000,0.000) proto (0.000,0.000) cols, (0.000,0.000) finding (0.000,0.000) that (0.000,0.000) an (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) who (0.000,0.000) could (0.000,0.000) p (0.000,0.000) erform (0.000,0.000) precomputations (0.000,0.000) for (0.000,0.000) ten (0.000,0.000) 1024-bit (0.000,0.000) groups (0.000,0.000) could (0.000,0.000) passiv (0.000,0.000) ely (0.000,0.000) de- (0.000,0.000) crypt (0.000,0.000) traffic (0.000,0.000) to (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) 66% (0.000,0.000) of (0.000,0.000) IKE (0.000,0.000) VPNs, (0.000,0.000) 26% (0.000,0.000) of (0.000,0.000) SSH (0.000,0.000) serv (0.000,0.000) ers, (0.000,0.000) 16% (0.000,0.000) of (0.000,0.000) SMTP (0.000,0.000) serv (0.000,0.000) ers, (0.000,0.000) and (0.000,0.000) 24% (0.000,0.000) of (0.000,0.000) p (0.000,0.000) opular (0.000,0.000) HTTPS (0.000,0.000) sites. (0.000,0.000) Mitigations (0.000,0.000) and (0.000,0.000) lessons. (0.000,0.000) As (0.000,0.000) a (0.000,0.000) short-term (0.000,0.000) co (0.000,0.000) un (0.000,0.000) t (0.000,0.000) ermeasure (0.000,0.000) in (0.000,0.000) resp (0.000,0.000) onse (0.000,0.000) to (0.000,0.000) the (0.000,0.000) Log (0.000,0.000) jam (0.000,0.000) attac (0.000,0.000) k, (0.000,0.000) all (0.000,0.000) mainstream (0.000,0.000) bro (0.000,0.000) wsers (0.000,0.000) are (0.000,0.000) implemen (0.000,0.000) ting (0.000,0.000) a (0.000,0.000) more (0.000,0.000) rest (0.000,0.000) rictiv (0.000,0.000) e (0.000,0.000) p (0.000,0.000) olicy (0.000,0.000) on (0.000,0.000) the (0.000,0.000) size (0.000,0.000) of (0.000,0.000) Diffie-Hellman (0.000,0.000) groups (0.000,0.000) they (0.000,0.000) accept. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) further (0.000,0.000) recommend (0.000,0.000) that (0.000,0.000) TLS (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) disable (0.000,0.000) exp (0.000,0.000) ort-grade (0.000,0.000) cryptograph (0.000,0.000) y (0.000,0.000) and (0.000,0.000) carefully (0.000,0.000) v (0.000,0.000) et (0.000,0.000) the (0.000,0.000) Diffie-Hellman (0.000,0.000) groups (0.000,0.000) they (0.000,0.000) use. (0.000,0.000) In (0.000,0.000) the (0.000,0.000) longer (0.000,0.000) term, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) adv (0.000,0.000) o (0.000,0.000) cate (0.000,0.000) that (0.000,0.000) proto (0.000,0.000) cols (0.000,0.000) migrate (0.000,0.000) to (0.000,0.000) s (0.000,0.000) t (0.000,0.000) ronger (0.000,0.000) Diffie-Hellman (0.000,0.000) groups, (0.000,0.000) suc (0.000,0.000) h (0.000,0.000) as (0.000,0.000) t (0.000,0.000) hose (0.000,0.000) base (0.000,0.000) d (0.000,0.000) on (0.000,0.000) elliptic (0.000,0.000) curv (0.000,0.000) es. (0.000,0.000) 2. (0.000,0.000) DIFFIE-HELLMAN (0.000,0.000) CR (0.000,0.000) YPT (0.000,0.000) AN (0.000,0.000) AL (0.000,0.000) YSIS (0.000,0.000) Diffie-Hellman (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) exc (0.000,0.000) hange (0.000,0.000) w (0.000,0.000) as (0.000,0.000) the (0.000,0.000) first (0.000,0.000) published (0.000,0.000) public- (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) algorithm (0.000,0.000) [14]. (0.000,0.000) In (0.000,0.000) the (0.000,0.000) simple (0.000,0.000) ca (0.000,0.000) se (0.000,0.000) of (0.000,0.000) prime (0.000,0.000) groups, (0.000,0.000) Alice (0.000,0.000) and (0.000,0.000) Bob (0.000,0.000) agree (0.000,0.000) on (0.000,0.000) a (0.000,0.000) prime (0.000,0.000) p (0.000,0.000) and (0.000,0.000) a (0.000,0.000) generat (0.000,0.000) or (0.000,0.000) g (0.000,0.000) of (0.000,0.000) a (0.000,0.000) m (0.000,0.000) ultiplicativ (0.000,0.000) e (0.000,0.000) subgroup (0.000,0.000) mo (0.000,0.000) dulo (0.000,0.000) p (0.000,0.000) . (0.000,0.000) Alice (0.000,0.000) se (0.000,0.000) nds (0.000,0.000) g (0.000,0.000) a (0.000,0.000) mo (0.000,0.000) d (0.000,0.000) p (0.000,0.000) , (0.000,0.000) Bob (0.000,0.000) sends (0.000,0.000) g (0.000,0.000) b (0.000,0.000) mo (0.000,0.000) d (0.000,0.000) p (0.000,0.000) , (0.000,0.000) and (0.000,0.000) eac (0.000,0.000) h (0.000,0.000) computes (0.000,0.000) a (0.000,0.000) shared (0.000,0.000) secret (0.000,0.000) g (0.000,0.000) ab (0.000,0.000) mo (0.000,0.000) d (0.000,0.000) p (0.000,0.000) . (0.000,0.000) While (0.000,0.000) there (0.000,0.000) is (0.000,0.000) also (0.000,0.000) a (0.000,0.000) Diffie-Hellman (0.000,0.000) exc (0.000,0.000) hange (0.000,0.000) o (0.000,0.000) v (0.000,0.000) er (0.000,0.000) elliptic (0.000,0.000) curv (0.000,0.000) e (0.000,0.000) groups, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) address (0.000,0.000) only (0.000,0.000) the (0.000,0.000) “mo (0.000,0.000) d (0.000,0.000) p (0.000,0.000) ” (0.000,0.000) case. (0.000,0.000) The (0.000,0.000) securit (0.000,0.000) y (0.000,0.000) of (0.000,0.000) Diffie-Hellman (0.000,0.000) is (0.000,0.000) not (0.000,0.000) kno (0.000,0.000) wn (0.000,0.000) to (0.000,0.000) b (0.000,0.000) e (0.000,0.000) equiv (0.000,0.000) a- (0.000,0.000) len (0.000,0.000) t (0.000,0.000) to (0.000,0.000) t (0.000,0.000) he (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) problem (0.000,0.000) (except (0.000,0.000) in (0.000,0.000) certain (0.000,0.000) groups (0.000,0.000) [13, (0.000,0.000) 33, (0.000,0.000) 34]), (0.000,0.000) but (0.000,0.000) c (0.000,0.000) om (0.000,0.000) put (0.000,0.000) ing (0.000,0.000) discre (0.000,0.000) te (0.000,0.000) logs (0.000,0.000) remains (0.000,0.000) the (0.000,0.000) b (0.000,0.000) est (0.000,0.000) kno (0.000,0.000) wn (0.000,0.000) cryptanalytic (0.000,0.000) attac (0.000,0.000) k. (0.000,0.000) An (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) who (0.000,0.000) can (0.000,0.000) find (0.000,0.000) the (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) x (0.000,0.000) from (0.000,0.000) y (0.000,0.000) = (0.000,0.000) g (0.000,0.000) x (0.000,0.000) mo (0.000,0.000) d (0.000,0.000) p (0.000,0.000) can (0.000,0.000) easily (0.000,0.000) find (0.000,0.000) the (0.000,0.000) shared (0.000,0.000) secret. (0.000,0.000) T (0.000,0.000) extb (0.000,0.000) o (0.000,0.000) ok (0.000,0.000) descriptions (0.000,0.000) of (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) c (0.000,0.000) an (0.000,0.000) b (0.000,0.000) e (0.000,0.000) misleading (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) the (0.000,0.000) computational (0.000,0.000) trade (0.000,0.000) offs, (0.000,0.000) for (0.000,0.000) example (0.000,0.000) b (0.000,0.000) y (0.000,0.000) balancing (0.000,0.000) parameters (0.000,0.000) to (0.000,0.000) minim (0.000,0.000) iz (0.000,0.000) e (0.000,0.000) o (0.000,0.000) v (0.000,0.000) erall (0.000,0.000) time (0.000,0.000) to (0.000,0.000) compute (0.000,0.000) a (0.000,0.000) single (0.000,0.000) discrete (0.000,0.000) log. (0.000,0.000) In (0.000,0.000) fact, (0.000,0.000) as (0.000,0.000) illustrated (0.000,0.000) in (0.000,0.000) Figure (0.000,0.000) 1, (0.000,0.000) a (0.000,0.000) single (0.000,0.000) large (0.000,0.000) precomputation (0.000,0.000) on (0.000,0.000) p (0.000,0.000) can (0.000,0.000) b (0.000,0.000) e (0.000,0.000) used (0.000,0.000) to (0.000,0.000) efficien (0.000,0.000) tly (0.000,0.000) break (0.000,0.000) al (0.000,0.000) l (0.000,0.000) Diffie-Hellman (0.000,0.000) exc (0.000,0.000) hanges (0.000,0.000) made (0.000,0.000) with (0.000,0.000) that (0.000,0.000) prime. (0.000,0.000) The (0.000,0.000) t (0.000,0.000) ypical (0.000,0.000) case (0.000,0.000) Diffie-Hellman (0.000,0.000) is (0.000,0.000) t (0.000,0.000) ypically (0.000,0.000) implemen (0.000,0.000) ted (0.000,0.000) with (0.000,0.000) prime (0.000,0.000) fields (0.000,0.000) and (0.000,0.000) large (0.000,0.000) group (0.000,0.000) orders. (0.000,0.000) In (0.000,0.000) this (0.000,0.000) case, (0.000,0.000) the (0.000,0.000) most (0.000,0.000) efficien (0.000,0.000) t (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) algo (0.000,0.000) rithm (0.000,0.000) is (0.000,0.000) the (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) field (0.000,0.000) siev (0.000,0.000) e (0.000,0.000) (NFS) (0.000,0.000) [21, (0.000,0.000) 24, (0.000,0.000) 43]. (0.000,0.000) 1 (0.000,0.000) There (0.000,0.000) is (0.000,0.000) a (0.000,0.000) closely (0.000,0.000) related (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) field (0.000,0.000) siev (0.000,0.000) e (0.000,0.000) algorithm (0.000,0.000) for (0.000,0.000) factoring (0.000,0.000) [12, (0.000,0.000) 31], (0.000,0.000) and (0.000,0.000) in (0.000,0.000) fact (0.000,0.000) man (0.000,0.000) y (0.000,0.000) parts (0.000,0.000) of (0.000,0.000) the (0.000,0.000) implemen (0.000,0.000) tations (0.000,0.000) can (0.000,0.000) b (0.000,0.000) e (0.000,0.000) share (0.000,0.000) d. (0.000,0.000) The (0.000,0.000) general (0.000,0.000) tec (0.000,0.000) hnique (0.000,0.000) is (0.000,0.000) called (0.000,0.000) index (0.000,0.000) calculus (0.000,0.000) and (0.000,0.000) has (0.000,0.000) four (0.000,0.000) stages (0.000,0.000) with (0.000,0.000) diff (0.000,0.000) eren (0.000,0.000) t (0.000,0.000) compu- (0.000,0.000) tational (0.000,0.000) prop (0.000,0.000) erties. (0.000,0.000) The (0.000,0.000) first (0.000,0.000) three (0.000,0.000) steps (0.000,0.000) are (0.000,0.000) only (0.000,0.000) dep (0.000,0.000) enden (0.000,0.000) t (0.000,0.000) on (0.000,0.000) the (0.000,0.000) prime (0.000,0.000) p (0.000,0.000) and (0.000,0.000) comprise (0.000,0.000) most (0.000,0.000) of (0.000,0.000) the (0.000,0.000) computation. (0.000,0.000) First (0.000,0.000) is (0.000,0.000) p (0.000,0.000) ol (0.000,0.000) ynomial (0.000,0.000) sele (0.000,0.000) ction (0.000,0.000) , (0.000,0.000) in (0.000,0.000) w (0.000,0.000) hic (0.000,0.000) h (0.000,0.000) one (0.000,0.000) finds (0.000,0.000) a (0.000,0.000) p (0.000,0.000) olyno- (0.000,0.000) mial (0.000,0.000) f (0.000,0.000) ( (0.000,0.000) z (0.000,0.000) ) (0.000,0.000) defining (0.000,0.000) a (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) field (0.000,0.000) ( (0.000,0.000) z (0.000,0.000) ) (0.000,0.000) /f (0.000,0.000) ( (0.000,0.000) z (0.000,0.000) ) (0.000,0.000) for (0.000,0.000) the (0.000,0.000) computa- (0.000,0.000) tion. (0.000,0.000) (F (0.000,0.000) or (0.000,0.000) our (0.000,0.000) cases, (0.000,0.000) f (0.000,0.000) ( (0.000,0.000) z (0.000,0.000) ) (0.000,0.000) t (0.000,0.000) ypically (0.000,0.000) has (0.000,0.000) degree (0.000,0.000) 5 (0.000,0.000) or (0.000,0.000) 6.) (0.000,0.000) This (0.000,0.000) parallelizes (0.000,0.000) w (0.000,0.000) ell (0.000,0.000) and (0.000,0.000) is (0.000,0.000) only (0.000,0.000) a (0.000,0.000) small (0.000,0.000) p (0.000,0.000) ortion (0.000,0.000) of (0.000,0.000) the (0.000,0.000) run (0.000,0.000) time. (0.000,0.000) In (0.000,0.000) the (0.000,0.000) second (0.000,0.000) stage, (0.000,0.000) sieving (0.000,0.000) , (0.000,0.000) one (0.000,0.000) factors (0.000,0.000) ranges (0.000,0.000) of (0.000,0.000) in (0.000,0.000) tegers (0.000,0.000) and (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) field (0.000,0.000) elemen (0.000,0.000) ts (0.000,0.000) in (0.000,0.000) batc (0.000,0.000) hes (0.000,0.000) to (0.000,0.000) find (0.000,0.000) man (0.000,0.000) y (0.000,0.000) relations (0.000,0.000) of (0.000,0.000) elemen (0.000,0.000) ts, (0.000,0.000) all (0.000,0.000) of (0.000,0.000) whose (0.000,0.000) prime (0.000,0.000) factors (0.000,0.000) are (0.000,0.000) less (0.000,0.000) than (0.000,0.000) some (0.000,0.000) b (0.000,0.000) ound (0.000,0.000) B (0.000,0.000) (called (0.000,0.000) B (0.000,0.000) -smo (0.000,0.000) oth). (0.000,0.000) Mo (0.000,0.000) dern (0.000,0.000) implemen (0.000,0.000) tations (0.000,0.000) use (0.000,0.000) sp (0.000,0.000) e (0.000,0.000) cial- (0.000,0.000) q (0.000,0.000) lattice (0.000,0.000) sie (0.000,0.000) v (0.000,0.000) ing, (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) for (0.000,0.000) eac (0.000,0.000) h (0.000,0.000) sp (0.000,0.000) ecial (0.000,0.000) q (0.000,0.000) explores (0.000,0.000) a (0.000,0.000) sieving (0.000,0.000) region (0.000,0.000) of (0.000,0.000) 2 (0.000,0.000) 2 (0.000,0.000) I (0.000,0.000) candidates, (0.000,0.000) where (0.000,0.000) I (0.000,0.000) is (0.000,0.000) a (0.000,0.000) parameter. (0.000,0.000) Sieving (0.000,0.000) parallelizes (0.000,0.000) w (0.000,0.000) ell (0.000,0.000) since (0.000,0.000) eac (0.000,0.000) h (0.000,0.000) sp (0.000,0.000) e (0.000,0.000) cial (0.000,0.000) q (0.000,0.000) is (0.000,0.000) handled (0.000,0.000) indep (0.000,0.000) enden (0.000,0.000) tly (0.000,0.000) of (0.000,0.000) the (0.000,0.000) others, (0.000,0.000) but (0.000,0.000) is (0.000,0.000) co (0.000,0.000) m (0.000,0.000) puta (0.000,0.000) tionally (0.000,0.000) exp (0.000,0.000) ensiv (0.000,0.000) e, (0.000,0.000) b (0.000,0.000) eca (0.000,0.000) use (0.000,0.000) w (0.000,0.000) e (0.000,0.000) m (0.000,0.000) ust (0.000,0.000) searc (0.000,0.000) h (0.000,0.000) through (0.000,0.000) and (0.000,0.000) attempt (0.000,0.000) to (0.000,0.000) factor (0.000,0.000) man (0.000,0.000) y (0.000,0.000) elemen (0.000,0.000) t (0.000,0.000) s. (0.000,0.000) The (0.000,0.000) time (0.000,0.000) for (0.000,0.000) this (0.000,0.000) step (0.000,0.000) dep (0.000,0.000) ends (0.000,0.000) on (0.000,0.000) heuristic (0.000,0.000) estimates (0.000,0.000) of (0.000,0.000) the (0.000,0.000) probabilit (0.000,0.000) y (0.000,0.000) of (0.000,0.000) encoun (0.000,0.000) tering (0.000,0.000) B (0.000,0.000) -smo (0.000,0.000) oth (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) ers (0.000,0.000) in (0.000,0.000) this (0.000,0.000) searc (0.000,0.000) h; (0.000,0.000) it (0.000,0.000) also (0.000,0.000) dep (0.000,0.000) ends (0.000,0.000) on (0.000,0.000) I (0.000,0.000) and (0.000,0.000) on (0.000,0.000) the (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) of (0.000,0.000) sp (0.000,0.000) ecial (0.000,0.000) q (0.000,0.000) to (0.000,0.000) conside (0.000,0.000) r (0.000,0.000) b (0.000,0.000) efore (0.000,0.000) ha (0.000,0.000) ving (0.000,0.000) enough (0.000,0.000) relations. (0.000,0.000) In (0.000,0.000) the (0.000,0.000) third (0.000,0.000) stage, (0.000,0.000) line (0.000,0.000) ar (0.000,0.000) algebr (0.000,0.000) a (0.000,0.000) , (0.000,0.000) w (0.000,0.000) e (0.000,0.000) construct (0.000,0.000) a (0.000,0.000) large, (0.000,0.000) sparse (0.000,0.000) matrix (0.000,0.000) consisting (0.000,0.000) of (0.000,0.000) the (0.000,0.000) co (0.000,0.000) efficien (0.000,0.000) t (0.000,0.000) v (0.000,0.000) ectors (0.000,0.000) of (0.000,0.000) prime (0.000,0.000) factorizations (0.000,0.000) w (0.000,0.000) e (0.000,0.000) ha (0.000,0.000) v (0.000,0.000) e (0.000,0.000) found. (0.000,0.000) A (0.000,0.000) nonzero (0.000,0.000) k (0.000,0.000) ernel (0.000,0.000) v (0.000,0.000) ector (0.000,0.000) of (0.000,0.000) the (0.000,0.000) matrix (0.000,0.000) mo (0.000,0.000) dulo (0.000,0.000) the (0.000,0.000) order (0.000,0.000) q (0.000,0.000) of (0.000,0.000) the (0.000,0.000) group (0.000,0.000) will (0.000,0.000) giv (0.000,0.000) e (0.000,0.000) us (0.000,0.000) logs (0.000,0.000) of (0.000,0.000) man (0.000,0.000) y (0.000,0.000) small (0.000,0.000) elemen (0.000,0.000) ts. (0.000,0.000) This (0.000,0.000) database (0.000,0.000) of (0.000,0.000) logs (0.000,0.000) serv (0.000,0.000) es (0.000,0.000) as (0.000,0.000) input (0.000,0.000) to (0.000,0.000) the (0.000,0.000) final (0.000,0.000) stage. (0.000,0.000) The (0.000,0.000) difficult (0.000,0.000) y (0.000,0.000) dep (0.000,0.000) ends (0.000,0.000) on (0.000,0.000) q (0.000,0.000) and (0.000,0.000) the (0.000,0.000) matrix (0.000,0.000) size (0.000,0.000) and (0.000,0.000) can (0.000,0.000) b (0.000,0.000) e (0.000,0.000) parallelized (0.000,0.000) in (0.000,0.000) a (0.000,0.000) limited (0.000,0.000) fashion. (0.000,0.000) The (0.000,0.000) final (0.000,0.000) stage, (0.000,0.000) desc (0.000,0.000) ent (0.000,0.000) , (0.000,0.000) actually (0.000,0.000) deduces (0.000,0.000) the (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) of (0.000,0.000) the (0.000,0.000) target (0.000,0.000) y (0.000,0.000) . (0.000,0.000) W (0.000,0.000) e (0.000,0.000) re-siev (0.000,0.000) e (0.000,0.000) un (0.000,0.000) til (0.000,0.000) w (0.000,0.000) e (0.000,0.000) can (0.000,0.000) find (0.000,0.000) a (0.000,0.000) set (0.000,0.000) of (0.000,0.000) relations (0.000,0.000) that (0.000,0.000) allo (0.000,0.000) w (0.000,0.000) us (0.000,0.000) to (0.000,0.000) write (0.000,0.000) the (0.000,0.000) log (0.000,0.000) of (0.000,0.000) y (0.000,0.000) in (0.000,0.000) terms (0.000,0.000) of (0.000,0.000) the (0.000,0.000) logs (0.000,0.000) in (0.000,0.000) the (0.000,0.000) precomputed (0.000,0.000) database. (0.000,0.000) This (0.000,0.000) step (0.000,0.000) is (0.000,0.000) accomplished (0.000,0.000) in (0.000,0.000) three (0.000,0.000) phases: (0.000,0.000) an (0.000,0.000) initialization (0.000,0.000) phase (0.000,0.000) , (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) trie (0.000,0.000) s (0.000,0.000) to (0.000,0.000) write (0.000,0.000) the (0.000,0.000) target (0.000,0.000) in (0.000,0.000) terms (0.000,0.000) of (0.000,0.000) medium-sized (0.000,0.000) primes, (0.000,0.000) a (0.000,0.000) middle (0.000,0.000) phase (0.000,0.000) , (0.000,0.000) in (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) these (0.000,0.000) medium-sized (0.000,0.000) primes (0.000,0.000) are (0.000,0.000) further (0.000,0.000) siev (0.000,0.000) ed (0.000,0.000) un (0.000,0.000) til (0.000,0.000) they (0.000,0.000) can (0.000,0.000) b (0.000,0.000) e (0.000,0.000) represen (0.000,0.000) t (0.000,0.000) ed (0.000,0.000) b (0.000,0.000) y (0.000,0.000) elemen (0.000,0.000) ts (0.000,0.000) in (0.000,0.000) the (0.000,0.000) database (0.000,0.000) of (0.000,0.000) kno (0.000,0.000) wn (0.000,0.000) logs, (0.000,0.000) and (0.000,0.000) a (0.000,0.000) final (0.000,0.000) phase (0.000,0.000) that (0.000,0.000) actually (0.000,0.000) rec (0.000,0.000) onstructs (0.000,0.000) the (0.000,0.000) target (0.000,0.000) using (0.000,0.000) the (0.000,0.000) log (0.000,0.000) database. (0.000,0.000) Crucially (0.000,0.000) , (0.000,0.000) descen (0.000,0.000) t (0.000,0.000) is (0.000,0.000) the (0.000,0.000) only (0.000,0.000) NFS (0.000,0.000) stage (0.000,0.000) that (0.000,0.000) in (0.000,0.000) v (0.000,0.000) olv (0.000,0.000) es (0.000,0.000) y (0.000,0.000) (or (0.000,0.000) g (0.000,0.000) ), (0.000,0.000) so (0.000,0.000) p (0.000,0.000) olynomial (0.000,0.000) selection, (0.000,0.000) sieving, (0.000,0.000) and (0.000,0.000) linear (0.000,0.000) algebra (0.000,0.000) can (0.000,0.000) b (0.000,0.000) e (0.000,0.000) done (0.000,0.000) once (0.000,0.000) for (0.000,0.000) a (0.000,0.000) prime (0.000,0.000) p (0.000,0.000) and (0.000,0.000) reused (0.000,0.000) to (0.000,0.000) compute (0.000,0.000) t (0.000,0.000) he (0.000,0.000) discrete (0.000,0.000) lo (0.000,0.000) gs (0.000,0.000) of (0.000,0.000) man (0.000,0.000) y (0.000,0.000) targets. (0.000,119.552) 1 (0.000,119.552) Recen (0.000,119.552) t (0.000,119.552) sp (0.000,119.552) ectacular (0.000,119.552) adv (0.000,119.552) ances (0.000,119.552) in (0.000,119.552) discrete (0.000,119.552) log (0.000,119.552) algorithms (0.000,119.552) ha (0.000,119.552) v (0.000,119.552) e (0.000,119.552) resulted (0.000,119.552) in (0.000,119.552) a (0.000,119.552) quasi-p (0.000,119.552) olynomial (0.000,119.552) algorithm (0.000,119.552) for (0.000,119.552) small- (0.000,119.552) c (0.000,119.552) haracteristic (0.000,119.552) fields (0.000,119.552) [3], (0.000,119.552) but (0.000,119.552) these (0.000,119.552) adv (0.000,119.552) ances (0.000,119.552) are (0.000,119.552) not (0.000,119.552) kno (0.000,119.552) wn (0.000,119.552) to (0.000,119.552) apply (0.000,119.552) to (0.000,119.552) the (0.000,119.552) prime (0.000,119.552) fields (0.000,119.552) used (0.000,119.552) in (0.000,119.552) practice. (0.000,119.552) 2 (0.000,0.000) The (0.000,0.000) running (0.000,0.000) time (0.000,0.000) of (0.000,0.000) t (0.000,0.000) his (0.000,0.000) algorithm (0.000,0.000) is (0.000,0.000) L (0.000,0.000) p (0.000,0.000) (1 (0.000,0.000) / (0.000,0.000) 3 (0.000,0.000) , (0.000,0.000) (64 (0.000,0.000) / (0.000,0.000) 9) (0.000,0.000) 1 (0.000,0.000) / (0.000,0.000) 3 (0.000,0.000) ) (0.000,0.000) = (0.000,0.000) exp (0.000,0.000) (0.000,0.000) (1 (0.000,0.000) . (0.000,0.000) 923 (0.000,0.000) + (0.000,0.000) o (0.000,0.000) (1))(log (0.000,0.000) p (0.000,0.000) ) (0.000,0.000) 1 (0.000,0.000) / (0.000,0.000) 3 (0.000,0.000) (log (0.000,0.000) log (0.000,0.000) p (0.000,0.000) ) (0.000,0.000) 2 (0.000,0.000) / (0.000,0.000) 3 (0.000,0.000) (0.000,0.000) . (0.000,0.000) This (0.000,0.000) is (0.000,0.000) obtained (0.000,0.000) b (0.000,0.000) y (0.000,0.000) tuning (0.000,0.000) man (0.000,0.000) y (0.000,0.000) parameters, (0.000,0.000) including (0.000,0.000) the (0.000,0.000) degre (0.000,0.000) e (0.000,0.000) of (0.000,0.000) f (0.000,0.000) , (0.000,0.000) the (0.000,0.000) sieving (0.000,0.000) region (0.000,0.000) parameter (0.000,0.000) I (0.000,0.000) , (0.000,0.000) and, (0.000,0.000) most (0.000,0.000) imp (0.000,0.000) ortan (0.000,0.000) tly (0.000,0.000) , (0.000,0.000) the (0.000,0.000) smo (0.000,0.000) othness (0.000,0.000) b (0.000,0.000) ound (0.000,0.000) B (0.000,0.000) . (0.000,0.000) Early (0.000,0.000) articles (0.000,0.000) (e.g. (0.000,0.000) [21]) (0.000,0.000) encoun (0.000,0.000) te (0.000,0.000) red (0.000,0.000) tec (0.000,0.000) hnical (0.000,0.000) difficulties (0.000,0.000) with (0.000,0.000) desce (0.000,0.000) n (0.000,0.000) t (0.000,0.000) and (0.000,0.000) rep (0.000,0.000) orted (0.000,0.000) that (0.000,0.000) the (0.000,0.000) com- (0.000,0.000) plexit (0.000,0.000) y (0.000,0.000) of (0.000,0.000) this (0.000,0.000) st (0.000,0.000) ep (0.000,0.000) w (0.000,0.000) ould (0.000,0.000) equal (0.000,0.000) that (0.000,0.000) of (0.000,0.000) the (0.000,0.000) precomputation; (0.000,0.000) this (0.000,0.000) m (0.000,0.000) a (0.000,0.000) y (0.000,0.000) ha (0.000,0.000) v (0.000,0.000) e (0.000,0.000) con (0.000,0.000) tributed (0.000,0.000) to (0.000,0.000) misconceptions (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) the (0.000,0.000) p (0.000,0.000) erfor- (0.000,0.000) mance (0.000,0.000) of (0.000,0.000) the (0.000,0.000) NFS (0.000,0.000) f (0.000,0.000) o (0.000,0.000) r (0.000,0.000) discrete (0.000,0.000) logs. (0.000,0.000) More (0.000,0.000) recen (0.000,0.000) t (0.000,0.000) analyses (0.000,0.000) ha (0.000,0.000) v (0.000,0.000) e (0.000,0.000) impro (0.000,0.000) v (0.000,0.000) ed (0.000,0.000) the (0.000,0.000) complexit (0.000,0.000) y (0.000,0.000) of (0.000,0.000) descen (0.000,0.000) t (0.000,0.000) to (0.000,0.000) L (0.000,0.000) p (0.000,0.000) (1 (0.000,0.000) / (0.000,0.000) 3 (0.000,0.000) , (0.000,0.000) 1 (0.000,0.000) . (0.000,0.000) 442) (0.000,0.000) [10], (0.000,0.000) and (0.000,0.000) later (0.000,0.000) to (0.000,0.000) L (0.000,0.000) p (0.000,0.000) (1 (0.000,0.000) / (0.000,0.000) 3 (0.000,0.000) , (0.000,0.000) 1 (0.000,0.000) . (0.000,0.000) 232) (0.000,0.000) [2], (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) is (0.000,0.000) m (0.000,0.000) uc (0.000,0.000) h (0.000,0.000) c (0.000,0.000) heap (0.000,0.000) er (0.000,0.000) than (0.000,0.000) the (0.000,0.000) prec (0.000,0.000) om (0.000,0.000) put (0.000,0.000) ation (0.000,0.000) in (0.000,0.000) practice (0.000,0.000) . (0.000,0.000) The (0.000,0.000) n (0.000,0.000) um (0.000,0.000) e (0.000,0.000) rous (0.000,0.000) parameters (0.000,0.000) of (0.000,0.000) the (0.000,0.000) algorithm (0.000,0.000) allo (0.000,0.000) w (0.000,0.000) some (0.000,0.000) flexibilit (0.000,0.000) y (0.000,0.000) to (0.000,0.000) reduce (0.000,0.000) time (0.000,0.000) on (0.000,0.000) some (0.000,0.000) computational (0.000,0.000) steps (0.000,0.000) at (0.000,0.000) the (0.000,0.000) exp (0.000,0.000) ense (0.000,0.000) of (0.000,0.000) others. (0.000,0.000) F (0.000,0.000) or (0.000,0.000) example, (0.000,0.000) sieving (0.000,0.000) more (0.000,0.000) will (0.000,0.000) result (0.000,0.000) in (0.000,0.000) a (0.000,0.000) smaller (0.000,0.000) matrix, (0.000,0.000) making (0.000,0.000) linear (0.000,0.000) algebra (0.000,0.000) c (0.000,0.000) heap (0.000,0.000) er, (0.000,0.000) and (0.000,0.000) doing (0.000,0.000) more (0.000,0.000) w (0.000,0.000) ork (0.000,0.000) in (0.000,0.000) the (0.000,0.000) precomputation (0.000,0.000) mak (0.000,0.000) es (0.000,0.000) the (0.000,0.000) final (0.000,0.000) descen (0.000,0.000) t (0.000,0.000) step (0.000,0.000) easier. (0.000,0.000) In (0.000,0.000) §3.3, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) sho (0.000,0.000) w (0.000,0.000) ho (0.000,0.000) w (0.000,0.000) exploiting (0.000,0.000) these (0.000,0.000) tradeoffs (0.000,0.000) allo (0.000,0.000) ws (0.000,0.000) us (0.000,0.000) to (0.000,0.000) quic (0.000,0.000) kly (0.000,0.000) compute (0.000,0.000) 512-bit (0.000,0.000) discrete (0.000,0.000) logs (0.000,0.000) in (0.000,0.000) order (0.000,0.000) to (0.000,0.000) p (0.000,0.000) erform (0.000,0.000) an (0.000,0.000) effectiv (0.000,0.000) e (0.000,0.000) man-in-the-middle (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) on (0.000,0.000) TLS. (0.000,0.000) Improp (0.000,0.000) erly (0.000,0.000) g (0.000,0.000) enera (0.000,0.000) t (0.000,0.000) ed (0.000,0.000) groups (0.000,0.000) A (0.000,0.000) differen (0.000,0.000) t (0.000,0.000) family (0.000,0.000) of (0.000,0.000) algorithms (0.000,0.000) runs (0.000,0.000) in (0.000,0.000) time (0.000,0.000) exp (0.000,0.000) onen (0.000,0.000) tial (0.000,0.000) in (0.000,0.000) group (0.000,0.000) order, (0.000,0.000) and (0.000,0.000) they (0.000,0.000) are (0.000,0.000) practical (0.000,0.000) ev (0.000,0.000) en (0.000,0.000) for (0.000,0.000) large (0.000,0.000) primes (0.000,0.000) when (0.000,0.000) t (0.000,0.000) he (0.000,0.000) group (0.000,0.000) order (0.000,0.000) is (0.000,0.000) small (0.000,0.000) or (0.000,0.000) has (0.000,0.000) man (0.000,0.000) y (0.000,0.000) small (0.000,0.000) prime (0.000,0.000) factors. (0.000,0.000) T (0.000,0.000) o (0.000,0.000) a (0.000,0.000) v (0.000,0.000) oid (0.000,0.000) this, (0.000,0.000) most (0.000,0.000) implemen (0.000,0.000) tations (0.000,0.000) use (0.000,0.000) “safe” (0.000,0.000) primes, (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) ha (0.000,0.000) v (0.000,0.000) e (0.000,0.000) the (0.000,0.000) prop (0.000,0.000) ert (0.000,0.000) y (0.000,0.000) that (0.000,0.000) p (0.000,0.000) − (0.000,0.000) 1 (0.000,0.000) = (0.000,0.000) 2 (0.000,0.000) q (0.000,0.000) for (0.000,0.000) some (0.000,0.000) prime (0.000,0.000) q (0.000,0.000) , (0.000,0.000) so (0.000,0.000) that (0.000,0.000) the (0.000,0.000) only (0.000,0.000) p (0.000,0.000) ossible (0.000,0.000) subgroups (0.000,0.000) ha (0.000,0.000) v (0.000,0.000) e (0.000,0.000) order (0.000,0.000) 2 (0.000,0.000) , (0.000,0.000) q (0.000,0.000) , (0.000,0.000) or (0.000,0.000) 2 (0.000,0.000) q (0.000,0.000) . (0.000,0.000) Ho (0.000,0.000) w (0.000,0.000) ev (0.000,0.000) er, (0.000,0.000) as (0.000,0.000) w (0.000,0.000) e (0.000,0.000) sho (0.000,0.000) w (0.000,0.000) in (0.000,0.000) §3.5, (0.000,0.000) improp (0.000,0.000) erly (0.000,0.000) generat (0.000,0.000) ed (0.000,0.000) groups (0.000,0.000) are (0.000,0.000) sometimes (0.000,0.000) used (0.000,0.000) in (0.000,0.000) practice (0.000,0.000) and (0.000,0.000) susceptible (0.000,0.000) t (0.000,0.000) o (0.000,0.000) attac (0.000,0.000) k. (0.000,0.000) The (0.000,0.000) bab (0.000,0.000) y-step (0.000,0.000) gian (0.000,0.000) t-step (0.000,0.000) [45] (0.000,0.000) and (0.000,0.000) P (0.000,0.000) ollard (0.000,0.000) rho (0.000,0.000) [42] (0.000,0.000) algo- (0.000,0.000) rithms (0.000,0.000) b (0.000,0.000) oth (0.000,0.000) tak (0.000,0.000) e (0.000,0.000) √ (0.000,4.439) q (0.000,4.439) time (0.000,4.439) to (0.000,4.439) compute (0.000,4.439) a (0.000,4.439) discrete (0.000,4.439) log (0.000,4.439) in (0.000,4.439) an (0.000,4.439) y (0.000,4.439) (sub)group (0.000,4.439) of (0.000,4.439) order (0.000,4.439) q (0.000,4.439) , (0.000,4.439) while (0.000,4.439) P (0.000,4.439) ollard (0.000,4.439) lam (0.000,4.439) b (0.000,4.439) da (0.000,4.439) [42] (0.000,4.439) can (0.000,4.439) find (0.000,4.439) x (0.000,4.439) < (0.000,4.439) t (0.000,4.439) in (0.000,4.439) time (0.000,4.439) √ (0.000,3.328) t (0.000,3.328) . (0.000,3.328) These (0.000,3.328) parallelize (0.000,3.328) w (0.000,3.328) ell (0.000,3.328) [50], (0.000,3.328) and (0.000,3.328) precom- (0.000,3.328) putation (0.000,3.328) can (0.000,3.328) sp (0.000,3.328) eed (0.000,3.328) up (0.000,3.328) individual (0.000,3.328) log (0.000,3.328) calculations. (0.000,3.328) If (0.000,3.328) the (0.000,3.328) factorization (0.000,3.328) of (0.000,3.328) the (0.000,3.328) subgroup (0.000,3.328) order (0.000,3.328) q (0.000,3.328) is (0.000,3.328) kno (0.000,3.328) wn, (0.000,3.328) one (0.000,3.328) can (0.000,3.328) use (0.000,3.328) an (0.000,3.328) y (0.000,3.328) of (0.000,3.328) the (0.000,3.328) ab (0.000,3.328) o (0.000,3.328) v (0.000,3.328) e (0.000,3.328) algorithms (0.000,3.328) to (0.000,3.328) compute (0.000,3.328) the (0.000,3.328) discrete (0.000,3.328) log (0.000,3.328) in (0.000,3.328) eac (0.000,3.328) h (0.000,3.328) subgroup (0.000,3.328) of (0.000,3.328) order (0.000,3.328) q (0.000,3.328) e (0.000,3.328) i (0.000,3.328) i (0.000,3.328) dividing (0.000,3.328) q (0.000,3.328) , (0.000,3.328) and (0.000,3.328) then (0.000,3.328) re- (0.000,3.328) co (0.000,3.328) v (0.000,3.328) er (0.000,3.328) x (0.000,3.328) using (0.000,3.328) the (0.000,3.328) Chinese (0.000,3.328) re (0.000,3.328) m (0.000,3.328) ainde (0.000,3.328) r (0.000,3.328) theorem. (0.000,3.328) This (0.000,3.328) is (0.000,3.328) the (0.000,3.328) P (0.000,3.328) ohlig-Hellman (0.000,3.328) algorithm (0.000,3.328) [41], (0.000,3.328) whic (0.000,3.328) h (0.000,3.328) costs (0.000,3.328) (0.000,3.328) i (0.000,3.328) e (0.000,3.328) i (0.000,3.328) √ (0.000,7.279) q (0.000,7.279) i (0.000,7.279) using (0.000,7.279) bab (0.000,7.279) y (0.000,7.279) - (0.000,7.279) s (0.000,7.279) t (0.000,7.279) ep (0.000,7.279) gian (0.000,7.279) t-step (0.000,7.279) or (0.000,7.279) P (0.000,7.279) ollard (0.000,7.279) rho. (0.000,7.279) Standard (0.000,7.279) primes (0.000,7.279) Generating (0.000,7.279) primes (0.000,7.279) with (0.000,7.279) sp (0.000,7.279) ecial (0.000,7.279) prop (0.000,7.279) er- (0.000,7.279) ties (0.000,7.279) can (0.000,7.279) b (0.000,7.279) e (0.000,7.279) computationally (0.000,7.279) burdensome, (0.000,7.279) so (0.000,7.279) man (0.000,7.279) y (0.000,7.279) implemen- (0.000,7.279) tations (0.000,7.279) use (0.000,7.279) fix (0.000,7.279) e (0.000,7.279) d (0.000,7.279) or (0.000,7.279) standardized (0.000,7.279) Diffie-Hellman (0.000,7.279) parameters. (0.000,7.279) A (0.000,7.279) prominen (0.000,7.279) t (0.000,7.279) example (0.000,7.279) is (0.000,7.279) the (0.000,7.279) Oakley (0.000,7.279) groups (0.000,7.279) [40], (0.000,7.279) whic (0.000,7.279) h (0.000,7.279) giv (0.000,7.279) e (0.000,7.279) “safe” (0.000,7.279) primes (0.000,7.279) of (0.000,7.279) length (0.000,7.279) 768 (0.000,7.279) (Oakley (0.000,7.279) Group (0.000,7.279) 1), (0.000,7.279) 1024 (0.000,7.279) (Oakley (0.000,7.279) Group (0.000,7.279) 2), (0.000,7.279) and (0.000,7.279) 1536 (0.000,7.279) (Oakley (0.000,7.279) Group (0.000,7.279) 5) (0.000,7.279) . (0.000,7.279) These (0.000,7.279) groups (0.000,7.279) w (0.000,7.279) ere (0.000,7.279) published (0.000,7.279) in (0.000,7.279) 1998 (0.000,7.279) and (0.000,7.279) ha (0.000,7.279) v (0.000,7.279) e (0.000,7.279) b (0.000,7.279) een (0.000,7.279) used (0.000,7.279) for (0.000,7.279) man (0.000,7.279) y (0.000,7.279) applications (0.000,7.279) since, (0.000,7.279) including (0.000,7.279) IKE, (0.000,7.279) SSH, (0.000,7.279) T (0.000,7.279) or, (0.000,7.279) and (0.000,7.279) OTR. (0.000,7.279) When (0.000,7.279) primes (0.000,7.279) are (0.000,7.279) of (0.000,7.279) sufficien (0.000,7.279) t (0.000,7.279) strength, (0.000,7.279) there (0.000,7.279) see (0.000,7.279) m (0.000,7.279) s (0.000,7.279) to (0.000,7.279) b (0.000,7.279) e (0.000,7.279) no (0.000,7.279) disadv (0.000,7.279) an (0.000,7.279) tage (0.000,7.279) to (0.000,7.279) reusing (0.000,7.279) them. (0.000,7.279) Ho (0.000,7.279) w (0.000,7.279) ev (0.000,7.279) er, (0.000,7.279) widespread (0.000,7.279) reuse (0.000,7.279) of (0.000,7.279) Diffi (0.000,7.279) e (0.000,7.279) -Hellman (0.000,7.279) groups (0.000,7.279) can (0.000,7.279) con (0.000,7.279) v (0.000,7.279) ert (0.000,7.279) attac (0.000,7.279) ks (0.000,7.279) t (0.000,7.279) hat (0.000,7.279) are (0.000,7.279) at (0.000,7.279) the (0.000,7.279) limits (0.000,7.279) of (0.000,7.279) an (0.000,7.279) adv (0.000,7.279) ersary’s (0.000,7.279) capabilities (0.000,7.279) in (0.000,7.279) to (0.000,7.279) dev (0.000,7.279) astating (0.000,7.279) breaks, (0.000,7.279) since (0.000,7.279) it (0.000,7.279) allo (0.000,7.279) ws (0.000,7.279) the (0.000,7.279) attac (0.000,7.279) k (0.000,7.279) er (0.000,7.279) to (0.000,7.279) amortize (0.000,7.279) the (0.000,7.279) cost (0.000,7.279) of (0.000,7.279) discrete (0.000,7.279) log (0.000,7.279) precomputation (0.000,7.279) am (0.000,7.279) ong (0.000,7.279) v (0.000,7.279) ast (0.000,7.279) n (0.000,7.279) um (0.000,7.279) b (0.000,7.279) ers (0.000,7.279) of (0.000,7.279) p (0.000,7.279) o (0.000,7.279) ten (0.000,7.279) tial (0.000,7.279) targets. (0.000,7.279) 3. (0.000,7.279) A (0.000,7.279) TT (0.000,7.279) A (0.000,7.279) CKING (0.000,7.279) TLS (0.000,7.279) TLS (0.000,7.279) supp (0.000,7.279) orts (0.000,7.279) Diffie-Hellman (0.000,7.279) as (0.000,7.279) one (0.000,7.279) of (0.000,7.279) sev (0.000,7.279) eral (0.000,7.279) p (0.000,7.279) ossible (0.000,7.279) k (0.000,7.279) ey (0.000,7.279) e (0.000,7.279) x (0.000,7.279) c (0.000,7.279) hang (0.000,7.279) e (0.000,7.279) metho (0.000,7.279) ds, (0.000,7.279) and (0.000,7.279) ab (0.000,7.279) out (0.000,7.279) t (0.000,7.279) w (0.000,7.279) o-thirds (0.000,7.279) of (0.000,7.279) p (0.000,7.279) opular (0.000,7.279) HTTPS (0.000,7.279) sites (0.000,7.279) allo (0.000,7.279) w (0.000,7.279) it, (0.000,7.279) m (0.000,7.279) ost (0.000,7.279) commonly (0.000,7.279) using (0.000,7.279) 1024-bit (0.000,7.279) primes. (0.000,7.279) Ho (0.000,7.279) w (0.000,7.279) ev (0.000,7.279) er, (0.000,7.279) a (0.000,7.279) smaller (0.000,7.279) n (0.000,7.279) um (0.000,7.279) b (0.000,7.279) er (0.000,7.279) of (0.000,7.279) serv (0.000,7.279) ers (0.000,7.279) also (0.000,7.279) supp (0.000,7.279) ort (0.000,7.279) legacy (0.000,7.279) “exp (0.000,7.279) ort-grade” (0.000,7.279) Diffie-Hellman (0.000,7.279) using (0.000,7.279) 512-bit (0.000,7.279) primes (0.000,7.279) that (0.000,7.279) are (0.000,7.279) w (0.000,7.279) ell (0.000,7.279) within (0.000,7.279) reac (0.000,7.279) h (0.000,7.279) of (0.000,7.279) NFS-based (0.000,7.279) cryptanalysis. (0.000,7.279) F (0.000,7.279) urthermore, (0.000,238.310) Source (0.000,238.310) P (0.000,238.310) opularit (0.000,238.310) y (0.000,238.310) Prime (0.000,238.310) Apac (0.000,238.310) he (0.000,238.310) 8 (0.000,238.310) 2% (0.000,238.310) 9fdb8b8a004 (0.000,238.310) 544f0045f1737d0ba2e0 (0.000,238.310) b (0.000,238.310) 274cdf1a9f5 (0.000,238.310) 88218fb435316a16e3741 (0.000,238.310) 71fd19d8d8f (0.000,238.310) 37c39bf863fd60e3e3006 (0.000,238.310) 80a3030c6e4 (0.000,238.310) c3757d08f70e6aa871033 (0.000,238.310) mo (0.000,238.310) d_ssl (0.000,238.310) 1 (0.000,238.310) 0% (0.000,238.310) d4bcd52406f (0.000,238.310) 69b35994b88de5db89682 (0.000,238.310) c8157f62d8f (0.000,238.310) 33633ee5772f11f05ab22 (0.000,238.310) d6b5145b9f24 (0.000,238.310) 1e5acc31ff090a4bc711 (0.000,238.310) 48976f76795094e (0.000,238.310) 71e7903529f5a824b (0.000,238.310) ( (0.000,238.310) others (0.000,238.310) ) (0.000,238.310) 8% (0.000,238.310) (463 (0.000,238.310) distinct (0.000,238.310) primes) (0.000,238.310) T (0.000,238.310) able (0.000,238.310) 1: (0.000,238.310) T (0.000,238.310) op (0.000,238.310) 512-bit (0.000,238.310) DH (0.000,238.310) primes (0.000,238.310) for (0.000,238.310) TLS. (0.000,238.310) 8.4% (0.000,238.310) of (0.000,238.310) Alexa (0.000,238.310) T (0.000,238.310) op (0.000,238.310) 1M (0.000,238.310) HTTPS (0.000,238.310) domains (0.000,238.310) allo (0.000,238.310) w (0.000,238.310) DHE_EXPORT (0.000,238.310) , (0.000,238.310) of (0.000,238.310) whic (0.000,238.310) h (0.000,238.310) 92.3% (0.000,238.310) use (0.000,238.310) one (0.000,238.310) of (0.000,238.310) the (0.000,238.310) t (0.000,238.310) w (0.000,238.310) o (0.000,238.310) most (0.000,238.310) p (0.000,238.310) opular (0.000,238.310) primes, (0.000,238.310) sho (0.000,238.310) wn (0.000,238.310) here. (0.000,238.310) for (0.000,238.310) b (0.000,238.310) oth (0.000,238.310) normal (0.000,238.310) and (0.000,238.310) exp (0.000,238.310) ort-grade (0.000,238.310) Diffie-Hellman, (0.000,238.310) the (0.000,238.310) v (0.000,238.310) ast (0.000,238.310) ma (0.000,238.310) jorit (0.000,238.310) y (0.000,238.310) of (0.000,238.310) serv (0.000,238.310) ers (0.000,238.310) use (0.000,238.310) a (0.000,238.310) handful (0.000,238.310) of (0.000,238.310) common (0.000,238.310) groups. (0.000,238.310) In (0.000,238.310) this (0.000,238.310) sectio (0.000,238.310) n, (0.000,238.310) w (0.000,238.310) e (0.000,238.310) exploit (0.000,238.310) these (0.000,238.310) facts (0.000,238.310) to (0.000,238.310) construct (0.000,238.310) a (0.000,238.310) no (0.000,238.310) v (0.000,238.310) el (0.000,238.310) attac (0.000,238.310) k (0.000,238.310) against (0.000,238.310) TLS, (0.000,238.310) whic (0.000,238.310) h (0.000,238.310) w (0.000,238.310) e (0.000,238.310) call (0.000,238.310) the (0.000,238.310) Log (0.000,238.310) jam (0.000,238.310) attac (0.000,238.310) k. (0.000,238.310) First, (0.000,238.310) w (0.000,238.310) e (0.000,238.310) p (0.000,238.310) erform (0.000,238.310) NFS (0.000,238.310) precomputations (0.000,238.310) for (0.000,238.310) the (0.000,238.310) t (0.000,238.310) w (0.000,238.310) o (0.000,238.310) most (0.000,238.310) p (0.000,238.310) opular (0.000,238.310) 512-bit (0.000,238.310) prim (0.000,238.310) e (0.000,238.310) s (0.000,238.310) on (0.000,238.310) the (0.000,238.310) w (0.000,238.310) eb, (0.000,238.310) so (0.000,238.310) that (0.000,238.310) w (0.000,238.310) e (0.000,238.310) can (0.000,238.310) quic (0.000,238.310) kly (0.000,238.310) compute (0.000,238.310) the (0.000,238.310) discre (0.000,238.310) te (0.000,238.310) log (0.000,238.310) for (0.000,238.310) an (0.000,238.310) y (0.000,238.310) k (0.000,238.310) ey-exc (0.000,238.310) hange (0.000,238.310) message (0.000,238.310) that (0.000,238.310) uses (0.000,238.310) one (0.000,238.310) of (0.000,238.310) them. (0.000,238.310) Next, (0.000,238.310) w (0.000,238.310) e (0.000,238.310) sho (0.000,238.310) w (0.000,238.310) ho (0.000,238.310) w (0.000,238.310) a (0.000,238.310) man-in-the-middle, (0.000,238.310) so (0.000,238.310) armed, (0.000,238.310) can (0.000,238.310) attac (0.000,238.310) k (0.000,238.310) connections (0.000,238.310) b (0.000,238.310) et (0.000,238.310) w (0.000,238.310) een (0.000,238.310) p (0.000,238.310) opular (0.000,238.310) bro (0.000,238.310) wsers (0.000,238.310) and (0.000,238.310) an (0.000,238.310) y (0.000,238.310) serv (0.000,238.310) er (0.000,238.310) that (0.000,238.310) allo (0.000,238.310) ws (0.000,238.310) exp (0.000,238.310) ort-grade (0.000,238.310) Diffie-Hellman, (0.000,238.310) b (0.000,238.310) y (0.000,238.310) using (0.000,238.310) a (0.000,238.310) TLS (0.000,238.310) prot (0.000,238.310) o (0.000,238.310) col (0.000,238.310) fla (0.000,238.310) w (0.000,238.310) t (0.000,238.310) o (0.000,238.310) do (0.000,238.310) wngrade (0.000,238.310) the (0.000,238.310) connection (0.000,238.310) to (0.000,238.310) exp (0.000,238.310) ort- (0.000,238.310) strength (0.000,238.310) and (0.000,238.310) then (0.000,238.310) reco (0.000,238.310) v (0.000,238.310) ering (0.000,238.310) the (0.000,238.310) session (0.000,238.310) k (0.000,238.310) ey (0.000,238.310) . (0.000,238.310) W (0.000,238.310) e (0.000,238.310) find (0.000,238.310) that (0.000,238.310) this (0.000,238.310) attac (0.000,238.310) k (0.000,238.310) with (0.000,238.310) our (0.000,238.310) precomputations (0.000,238.310) can (0.000,238.310) compromise (0.000,238.310) ab (0.000,238.310) out (0.000,238.310) 7.8% (0.000,238.310) of (0.000,238.310) HTTPS (0.000,238.310) serv (0.000,238.310) ers (0.000,238.310) among (0.000,238.310) Alexa (0.000,238.310) T (0.000,238.310) op (0.000,238.310) Million (0.000,238.310) domains. (0.000,238.310) 3.1 (0.000,238.310) TLS (0.000,238.310) and (0.000,238.310) Diffie-Hellman (0.000,238.310) The (0.000,238.310) TLS (0.000,238.310) handshak (0.000,238.310) e (0.000,238.310) b (0.000,238.310) egins (0.000,238.310) with (0.000,238.310) a (0.000,238.310) ne (0.000,238.310) gotiation (0.000,238.310) to (0.000,238.310) determine (0.000,238.310) the (0.000,238.310) crypto (0.000,238.310) algorithms (0.000,238.310) used (0.000,238.310) for (0.000,238.310) the (0.000,238.310) session. (0.000,238.310) The (0.000,238.310) clien (0.000,238.310) t (0.000,238.310) sends (0.000,238.310) a (0.000,238.310) list (0.000,238.310) of (0.000,238.310) supp (0.000,238.310) orted (0.000,238.310) ciphersuites (0.000,238.310) ( (0.000,238.310) and (0.000,238.310) a (0.000,238.310) random (0.000,238.310) nonce (0.000,238.310) cr (0.000,238.310) ) (0.000,238.310) within (0.000,238.310) the (0.000,238.310) ClientHello (0.000,238.310) message, (0.000,238.310) where (0.000,238.310) eac (0.000,238.310) h (0.000,238.310) ciphersuite (0.000,238.310) sp (0.000,238.310) ecifies (0.000,238.310) a (0.000,238.310) k (0.000,238.310) ey (0.000,238.310) exc (0.000,238.310) hange (0.000,238.310) algorithm (0.000,238.310) and (0.000,238.310) other (0.000,238.310) primitiv (0.000,238.310) es. (0.000,238.310) The (0.000,238.310) serv (0.000,238.310) e (0.000,238.310) r (0.000,238.310) selects (0.000,238.310) a (0.000,238.310) ciphersuite (0.000,238.310) from (0.000,238.310) the (0.000,238.310) clien (0.000,238.310) t’s (0.000,238.310) list (0.000,238.310) and (0.000,238.310) signals (0.000,238.310) its (0.000,238.310) selection (0.000,238.310) in (0.000,238.310) a (0.000,238.310) ServerHello (0.000,238.310) message (0.000,238.310) (con (0.000,238.310) taining (0.000,238.310) a (0.000,238.310) random (0.000,238.310) nonce (0.000,238.310) sr (0.000,238.310) ). (0.000,238.310) TLS (0.000,238.310) sp (0.000,238.310) ecifies (0.000,238.310) ciphersuites (0.000,238.310) supp (0.000,238.310) ort (0.000,238.310) ing (0.000,238.310) m (0.000,238.310) ultiple (0.000,238.310) v (0.000,238.310) arieties (0.000,238.310) of (0.000,238.310) Diffie-Hellman. (0.000,238.310) T (0.000,238.310) extb (0.000,238.310) o (0.000,238.310) ok (0.000,238.310) Diffie-Hellman (0.000,238.310) with (0.000,238.310) unrestricted (0.000,238.310) strength (0.000,238.310) is (0.000,238.310) called (0.000,238.310) “ephemeral” (0.000,238.310) Diffie-Hellman, (0.000,238.310) or (0.000,238.310) DHE (0.000,238.310) , (0.000,238.310) and (0.000,238.310) is (0.000,238.310) iden (0.000,238.310) tified (0.000,238.310) b (0.000,238.310) y (0.000,238.310) ciphersuites (0.000,238.310) that (0.000,238.310) b (0.000,238.310) egin (0.000,238.310) with (0.000,238.310) TLS_DHE_* (0.000,238.310) . (0.000,238.310) 2 (0.000,238.310) In (0.000,238.310) DHE (0.000,238.310) , (0.000,238.310) the (0.000,238.310) serv (0.000,238.310) er (0.000,238.310) is (0.000,238.310) resp (0.000,238.310) onsible (0.000,238.310) for (0.000,238.310) selec (0.000,238.310) ting (0.000,238.310) the (0.000,238.310) Diffie-Hellman (0.000,238.310) parameters. (0.000,238.310) It (0.000,238.310) c (0.000,238.310) ho (0.000,238.310) oses (0.000,238.310) a (0.000,238.310) group (0.000,238.310) ( (0.000,238.310) p, (0.000,238.310) g (0.000,238.310) ) (0.000,238.310) , (0.000,238.310) computes (0.000,238.310) g (0.000,238.310) b (0.000,238.310) , (0.000,238.310) and (0.000,238.310) sends (0.000,238.310) a (0.000,238.310) ServerKeyExchange (0.000,238.310) message (0.000,238.310) con (0.000,238.310) taining (0.000,238.310) a (0.000,238.310) signature (0.000,238.310) o (0.000,238.310) v (0.000,238.310) e (0.000,238.310) r (0.000,238.310) the (0.000,238.310) tuple (0.000,238.310) ( (0.000,238.310) cr (0.000,238.310) , (0.000,238.310) sr (0.000,238.310) , (0.000,238.310) p, (0.000,238.310) g (0.000,238.310) , (0.000,238.310) g (0.000,238.310) b (0.000,238.310) ) (0.000,238.310) using (0.000,238.310) the (0.000,238.310) long-term (0.000,238.310) signing (0.000,238.310) k (0.000,238.310) ey (0.000,238.310) from (0.000,238.310) its (0.000,238.310) certificate (0.000,238.310) . (0.000,238.310) The (0.000,238.310) clien (0.000,238.310) t (0.000,238.310) v (0.000,238.310) erifies (0.000,238.310) the (0.000,238.310) signature (0.000,238.310) and (0.000,238.310) resp (0.000,238.310) onds (0.000,238.310) with (0.000,238.310) a (0.000,238.310) ClientKeyExchange (0.000,238.310) message (0.000,238.310) con (0.000,238.310) taining (0.000,238.310) g (0.000,238.310) a (0.000,238.310) . (0.000,238.310) T (0.000,238.310) o (0.000,238.310) ensure (0.000,238.310) a (0.000,238.310) greemen (0.000,238.310) t (0.000,238.310) on (0.000,238.310) the (0.000,238.310) negotia (0.000,238.310) tion (0.000,238.310) messages, (0.000,238.310) and (0.000,238.310) to (0.000,238.310) prev (0.000,238.310) en (0.000,238.310) t (0.000,238.310) do (0.000,238.310) wngrade (0.000,238.310) attac (0.000,238.310) ks (0.000,238.310) [52], (0.000,238.310) eac (0.000,238.310) h (0.000,238.310) part (0.000,238.310) y (0.000,238.310) computes (0.000,238.310) the (0.000,238.310) TLS (0.000,238.310) master (0.000,238.310) secret (0.000,238.310) from (0.000,238.310) g (0.000,238.310) ab (0.000,238.310) and (0.000,238.310) calculates (0.000,238.310) a (0.000,238.310) MA (0.000,238.310) C (0.000,238.310) of (0.000,238.310) its (0.000,238.310) view (0.000,238.310) of (0.000,238.310) the (0.000,238.310) handshak (0.000,238.310) e (0.000,238.310) transc (0.000,238.310) ript. (0.000,238.310) These (0.000,238.310) MA (0.000,238.310) Cs (0.000,238.310) are (0.000,238.310) exc (0.000,238.310) hanged (0.000,238.310) in (0.000,238.310) a (0.000,238.310) pair (0.000,238.310) of (0.000,238.310) Finished (0.000,238.310) messages (0.000,238.310) and (0.000,238.310) v (0.000,238.310) erified (0.000,238.310) b (0.000,238.310) y (0.000,238.310) the (0.000,238.310) recipien (0.000,238.310) ts. (0.000,238.310) Thereafter, (0.000,238.310) clien (0.000,238.310) t (0.000,238.310) and (0.000,238.310) serv (0.000,238.310) er (0.000,238.310) start (0.000,238.310) exc (0.000,238.310) hanging (0.000,238.310) application (0.000,238.310) data, (0.000,238.310) prote (0.000,238.310) cted (0.000,238.310) b (0.000,238.310) y (0.000,238.310) an (0.000,238.310) authen (0.000,238.310) ticated (0.000,238.310) encryption (0.000,238.310) sc (0.000,238.310) heme (0.000,238.310) with (0.000,238.310) k (0.000,238.310) eys (0.000,238.310) also (0.000,238.310) deriv (0.000,238.310) ed (0.000,238.310) from (0.000,238.310) g (0.000,238.310) ab (0.000,238.310) . (0.000,238.310) T (0.000,238.310) o (0.000,238.310) comply (0.000,238.310) with (0.000,238.310) 1990s-era (0.000,238.310) U.S. (0.000,238.310) e (0.000,238.310) x (0.000,238.310) p (0.000,238.310) ort (0.000,238.310) restrict (0.000,238.310) ions (0.000,238.310) on (0.000,238.310) c (0.000,238.310) ry (0.000,238.310) p- (0.000,238.310) tograph (0.000,238.310) y (0.000,238.310) , (0.000,238.310) SSL (0.000,238.310) 3.0 (0.000,238.310) and (0.000,238.310) TLS (0.000,238.310) 1.0 (0.000,238.310) supp (0.000,238.310) orted (0.000,238.310) reduced-strength (0.000,119.552) 2 (0.000,119.552) TLS (0.000,119.552) also (0.000,119.552) supp (0.000,119.552) orts (0.000,119.552) a (0.000,119.552) rarely (0.000,119.552) used (0.000,119.552) “st (0.000,119.552) atic” (0.000,119.552) Diffie-Hellman (0.000,119.552) format, (0.000,119.552) where (0.000,119.552) the (0.000,119.552) serv (0.000,119.552) er’s (0.000,119.552) k (0.000,119.552) ey (0.000,119.552) exc (0.000,119.552) hange (0.000,119.552) v (0.000,119.552) alue (0.000,119.552) is (0.000,119.552) fixed (0.000,119.552) and (0.000,119.552) con (0.000,119.552) tained (0.000,119.552) in (0.000,119.552) its (0.000,119.552) certificate. (0.000,119.552) New (0.000,119.552) c (0.000,119.552) iphersuites (0.000,119.552) that (0.000,119.552) use (0.000,119.552) elliptic (0.000,119.552) curv (0.000,119.552) e (0.000,119.552) Diffie-Hellman (0.000,119.552) ( (0.000,119.552) ECDHE (0.000,119.552) ) (0.000,119.552) are (0.000,119.552) gaining (0.000,119.552) in (0.000,119.552) p (0.000,119.552) opularit (0.000,119.552) y (0.000,119.552) , (0.000,119.552) but (0.000,119.552) w (0.000,119.552) e (0.000,119.552) fo (0.000,119.552) cus (0.000,119.552) exclusiv (0.000,119.552) ely (0.000,119.552) on (0.000,119.552) the (0.000,119.552) traditional (0.000,119.552) prime (0.000,119.552) field (0.000,119.552) v (0.000,119.552) ariet (0.000,119.552) y (0.000,119.552) . (0.000,119.552) 3 (0.000,0.000) Figure (0.000,0.000) 2: (0.000,0.000) The (0.000,0.000) Log (0.000,0.000) jam (0.000,0.000) attac (0.000,0.000) k. (0.000,0.000) A (0.000,0.000) man-in-the-middle (0.000,0.000) can (0.000,0.000) force (0.000,0.000) TLS (0.000,0.000) clien (0.000,0.000) ts (0.000,0.000) to (0.000,0.000) use (0.000,0.000) exp (0.000,0.000) ort-strength (0.000,0.000) DH (0.000,0.000) with (0.000,0.000) an (0.000,0.000) y (0.000,0.000) serv (0.000,0.000) er (0.000,0.000) that (0.000,0.000) allo (0.000,0.000) ws (0.000,0.000) DHE_EXPORT (0.000,0.000) . (0.000,0.000) Then, (0.000,0.000) b (0.000,0.000) y (0.000,0.000) finding (0.000,0.000) the (0.000,0.000) 512-bit (0.000,0.000) dis- (0.000,0.000) crete (0.000,0.000) log, (0.000,0.000) the (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) can (0.000,0.000) le (0.000,0.000) arn (0.000,0.000) the (0.000,0.000) session (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) and (0.000,0.000) arbitrarily (0.000,0.000) read (0.000,0.000) or (0.000,0.000) mo (0.000,0.000) dify (0.000,0.000) the (0.000,0.000) con (0.000,0.000) ten (0.000,0.000) ts. (0.000,0.000) Data (0.000,0.000) f (0.000,0.000) s (0.000,0.000) refers (0.000,0.000) to (0.000,0.000) F (0.000,0.000) alse (0.000,0.000) Start (0.000,0.000) [30] (0.000,0.000) application (0.000,0.000) data (0.000,0.000) that (0.000,0.000) some (0.000,0.000) TLS (0.000,0.000) clien (0.000,0.000) ts (0.000,0.000) send (0.000,0.000) b (0.000,0.000) efore (0.000,0.000) receiving (0.000,0.000) the (0.000,0.000) serv (0.000,0.000) er’s (0.000,0.000) Finished (0.000,0.000) message. (0.000,0.000) DHE_EXPORT (0.000,0.000) ciphersuites (0.000,0.000) that (0.000,0.000) w (0.000,0.000) ere (0.000,0.000) restricted (0.000,0.000) to (0.000,0.000) primes (0.000,0.000) no (0.000,0.000) longer (0.000,0.000) than (0.000,0.000) 512 (0.000,0.000) bits. (0.000,0.000) In (0.000,0.000) all (0.000,0.000) other (0.000,0.000) resp (0.000,0.000) ects, (0.000,0.000) DHE_EXPORT (0.000,0.000) proto (0.000,0.000) col (0.000,0.000) messages (0.000,0.000) are (0.000,0.000) iden (0.000,0.000) tical (0.000,0.000) to (0.000,0.000) DHE (0.000,0.000) . (0.000,0.000) The (0.000,0.000) relev (0.000,0.000) an (0.000,0.000) t (0.000,0.000) exp (0.000,0.000) ort (0.000,0.000) restrictions (0.000,0.000) are (0.000,0.000) no (0.000,0.000) longer (0.000,0.000) in (0.000,0.000) effect (0.000,0.000) , (0.000,0.000) but (0.000,0.000) man (0.000,0.000) y (0.000,0.000) libraries (0.000,0.000) and (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) main (0.000,0.000) tain (0.000,0.000) supp (0.000,0.000) ort (0.000,0.000) for (0.000,0.000) bac (0.000,0.000) kw (0.000,0.000) ards (0.000,0.000) compatibilit (0.000,0.000) y (0.000,0.000) . (0.000,0.000) Man (0.000,0.000) y (0.000,0.000) TLS (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) are (0.000,0.000) still (0.000,0.000) configured (0.000,0.000) with (0.000,0.000) t (0.000,0.000) w (0.000,0.000) o (0.000,0.000) groups: (0.000,0.000) a (0.000,0.000) strong (0.000,0.000) 1024-bit (0.000,0.000) group (0.000,0.000) for (0.000,0.000) regular (0.000,0.000) DHE (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) exc (0.000,0.000) hanges (0.000,0.000) and (0.000,0.000) a (0.000,0.000) 512-bit (0.000,0.000) group (0.000,0.000) for (0.000,0.000) legacy (0.000,0.000) DHE_EXPORT (0.000,0.000) . (0.000,0.000) This (0.000,0.000) has (0.000,0.000) b (0.000,0.000) een (0.000,0.000) considered (0.000,0.000) safe (0.000,0.000) b (0.000,0.000) ecause (0.000,0.000) most (0.000,0.000) mo (0.000,0.000) dern (0.000,0.000) TLS (0.000,0.000) clien (0.000,0.000) ts (0.000,0.000) do (0.000,0.000) not (0.000,0.000) offer (0.000,0.000) or (0.000,0.000) accept (0.000,0.000) DHE_EXPORT (0.000,0.000) ciphersuites. (0.000,0.000) T (0.000,0.000) o (0.000,0.000) understand (0.000,0.000) ho (0.000,0.000) w (0.000,0.000) HTTPS (0.000,0.000) se (0.000,0.000) rv (0.000,0.000) ers (0.000,0.000) in (0.000,0.000) the (0.000,0.000) wild (0.000,0.000) use (0.000,0.000) Diffie- (0.000,0.000) Hellman, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) mo (0.000,0.000) dified (0.000,0.000) the (0.000,0.000) ZMap (0.000,0.000) [15] (0.000,0.000) to (0.000,0.000) olc (0.000,0.000) hain (0.000,0.000) to (0.000,0.000) offer (0.000,0.000) DHE (0.000,0.000) and (0.000,0.000) DHE_EXPORT (0.000,0.000) ciphersuites (0.000,0.000) and (0.000,0.000) scanne (0.000,0.000) d (0.000,0.000) TCP/443 (0.000,0.000) on (0.000,0.000) b (0.000,0.000) oth (0.000,0.000) the (0.000,0.000) full (0.000,0.000) public (0.000,0.000) IPv4 (0.000,0.000) address (0.000,0.000) space (0.000,0.000) and (0.000,0.000) the (0.000,0.000) Alexa (0.000,0.000) T (0.000,0.000) op (0.000,0.000) 1M (0.000,0.000) dom (0.000,0.000) ains. (0.000,0.000) The (0.000,0.000) scans (0.000,0.000) to (0.000,0.000) ok (0.000,0.000) place (0.000,0.000) in (0.000,0.000) Marc (0.000,0.000) h (0.000,0.000) 2015. (0.000,0.000) Of (0.000,0.000) 539,000 (0.000,0.000) HTTPS (0.000,0.000) sites (0.000,0.000) among (0.000,0.000) T (0.000,0.000) op (0.000,0.000) 1M (0.000,0.000) domains, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) found (0.000,0.000) that (0.000,0.000) 68.3% (0.000,0.000) supp (0.000,0.000) orted (0.000,0.000) DHE (0.000,0.000) and (0.000,0.000) 8.4% (0.000,0.000) supp (0.000,0.000) orted (0.000,0.000) DHE_EXPORT (0.000,0.000) . (0.000,0.000) Of (0.000,0.000) 14 (0.000,0.000) .3 (0.000,0.000) million (0.000,0.000) IPv4 (0.000,0.000) HTTPS (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) with (0.000,0.000) bro (0.000,0.000) wser-trusted (0.000,0.000) certificates, (0.000,0.000) 23.9% (0.000,0.000) supp (0.000,0.000) orte (0.000,0.000) d (0.000,0.000) DHE (0.000,0.000) and (0.000,0.000) 4.9% (0.000,0.000) DHE_EXPORT (0.000,0.000) . (0.000,0.000) While (0.000,0.000) the (0.000,0.000) TLS (0.000,0.000) proto (0.000,0.000) col (0.000,0.000) allo (0.000,0.000) ws (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) to (0.000,0.000) gene (0.000,0.000) rate (0.000,0.000) the (0.000,0.000) ir (0.000,0.000) o (0.000,0.000) w (0.000,0.000) n (0.000,0.000) Diffie-Hellman (0.000,0.000) parameters, (0.000,0.000) the (0.000,0.000) o (0.000,0.000) v (0.000,0.000) erwhelming (0.000,0.000) ma (0.000,0.000) jorit (0.000,0.000) y (0.000,0.000) use (0.000,0.000) one (0.000,0.000) of (0.000,0.000) a (0.000,0.000) handful (0.000,0.000) of (0.000,0.000) primes. (0.000,0.000) As (0.000,0.000) sho (0.000,0.000) wn (0.000,0.000) in (0.000,0.000) T (0.000,0.000) a (0.000,0.000) b (0.000,0.000) l (0.000,0.000) e (0.000,0.000) 1, (0.000,0.000) just (0.000,0.000) t (0.000,0.000) w (0.000,0.000) o (0.000,0.000) 512- (0.000,0.000) bit (0.000,0.000) primes (0.000,0.000) accoun (0.000,0.000) t (0.000,0.000) for (0.000,0.000) 92.3% (0.000,0.000) of (0.000,0.000) Alexa (0.000,0.000) T (0.000,0.000) op (0.000,0.000) 1M (0.000,0.000) dom (0.000,0.000) ains (0.000,0.000) that (0.000,0.000) supp (0.000,0.000) ort (0.000,0.000) DHE_EXPORT (0.000,0.000) , (0.000,0.000) and (0.000,0.000) 92.5% (0.000,0.000) of (0.000,0.000) all (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) with (0.000,0.000) bro (0.000,0.000) wser- (0.000,0.000) trusted (0.000,0.000) certificates (0.000,0.000) that (0.000,0.000) supp (0.000,0.000) ort (0.000,0.000) DHE_EXPORT (0.000,0.000) . (0.000,0.000) (Non-exp (0.000,0.000) ort (0.000,0.000) DHE (0.000,0.000) follo (0.000,0.000) ws (0.000,0.000) a (0.000,0.000) similar (0.000,0.000) distribution (0.000,0.000) with (0.000,0.000) longer (0.000,0.000) primes.) (0.000,0.000) The (0.000,0.000) most (0.000,0.000) p (0.000,0.000) opular (0.000,0.000) 512-bit (0.000,0.000) prime (0.000,0.000) w (0.000,0.000) as (0.000,0.000) hard-co (0.000,0.000) ded (0.000,0.000) in (0.000,0.000) to (0.000,0.000) man (0.000,0.000) y (0.000,0.000) v (0.000,0.000) er- (0.000,0.000) sions (0.000,0.000) of (0.000,0.000) Apac (0.000,0.000) he. (0.000,0.000) In (0.000,0.000) tro (0.000,0.000) duced (0.000,0.000) in (0.000,0.000) 2005 (0.000,0.000) with (0.000,0.000) Apac (0.000,0.000) he (0.000,0.000) 2.1.5, (0.000,0.000) it (0.000,0.000) w (0.000,0.000) as (0.000,0.000) used (0.000,0.000) un (0.000,0.000) til (0.000,0.000) 2.4.7, (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) disabled (0.000,0.000) exp (0.000,0.000) ort (0.000,0.000) ciphersuites. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) found (0.000,0.000) it (0.000,0.000) in (0.000,0.000) use (0.000,0.000) b (0.000,0.000) y (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) 564,000 (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) with (0.000,0.000) bro (0.000,0.000) w (0.000,0.000) s (0.000,0.000) e (0.000,0.000) r-trusted (0.000,0.000) certificates. (0.000,0.000) The (0.000,0.000) second (0.000,0.000) most (0.000,0.000) p (0.000,0.000) opular (0.000,0.000) 512-bit (0.000,0.000) prime (0.000,0.000) is (0.000,0.000) the (0.000,0.000) default (0.000,0.000) used (0.000,0.000) for (0.000,0.000) DHE_EXPORT (0.000,0.000) when (0.000,0.000) using (0.000,0.000) mod_ssl (0.000,0.000) . (0.000,0.000) It (0.000,0.000) w (0.000,0.000) as (0.000,0.000) in (0.000,0.000) tro (0.000,0.000) duced (0.000,0.000) in (0.000,0.000) v (0.000,0.000) ersion (0.000,0.000) 2.3.0 (0.000,0.000) in (0.000,0.000) 1999. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) found (0.000,0.000) it (0.000,0.000) in (0.000,0.000) use (0.000,0.000) b (0.000,0.000) y (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) 89,000 (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) with (0.000,0.000) bro (0.000,0.000) wser-trust (0.000,0.000) ed (0.000,0.000) certificates. (0.000,0.000) 3.2 (0.000,0.000) Acti (0.000,0.000) v (0.000,0.000) e (0.000,0.000) Do (0.000,0.000) wngrade (0.000,0.000) to (0.000,0.000) Export-Grade (0.000,0.000) DHE (0.000,0.000) Giv (0.000,0.000) en (0.000,0.000) the (0.000,0.000) widespread (0.000,0.000) use (0.000,0.000) of (0.000,0.000) these (0.000,0.000) primes, (0.000,0.000) an (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) with (0.000,0.000) the (0.000,0.000) abilit (0.000,0.000) y (0.000,0.000) to (0.000,0.000) compute (0.000,0.000) discrete (0.000,0.000) logs (0.000,0.000) in (0.000,0.000) 512-bit (0.000,0.000) groups (0.000,0.000) could (0.000,0.000) efficien (0.000,0.000) t (0.000,0.000) ly (0.000,0.000) break (0.000,0.000) DHE_EXPORT (0.000,0.000) handshak (0.000,0.000) es (0.000,0.000) for (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) 8% (0.000,0.000) of (0.000,0.000) Alexa (0.000,0.000) T (0.000,0.000) op (0.000,0.000) 1M (0.000,0.000) H (0.000,0.000) TTPS (0.000,0.000) sites, (0.000,0.000) but (0.000,0.000) mo (0.000,0.000) dern (0.000,0.000) bro (0.000,0.000) wsers (0.000,0.000) nev (0.000,0.000) er (0.000,0.000) negotiate (0.000,0.000) exp (0.000,0.000) ort-grade (0.000,0.000) ciphersuites. (0.000,0.000) T (0.000,0.000) o (0.000,0.000) circum (0.000,0.000) v (0.000,0.000) en (0.000,0.000) t (0.000,0.000) this, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) sho (0.000,0.000) w (0.000,0.000) ho (0.000,0.000) w (0.000,0.000) an (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) who (0.000,0.000) can (0.000,0.000) compute (0.000,0.000) 512-bit (0.000,0.000) discrete (0.000,0.000) logs (0.000,0.000) in (0.000,0.000) r (0.000,0.000) e (0.000,0.000) al (0.000,0.000) time (0.000,0.000) can (0.000,0.000) do (0.000,0.000) wngrade (0.000,0.000) a (0.000,0.000) regular (0.000,0.000) DHE (0.000,0.000) connection (0.000,0.000) to (0.000,0.000) use (0.000,0.000) a (0.000,0.000) DHE_EXPORT (0.000,0.000) group, (0.000,0.000) and (0.000,0.000) thereb (0.000,0.000) y (0.000,0.000) break (0.000,0.000) b (0.000,0.000) ot (0.000,0.000) h (0.000,0.000) the (0.000,0.000) confiden (0.000,0.000) tialit (0.000,0.000) y (0.000,0.000) and (0.000,0.000) in (0.000,0.000) tegrit (0.000,0.000) y (0.000,0.000) of (0.000,0.000) application (0.000,0.000) data. (0.000,0.000) The (0.000,0.000) attac (0.000,0.000) k, (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) w (0.000,0.000) e (0.000,0.000) call (0.000,0.000) Log (0.000,0.000) jam, (0.000,0.000) is (0.000,0.000) depicted (0.000,0.000) in (0.000,0.000) Figure (0.000,0.000) 2 (0.000,0.000) and (0.000,0.000) relies (0.000,0.000) on (0.000,0.000) a (0.000,0.000) fla (0.000,0.000) w (0.000,0.000) in (0.000,0.000) the (0.000,0.000) w (0.000,0.000) a (0.000,0.000) y (0.000,0.000) TLS (0.000,0.000) comp (0.000,0.000) oses (0.000,0.000) DHE (0.000,0.000) and (0.000,0.000) DHE_EXPORT (0.000,0.000) . (0.000,0.000) When (0.000,0.000) a (0.000,0.000) serv (0.000,0.000) er (0.000,0.000) selects (0.000,0.000) DHE_EXPORT (0.000,0.000) for (0.000,0.000) a (0.000,0.000) handshak (0.000,0.000) e, (0.000,0.000) it (0.000,0.000) pro (0.000,0.000) ceeds (0.000,0.000) b (0.000,0.000) y (0.000,0.000) issuing (0.000,0.000) a (0.000,0.000) signed (0.000,0.000) ServerKeyExchange (0.000,0.000) message (0.000,0.000) con (0.000,0.000) taining (0.000,0.000) a (0.000,0.000) 512-bit (0.000,0.000) p (0.000,0.000) 512 (0.000,0.000) , (0.000,0.000) but (0.000,0.000) the (0.000,0.000) structure (0.000,0.000) of (0.000,0.000) this (0.000,0.000) message (0.000,0.000) is (0.000,0.000) iden (0.000,0.000) tical (0.000,0.000) to (0.000,0.000) the (0.000,0.000) message (0.000,0.000) sen (0.000,0.000) t (0.000,0.000) during (0.000,0.000) standard (0.000,0.000) DHE (0.000,0.000) ciphersuites. (0.000,0.000) Crit (0.000,0.000) ically (0.000,0.000) , (0.000,0.000) the (0.000,0.000) signed (0.000,0.000) p (0.000,0.000) ortion (0.000,0.000) of (0.000,0.000) the (0.000,0.000) serv (0.000,0.000) er’s (0.000,0.000) message (0.000,0.000) fails (0.000,0.000) to (0.000,0.000) include (0.000,0.000) an (0.000,0.000) y (0.000,0.000) indication (0.000,0.000) of (0.000,0.000) the (0.000,0.000) sp (0.000,0.000) ecific (0.000,0.000) cipher- (0.000,0.000) suite (0.000,0.000) that (0.000,0.000) the (0.000,0.000) serv (0.000,0.000) er (0.000,0.000) has (0.000,0.000) c (0.000,0.000) hosen. (0.000,0.000) Pro (0.000,0.000) vided (0.000,0.000) that (0.000,0.000) a (0.000,0.000) clien (0.000,0.000) t (0.000,0.000) offers (0.000,0.000) DHE (0.000,0.000) , (0.000,0.000) an (0.000,0.000) activ (0.000,0.000) e (0.000,0.000) att (0.000,0.000) ac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) can (0.000,0.000) rewrite (0.000,0.000) the (0.000,0.000) clien (0.000,0.000) t’s (0.000,0.000) ClientHello (0.000,0.000) to (0.000,0.000) offer (0.000,0.000) a (0.000,0.000) corresp (0.000,0.000) onding (0.000,0.000) DHE_EXPORT (0.000,0.000) ciphersuite (0.000,0.000) accepted (0.000,0.000) b (0.000,0.000) y (0.000,0.000) the (0.000,0.000) serv (0.000,0.000) er (0.000,0.000) and (0.000,0.000) remo (0.000,0.000) v (0.000,0.000) e (0.000,0.000) other (0.000,0.000) ciphersuites (0.000,0.000) that (0.000,0.000) could (0.000,0.000) b (0.000,0.000) e (0.000,0.000) c (0.000,0.000) hosen (0.000,0.000) instead. (0.000,0.000) The (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) rewrites (0.000,0.000) the (0.000,0.000) ServerHello (0.000,0.000) resp (0.000,0.000) onse (0.000,0.000) to (0.000,0.000) replace (0.000,0.000) the (0.000,0.000) c (0.000,0.000) hosen (0.000,0.000) DHE_EXPORT (0.000,0.000) ciphersuite (0.000,0.000) with (0.000,0.000) a (0.000,0.000) matc (0.000,0.000) hing (0.000,0.000) non-exp (0.000,0.000) ort (0.000,0.000) ciphersuite (0.000,0.000) and (0.000,0.000) forw (0.000,0.000) ards (0.000,0.000) the (0.000,0.000) ServerKeyExchange (0.000,0.000) message (0.000,0.000) to (0.000,0.000) the (0.000,0.000) clien (0.000,0.000) t (0.000,0.000) as (0.000,0.000) is. (0.000,0.000) The (0.000,0.000) clien (0.000,0.000) t (0.000,0.000) will (0.000,0.000) in (0.000,0.000) terpret (0.000,0.000) the (0.000,0.000) exp (0.000,0.000) ort-grade (0.000,0.000) tuple (0.000,0.000) ( (0.000,0.000) p (0.000,0.000) 512 (0.000,0.000) , (0.000,0.000) g (0.000,0.000) , (0.000,0.000) g (0.000,0.000) b (0.000,0.000) ) (0.000,0.000) as (0.000,0.000) v (0.000,0.000) alid (0.000,0.000) DHE (0.000,0.000) parameters (0.000,0.000) c (0.000,0.000) ho- (0.000,0.000) sen (0.000,0.000) b (0.000,0.000) y (0.000,0.000) the (0.000,0.000) serv (0.000,0.000) e (0.000,0.000) r (0.000,0.000) and (0.000,0.000) pro (0.000,0.000) ceed (0.000,0.000) with (0.000,0.000) the (0.000,0.000) handshak (0.000,0.000) e. (0.000,0.000) T (0.000,0.000) he (0.000,0.000) clien (0.000,0.000) t (0.000,0.000) and (0.000,0.000) serv (0.000,0.000) er (0.000,0.000) ha (0.000,0.000) v (0.000,0.000) e (0.000,0.000) differen (0.000,0.000) t (0.000,0.000) handshak (0.000,0.000) e (0.000,0.000) transcripts (0.000,0.000) at (0.000,0.000) this (0.000,0.000) stage, (0.000,0.000) but (0.000,0.000) an (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) who (0.000,0.000) can (0.000,0.000) compute (0.000,0.000) b (0.000,0.000) in (0.000,0.000) close (0.000,0.000) to (0.000,0.000) real (0.000,0.000) time (0.000,0.000) can (0.000,0.000) then (0.000,0.000) deriv (0.000,0.000) e (0.000,0.000) the (0.000,0.000) m (0.000,0.000) ast (0.000,0.000) er (0.000,0.000) secret (0.000,0.000) and (0.000,0.000) connection (0.000,0.000) k (0.000,0.000) eys (0.000,0.000) to (0.000,0.000) complete (0.000,0.000) the (0.000,0.000) handshak (0.000,0.000) e (0.000,0.000) with (0.000,0.000) the (0.000,0.000) clien (0.000,0.000) t, (0.000,0.000) and (0.000,0.000) then (0.000,0.000) freely (0.000,0.000) read (0.000,0.000) and (0.000,0.000) write (0.000,0.000) application (0.000,0.000) data (0.000,0.000) pretending (0.000,0.000) to (0.000,0.000) b (0.000,0.000) e (0.000,0.000) the (0.000,0.000) serv (0.000,0.000) er. (0.000,0.000) There (0.000,0.000) are (0.000,0.000) t (0.000,0.000) w (0.000,0.000) o (0.000,0.000) remaining (0.000,0.000) c (0.000,0.000) hallenges (0.000,0.000) in (0.000,0.000) implemen (0.000,0.000) ting (0.000,0.000) this (0.000,0.000) activ (0.000,0.000) e (0.000,0.000) do (0.000,0.000) wngrade (0.000,0.000) attac (0.000,0.000) k. (0.000,0.000) The (0.000,0.000) first (0.000,0.000) is (0.000,0.000) to (0.000,0.000) compute (0.000,0.000) individual (0.000,0.000) discrete (0.000,0.000) logs (0.000,0.000) in (0.000,0.000) close (0.000,0.000) to (0.000,0.000) real (0.000,0.000) time, (0.000,0.000) and (0.000,0.000) the (0.000,0.000) second (0.000,0.000) is (0.000,0.000) to (0.000,0.000) dela (0.000,0.000) y (0.000,0.000) handshak (0.000,0.000) e (0.000,0.000) completio (0.000,0.000) n (0.000,0.000) un (0.000,0.000) til (0.000,0.000) the (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) computation (0.000,0.000) has (0.000,0.000) had (0.000,0.000) time (0.000,0.000) to (0.000,0.000) finish. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) address (0.000,0.000) these (0.000,0.000) in (0.000,0.000) the (0.000,0.000) ne (0.000,0.000) x (0.000,0.000) t (0.000,0.000) subs (0.000,0.000) e (0.000,0.000) ctions. (0.000,0.000) Comparison (0.000,0.000) with (0.000,0.000) prev (0.000,0.000) ious (0.000,0.000) attac (0.000,0.000) ks (0.000,0.000) Log (0.000,0.000) jam (0.000,0.000) is (0.000,0.000) remi- (0.000,0.000) niscen (0.000,0.000) t (0.000,0.000) of (0.000,0.000) the (0.000,0.000) rec (0.000,0.000) en (0.000,0.000) t (0.000,0.000) FREAK (0.000,0.000) [7] (0.000,0.000) attac (0.000,0.000) k, (0.000,0.000) in (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) an (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) do (0.000,0.000) wngrades (0.000,0.000) a (0.000,0.000) regular (0.000,0.000) RSA (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) exc (0.000,0.000) hange (0.000,0.000) to (0.000,0.000) one (0.000,0.000) that (0.000,0.000) uses (0.000,0.000) exp (0.000,0.000) ort-grade (0.000,0.000) 512-bit (0.000,0.000) ephemeral (0.000,0.000) RSA (0.000,0.000) k (0.000,0.000) eys, (0.000,0.000) relying (0.000,0.000) on (0.000,0.000) a (0.000,0.000) bug (0.000,0.000) in (0.000,0.000) sev (0.000,0.000) eral (0.000,0.000) TLS (0.000,0.000) clien (0.000,0.000) t (0.000,0.000) im (0.000,0.000) ple (0.000,0.000) m (0.000,0.000) en (0.000,0.000) t (0.000,0.000) ations. (0.000,0.000) The (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) then (0.000,0.000) factors (0.000,0.000) the (0.000,0.000) ephemeral (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) t (0.000,0.000) o (0.000,0.000) hijac (0.000,0.000) k (0.000,0.000) future (0.000,0.000) connections (0.000,0.000) that (0.000,0.000) use (0.000,0.000) the (0.000,0.000) same (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) . (0.000,0.000) The (0.000,0.000) cryptanalysis (0.000,0.000) tak (0.000,0.000) es (0.000,0.000) sev (0.000,0.000) eral (0.000,0.000) hours (0.000,0.000) on (0.000,0.000) commo (0.000,0.000) dit (0.000,0.000) y (0.000,0.000) hardw (0.000,0.000) are (0.000,0.000) and (0.000,0.000) is (0.000,0.000) usable (0.000,0.000) un (0.000,0.000) til (0.000,0.000) the (0.000,0.000) serv (0.000,0.000) er (0.000,0.000) genera (0.000,0.000) tes (0.000,0.000) a (0.000,0.000) fresh (0.000,0.000) ephemeral (0.000,0.000) RSA (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) (t (0.000,0.000) ypically (0.000,0.000) when (0.000,0.000) it (0.000,0.000) restarts). (0.000,0.000) In (0.000,0.000) con (0.000,0.000) trast, (0.000,0.000) Log (0.000,0.000) jam (0.000,0.000) is (0.000,0.000) due (0.000,0.000) to (0.000,0.000) a (0.000,0.000) proto (0.000,0.000) col (0.000,0.000) fla (0.000,0.000) w (0.000,0.000) in (0.000,0.000) TLS, (0.000,0.000) not (0.000,0.000) an (0.000,0.000) implemen (0.000,0.000) tation (0.000,0.000) bug. (0.000,0.000) F (0.000,0.000) rom (0.000,0.000) a (0.000,0.000) clie (0.000,0.000) n (0.000,0.000) t (0.000,0.000) p (0.000,0.000) ersp (0.000,0.000) ectiv (0.000,0.000) e, (0.000,0.000) the (0.000,0.000) only (0.000,0.000) defense (0.000,0.000) is (0.000,0.000) to (0.000,0.000) reject (0.000,0.000) small (0.000,0.000) primes (0.000,0.000) in (0.000,0.000) DHE (0.000,0.000) handshak (0.000,0.000) es. (0.000,0.000) (Prior (0.000,0.000) to (0.000,0.000) this (0.000,0.000) w (0.000,0.000) ork, (0.000,0.000) most (0.000,0.000) p (0.000,0.000) opular (0.000,0.000) bro (0.000,0.000) wsers (0.000,0.000) ac (0.000,0.000) cepted (0.000,0.000) p (0.000,0.000) of (0.000,0.000) size (0.000,0.000) ≥ (0.000,0.000) 512 (0.000,0.000) bits.) (0.000,0.000) Log (0.000,0.000) jam (0.000,0.000) affects (0.000,0.000) few (0.000,0.000) er (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) than (0.000,0.000) FREAK, (0.000,0.000) but, (0.000,0.000) as (0.000,0.000) w (0.000,0.000) e (0.000,0.000) shall (0.000,0.000) see, (0.000,0.000) t (0.000,0.000) he (0.000,0.000) cost (0.000,0.000) p (0.000,0.000) er (0.000,0.000) compromised (0.000,0.000) connection (0.000,0.000) is (0.000,0.000) far (0.000,0.000) lo (0.000,0.000) w (0.000,0.000) er, (0.000,0.000) since (0.000,0.000) the (0.000,0.000) pre (0.000,0.000) computation (0.000,0.000) for (0.000,0.000) eac (0.000,0.000) h (0.000,0.000) 512-bit (0.000,0.000) group (0.000,0.000) can (0.000,0.000) b (0.000,0.000) e (0.000,0.000) used (0.000,0.000) indefinitely (0.000,0.000) against (0.000,0.000) all (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) that (0.000,0.000) use (0.000,0.000) that (0.000,0.000) group, (0.000,0.000) and (0.000,0.000) since (0.000,0.000) eac (0.000,0.000) h (0.000,0.000) individual (0.000,0.000) discret (0.000,0.000) e (0.000,0.000) log (0.000,0.000) only (0.000,0.000) tak (0.000,0.000) es (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) a (0.000,0.000) min (0.000,0.000) ute. (0.000,0.000) Log (0.000,0.000) jam (0.000,0.000) and (0.000,0.000) FREAK (0.000,0.000) b (0.000,0.000) ot (0.000,0.000) h (0.000,0.000) follo (0.000,0.000) w (0.000,0.000) the (0.000,0.000) same (0.000,0.000) pattern (0.000,0.000) as (0.000,0.000) other (0.000,0.000) cross-proto (0.000,0.000) col (0.000,0.000) attac (0.000,0.000) ks (0.000,0.000) disco (0.000,0.000) v (0.000,0.000) ered (0.000,0.000) in (0.000,0.000) TLS. (0.000,0.000) As (0.000,0.000) early (0.000,0.000) as (0.000,0.000) SSL (0.000,0.000) 3.0, (0.000,0.000) Sc (0.000,0.000) hneier (0.000,0.000) and (0.000,0.000) W (0.000,0.000) agner (0.000,0.000) noted (0.000,0.000) a (0.000,0.000) related (0.000,0.000) vulnerabilit (0.000,0.000) y (0.000,0.000) that (0.000,0.000) the (0.000,0.000) y (0.000,0.000) called (0.000,0.000) key (0.000,0.000) exchange (0.000,0.000) r (0.000,0.000) ol (0.000,0.000) lb (0.000,0.000) ac (0.000,0.000) k (0.000,0.000) [52]. (0.000,0.000) Ma (0.000,0.000) vrogiannop (0.000,0.000) oulos (0.000,0.000) et (0.000,0.000) al. (0.000,0.000) sho (0.000,0.000) w (0.000,0.000) ed (0.000,0.000) ho (0.000,0.000) w (0.000,0.000) explicit (0.000,0.000) -curv (0.000,0.000) e (0.000,0.000) ECDHE (0.000,0.000) handshak (0.000,0.000) es (0.000,0.000) could (0.000,0.000) b (0.000,0.000) e (0.000,0.000) con- (0.000,0.000) fused (0.000,0.000) with (0.000,0.000) DHE (0.000,0.000) handshak (0.000,0.000) es (0.000,0.000) [35]. (0.000,0.000) All (0.000,0.000) these (0.000,0.000) attac (0.000,0.000) ks (0.000,0.000) could (0.000,0.000) b (0.000,0.000) e (0.000,0.000) prev (0.000,0.000) en (0.000,0.000) ted (0.000,0.000) b (0.000,0.000) y (0.000,0.000) additionally (0.000,0.000) signing (0.000,0.000) the (0.000,0.000) ciphersuite (0.000,0.000) in (0.000,0.000) the (0.000,0.000) ServerKeyExchange (0.000,0.000) message. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) exp (0.000,0.000) ect (0.000,0.000) that (0.000,0.000) TLS (0.000,0.000) 1.3 (0.000,0.000) will (0.000,0.000) fix (0.000,0.000) this (0.000,0.000) proto (0.000,0.000) col (0.000,0.000) fla (0.000,0.000) w. (0.000,0.000) More (0.000,0.000) generally (0.000,0.000) , (0.000,0.000) Log (0.000,0.000) jam (0.000,0.000) can (0.000,0.000) a (0.000,0.000) l (0.000,0.000) so (0.000,0.000) b (0.000,0.000) e (0.000,0.000) in (0.000,0.000) ter- (0.000,0.000) preted (0.000,0.000) as (0.000,0.000) a (0.000,0.000) bac (0.000,0.000) kw (0.000,0.000) ards (0.000,0.000) compatibilit (0.000,0.000) y (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) [23] (0.000,0.000) where (0.000,0.000) one (0.000,0.000) part (0.000,0.000) y (0.000,0.000) uses (0.000,0.000) only (0.000,0.000) strong (0.000,0.000) cryptograph (0.000,0.000) y (0.000,0.000) but (0.000,0.000) the (0.000,0.000) other (0.000,0.000) supp (0.000,0.000) orts (0.000,0.000) b (0.000,0.000) oth (0.000,0.000) strong (0.000,0.000) and (0.000,0.000) w (0.000,0.000) eak (0.000,0.000) ciphersuites. (0.000,0.000) 4 (0.000,0.000) 3.3 (0.000,0.000) 512-bit (0.000,0.000) Discr (0.000,0.000) ete (0.000,0.000) Log (0.000,0.000) Computations (0.000,0.000) W (0.000,0.000) e (0.000,0.000) mo (0.000,0.000) dified (0.000,0.000) CADO-NFS (0.000,0.000) [1] (0.000,0.000) to (0.000,0.000) implemen (0.000,0.000) t (0.000,0.000) the (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) field (0.000,0.000) siev (0.000,0.000) e (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) algorithm (0.000,0.000) from (0.000,0.000) §2 (0.000,0.000) and (0.000,0.000) applied (0.000,0.000) it (0.000,0.000) to (0.000,0.000) three (0.000,0.000) 512-bit (0.000,0.000) primes, (0.000,0.000) including (0.000,0.000) the (0.000,0.000) top (0.000,0.000) t (0.000,0.000) w (0.000,0.000) o (0.000,0.000) DHE_EXPORT (0.000,0.000) primes (0.000,0.000) sho (0.000,0.000) wn (0.000,0.000) in (0.000,0.000) T (0.000,0.000) able (0.000,0.000) 1. (0.000,0.000) Precomputation (0.000,0.000) to (0.000,0.000) ok (0.000,0.000) 7 (0.000,0.000) da (0.000,0.000) ys (0.000,0.000) for (0.000,0.000) eac (0.000,0.000) h (0.000,0.000) prime, (0.000,0.000) after (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) computing (0.000,0.000) individual (0.000,0.000) logs (0.000,0.000) to (0.000,0.000) ok (0.000,0.000) a (0.000,0.000) median (0.000,0.000) of (0.000,0.000) 70 (0.000,0.000) sec- (0.000,0.000) onds. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) list (0.000,0.000) the (0.000,0.000) run (0.000,0.000) time (0.000,0.000) for (0.000,0.000) eac (0.000,0.000) h (0.000,0.000) stage (0.000,0.000) of (0.000,0.000) the (0.000,0.000) computation (0.000,0.000) b (0.000,0.000) elo (0.000,0.000) w. (0.000,0.000) The (0.000,0.000) times (0.000,0.000) w (0.000,0.000) ere (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) the (0.000,0.000) same (0.000,0.000) for (0.000,0.000) eac (0.000,0.000) h (0.000,0.000) prime. (0.000,0.000) Precomputation (0.000,0.000) As (0.000,0.000) illustrated (0.000,0.000) in (0.000,0.000) Figure (0.000,0.000) 1, (0.000,0.000) the (0.000,0.000) precom- (0.000,0.000) putation (0.000,0.000) phase (0.000,0.000) includes (0.000,0.000) the (0.000,0.000) p (0.000,0.000) olynomial (0.000,0.000) selection, (0.000,0.000) sieving, (0.000,0.000) and (0.000,0.000) linear (0.000,0.000) algebra (0.000,0.000) steps. (0.000,0.000) F (0.000,0.000) or (0.000,0.000) this (0.000,0.000) precomputation, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) delib (0.000,0.000) erately (0.000,0.000) siev (0.000,0.000) ed (0.000,0.000) more (0.000,0.000) t (0.000,0.000) han (0.000,0.000) strictly (0.000,0.000) necessary (0.000,0.000) . (0.000,0.000) This (0.000,0.000) enabled (0.000,0.000) t (0.000,0.000) w (0.000,0.000) o (0.000,0.000) opti- (0.000,0.000) mizations: (0.000,0.000) first, (0.000,0.000) with (0.000,0.000) more (0.000,0.000) relations (0.000,0.000) obtained (0.000,0.000) from (0.000,0.000) sieving, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) ev (0.000,0.000) en (0.000,0.000) tually (0.000,0.000) obtain (0.000,0.000) a (0.000,0.000) larger (0.000,0.000) database (0.000,0.000) of (0.000,0.000) kno (0.000,0.000) wn (0.000,0.000) logs, (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) mak (0.000,0.000) es (0.000,0.000) the (0.000,0.000) descen (0.000,0.000) t (0.000,0.000) faster. (0.000,0.000) Second, (0.000,0.000) more (0.000,0.000) sieving (0.000,0.000) relations (0.000,0.000) also (0.000,0.000) yield (0.000,0.000) a (0.000,0.000) smaller (0.000,0.000) linear (0.000,0.000) algebra (0.000,0.000) step, (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) is (0.000,0.000) desirable (0.000,0.000) b (0.000,0.000) ecause (0.000,0.000) sieving (0.000,0.000) is (0.000,0.000) m (0.000,0.000) uc (0.000,0.000) h (0.000,0.000) easier (0.000,0.000) to (0.000,0.000) parallelize (0.000,0.000) than (0.000,0.000) linear (0.000,0.000) algebra. (0.000,0.000) F (0.000,0.000) or (0.000,0.000) the (0.000,0.000) p (0.000,0.000) olynomial (0.000,0.000) se (0.000,0.000) lection (0.000,0.000) and (0.000,0.000) sieving (0.000,0.000) steps, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) used (0.000,0.000) idle (0.000,0.000) t (0.000,0.000) im (0.000,0.000) e (0.000,0.000) on (0.000,0.000) 2 (0.000,0.000) 000–3000 (0.000,0.000) CPU (0.000,0.000) cores (0.000,0.000) in (0.000,0.000) parallel, (0.000,0.000) of (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) most (0.000,0.000) CPUs (0.000,0.000) w (0.000,0.000) ere (0.000,0.000) In (0.000,0.000) tel (0.000,0.000) Sandy (0.000,0.000) Bridge. (0.000,0.000) P (0.000,0.000) olynomial (0.000,0.000) selection (0.000,0.000) ran (0.000,0.000) for (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) 3 (0.000,0.000) hours, (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) in (0.000,0.000) total (0.000,0.000) corresp (0.000,0.000) onds (0.000,0.000) to (0.000,0.000) 7,600 (0.000,0.000) core- (0.000,0.000) hours. (0.000,0.000) Sieving (0.000,0.000) ran (0.000,0.000) for (0.000,0.000) 15 (0.000,0.000) hours, (0.000,0.000) corresp (0.000,0.000) onding (0.000,0.000) to (0.000,0.000) 21,400 (0.000,0.000) core-hours. (0.000,0.000) This (0.000,0.000) sufficed (0.000,0.000) to (0.000,0.000) collect (0.000,0.000) 40,003 (0.000,0.000) ,519 (0.000,0.000) relations (0.000,0.000) of (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) 28,372,442 (0.000,0.000) w (0.000,0.000) ere (0.000,0.000) unique, (0.000,0.000) in (0.000,0.000) v (0.000,0.000) olving (0.000,0.000) 15,207,865 (0.000,0.000) primes (0.000,0.000) of (0.000,0.000) at (0.000,0.000) most (0.000,0.000) 27 (0.000,0.000) bits (0.000,0.000) (hence (0.000,0.000) b (0.000,0.000) ound (0.000,0.000) B (0.000,0.000) from (0.000,0.000) §2 (0.000,0.000) is (0.000,0.000) 2 (0.000,0.000) 27 (0.000,0.000) ). (0.000,0.000) F (0.000,0.000) rom (0.000,0.000) this (0.000,0.000) data (0.000,0.000) set, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) obtained (0.000,0.000) a (0.000,0.000) square (0.000,0.000) matrix (0.000,0.000) with (0.000,0.000) 2,157,378 (0.000,0.000) ro (0.000,0.000) ws (0.000,0.000) and (0.000,0.000) columns, (0.000,0.000) with (0.000,0.000) 113 (0.000,0.000) nonzero (0.000,0.000) co (0.000,0.000) efficien (0.000,0.000) ts (0.000,0.000) p (0.000,0.000) er (0.000,0.000) ro (0.000,0.000) w (0.000,0.000) on (0.000,0.000) a (0.000,0.000) v (0.000,0.000) erage. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) solv (0.000,0.000) ed (0.000,0.000) the (0.000,0.000) corresp (0.000,0.000) onding (0.000,0.000) linear (0.000,0.000) system (0.000,0.000) on (0.000,0.000) a (0.000,0.000) 36-no (0.000,0.000) de (0.000,0.000) cluster (0.000,0.000) with (0.000,0.000) t (0.000,0.000) w (0.000,0.000) o (0.000,0.000) 8-core (0.000,0.000) In (0.000,0.000) tel (0.000,0.000) Xeon (0.000,0.000) E5-2650 (0.000,0.000) CPUs (0.000,0.000) p (0.000,0.000) er (0.000,0.000) no (0.000,0.000) de, (0.000,0.000) connected (0.000,0.000) with (0.000,0.000) Infiniband (0.000,0.000) FDR. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) used (0.000,0.000) the (0.000,0.000) blo (0.000,0.000) c (0.000,0.000) k (0.000,0.000) Wiedemann (0.000,0.000) algorithm (0.000,0.000) [11, (0.000,0.000) 49] (0.000,0.000) with (0.000,0.000) parameters (0.000,0.000) m (0.000,0.000) = (0.000,0.000) 18 (0.000,0.000) and (0.000,0.000) n (0.000,0.000) = (0.000,0.000) 6 (0.000,0.000) . (0.000,0.000) Using (0.000,0.000) the (0.000,0.000) unoptimized (0.000,0.000) implemen (0.000,0.000) tation (0.000,0.000) from (0.000,0.000) CADO- (0.000,0.000) NFS (0.000,0.000) [1] (0.000,0.000) for (0.000,0.000) linear (0.000,0.000) algebra (0.000,0.000) o (0.000,0.000) v (0.000,0.000) er (0.000,0.000) GF (0.000,0.000) ( (0.000,0.000) p (0.000,0.000) ) (0.000,0.000) , (0.000,0.000) the (0.000,0.000) c (0.000,0.000) om (0.000,0.000) put (0.000,0.000) ation (0.000,0.000) finished (0.000,0.000) in (0.000,0.000) 120 (0.000,0.000) hours, (0.000,0.000) corresp (0.000,0.000) onding (0.000,0.000) to (0.000,0.000) 60,000 (0.000,0.000) core-hours. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) exp (0.000,0.000) ect (0.000,0.000) that (0.000,0.000) optimizations (0.000,0.000) could (0.000,0.000) bring (0.000,0.000) this (0.000,0.000) cost (0.000,0.000) do (0.000,0.000) wn (0.000,0.000) b (0.000,0.000) y (0.000,0.000) at (0.000,0.000) least (0.000,0.000) a (0.000,0.000) factor (0.000,0.000) of (0.000,0.000) three. (0.000,0.000) In (0.000,0.000) total, (0.000,0.000) the (0.000,0.000) w (0.000,0.000) all-clo (0.000,0.000) c (0.000,0.000) k (0.000,0.000) t (0.000,0.000) im (0.000,0.000) e (0.000,0.000) for (0.000,0.000) eac (0.000,0.000) h (0.000,0.000) precomputation (0.000,0.000) w (0.000,0.000) as (0.000,0.000) sligh (0.000,0.000) tly (0.000,0.000) o (0.000,0.000) v (0.000,0.000) er (0.000,0.000) one (0.000,0.000) w (0.000,0.000) eek. (0.000,0.000) E (0.000,0.000) ac (0.000,0.000) h (0.000,0.000) resulting (0.000,0.000) database (0.000,0.000) of (0.000,0.000) kno (0.000,0.000) wn (0.000,0.000) logs (0.000,0.000) for (0.000,0.000) the (0.000,0.000) desce (0.000,0.000) n (0.000,0.000) t (0.000,0.000) o (0.000,0.000) ccupies (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) 2.5 (0.000,0.000) GB (0.000,0.000) in (0.000,0.000) ASCI (0.000,0.000) I (0.000,0.000) format. (0.000,0.000) Descen (0.000,0.000) t (0.000,0.000) Once (0.000,0.000) this (0.000,0.000) precomputation (0.000,0.000) w (0.000,0.000) as (0.000,0.000) finished, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) w (0.000,0.000) ere (0.000,0.000) able (0.000,0.000) to (0.000,0.000) run (0.000,0.000) the (0.000,0.000) final (0.000,0.000) desce (0.000,0.000) n (0.000,0.000) t (0.000,0.000) step (0.000,0.000) to (0.000,0.000) compute (0.000,0.000) individual (0.000,0.000) dis- (0.000,0.000) crete (0.000,0.000) logs (0.000,0.000) in (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) a (0.000,0.000) min (0.000,0.000) ute (0.000,0.000) for (0.000,0.000) targets (0.000,0.000) in (0.000,0.000) eac (0.000,0.000) h (0.000,0.000) of (0.000,0.000) these (0.000,0.000) groups. (0.000,0.000) In (0.000,0.000) order (0.000,0.000) to (0.000,0.000) sa (0.000,0.000) v (0.000,0.000) e (0.000,0.000) time (0.000,0.000) on (0.000,0.000) individual (0.000,0.000) computations, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) imple- (0.000,0.000) men (0.000,0.000) ted (0.000,0.000) a (0.000,0.000) clien (0.000,0.000) t-serv (0.000,0.000) er (0.000,0.000) arc (0.000,0.000) hitecture (0.000,0.000) using (0.000,0.000) the (0.000,0.000) Zero (0.000,0.000) MQ (0.000,0.000) mes- (0.000,0.000) saging (0.000,0.000) library (0.000,0.000) . (0.000,0.000) The (0.000,0.000) serv (0.000,0.000) er (0.000,0.000) main (0.000,0.000) tains (0.000,0.000) the (0.000,0.000) precomputed (0.000,0.000) data (0.000,0.000) in (0.000,0.000) RAM (0.000,0.000) and (0.000,0.000) returns (0.000,0.000) logs (0.000,0.000) for (0.000,0.000) v (0.000,0.000) alues (0.000,0.000) passed (0.000,0.000) t (0.000,0.000) o (0.000,0.000) it (0.000,0.000) b (0.000,0.000) y (0.000,0.000) clien (0.000,0.000) ts. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) implemen (0.000,0.000) ted (0.000,0.000) the (0.000,0.000) descen (0.000,0.000) t (0.000,0.000) calculation (0.000,0.000) in (0.000,0.000) a (0.000,0.000) mix (0.000,0.000) of (0.000,0.000) Python (0.000,0.000) and (0.000,0.000) C. (0.000,0.000) The (0.000,0.000) first (0.000,0.000) and (0.000,0.000) second (0.000,0.000) stages (0.000,0.000) are (0.000,0.000) parallelized (0.000,0.000) and (0.000,0.000) run (0.000,0.000) sieving (0.000,0.000) in (0.000,0.000) C, (0.000,0.000) and (0.000,0.000) the (0.000,0.000) final (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) is (0.000,0.000) deduced (0.000,0.000) in (0.000,0.000) Python. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) ran (0.000,0.000) the (0.000,0.000) serv (0.000,0.000) er (0.000,0.000) on (0.000,0.000) a (0.000,0.000) mac (0.000,0.000) hine (0.000,0.000) wit (0.000,0.000) h (0.000,0.000) t (0.000,0.000) w (0.000,0.000) o (0.000,0.000) 18-c (0.000,0.000) ore (0.000,0.000) In (0.000,0.000) t (0.000,0.000) el (0.000,0.000) Xeon (0.000,0.000) E5-2699 (0.000,0.000) CPUs (0.000,0.000) and (0.000,0.000) 128 (0.000,0.000) GB (0.000,0.000) of (0.000,0.000) RAM. (0.000,0.000) On (0.000,0.000) a (0.000,0.000) v (0.000,0.000) erage, (0.000,0.000) c (0.000,0.000) om (0.000,0.000) put (0.000,0.000) ing (0.000,0.000) individual (0.000,0.000) logs (0.000,0.000) to (0.000,0.000) ok (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) 70 (0.000,0.000) seconds, (0.000,0.000) but (0.000,0.000) the (0.000,0.000) time (0.000,0.000) v (0.000,0.000) aried (0.000,0.000) from (0.000,0.000) 34 (0.000,0.000) to (0.000,0.000) 206 (0.000,0.000) seconds (0.000,0.000) (see (0.000,0.000) Fig. (0.000,0.000) 3). (0.000,0.000) This (0.000,0.000) is (0.000,0.000) divided (0.000,0.000) b (0.000,0.000) et (0.000,0.000) w (0.000,0.000) een (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) 20 (0.000,0.000) seconds (0.000,0.000) for (0.000,0.000) descen (0.000,0.000) t (0.000,0.000) initialization (0.000,0.000) and (0.000,0.000) the (0.000,0.000) remainder (0.000,0.000) on (0.000,0.000) the (0.000,0.000) middle (0.000,0.000) phase. (0.000,0.000) F (0.000,0.000) urther (0.000,0.000) optimizations (0.000,0.000) — (0.000,0.000) suc (0.000,0.000) h (0.000,0.000) as (0.000,0.000) more (0.000,0.000) effectiv (0.000,0.000) e (0.000,0.000) parallelization (0.000,0.000) on (0.000,0.000) the (0.000,0.000) middle (0.000,0.000) phase (0.000,0.000) or (0.000,0.000) additional (0.000,0.000) sieving (0.000,0.000) — (0.000,0.000) should (0.000,0.000) bring (0.000,0.000) the (0.000,0.000) median (0.000,0.000) time (0.000,0.000) w (0.000,0.000) ell (0.000,0.000) b (0.000,0.000) elo (0.000,0.000) w (0.000,0.000) a (0.000,0.000) min (0.000,0.000) ute. (0.000,0.000) F (0.000,0.000) or (0.000,0.000) purp (0.000,0.000) oses (0.000,0.000) of (0.000,0.000) comparison, (0.000,0.000) a (0.000,0.000) single (0.000,0.000) 512-bit (0.000,0.000) RSA (0.000,0.000) factor- (0.000,0.000) ization (0.000,0.000) using (0.000,0.000) the (0.000,0.000) CADO-NFS (0.000,0.000) implemen (0.000,0.000) tation (0.000,0.000) tak (0.000,0.000) es (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) eigh (0.000,0.000) t (0.000,0.000) da (0.000,0.000) ys (0.000,0.000) of (0.000,0.000) w (0.000,0.000) all-clo (0.000,0.000) c (0.000,0.000) k (0.000,0.000) time (0.000,0.000) on (0.000,0.000) the (0.000,0.000) computer (0.000,0.000) used (0.000,0.000) for (0.000,0.000) the (0.000,0.000) descen (0.000,0.000) t, (0.000,0.000) and (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) three (0.000,0.000) hours (0.000,0.000) parallelized (0.000,0.000) across (0.000,0.000) 1,800 (0.000,0.000) co (0.000,0.000) res (0.000,0.000) of (0.000,0.000) Amazon (0.000,0.000) EC2 (0.000,0.000) c4.8xlarge (0.000,0.000) instances. (0.000,0.000) Figure (0.000,0.000) 3: (0.000,0.000) Individual (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) time (0.000,0.000) for (0.000,0.000) 512-bit (0.000,0.000) DH. (0.000,0.000) After (0.000,0.000) a (0.000,0.000) w (0.000,0.000) eek-long (0.000,0.000) precomputation (0.000,0.000) for (0.000,0.000) eac (0.000,0.000) h (0.000,0.000) of (0.000,0.000) the (0.000,0.000) t (0.000,0.000) w (0.000,0.000) o (0.000,0.000) top (0.000,0.000) exp (0.000,0.000) ort-grade (0.000,0.000) primes (0.000,0.000) (see (0.000,0.000) T (0.000,0.000) able (0.000,0.000) 1), (0.000,0.000) w (0.000,0.000) e (0.000,0.000) can (0.000,0.000) quic (0.000,0.000) kly (0.000,0.000) break (0.000,0.000) an (0.000,0.000) y (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) exc (0.000,0.000) hange (0.000,0.000) that (0.000,0.000) uses (0.000,0.000) them. (0.000,0.000) Here (0.000,0.000) w (0.000,0.000) e (0.000,0.000) sho (0.000,0.000) w (0.000,0.000) times (0.000,0.000) for (0.000,0.000) computing (0.000,0.000) 3,500 (0.000,0.000) individual (0.000,0.000) logs; (0.000,0.000) the (0.000,0.000) median (0.000,0.000) is (0.000,0.000) 70 (0.000,0.000) sec (0.000,0.000) onds. (0.000,0.000) 3.4 (0.000,0.000) Acti (0.000,0.000) v (0.000,0.000) e (0.000,0.000) Attack (0.000,0.000) Implementation (0.000,0.000) W (0.000,0.000) e (0.000,0.000) implemen (0.000,0.000) ted (0.000,0.000) a (0.000,0.000) man-in-the-middle (0.000,0.000) ne (0.000,0.000) t (0.000,0.000) w (0.000,0.000) ork (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) that (0.000,0.000) sits (0.000,0.000) b (0.000,0.000) et (0.000,0.000) w (0.000,0.000) een (0.000,0.000) a (0.000,0.000) TLS (0.000,0.000) clien (0.000,0.000) t (0.000,0.000) (w (0.000,0.000) eb (0.000,0.000) bro (0.000,0.000) wser) (0.000,0.000) and (0.000,0.000) an (0.000,0.000) y (0.000,0.000) serv (0.000,0.000) er (0.000,0.000) that (0.000,0.000) supp (0.000,0.000) orts (0.000,0.000) DHE_EXPORT (0.000,0.000) and (0.000,0.000) uses (0.000,0.000) the (0.000,0.000) most (0.000,0.000) common (0.000,0.000) 512- (0.000,0.000) bit (0.000,0.000) Apac (0.000,0.000) he (0.000,0.000) group. (0.000,0.000) Our (0.000,0.000) implemen (0.000,0.000) tation (0.000,0.000) follo (0.000,0.000) ws (0.000,0.000) the (0.000,0.000) message (0.000,0.000) sequence (0.000,0.000) in (0.000,0.000) Figure (0.000,0.000) 2: (0.000,0.000) it (0.000,0.000) do (0.000,0.000) wngrades (0.000,0.000) the (0.000,0.000) connection (0.000,0.000) to (0.000,0.000) w (0.000,0.000) ards (0.000,0.000) the (0.000,0.000) serv (0.000,0.000) er, (0.000,0.000) computes (0.000,0.000) the (0.000,0.000) session (0.000,0.000) k (0.000,0.000) eys, (0.000,0.000) a (0.000,0.000) nd (0.000,0.000) tak (0.000,0.000) es (0.000,0.000) o (0.000,0.000) v (0.000,0.000) er (0.000,0.000) the (0.000,0.000) connection (0.000,0.000) to (0.000,0.000) w (0.000,0.000) ards (0.000,0.000) the (0.000,0.000) clien (0.000,0.000) t (0.000,0.000) b (0.000,0.000) y (0.000,0.000) imp (0.000,0.000) ersonating (0.000,0.000) the (0.000,0.000) serv (0.000,0.000) er. (0.000,0.000) The (0.000,0.000) main (0.000,0.000) c (0.000,0.000) hallenge (0.000,0.000) is (0.000,0.000) t (0.000,0.000) o (0.000,0.000) compute (0.000,0.000) the (0.000,0.000) shared (0.000,0.000) secret (0.000,0.000) g (0.000,0.000) ab (0.000,0.000) b (0.000,0.000) efore (0.000,0.000) the (0.000,0.000) handshak (0.000,0.000) e (0.000,0.000) completes (0.000,0.000) in (0.000,0.000) order (0.000,0.000) to (0.000,0.000) forge (0.000,0.000) a (0.000,0.000) Finished (0.000,0.000) message (0.000,0.000) from (0.000,0.000) the (0.000,0.000) serv (0.000,0.000) er. (0.000,0.000) With (0.000,0.000) our (0.000,0.000) descen (0.000,0.000) t (0.000,0.000) implemen (0.000,0.000) tation, (0.000,0.000) the (0.000,0.000) computation (0.000,0.000) tak (0.000,0.000) es (0.000,0.000) an (0.000,0.000) a (0.000,0.000) v (0.000,0.000) erage (0.000,0.000) of (0.000,0.000) 70 (0.000,0.000) seconds, (0.000,0.000) but (0.000,0.000) there (0.000,0.000) are (0.000,0.000) sev (0.000,0.000) eral (0.000,0.000) w (0.000,0.000) a (0.000,0.000) ys (0.000,0.000) an (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) can (0.000,0.000) w (0.000,0.000) ork (0.000,0.000) around (0.000,0.000) this (0.000,0.000) dela (0.000,0.000) y: (0.000,0.000) Non-bro (0.000,0.000) wser (0.000,0.000) clien (0.000,0.000) ts. (0.000,0.000) Differen (0.000,0.000) t (0.000,0.000) TLS (0.000,0.000) clien (0.000,0.000) ts (0.000,0.000) imp (0.000,0.000) ose (0.000,0.000) differen (0.000,0.000) t (0.000,0.000) time (0.000,0.000) limits (0.000,0.000) for (0.000,0.000) the (0.000,0.000) handshak (0.000,0.000) e, (0.000,0.000) after (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) the (0.000,0.000) y (0.000,0.000) kill (0.000,0.000) the (0.000,0.000) connection. (0.000,0.000) Command-line (0.000,0.000) clien (0.000,0.000) ts (0.000,0.000) suc (0.000,0.000) h (0.000,0.000) as (0.000,0.000) curl (0.000,0.000) and (0.000,0.000) git (0.000,0.000) often (0.000,0.000) run (0.000,0.000) unattended, (0.000,0.000) so (0.000,0.000) they (0.000,0.000) ha (0.000,0.000) v (0.000,0.000) e (0.000,0.000) long (0.000,0.000) or (0.000,0.000) no (0.000,0.000) timeouts, (0.000,0.000) and (0.000,0.000) w (0.000,0.000) e (0.000,0.000) can (0.000,0.000) hijac (0.000,0.000) k (0.000,0.000) their (0.000,0.000) connections (0.000,0.000) without (0.000,0.000) difficult (0.000,0.000) y (0.000,0.000) . (0.000,0.000) TLS (0.000,0.000) w (0.000,0.000) arning (0.000,0.000) alerts. (0.000,0.000) W (0.000,0.000) eb (0.000,0.000) bro (0.000,0.000) wsers (0.000,0.000) tend (0.000,0.000) to (0.000,0.000) ha (0.000,0.000) v (0.000,0.000) e (0.000,0.000) shorter (0.000,0.000) timeouts, (0.000,0.000) but (0.000,0.000) w (0.000,0.000) e (0.000,0.000) can (0.000,0.000) k (0.000,0.000) eep (0.000,0.000) their (0.000,0.000) connections (0.000,0.000) a (0.000,0.000) liv (0.000,0.000) e (0.000,0.000) b (0.000,0.000) y (0.000,0.000) sending (0.000,0.000) TLS (0.000,0.000) w (0.000,0.000) arning (0.000,0.000) alerts, (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) are (0.000,0.000) ignored (0.000,0.000) b (0.000,0.000) y (0.000,0.000) the (0.000,0.000) bro (0.000,0.000) wser (0.000,0.000) but (0.000,0.000) reset (0.000,0.000) the (0.000,0.000) handshak (0.000,0.000) e (0.000,0.000) timer. (0.000,0.000) F (0.000,0.000) or (0.000,0.000) e (0.000,0.000) x (0.000,0.000) ample, (0.000,0.000) this (0.000,0.000) allo (0.000,0.000) ws (0.000,0.000) us (0.000,0.000) to (0.000,0.000) k (0.000,0.000) eep (0.000,0.000) Firefo (0.000,0.000) x’s (0.000,0.000) TLS (0.000,0.000) connections (0.000,0.000) aliv (0.000,0.000) e (0.000,0.000) indefinitely (0.000,0.000) . (0.000,0.000) (Other (0.000,0.000) bro (0.000,0.000) wsers (0.000,0.000) w (0.000,0.000) e (0.000,0.000) tested (0.000,0.000) close (0.000,0.000) the (0.000,0.000) connection (0.000,0.000) af (0.000,0.000) t (0.000,0.000) er (0.000,0.000) a (0.000,0.000) min (0.000,0.000) ute.) (0.000,0.000) Alt (0.000,0.000) hough (0.000,0.000) the (0.000,0.000) victim (0.000,0.000) co (0.000,0.000) nnection (0.000,0.000) still (0.000,0.000) tak (0.000,0.000) es (0.000,0.000) m (0.000,0.000) uc (0.000,0.000) h (0.000,0.000) longe (0.000,0.000) r (0.000,0.000) than (0.000,0.000) usual, (0.000,0.000) the (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) migh (0.000,0.000) t (0.000,0.000) c (0.000,0.000) ho (0.000,0.000) ose (0.000,0.000) to (0.000,0.000) compromise (0.000,0.000) a (0.000,0.000) request (0.000,0.000) for (0.000,0.000) a (0.000,0.000) bac (0.000,0.000) kground (0.000,0.000) resource (0.000,0.000) that (0.000,0.000) do (0.000,0.000) es (0.000,0.000) not (0.000,0.000) dela (0.000,0.000) y (0.000,0.000) re (0.000,0.000) ndering (0.000,0.000) the (0.000,0.000) page. (0.000,0.000) Ephemeral (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) cac (0.000,0.000) hing. (0.000,0.000) Man (0.000,0.000) y (0.000,0.000) TLS (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) do (0.000,0.000) not (0.000,0.000) use (0.000,0.000) a (0.000,0.000) fresh (0.000,0.000) v (0.000,0.000) alue (0.000,0.000) b (0.000,0.000) for (0.000,0.000) eac (0.000,0.000) h (0.000,0.000) conne (0.000,0.000) ction, (0.000,0.000) but (0.000,0.000) instead (0.000,0.000) compute (0.000,0.000) g (0.000,0.000) b (0.000,0.000) once (0.000,0.000) and (0.000,0.000) reuse (0.000,0.000) it (0.000,0.000) for (0.000,0.000) m (0.000,0.000) ultiple (0.000,0.000) negotiations. (0.000,0.000) Without (0.000,0.000) enabling (0.000,0.000) the (0.000,0.000) SSL_OP_SINGLE_DH_USE (0.000,0.000) option, (0.000,0.000) Op (0.000,0.000) enSSL (0.000,0.000) will (0.000,0.000) reuse (0.000,0.000) g (0.000,0.000) b (0.000,0.000) for (0.000,0.000) the (0.000,0.000) lifetime (0.000,0.000) of (0.000,0.000) a (0.000,0.000) TLS (0.000,0.000) con (0.000,0.000) text. (0.000,0.000) While (0.000,0.000) b (0.000,0.000) oth (0.000,0.000) Apac (0.000,0.000) he (0.000,0.000) and (0.000,0.000) Nginx (0.000,0.000) in (0.000,0.000) ternally (0.000,0.000) apply (0.000,0.000) this (0.000,0.000) option, (0.000,0.000) certain (0.000,0.000) lo (0.000,0.000) ad (0.000,0.000) balancers, (0.000,0.000) suc (0.000,0.000) h (0.000,0.000) as (0.000,0.000) stud (0.000,0.000) [48], (0.000,0.000) do (0.000,0.000) not. (0.000,0.000) The (0.000,0.000) F5 (0.000,0.000) BIG-IP (0.000,0.000) load (0.000,0.000) balancers (0.000,0.000) and (0.000,0.000) hardw (0.000,0.000) are (0.000,0.000) TLS (0.000,0.000) fron (0.000,0.000) tends (0.000,0.000) will (0.000,0.000) reuse (0.000,0.000) g (0.000,0.000) b (0.000,0.000) unless (0.000,0.000) the (0.000,0.000) “Single (0.000,0.000) DH” (0.000,0.000) option (0.000,0.000) is (0.000,0.000) c (0.000,0.000) hec (0.000,0.000) k (0.000,0.000) ed (0.000,0.000) [53]. (0.000,0.000) Microsoft (0.000,0.000) Sc (0.000,0.000) hannel (0.000,0.000) cac (0.000,0.000) h (0.000,0.000) e (0.000,0.000) s (0.000,0.000) g (0.000,0.000) b (0.000,0.000) for (0.000,0.000) t (0.000,0.000) w (0.000,0.000) o (0.000,0.000) hours (0.000,0.000) — (0.000,0.000) this (0.000,0.000) setting (0.000,0.000) is (0.000,0.000) hard-co (0.000,0.000) ded. (0.000,0.000) F (0.000,0.000) or (0.000,0.000) these (0.000,0.000) serv (0.000,0.000) ers, (0.000,0.000) an (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) can (0.000,0.000) compute (0.000,0.000) the (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) of (0.000,0.000) g (0.000,0.000) b (0.000,0.000) from (0.000,0.000) one (0.000,0.000) connec- (0.000,0.000) tion (0.000,0.000) and (0.000,0.000) use (0.000,0.000) it (0.000,0.000) to (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) late (0.000,0.000) r (0.000,0.000) handshak (0.000,0.000) e (0.000,0.000) s, (0.000,0.000) a (0.000,0.000) v (0.000,0.000) oiding (0.000,0.000) the (0.000,0.000) need (0.000,0.000) to (0.000,0.000) do (0.000,0.000) the (0.000,0.000) computation (0.000,0.000) online. (0.000,0.000) By (0.000,0.000) randomly (0.000,0.000) sampling (0.000,0.000) IPv4 (0.000,0.000) hosts (0.000,0.000) serving (0.000,0.000) bro (0.000,0.000) wser-trusted (0.000,0.000) certificates (0.000,0.000) that (0.000,0.000) supp (0.000,0.000) ort (0.000,0.000) DHE (0.000,0.000) , (0.000,0.000) w (0.000,0.000) e (0.000,0.000) found (0.000,0.000) that (0.000,0.000) 17% (0.000,0.000) reused (0.000,0.000) g (0.000,0.000) b (0.000,0.000) at (0.000,0.000) least (0.000,0.000) once (0.000,0.000) o (0.000,0.000) v (0.000,0.000) er (0.000,0.000) the (0.000,0.000) course (0.000,0.000) of (0.000,0.000) 20 (0.000,0.000) handshak (0.000,0.000) e (0.000,0.000) s (0.000,0.000) , (0.000,0.000) and (0.000,0.000) that (0.000,0.000) 15% (0.000,0.000) only (0.000,0.000) used (0.000,0.000) one (0.000,0.000) v (0.000,0.000) alue. (0.000,0.000) Ho (0.000,0.000) w- (0.000,0.000) ev (0.000,0.000) er, (0.000,0.000) for (0.000,0.000) DHE_EXPORT (0.000,0.000) , (0.000,0.000) only (0.000,0.000) 0.1% (0.000,0.000) reuse (0.000,0.000) d (0.000,0.000) g (0.000,0.000) b (0.000,0.000) , (0.000,0.000) lik (0.000,0.000) ely (0.000,0.000) b (0.000,0.000) ecause (0.000,0.000) Microsoft (0.000,0.000) I (0.000,0.000) IS (0.000,0.000) do (0.000,0.000) es (0.000,0.000) not (0.000,0.000) supp (0.000,0.000) ort (0.000,0.000) 512-bit (0.000,0.000) exp (0.000,0.000) ort (0.000,0.000) ciphersuites. (0.000,0.000) 5 (0.000,0.000) TLS (0.000,0.000) F (0.000,0.000) alse (0.000,0.000) Start. (0.000,0.000) Ev (0.000,0.000) en (0.000,0.000) when (0.000,0.000) clien (0.000,0.000) ts (0.000,0.000) enforce (0.000,0.000) shorter (0.000,0.000) time- (0.000,0.000) outs (0.000,0.000) and (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) do (0.000,0.000) n (0.000,0.000) ot (0.000,0.000) reuse (0.000,0.000) v (0.000,0.000) alues (0.000,0.000) for (0.000,0.000) b (0.000,0.000) , (0.000,0.000) the (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) can (0.000,0.000) still (0.000,0.000) break (0.000,0.000) the (0.000,0.000) confiden (0.000,0.000) tialit (0.000,0.000) y (0.000,0.000) of (0.000,0.000) user (0.000,0.000) requests (0.000,0.000) if (0.000,0.000) the (0.000,0.000) clien (0.000,0.000) t (0.000,0.000) supp (0.000,0.000) orts (0.000,0.000) the (0.000,0.000) TLS (0.000,0.000) F (0.000,0.000) alse (0.000,0.000) Start (0.000,0.000) extension (0.000,0.000) [30]. (0.000,0.000) This (0.000,0.000) extension (0.000,0.000) reduces (0.000,0.000) connection (0.000,0.000) latency (0.000,0.000) b (0.000,0.000) y (0.000,0.000) ha (0.000,0.000) ving (0.000,0.000) the (0.000,0.000) clien (0.000,0.000) t (0.000,0.000) send (0.000,0.000) early (0.000,0.000) application (0.000,0.000) data (0.000,0.000) (suc (0.000,0.000) h (0.000,0.000) as (0.000,0.000) an (0.000,0.000) HTTP (0.000,0.000) request) (0.000,0.000) without (0.000,0.000) w (0.000,0.000) aiting (0.000,0.000) for (0.000,0.000) the (0.000,0.000) serv (0.000,0.000) er’s (0.000,0.000) Finished (0.000,0.000) message (0.000,0.000) to (0.000,0.000) arriv (0.000,0.000) e. (0.000,0.000) R (0.000,0.000) e (0.000,0.000) cen (0.000,0.000) t (0.000,0.000) v (0.000,0.000) ersions (0.000,0.000) of (0.000,0.000) Chrome, (0.000,0.000) In (0.000,0.000) ternet (0.000,0.000) Explorer, (0.000,0.000) and (0.000,0.000) F (0.000,0.000) ire (0.000,0.000) f (0.000,0.000) o (0.000,0.000) x (0.000,0.000) implemen (0.000,0.000) t (0.000,0.000) F (0.000,0.000) alse (0.000,0.000) Start, (0.000,0.000) but (0.000,0.000) their (0.000,0.000) p (0.000,0.000) olicies (0.000,0.000) on (0.000,0.000) when (0.000,0.000) to (0.000,0.000) enable (0.000,0.000) it (0.000,0.000) v (0.000,0.000) ary (0.000,0.000) b (0.000,0.000) et (0.000,0.000) w (0.000,0.000) e (0.000,0.000) en (0.000,0.000) v (0.000,0.000) ersions. (0.000,0.000) Firefo (0.000,0.000) x (0.000,0.000) 35, (0.000,0.000) Chrome (0.000,0.000) 41, (0.000,0.000) and (0.000,0.000) In (0.000,0.000) ternet (0.000,0.000) Explorer (0.000,0.000) (Win- (0.000,0.000) do (0.000,0.000) ws (0.000,0.000) 10) (0.000,0.000) send (0.000,0.000) F (0.000,0.000) alse (0.000,0.000) Start (0.000,0.000) data (0.000,0.000) with (0.000,0.000) DHE (0.000,0.000) . (0.000,0.000) In (0.000,0.000) t (0.000,0.000) hese (0.000,0.000) cases, (0.000,0.000) a (0.000,0.000) man-in-the-middle (0.000,0.000) can (0.000,0.000) record (0.000,0.000) the (0.000,0.000) handshak (0.000,0.000) e (0.000,0.000) and (0.000,0.000) decrypt (0.000,0.000) the (0.000,0.000) F (0.000,0.000) alse (0.000,0.000) Start (0.000,0.000) pa (0.000,0.000) yload (0.000,0.000) at (0.000,0.000) le (0.000,0.000) isure. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) note (0.000,0.000) that (0.000,0.000) this (0.000,0.000) initial (0.000,0.000) data (0.000,0.000) sen (0.000,0.000) t (0.000,0.000) b (0.000,0.000) y (0.000,0.000) a (0.000,0.000) bro (0.000,0.000) wser (0.000,0.000) ofte (0.000,0.000) n (0.000,0.000) c (0.000,0.000) on (0.000,0.000) tains (0.000,0.000) sensitiv (0.000,0.000) e (0.000,0.000) user (0.000,0.000) authen (0.000,0.000) tication (0.000,0.000) information, (0.000,0.000) suc (0.000,0.000) h (0.000,0.000) as (0.000,0.000) passw (0.000,0.000) ords (0.000,0.000) and (0.000,0.000) co (0.000,0.000) okies. (0.000,0.000) 3.5 (0.000,0.000) Other (0.000,0.000) W (0.000,0.000) eak (0.000,0.000) and (0.000,0.000) Misconfigur (0.000,0.000) ed (0.000,0.000) Gr (0.000,0.000) oups (0.000,0.000) In (0.000,0.000) our (0.000,0.000) scans, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) found (0.000,0.000) sev (0.000,0.000) era (0.000,0.000) l (0.000,0.000) other (0.000,0.000) exploitable (0.000,0.000) securit (0.000,0.000) y (0.000,0.000) issues (0.000,0.000) in (0.000,0.000) the (0.000,0.000) DHE (0.000,0.000) configurations (0.000,0.000) used (0.000,0.000) b (0.000,0.000) y (0.000,0.000) TLS (0.000,0.000) serv (0.000,0.000) ers. (0.000,0.000) 512-bit (0.000,0.000) p (0.000,0.000) r (0.000,0.000) imes (0.000,0.000) in (0.000,0.000) non-exp (0.000,0.000) ort (0.000,0.000) DHE (0.000,0.000) W (0.000,0.000) e (0.000,0.000) found (0.000,0.000) 2,63 (0.000,0.000) 1 (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) with (0.000,0.000) bro (0.000,0.000) wser-truste (0.000,0.000) d (0.000,0.000) certificates (0.000,0.000) (and (0.000,0.000) 118 (0.000,0.000) in (0.000,0.000) the (0.000,0.000) T (0.000,0.000) op (0.000,0.000) 1M (0.000,0.000) domains) (0.000,0.000) that (0.000,0.000) used (0.000,0.000) 512-bit (0.000,0.000) or (0.000,0.000) w (0.000,0.000) eak (0.000,0.000) er (0.000,0.000) primes (0.000,0.000) f (0.000,0.000) or (0.000,0.000) non-exp (0.000,0.000) ort (0.000,0.000) DHE (0.000,0.000) . (0.000,0.000) In (0.000,0.000) these (0.000,0.000) instances, (0.000,0.000) activ (0.000,0.000) e (0.000,0.000) attac (0.000,0.000) ks (0.000,0.000) ma (0.000,0.000) y (0.000,0.000) b (0.000,0.000) e (0.000,0.000) unnecessary (0.000,0.000) . (0.000,0.000) If (0.000,0.000) a (0.000,0.000) bro (0.000,0.000) w (0.000,0.000) ser (0.000,0.000) negotiates (0.000,0.000) a (0.000,0.000) DHE (0.000,0.000) ciphersuite (0.000,0.000) with (0.000,0.000) one (0.000,0.000) of (0.000,0.000) these (0.000,0.000) serv (0.000,0.000) ers, (0.000,0.000) a (0.000,0.000) p (0.000,0.000) assive (0.000,0.000) ea (0.000,0.000) v (0.000,0.000) esdropp (0.000,0.000) er (0.000,0.000) can (0.000,0.000) later (0.000,0.000) compute (0.000,0.000) the (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) and (0.000,0.000) obt (0.000,0.000) ain (0.000,0.000) the (0.000,0.000) TLS (0.000,0.000) session (0.000,0.000) k (0.000,0.000) eys (0.000,0.000) for (0.000,0.000) the (0.000,0.000) connection. (0.000,0.000) An (0.000,0.000) activ (0.000,0.000) e (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) ma (0.000,0.000) y (0.000,0.000) still (0.000,0.000) b (0.000,0.000) e (0.000,0.000) necessary (0.000,0.000) when (0.000,0.000) the (0.000,0.000) clien (0.000,0.000) t’s (0.000,0.000) ordering (0.000,0.000) of (0.000,0.000) ciphersuites (0.000,0.000) w (0.000,0.000) ould (0.000,0.000) result (0.000,0.000) in (0.000,0.000) the (0.000,0.000) serv (0.000,0.000) er (0.000,0.000) not (0.000,0.000) selecting (0.000,0.000) DHE (0.000,0.000) . (0.000,0.000) In (0.000,0.000) this (0.000,0.000) case, (0.000,0.000) as (0.000,0.000) in (0.000,0.000) the (0.000,0.000) DHE_EXPORT (0.000,0.000) do (0.000,0.000) wngrade (0.000,0.000) attac (0.000,0.000) k, (0.000,0.000) an (0.000,0.000) activ (0.000,0.000) e (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) can (0.000,0.000) force (0.000,0.000) the (0.000,0.000) serv (0.000,0.000) er (0.000,0.000) to (0.000,0.000) c (0.000,0.000) ho (0.000,0.000) ose (0.000,0.000) a (0.000,0.000) vulnerable (0.000,0.000) DHE (0.000,0.000) ciphersuite. (0.000,0.000) As (0.000,0.000) a (0.000,0.000) pro (0.000,0.000) of-of-concept, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) implemen (0.000,0.000) ted (0.000,0.000) a (0.000,0.000) passiv (0.000,0.000) e (0.000,0.000) ea (0.000,0.000) v (0.000,0.000) es- (0.000,0.000) dropp (0.000,0.000) er (0.000,0.000) for (0.000,0.000) regular (0.000,0.000) DHE (0.000,0.000) connections (0.000,0.000) and (0.000,0.000) used (0.000,0.000) it (0.000,0.000) to (0.000,0.000) decrypt (0.000,0.000) test (0.000,0.000) connections (0.000,0.000) to (0.000,0.000) www.fbi.go (0.000,0.000) v (0.000,0.000) . (0.000,0.000) Un (0.000,0.000) til (0.000,0.000) April (0.000,0.000) 2015, (0.000,0.000) this (0.000,0.000) serv (0.000,0.000) er (0.000,0.000) used (0.000,0.000) the (0.000,0.000) default (0.000,0.000) 512-bit (0.000,0.000) DH (0.000,0.000) group (0.000,0.000) from (0.000,0.000) Op (0.000,0.000) enSSL, (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) w (0.000,0.000) as (0.000,0.000) the (0.000,0.000) third (0.000,0.000) group (0.000,0.000) for (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) w (0.000,0.000) e (0.000,0.000) p (0.000,0.000) erformed (0.000,0.000) the (0.000,0.000) NFS (0.000,0.000) pre- (0.000,0.000) computation. (0.000,0.000) The (0.000,0.000) w (0.000,0.000) ebsite (0.000,0.000) no (0.000,0.000) longer (0.000,0.000) supp (0.000,0.000) orts (0.000,0.000) DHE (0.000,0.000) . (0.000,0.000) A (0.000,0.000) ttac (0.000,0.000) ks (0.000,0.000) on (0.000,0.000) comp (0.000,0.000) osite-order (0.000,0.000) s (0.000,0.000) u (0.000,0.000) bgroups (0.000,0.000) F (0.000,0.000) ailure (0.000,0.000) t (0.000,0.000) o (0.000,0.000) generate (0.000,0.000) Diffie-Hellman (0.000,0.000) primes (0.000,0.000) according (0.000,0.000) to (0.000,0.000) b (0.000,0.000) est (0.000,0.000) practices (0.000,0.000) can (0.000,0.000) result (0.000,0.000) in (0.000,0.000) dev (0.000,0.000) astating (0.000,0.000) attac (0.000,0.000) ks. (0.000,0.000) Not (0.000,0.000) e (0.000,0.000) v (0.000,0.000) e (0.000,0.000) ry (0.000,0.000) TLS (0.000,0.000) serv (0.000,0.000) er (0.000,0.000) uses (0.000,0.000) “safe” (0.000,0.000) primes. (0.000,0.000) Out (0.000,0.000) of (0.000,0.000) appro (0.000,0.000) xim (0.000,0.000) at (0.000,0.000) ely (0.000,0.000) 70,000 (0.000,0.000) distinct (0.000,0.000) primes (0.000,0.000) seen (0.000,0.000) across (0.000,0.000) b (0.000,0.000) oth (0.000,0.000) exp (0.000,0.000) ort (0.000,0.000) and (0.000,0.000) non-exp (0.000,0.000) ort (0.000,0.000) TL (0.000,0.000) S (0.000,0.000) scans, (0.000,0.000) 4,800 (0.000,0.000) w (0.000,0.000) ere (0.000,0.000) not (0.000,0.000) safe, (0.000,0.000) meaning (0.000,0.000) that (0.000,0.000) ( (0.000,0.000) p (0.000,0.000) − (0.000,0.000) 1) (0.000,0.000) / (0.000,0.000) 2 (0.000,0.000) w (0.000,0.000) as (0.000,0.000) comp (0.000,0.000) osite. (0.000,0.000) (Inciden (0.000,0.000) tally (0.000,0.000) , (0.000,0.000) w (0.000,0.000) e (0.000,0.000) also (0.000,0.000) found (0.000,0.000) 9 (0.000,0.000) comp (0.000,0.000) osite (0.000,0.000) p (0.000,0.000) .) (0.000,0.000) These (0.000,0.000) groups (0.000,0.000) are (0.000,0.000) not (0.000,0.000) nece (0.000,0.000) s (0.000,0.000) sa (0.000,0.000) rily (0.000,0.000) vulnerable, (0.000,0.000) as (0.000,0.000) long (0.000,0.000) as (0.000,0.000) g (0.000,0.000) generates (0.000,0.000) a (0.000,0.000) g (0.000,0.000) roup (0.000,0.000) with (0.000,0.000) at (0.000,0.000) least (0.000,0.000) one (0.000,0.000) sufficien (0.000,0.000) tly (0.000,0.000) large (0.000,0.000) subgroup (0.000,0.000) order (0.000,0.000) to (0.000,0.000) rule (0.000,0.000) out (0.000,0.000) the (0.000,0.000) P (0.000,0.000) ohlig-Hellman (0.000,0.000) a (0.000,0.000) lgorithm (0.000,0.000) as (0.000,0.000) an (0.000,0.000) attac (0.000,0.000) k. (0.000,0.000) In (0.000,0.000) some (0.000,0.000) real-life (0.000,0.000) configurations, (0.000,0.000) ho (0.000,0.000) w (0.000,0.000) ev (0.000,0.000) er, (0.000,0.000) c (0.000,0.000) ho (0.000,0.000) osing (0.000,0.000) suc (0.000,0.000) h (0.000,0.000) primes (0.000,0.000) can (0.000,0.000) le (0.000,0.000) ad (0.000,0.000) to (0.000,0.000) an (0.000,0.000) attac (0.000,0.000) k. (0.000,0.000) F (0.000,0.000) or (0.000,0.000) efficiency (0.000,0.000) reasons, (0.000,0.000) some (0.000,0.000) implemen (0.000,0.000) tations (0.000,0.000) use (0.000,0.000) ephemeral (0.000,0.000) k (0.000,0.000) eys (0.000,0.000) g (0.000,0.000) x (0.000,0.000) with (0.000,0.000) a (0.000,0.000) short (0.000,0.000) exp (0.000,0.000) onen (0.000,0.000) t (0.000,0.000) x (0.000,0.000) ; (0.000,0.000) commonly (0.000,0.000) suggested (0.000,0.000) sizes (0.000,0.000) for (0.000,0.000) x (0.000,0.000) are (0.000,0.000) as (0.000,0.000) small (0.000,0.000) as (0.000,0.000) 160 (0.000,0.000) or (0.000,0.000) 224 (0.000,0.000) bits, (0.000,0.000) in (0.000,0.000) tended (0.000,0.000) to (0.000,0.000) matc (0.000,0.000) h (0.000,0.000) the (0.000,0.000) estimated (0.000,0.000) strength (0.000,0.000) of (0.000,0.000) a (0.000,0.000) 1024- (0.000,0.000) or (0.000,0.000) 2048-bit (0.000,0.000) group. (0.000,0.000) F (0.000,0.000) or (0.000,0.000) safe (0.000,0.000) p (0.000,0.000) , (0.000,0.000) suc (0.000,0.000) h (0.000,0.000) exp (0.000,0.000) onen (0.000,0.000) t (0.000,0.000) lengths (0.000,0.000) are (0.000,0.000) not (0.000,0.000) kno (0.000,0.000) wn (0.000,0.000) to (0.000,0.000) decrease (0.000,0.000) se (0.000,0.000) curit (0.000,0.000) y (0.000,0.000) , (0.000,0.000) as (0.000,0.000) the (0.000,0.000) most (0.000,0.000) efficien (0.000,0.000) t (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) will (0.000,0.000) b (0.000,0.000) e (0.000,0.000) the (0.000,0.000) P (0.000,0.000) ollard (0.000,0.000) lam (0.000,0.000) b (0.000,0.000) da (0.000,0.000) algorithm. (0.000,0.000) But (0.000,0.000) if (0.000,0.000) the (0.000,0.000) order (0.000,0.000) of (0.000,0.000) the (0.000,0.000) subgroup (0.000,0.000) generated (0.000,0.000) b (0.000,0.000) y (0.000,0.000) g (0.000,0.000) has (0.000,0.000) small (0.000,0.000) factors, (0.000,0.000) they (0.000,0.000) can (0.000,0.000) b (0.000,0.000) e (0.000,0.000) used (0.000,0.000) to (0.000,0.000) re (0.000,0.000) co (0.000,0.000) v (0.000,0.000) e (0.000,0.000) r (0.000,0.000) information (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) exp (0.000,0.000) onen (0.000,0.000) ts. (0.000,0.000) F (0.000,0.000) rom (0.000,0.000) a (0.000,0.000) subset (0.000,0.000) of (0.000,0.000) factors (0.000,0.000) { (0.000,0.000) q (0.000,0.000) e (0.000,0.000) 1 (0.000,0.000) 1 (0.000,0.000) . (0.000,0.000) . (0.000,0.000) . (0.000,0.000) q (0.000,0.000) e (0.000,0.000) k (0.000,0.000) k (0.000,0.000) } (0.000,0.000) with (0.000,0.000) (0.000,0.000) i (0.000,0.000) q (0.000,0.000) e (0.000,0.000) i (0.000,0.000) i (0.000,0.000) = (0.000,0.000) z (0.000,0.000) , (0.000,0.000) P (0.000,0.000) ohlig-Hellman (0.000,0.000) can (0.000,0.000) reco (0.000,0.000) v (0.000,0.000) er (0.000,0.000) x (0.000,0.000) mo (0.000,0.000) d (0.000,0.000) z (0.000,0.000) in (0.000,0.000) time (0.000,0.000) (0.000,0.000) i (0.000,0.000) e (0.000,0.000) i (0.000,0.000) √ (0.000,7.279) q (0.000,7.279) i (0.000,7.279) . (0.000,7.279) If (0.000,7.279) x (0.000,7.279) ≤ (0.000,7.279) z (0.000,7.279) , (0.000,7.279) this (0.000,7.279) suffices (0.000,7.279) to (0.000,7.279) reco (0.000,7.279) v (0.000,7.279) er (0.000,7.279) x (0.000,7.279) . (0.000,7.279) If (0.000,7.279) not, (0.000,7.279) P (0.000,7.279) ollard (0.000,7.279) lam (0.000,7.279) b (0.000,7.279) da (0.000,7.279) can (0.000,7.279) use (0.000,7.279) this (0.000,7.279) information (0.000,7.279) to (0.000,7.279) reco (0.000,7.279) v (0.000,7.279) er (0.000,7.279) x (0.000,7.279) in (0.000,7.279) time (0.000,7.279) (0.000,14.505) x/z (0.000,14.505) . (0.000,14.505) This (0.000,14.505) attac (0.000,14.505) k (0.000,14.505) w (0.000,14.505) as (0.000,14.505) first (0.000,14.505) describ (0.000,14.505) ed (0.000,14.505) as (0.000,14.505) h (0.000,14.505) yp (0.000,14.505) othetical (0.000,14.505) b (0.000,14.505) y (0.000,14.505) v (0.000,14.505) an (0.000,14.505) Oorsc (0.000,14.505) hot (0.000,14.505) and (0.000,14.505) Wiener (0.000,14.505) [51]. (0.000,14.505) T (0.000,14.505) o (0.000,14.505) see (0.000,14.505) if (0.000,14.505) TLS (0.000,14.505) serv (0.000,14.505) ers (0.000,14.505) in (0.000,14.505) the (0.000,14.505) wild (0.000,14.505) w (0.000,14.505) ere (0.000,14.505) vulnerable (0.000,14.505) to (0.000,14.505) this (0.000,14.505) attac (0.000,14.505) k, (0.000,14.505) w (0.000,14.505) e (0.000,14.505) tested (0.000,14.505) v (0.000,14.505) arious (0.000,14.505) non-safe (0.000,14.505) prim (0.000,14.505) e (0.000,14.505) s (0.000,14.505) found (0.000,14.505) in (0.000,14.505) our (0.000,14.505) scans. (0.000,14.505) F (0.000,14.505) or (0.000,14.505) eac (0.000,14.505) h (0.000,14.505) non-safe (0.000,14.505) prime (0.000,14.505) p (0.000,14.505) , (0.000,14.505) w (0.000,14.505) e (0.000,14.505) opp (0.000,14.505) ortunistically (0.000,14.505) factored (0.000,14.505) p (0.000,14.505) − (0.000,14.505) 1 (0.000,14.505) using (0.000,14.505) Bernstein’s (0.000,14.505) batc (0.000,14.505) h (0.000,14.505) metho (0.000,14.505) d (0.000,14.505) [5]. (0.000,14.505) W (0.000,14.505) e (0.000,14.505) then (0.000,14.505) ran (0.000,14.505) the (0.000,14.505) GMP-ECM (0.000,14.505) implemen (0.000,14.505) t (0.000,14.505) ations (0.000,14.505) of (0.000,14.505) the (0.000,14.505) P (0.000,14.505) ollard (0.000,14.505) p (0.000,14.505) − (0.000,14.505) 1 (0.000,14.505) algorithm (0.000,14.505) and (0.000,14.505) t (0.000,14.505) he (0.000,14.505) ECM (0.000,14.505) fact (0.000,14.505) oring (0.000,14.505) metho (0.000,14.505) ds (0.000,14.505) [54] (0.000,14.505) for (0.000,14.505) 5 (0.000,14.505) da (0.000,14.505) ys (0.000,14.505) parallelized (0.000,14.505) across (0.000,14.505) 28 (0.000,14.505) cores (0.000,14.505) and (0.000,14.505) disco (0.000,14.505) v (0.000,14.505) ered (0.000,14.505) 36,447 (0.000,14.505) prime (0.000,14.505) factors. (0.000,14.505) W (0.000,14.505) e (0.000,14.505) then (0.000,14.505) examined (0.000,14.505) the (0.000,14.505) generators (0.000,14.505) g (0.000,14.505) used (0.000,14.505) with (0.000,14.505) eac (0.000,14.505) h (0.000,14.505) prime (0.000,14.505) p (0.000,14.505) . (0.000,14.505) W (0.000,14.505) e (0.000,14.505) classified (0.000,14.505) a (0.000,14.505) tuple (0.000,14.505) ( (0.000,14.505) p, (0.000,14.505) g (0.000,14.505) , (0.000,14.505) y (0.000,14.505) ) (0.000,14.505) sen (0.000,14.505) t (0.000,14.505) b (0.000,14.505) y (0.000,14.505) a (0.000,14.505) serv (0.000,14.505) er (0.000,14.505) as (0.000,14.505) in (0.000,14.505) teresting (0.000,14.505) if (0.000,14.505) the (0.000,14.505) prime (0.000,14.505) factorization (0.000,14.505) of (0.000,14.505) p (0.000,14.505) − (0.000,14.505) 1 (0.000,14.505) had (0.000,14.505) rev (0.000,14.505) ealed (0.000,14.505) prime (0.000,14.505) factors (0.000,14.505) of (0.000,14.505) the (0.000,14.505) order (0.000,14.505) of (0.000,14.505) g (0.000,14.505) , (0.000,14.505) and (0.000,14.505) ordered (0.000,14.505) them (0.000,14.505) b (0.000,14.505) y (0.000,14.505) the (0.000,14.505) estimated (0.000,14.505) w (0.000,14.505) ork (0.000,14.505) required (0.000,14.505) using (0.000,14.505) P (0.000,14.505) ohlig-Hellman (0.000,14.505) and (0.000,14.505) P (0.000,14.505) ollard (0.000,14.505) lam (0.000,14.505) b (0.000,14.505) da (0.000,14.505) to (0.000,14.505) reco (0.000,14.505) v (0.000,14.505) er (0.000,14.505) a (0.000,14.505) target (0.000,14.505) priv (0.000,14.505) ate (0.000,14.505) exp (0.000,14.505) onen (0.000,14.505) t (0.000,14.505) x (0.000,14.505) of (0.000,14.505) length (0.000,14.505) ranging (0.000,14.505) from (0.000,14.505) 64 (0.000,14.505) to (0.000,14.505) 256 (0.000,14.505) bits. (0.000,14.505) There (0.000,14.505) w (0.000,14.505) ere (0.000,14.505) 753 (0.000,14.505) ( (0.000,14.505) p, (0.000,14.505) g (0.000,14.505) ) (0.000,14.505) pairs (0.000,14.505) where (0.000,14.505) w (0.000,14.505) e (0.000,14.505) knew (0.000,14.505) factors (0.000,14.505) of (0.000,14.505) the (0.000,14.505) subgroup (0.000,14.505) gene (0.000,14.505) rated (0.000,14.505) b (0.000,14.505) y (0.000,14.505) g (0.000,14.505) ; (0.000,14.505) these (0.000,14.505) had (0.000,14.505) b (0.000,14.505) een (0.000,14.505) used (0.000,14.505) for (0.000,14.505) 40,903 (0.000,14.505) connections (0.000,14.505) across (0.000,14.505) all (0.000,14.505) of (0.000,14.505) our (0.000,14.505) scans. (0.000,14.505) W (0.000,14.505) e (0.000,14.505) implemen (0.000,14.505) ted (0.000,14.505) the (0.000,14.505) v (0.000,14.505) an (0.000,14.505) O (0.000,14.505) orsc (0.000,14.505) hot (0.000,14.505) and (0.000,14.505) Wiener (0.000,14.505) a (0.000,14.505) lgorithm (0.000,14.505) in (0.000,14.505) Sage (0.000,14.505) [47] (0.000,14.505) using (0.000,14.505) a (0.000,14.505) parallel (0.000,14.505) P (0.000,14.505) ollard (0.000,14.505) rho (0.000,14.505) implemen (0.000,14.505) tation (0.000,14.505) that (0.000,14.505) w (0.000,14.505) e (0.000,14.505) wrote (0.000,14.505) in (0.000,14.505) C (0.000,14.505) using (0.000,14.505) the (0.000,14.505) GMP (0.000,14.505) library (0.000,14.505) . (0.000,14.505) W (0.000,14.505) e (0.000,14.505) used (0.000,14.505) the (0.000,14.505) distinguished (0.000,14.505) p (0.000,14.505) oin (0.000,14.505) ts (0.000,14.505) metho (0.000,14.505) d (0.000,14.505) for (0.000,14.505) collision (0.000,14.505) detection; (0.000,14.505) for (0.000,14.505) a (0.000,14.505) prime (0.000,14.505) kno (0.000,14.505) wn (0.000,14.505) in (0.000,14.505) adv (0.000,14.505) ance, (0.000,14.505) t (0.000,14.505) his (0.000,14.505) implemen (0.000,14.505) tation (0.000,14.505) can (0.000,14.505) b (0.000,14.505) e (0.000,14.505) arbitrarily (0.000,14.505) sp (0.000,14.505) ed (0.000,14.505) up (0.000,14.505) b (0.000,14.505) y (0.000,14.505) precomputing (0.000,14.505) a (0.000,14.505) table (0.000,14.505) of (0.000,14.505) distinguished (0.000,14.505) p (0.000,14.505) oin (0.000,14.505) ts. (0.000,14.505) W (0.000,14.505) e (0.000,14.505) computed (0.000,14.505) partial (0.000,14.505) information (0.000,14.505) ab (0.000,14.505) out (0.000,14.505) the (0.000,14.505) serv (0.000,14.505) er (0.000,14.505) secret (0.000,14.505) exp (0.000,14.505) onen (0.000,14.505) t (0.000,14.505) used (0.000,14.505) in (0.000,14.505) 460 (0.000,14.505) exc (0.000,14.505) hanges (0.000,14.505) and (0.000,14.505) w (0.000,14.505) ere (0.000,14.505) able (0.000,14.505) to (0.000,14.505) reco (0.000,14.505) v (0.000,14.505) er (0.000,14.505) the (0.000,14.505) whole (0.000,14.505) e (0.000,14.505) x (0.000,14.505) p (0.000,14.505) onen (0.000,14.505) t (0.000,14.505) used (0.000,14.505) b (0.000,14.505) y (0.000,14.505) 159 (0.000,14.505) differen (0.000,14.505) t (0.000,14.505) hosts, (0.000,14.505) 53 (0.000,14.505) o (0.000,14.505) f (0.000,14.505) whic (0.000,14.505) h (0.000,14.505) authen (0.000,14.505) ticated (0.000,14.505) wit (0.000,14.505) h (0.000,14.505) v (0.000,14.505) alid (0.000,14.505) bro (0.000,14.505) wser-trust (0.000,14.505) ed (0.000,14.505) certificate (0.000,14.505) s. (0.000,14.505) In (0.000,14.505) all (0.000,14.505) cases, (0.000,14.505) the (0.000,14.505) vulnerable (0.000,14.505) hosts (0.000,14.505) used (0.000,14.505) 512-bit (0.000,14.505) prime (0.000,14.505) mo (0.000,14.505) duli; (0.000,14.505) three (0.000,14.505) of (0.000,14.505) them (0.000,14.505) used (0.000,14.505) 160-bit (0.000,14.505) exp (0.000,14.505) onen (0.000,14.505) ts (0.000,14.505) and (0.000,14.505) the (0.000,14.505) rest (0.000,14.505) used (0.000,14.505) 128 (0.000,14.505) bits. (0.000,14.505) The (0.000,14.505) order (0.000,14.505) of (0.000,14.505) the (0.000,14.505) largest-order (0.000,14.505) subgroup (0.000,14.505) ranged (0.000,14.505) from (0.000,14.505) 46 (0.000,14.505) bits (0.000,14.505) (whic (0.000,14.505) h (0.000,14.505) finishes (0.000,14.505) in (0.000,14.505) seconds) (0.000,14.505) t (0.000,14.505) o (0.000,14.505) 81 (0.000,14.505) bits (0.000,14.505) (whic (0.000,14.505) h (0.000,14.505) to (0.000,14.505) ok (0.000,14.505) b (0.000,14.505) et (0.000,14.505) w (0.000,14.505) een (0.000,14.505) 50 (0.000,14.505) and (0.000,14.505) 176 (0.000,14.505) hours) (0.000,14.505) im (0.000,14.505) ple (0.000,14.505) m (0.000,14.505) e (0.000,14.505) n (0.000,14.505) t (0.000,14.505) ation. (0.000,14.505) The (0.000,14.505) P (0.000,14.505) ollard (0.000,14.505) lam (0.000,14.505) b (0.000,14.505) da (0.000,14.505) calculations (0.000,14.505) used (0.000,14.505) in (0.000,14.505) terv (0.000,14.505) al (0.000,14.505) width (0.000,14.505) v (0.000,14.505) arying (0.000,14.505) from (0.000,14.505) 40 (0.000,14.505) to (0.000,14.505) 70 (0.000,14.505) bits. (0.000,14.505) Our (0.000,14.505) computations (0.000,14.505) w (0.000,14.505) ould (0.000,14.505) ha (0.000,14.505) v (0.000,14.505) e (0.000,14.505) allo (0.000,14.505) w (0.000,14.505) ed (0.000,14.505) us (0.000,14.505) to (0.000,14.505) hijac (0.000,14.505) k (0.000,14.505) con- (0.000,14.505) nections (0.000,14.505) to (0.000,14.505) a (0.000,14.505) v (0.000,14.505) ariet (0.000,14.505) y (0.000,14.505) of (0.000,14.505) vulnerable (0.000,14.505) TLS (0.000,14.505) serv (0.000,14.505) ers, (0.000,14.505) including (0.000,14.505) w (0.000,14.505) e (0.000,14.505) b (0.000,14.505) in (0.000,14.505) terfaces (0.000,14.505) for (0.000,14.505) VPN (0.000,14.505) devices (0.000,14.505) (48 (0.000,14.505) hosts) (0.000,14.505) , (0.000,14.505) comm (0.000,14.505) unications (0.000,14.505) soft (0.000,14.505) w (0.000,14.505) are (0.000,14.505) (21 (0.000,14.505) hosts), (0.000,14.505) w (0.000,14.505) eb (0.000,14.505) conferencing (0.000,14.505) serv (0.000,14.505) ers (0.000,14.505) (27 (0.000,14.505) hosts), (0.000,14.505) and (0.000,14.505) FTP (0.000,14.505) serv (0.000,14.505) ers (0.000,14.505) (6 (0.000,14.505) hosts). (0.000,14.505) As (0.000,14.505) a (0.000,14.505) pro (0.000,14.505) of-of-concept, (0.000,14.505) w (0.000,14.505) e (0.000,14.505) mo (0.000,14.505) dified (0.000,14.505) our (0.000,14.505) man-in-the-middle (0.000,14.505) attac (0.000,14.505) k (0.000,14.505) er (0.000,14.505) of (0.000,14.505) §3.3 (0.000,14.505) to (0.000,14.505) imp (0.000,14.505) ersonate (0.000,14.505) a (0.000,14.505) vulnerable (0.000,14.505) serv (0.000,14.505) er (0.000,14.505) and (0.000,14.505) capture (0.000,14.505) user (0.000,14.505) creden (0.000,14.505) tials. (0.000,14.505) Compared (0.000,14.505) to (0.000,14.505) an (0.000,14.505) attac (0.000,14.505) k (0.000,14.505) using (0.000,14.505) NFS, (0.000,14.505) w (0.000,14.505) e (0.000,14.505) could (0.000,14.505) compute (0.000,14.505) the (0.000,14.505) discrete (0.000,14.505) log (0.000,14.505) with (0.000,14.505) a (0.000,14.505) dela (0.000,14.505) y (0.000,14.505) hardly (0.000,14.505) noticeable (0.000,14.505) for (0.000,14.505) bro (0.000,14.505) wser (0.000,14.505) users. (0.000,14.505) Misconfigured (0.000,14.505) groups (0.000,14.505) The (0.000,14.505) Digital (0.000,14.505) Signat (0.000,14.505) ure (0.000,14.505) Algorithm (0.000,14.505) (DSA) (0.000,14.505) [38] (0.000,14.505) uses (0.000,14.505) primes (0.000,14.505) p (0.000,14.505) suc (0.000,14.505) h (0.000,14.505) that (0.000,14.505) p (0.000,14.505) − (0.000,14.505) 1 (0.000,14.505) has (0.000,14.505) a (0.000,14.505) large (0.000,14.505) prime (0.000,14.505) factor (0.000,14.505) q (0.000,14.505) and (0.000,14.505) g (0.000,14.505) generates (0.000,14.505) only (0.000,14.505) a (0.000,14.505) subgroup (0.000,14.505) of (0.000,14.505) order (0.000,14.505) q (0.000,14.505) . (0.000,14.505) When (0.000,14.505) using (0.000,14.505) prop (0.000,14.505) erly (0.000,14.505) generated (0.000,14.505) DSA (0.000,14.505) parameters, (0.000,14.505) these (0.000,14.505) groups (0.000,14.505) are (0.000,14.505) secure (0.000,14.505) for (0.000,14.505) use (0.000,14.505) in (0.000,14.505) Diffie-Hellman (0.000,14.505) k (0.000,14.505) ey (0.000,14.505) exc (0.000,14.505) hanges. (0.000,14.505) Notably (0.000,14.505) , (0.000,14.505) DSA (0.000,14.505) groups (0.000,14.505) are (0.000,14.505) hard-co (0.000,14.505) ded (0.000,14.505) in (0.000,14.505) Ja (0.000,14.505) v (0.000,14.505) a’s (0.000,14.505) sun.security.provider (0.000,14.505) pac (0.000,14.505) kage (0.000,14.505) and (0.000,14.505) are (0.000,14.505) used (0.000,14.505) b (0.000,14.505) y (0.000,14.505) default (0.000,14.505) in (0.000,14.505) man (0.000,14.505) y (0.000,14.505) Ja (0.000,14.505) v (0.000,14.505) a-based (0.000,14.505) TLS (0.000,14.505) serv (0.000,14.505) ers. (0.000,14.505) Ho (0.000,14.505) w (0.000,14.505) ev (0.000,14.505) er, (0.000,14.505) some (0.000,14.505) serv (0.000,14.505) ers (0.000,14.505) in (0.000,14.505) our (0.000,14.505) scans (0.000,14.505) used (0.000,14.505) Ja (0.000,14.505) v (0.000,14.505) a’s (0.000,14.505) DSA (0.000,14.505) primes (0.000,14.505) as (0.000,14.505) p (0.000,14.505) but (0.000,14.505) mistak (0.000,14.505) enly (0.000,14.505) used (0.000,14.505) the (0.000,14.505) D (0.000,14.505) SA (0.000,14.505) group (0.000,14.505) order (0.000,14.505) q (0.000,14.505) in (0.000,14.505) the (0.000,14.505) place (0.000,14.505) of (0.000,14.505) the (0.000,14.505) generator (0.000,14.505) g (0.000,14.505) . (0.000,14.505) W (0.000,14.505) e (0.000,14.505) found (0.000,14.505) 5,741 (0.000,14.505) hosts (0.000,14.505) misconfigured (0.000,14.505) this (0.000,14.505) w (0.000,14.505) a (0.000,14.505) y (0.000,14.505) . (0.000,14.505) This (0.000,14.505) substitution (0.000,14.505) of (0.000,14.505) q (0.000,14.505) for (0.000,14.505) g (0.000,14.505) is (0.000,14.505) lik (0.000,14.505) ely (0.000,14.505) due (0.000,14.505) to (0.000,14.505) a (0.000,14.505) usabilit (0.000,14.505) y (0.000,14.505) prob- (0.000,14.505) lem: (0.000,14.505) the (0.000,14.505) canonical (0.000,14.505) ASN.1 (0.000,14.505) represen (0.000,14.505) tation (0.000,14.505) of (0.000,14.505) Diffie-Hellman (0.000,14.505) k (0.000,14.505) ey (0.000,14.505) exc (0.000,14.505) hange (0.000,14.505) parameters (0.000,14.505) (coming (0.000,14.505) from (0.000,14.505) PK (0.000,14.505) CS#3) (0.000,14.505) is (0.000,14.505) a (0.000,14.505) se- (0.000,14.505) quence (0.000,14.505) ( (0.000,14.505) p, (0.000,14.505) g (0.000,14.505) ) (0.000,14.505) , (0.000,14.505) while (0.000,14.505) that (0.000,14.505) of (0.000,14.505) DSA (0.000,14.505) parameters (0.000,14.505) (coming (0.000,14.505) from (0.000,14.505) PKIX) (0.000,14.505) is (0.000,14.505) ( (0.000,14.505) p, (0.000,14.505) q (0.000,14.505) , (0.000,14.505) g (0.000,14.505) ) (0.000,14.505) ; (0.000,14.505) w (0.000,14.505) e (0.000,14.505) conjecture (0.000,14.505) that (0.000,14.505) the (0.000,14.505) confusion (0.000,14.505) b (0.000,14.505) et (0.000,14.505) w (0.000,14.505) een (0.000,14.505) these (0.000,14.505) f (0.000,14.505) ormats (0.000,14.505) led (0.000,14.505) to (0.000,14.505) a (0.000,14.505) simple (0.000,14.505) programming (0.000,14.505) error. (0.000,14.505) In (0.000,14.505) a (0.000,14.505) DSA (0.000,14.505) group, (0.000,14.505) the (0.000,14.505) subgroup (0.000,14.505) gene (0.000,14.505) rated (0.000,14.505) b (0.000,14.505) y (0.000,14.505) q (0.000,14.505) is (0.000,14.505) lik (0.000,14.505) ely (0.000,14.505) to (0.000,14.505) ha (0.000,14.505) v (0.000,14.505) e (0.000,14.505) man (0.000,14.505) y (0.000,14.505) small (0.000,14.505) prime (0.000,14.505) factors (0.000,14.505) in (0.000,14.505) its (0.000,14.505) order, (0.000,14.505) since (0.000,14.505) for (0.000,14.505) p (0.000,14.505) generated (0.000,14.505) according (0.000,14.505) to (0.000,14.505) [38], (0.000,14.505) ( (0.000,14.505) p (0.000,14.505) − (0.000,14.505) 1) (0.000,14.505) /q (0.000,14.505) is (0.000,14.505) a (0.000,14.505) random (0.000,14.505) in (0.000,14.505) teger. (0.000,14.505) F (0.000,14.505) or (0.000,14.505) Ja (0.000,14.505) v (0.000,14.505) a’s (0.000,14.505) sun.security.provider (0.000,14.505) 512-bit (0.000,14.505) prime, (0.000,14.505) using (0.000,14.505) q (0.000,14.505) as (0.000,14.505) a (0.000,14.505) generator (0.000,14.505) leaks (0.000,14.505) 290 (0.000,14.505) bits (0.000,14.505) of (0.000,14.505) information (0.000,14.505) ab (0.000,14.505) out (0.000,14.505) exp (0.000,14.505) onen (0.000,14.505) ts (0.000,14.505) at (0.000,14.505) 6 (0.000,0.000) a (0.000,0.000) cost (0.000,0.000) of (0.000,0.000) roughly (0.000,0.000) 2 (0.000,0.000) 40 (0.000,0.000) op (0.000,0.000) erations. (0.000,0.000) Luc (0.000,0.000) kily (0.000,0.000) , (0.000,0.000) since (0.000,0.000) the (0.000,0.000) pro (0.000,0.000) vider (0.000,0.000) generates (0.000,0.000) exp (0.000,0.000) onen (0.000,0.000) ts (0.000,0.000) of (0.000,0.000) length (0.000,0.000) max (0.000,0.000) ( (0.000,0.000) n/ (0.000,0.000) 2 (0.000,0.000) , (0.000,0.000) 384) (0.000,0.000) for (0.000,0.000) n (0.000,0.000) -bit (0.000,0.000) p (0.000,0.000) , (0.000,0.000) this (0.000,0.000) do (0.000,0.000) es (0.000,0.000) not (0.000,0.000) suffice (0.000,0.000) to (0.000,0.000) reco (0.000,0.000) v (0.000,0.000) er (0.000,0.000) a (0.000,0.000) full (0.000,0.000) exp (0.000,0.000) onen (0.000,0.000) t. (0.000,0.000) Still, (0.000,0.000) this (0.000,0.000) misconfiguration (0.000,0.000) bug (0.000,0.000) results (0.000,0.000) in (0.000,0.000) a (0.000,0.000) s (0.000,0.000) ig (0.000,0.000) nifican (0.000,0.000) t (0.000,0.000) lo (0.000,0.000) s (0.000,0.000) s (0.000,0.000) of (0.000,0.000) securit (0.000,0.000) y (0.000,0.000) and (0.000,0.000) serv (0.000,0.000) es (0.000,0.000) as (0.000,0.000) a (0.000,0.000) cautionary (0.000,0.000) tale (0.000,0.000) for (0.000,0.000) programmers. (0.000,0.000) 4. (0.000,0.000) ST (0.000,0.000) A (0.000,0.000) TE-LEVEL (0.000,0.000) THREA (0.000,0.000) TS (0.000,0.000) T (0.000,0.000) O (0.000,0.000) DH (0.000,0.000) The (0.000,0.000) previous (0.000,0.000) sections (0.000,0.000) demonstrate (0.000,0.000) the (0.000,0.000) existence (0.000,0.000) of (0.000,0.000) pract (0.000,0.000) i- (0.000,0.000) cal (0.000,0.000) attac (0.000,0.000) ks (0.000,0.000) against (0.000,0.000) Diffie-Hellman (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) exc (0.000,0.000) hange (0.000,0.000) as (0.000,0.000) curren (0.000,0.000) tly (0.000,0.000) used (0.000,0.000) b (0.000,0.000) y (0.000,0.000) TLS. (0.000,0.000) Ho (0.000,0.000) w (0.000,0.000) e (0.000,0.000) v (0.000,0.000) er, (0.000,0.000) these (0.000,0.000) attac (0.000,0.000) ks (0.000,0.000) rely (0.000,0.000) on (0.000,0.000) the (0.000,0.000) abilit (0.000,0.000) y (0.000,0.000) to (0.000,0.000) do (0.000,0.000) wngrade (0.000,0.000) connections (0.000,0.000) to (0.000,0.000) exp (0.000,0.000) ort-grade (0.000,0.000) crypto (0.000,0.000) or (0.000,0.000) on (0.000,0.000) t (0.000,0.000) he (0.000,0.000) use (0.000,0.000) of (0.000,0.000) unsafe (0.000,0.000) parameters. (0.000,0.000) In (0.000,0.000) this (0.000,0.000) section (0.000,0.000) w (0.000,0.000) e (0.000,0.000) address (0.000,0.000) the (0.000,0.000) follo (0.000,0.000) wing (0.000,0.000) question: (0.000,0.000) ho (0.000,0.000) w (0.000,0.000) secure (0.000,0.000) is (0.000,0.000) Diffie-Hellman (0.000,0.000) in (0.000,0.000) broader (0.000,0.000) practice, (0.000,0.000) as (0.000,0.000) used (0.000,0.000) in (0.000,0.000) other (0.000,0.000) proto (0.000,0.000) cols (0.000,0.000) that (0.000,0.000) do (0.000,0.000) no (0.000,0.000) t (0.000,0.000) suffer (0.000,0.000) from (0.000,0.000) do (0.000,0.000) wngrade, (0.000,0.000) and (0.000,0.000) when (0.000,0.000) applied (0.000,0.000) with (0.000,0.000) stronger (0.000,0.000) groups? (0.000,0.000) T (0.000,0.000) o (0.000,0.000) answ (0.000,0.000) er (0.000,0.000) this (0.000,0.000) question (0.000,0.000) w (0.000,0.000) e (0.000,0.000) m (0.000,0.000) ust (0.000,0.000) first (0.000,0.000) examine (0.000,0.000) ho (0.000,0.000) w (0.000,0.000) the (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) field (0.000,0.000) siev (0.000,0.000) e (0.000,0.000) for (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) scales (0.000,0.000) to (0.000,0.000) 768- (0.000,0.000) and (0.000,0.000) 1024-bit (0.000,0.000) groups. (0.000,0.000) As (0.000,0.000) w (0.000,0.000) e (0.000,0.000) argue (0.000,0.000) b (0.000,0.000) elo (0.000,0.000) w, (0.000,0.000) 768-bit (0.000,0.000) groups, (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) are (0.000,0.000) still (0.000,0.000) in (0.000,0.000) relativ (0.000,0.000) ely (0.000,0.000) widespread (0.000,0.000) use, (0.000,0.000) are (0.000,0.000) no (0.000,0.000) w (0.000,0.000) within (0.000,0.000) reac (0.000,0.000) h (0.000,0.000) for (0.000,0.000) academic (0.000,0.000) computational (0.000,0.000) resources, (0.000,0.000) and (0.000,0.000) p (0.000,0.000) erforming (0.000,0.000) precomputations (0.000,0.000) for (0.000,0.000) a (0.000,0.000) small (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) of (0.000,0.000) 1024-bit (0.000,0.000) groups (0.000,0.000) is (0.000,0.000) plausibly (0.000,0.000) within (0.000,0.000) the (0.000,0.000) resources (0.000,0.000) of (0.000,0.000) state-lev (0.000,0.000) el (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) ers. (0.000,0.000) The (0.000,0.000) precomputation (0.000,0.000) w (0.000,0.000) ould (0.000,0.000) lik (0.000,0.000) ely (0.000,0.000) require (0.000,0.000) sp (0.000,0.000) ecial-purp (0.000,0.000) ose (0.000,0.000) hardw (0.000,0.000) are, (0.000,0.000) but (0.000,0.000) w (0.000,0.000) ould (0.000,0.000) not (0.000,0.000) require (0.000,0.000) an (0.000,0.000) y (0.000,0.000) ma (0.000,0.000) jor (0.000,0.000) algorithmic (0.000,0.000) impro (0.000,0.000) v (0.000,0.000) emen (0.000,0.000) ts (0.000,0.000) b (0.000,0.000) ey (0.000,0.000) ond (0.000,0.000) what (0.000,0.000) is (0.000,0.000) kno (0.000,0.000) wn (0.000,0.000) in (0.000,0.000) the (0.000,0.000) acade (0.000,0.000) m (0.000,0.000) ic (0.000,0.000) literature. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) further (0.000,0.000) sho (0.000,0.000) w (0.000,0.000) that (0.000,0.000) ev (0.000,0.000) en (0.000,0.000) in (0.000,0.000) the (0.000,0.000) 1024-bit (0.000,0.000) case, (0.000,0.000) the (0.000,0.000) descen (0.000,0.000) t (0.000,0.000) time (0.000,0.000) — (0.000,0.000) necessary (0.000,0.000) to (0.000,0.000) solv (0.000,0.000) e (0.000,0.000) an (0.000,0.000) y (0.000,0.000) sp (0.000,0.000) ecific (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) instance (0.000,0.000) within (0.000,0.000) a (0.000,0.000) common (0.000,0.000) group (0.000,0.000) — (0.000,0.000) w (0.000,0.000) ould (0.000,0.000) b (0.000,0.000) e (0.000,0.000) fast (0.000,0.000) enough (0.000,0.000) to (0.000,0.000) break (0.000,0.000) individual (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) exc (0.000,0.000) hanges (0.000,0.000) in (0.000,0.000) close (0.000,0.000) to (0.000,0.000) real (0.000,0.000) time. (0.000,0.000) In (0.000,0.000) ligh (0.000,0.000) t (0.000,0.000) of (0.000,0.000) these (0.000,0.000) results, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) examine (0.000,0.000) sev (0.000,0.000) e (0.000,0.000) ral (0.000,0.000) standard (0.000,0.000) In (0.000,0.000) ter- (0.000,0.000) net (0.000,0.000) securit (0.000,0.000) y (0.000,0.000) proto (0.000,0.000) cols (0.000,0.000) — (0.000,0.000) IKE, (0.000,0.000) SSH, (0.000,0.000) and (0.000,0.000) TLS (0.000,0.000) — (0.000,0.000) to (0.000,0.000) determine (0.000,0.000) the (0.000,0.000) vulnerabilit (0.000,0.000) y (0.000,0.000) of (0.000,0.000) their (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) exc (0.000,0.000) hanges (0.000,0.000) to (0.000,0.000) attac (0.000,0.000) ks (0.000,0.000) b (0.000,0.000) y (0.000,0.000) resource- (0.000,0.000) ful (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) e (0.000,0.000) rs. (0.000,0.000) Although (0.000,0.000) the (0.000,0.000) cost (0.000,0.000) of (0.000,0.000) the (0.000,0.000) precomputation (0.000,0.000) for (0.000,0.000) a (0.000,0.000) 1024-bit (0.000,0.000) group (0.000,0.000) is (0.000,0.000) sev (0.000,0.000) eral (0.000,0.000) times (0.000,0.000) higher (0.000,0.000) than (0.000,0.000) for (0.000,0.000) an (0.000,0.000) RSA (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) of (0.000,0.000) equal (0.000,0.000) size, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) observ (0.000,0.000) e (0.000,0.000) that (0.000,0.000) a (0.000,0.000) one-time (0.000,0.000) in (0.000,0.000) v (0.000,0.000) estmen (0.000,0.000) t (0.000,0.000) c (0.000,0.000) ould (0.000,0.000) b (0.000,0.000) e (0.000,0.000) used (0.000,0.000) to (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) millions (0.000,0.000) of (0.000,0.000) hosts, (0.000,0.000) due (0.000,0.000) to (0.000,0.000) widespread (0.000,0.000) reuse (0.000,0.000) of (0.000,0.000) the (0.000,0.000) most (0.000,0.000) c (0.000,0.000) om (0.000,0.000) mon (0.000,0.000) Diffie-Hellman (0.000,0.000) parameters. (0.000,0.000) Unfortunately (0.000,0.000) , (0.000,0.000) our (0.000,0.000) measuremen (0.000,0.000) ts (0.000,0.000) also (0.000,0.000) indicate (0.000,0.000) that (0.000,0.000) it (0.000,0.000) ma (0.000,0.000) y (0.000,0.000) b (0.000,0.000) e (0.000,0.000) v (0.000,0.000) e (0.000,0.000) ry (0.000,0.000) difficult (0.000,0.000) to (0.000,0.000) sunset (0.000,0.000) the (0.000,0.000) use (0.000,0.000) of (0.000,0.000) fixed (0.000,0.000) 1024-bit (0.000,0.000) Diffie-Hellman (0.000,0.000) groups (0.000,0.000) that (0.000,0.000) ha (0.000,0.000) v (0.000,0.000) e (0.000,0.000) long (0.000,0.000) b (0.000,0.000) een (0.000,0.000) em (0.000,0.000) b (0.000,0.000) edded (0.000,0.000) in (0.000,0.000) standards (0.000,0.000) and (0.000,0.000) implemen (0.000,0.000) tations. (0.000,0.000) Finally (0.000,0.000) , (0.000,0.000) w (0.000,0.000) e (0.000,0.000) apply (0.000,0.000) this (0.000,0.000) new (0.000,0.000) underst (0.000,0.000) anding (0.000,0.000) to (0.000,0.000) a (0.000,0.000) set (0.000,0.000) of (0.000,0.000) re- (0.000,0.000) cen (0.000,0.000) tly (0.000,0.000) published (0.000,0.000) do (0.000,0.000) cumen (0.000,0.000) ts (0.000,0.000) leak (0.000,0.000) ed (0.000,0.000) b (0.000,0.000) y (0.000,0.000) Edw (0.000,0.000) ard (0.000,0.000) Sno (0.000,0.000) wden (0.000,0.000) [46] (0.000,0.000) to (0.000,0.000) ev (0.000,0.000) aluate (0.000,0.000) the (0.000,0.000) h (0.000,0.000) yp (0.000,0.000) othesis (0.000,0.000) that (0.000,0.000) the (0.000,0.000) National (0.000,0.000) Securit (0.000,0.000) y (0.000,0.000) Agency (0.000,0.000) has (0.000,0.000) alr (0.000,0.000) e (0.000,0.000) ady (0.000,0.000) implemen (0.000,0.000) ted (0.000,0.000) suc (0.000,0.000) h (0.000,0.000) a (0.000,0.000) capabilit (0.000,0.000) y (0.000,0.000) . (0.000,0.000) W (0.000,0.000) e (0.000,0.000) sho (0.000,0.000) w (0.000,0.000) that (0.000,0.000) this (0.000,0.000) h (0.000,0.000) yp (0.000,0.000) othesis (0.000,0.000) is (0.000,0.000) consisten (0.000,0.000) t (0.000,0.000) with (0.000,0.000) the (0.000,0.000) published (0.000,0.000) details (0.000,0.000) of (0.000,0.000) the (0.000,0.000) in (0.000,0.000) telligence (0.000,0.000) comm (0.000,0.000) unit (0.000,0.000) y’s (0.000,0.000) cryptanalytic (0.000,0.000) capabilities, (0.000,0.000) and, (0.000,0.000) indeed, (0.000,0.000) matc (0.000,0.000) hes (0.000,0.000) the (0.000,0.000) kno (0.000,0.000) wn (0.000,0.000) capabilities (0.000,0.000) more (0.000,0.000) closely (0.000,0.000) than (0.000,0.000) other (0.000,0.000) prop (0.000,0.000) osed (0.000,0.000) explanations, (0.000,0.000) suc (0.000,0.000) h (0.000,0.000) as (0.000,0.000) no (0.000,0.000) v (0.000,0.000) el (0.000,0.000) breaks (0.000,0.000) on (0.000,0.000) R (0.000,0.000) C4 (0.000,0.000) or (0.000,0.000) AES. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) b (0.000,0.000) eliev (0.000,0.000) e (0.000,0.000) that (0.000,0.000) this (0.000,0.000) analysis (0.000,0.000) ma (0.000,0.000) y (0.000,0.000) help (0.000,0.000) shed (0.000,0.000) ligh (0.000,0.000) t (0.000,0.000) on (0.000,0.000) unansw (0.000,0.000) ered (0.000,0.000) questions (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) ho (0.000,0.000) w (0.000,0.000) NSA (0.000,0.000) ma (0.000,0.000) y (0.000,0.000) b (0.000,0.000) e (0.000,0.000) gaining (0.000,0.000) access (0.000,0.000) t (0.000,0.000) o (0.000,0.000) VPN, (0.000,0.000) SSH, (0.000,0.000) and (0.000,0.000) TLS (0.000,0.000) traffic. (0.000,0.000) 4.1 (0.000,0.000) Scaling (0.000,0.000) NFS (0.000,0.000) to (0.000,0.000) 768- (0.000,0.000) and (0.000,0.000) 1024-bit (0.000,0.000) DH (0.000,0.000) Estimating (0.000,0.000) the (0.000,0.000) cost (0.000,0.000) for (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) cryptanalysis (0.000,0.000) at (0.000,0.000) longer (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) sizes (0.000,0.000) is (0.000,0.000) far (0.000,0.000) from (0.000,0.000) straigh (0.000,0.000) tforw (0.000,0.000) ard, (0.000,0.000) due (0.000,0.000) in (0.000,0.000) part (0.000,0.000) to (0.000,0.000) the (0.000,0.000) complexit (0.000,0.000) y (0.000,0.000) of (0.000,0.000) parameter (0.000,0.000) t (0.000,0.000) uning (0.000,0.000) and (0.000,0.000) to (0.000,0.000) tradeoffs (0.000,0.000) b (0.000,0.000) et (0.000,0.000) w (0.000,0.000) een (0.000,0.000) the (0.000,0.000) sieving (0.000,0.000) and (0.000,0.000) linear (0.000,0.000) algebra (0.000,0.000) steps, (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) ha (0.000,0.000) v (0.000,0.000) e (0.000,0.000) v (0.000,0.000) ery (0.000,0.000) differen (0.000,0.000) t (0.000,0.000) computational (0.000,0.000) c (0.000,0.000) haracteristics. (0.000,0.000) (Muc (0.000,0.000) h (0.000,0.000) more (0.000,0.000) atten (0.000,0.000) tion (0.000,0.000) has (0.000,0.000) gone (0.000,0.000) to (0.000,0.000) understanding (0.000,0.000) 1024-bit (0.000,0.000) factorization, (0.000,0.000) but, (0.000,0.000) ev (0.000,0.000) en (0.000,0.000) there, (0.000,0.000) man (0.000,0.000) y (0.000,0.000) published (0.000,0.000) estimates (0.000,0.000) are (0.000,0.000) crude (0.000,0.000) extrap (0.000,0.000) olations (0.000,0.000) of (0.000,0.000) the (0.000,0.000) asymptotic (0.000,0.000) complexit (0.000,0.000) y (0.000,0.000) .) (0.000,0.000) W (0.000,0.000) e (0.000,0.000) attempt (0.000,0.000) estimates (0.000,0.000) for (0.000,0.000) 768- (0.000,0.000) and (0.000,0.000) 1024-bit (0.000,0.000) discrete (0.000,0.000) lo (0.000,0.000) g (0.000,0.000) based (0.000,0.000) on (0.000,0.000) the (0.000,0.000) existing (0.000,0.000) lit (0.000,0.000) erature (0.000,0.000) and (0.000,0.000) our (0.000,0.000) o (0.000,0.000) wn (0.000,0.000) exp (0.000,0.000) erimen (0.000,0.000) ts, (0.000,0.000) but (0.000,0.000) further (0.000,0.000) w (0.000,0.000) ork (0.000,0.000) is (0.000,0.000) needed (0.000,0.000) for (0.000,0.000) greater (0.000,0.000) confidence, (0.000,0.000) particularly (0.000,0.000) for (0.000,0.000) the (0.000,0.000) 1024-bit (0.000,0.000) case. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) summarize (0.000,0.000) all (0.000,0.000) the (0.000,0.000) costs, (0.000,0.000) measured (0.000,0.000) or (0.000,0.000) estimated, (0.000,0.000) in (0.000,0.000) T (0.000,0.000) able (0.000,0.000) 2. (0.000,0.000) DH-768: (0.000,0.000) F (0.000,0.000) easible (0.000,0.000) with (0.000,0.000) academic (0.000,0.000) p (0.000,0.000) o (0.000,0.000) w (0.000,0.000) er (0.000,0.000) F (0.000,0.000) or (0.000,0.000) the (0.000,0.000) 768- (0.000,0.000) bit (0.000,0.000) case, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) base (0.000,0.000) our (0.000,0.000) estimates (0.000,0.000) on (0.000,0.000) the (0.000,0.000) recen (0.000,0.000) t (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) record (0.000,0.000) at (0.000,0.000) 596 (0.000,0.000) bits (0.000,0.000) [8] (0.000,0.000) and (0.000,0.000) the (0.000,0.000) in (0.000,0.000) teger (0.000,0.000) factorization (0.000,0.000) record (0.000,0.000) of (0.000,0.000) 768 (0.000,0.000) bits (0.000,0.000) from (0.000,0.000) 2009 (0.000,0.000) [29]. (0.000,0.000) While (0.000,0.000) the (0.000,0.000) algorithms (0.000,0.000) for (0.000,0.000) factorization (0.000,0.000) and (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) are (0.000,0.000) similar, (0.000,0.000) the (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) linear (0.000,0.000) alg (0.000,0.000) ebra (0.000,0.000) stage (0.000,0.000) is (0.000,0.000) man (0.000,0.000) y (0.000,0.000) times (0.000,0.000) more (0.000,0.000) diffi (0.000,0.000) c (0.000,0.000) ult, (0.000,0.000) as (0.000,0.000) the (0.000,0.000) matrix (0.000,0.000) en (0.000,0.000) tries (0.000,0.000) are (0.000,0.000) no (0.000,0.000) longer (0.000,0.000) Bo (0.000,0.000) olean. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) can (0.000,0.000) reduce (0.000,0.000) o (0.000,0.000) v (0.000,0.000) erall (0.000,0.000) time (0.000,0.000) b (0.000,0.000) y (0.000,0.000) sieving (0.000,0.000) more, (0.000,0.000) th (0.000,0.000) us (0.000,0.000) generating (0.000,0.000) a (0.000,0.000) smaller (0.000,0.000) input (0.000,0.000) matrix (0.000,0.000) to (0.000,0.000) the (0.000,0.000) linear (0.000,0.000) algebra (0.000,0.000) ste (0.000,0.000) p (0.000,0.000) . (0.000,0.000) Since (0.000,0.000) sieving (0.000,0.000) parallelizes (0.000,0.000) b (0.000,0.000) etter (0.000,0.000) than (0.000,0.000) linear (0.000,0.000) algebra, (0.000,0.000) t (0.000,0.000) his (0.000,0.000) tradeoff (0.000,0.000) is (0.000,0.000) desirable (0.000,0.000) for (0.000,0.000) large (0.000,0.000) inputs. (0.000,0.000) A (0.000,0.000) 596-bit (0.000,0.000) factorization (0.000,0.000) tak (0.000,0.000) es (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) 5 (0.000,0.000) core-y (0.000,0.000) ears, (0.000,0.000) most (0.000,0.000) of (0.000,0.000) it (0.000,0.000) sp (0.000,0.000) en (0.000,0.000) t (0.000,0.000) on (0.000,0.000) sieving. (0.000,0.000) In (0.000,0.000) comparison, (0.000,0.000) the (0.000,0.000) record (0.000,0.000) 596-bit (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) effort (0.000,0.000) tuned (0.000,0.000) parameters (0.000,0.000) suc (0.000,0.000) h (0.000,0.000) that (0.000,0.000) they (0.000,0.000) sp (0.000,0.000) en (0.000,0.000) t (0.000,0.000) 50 (0.000,0.000) core-y (0.000,0.000) ears (0.000,0.000) on (0.000,0.000) sieving. (0.000,0.000) This (0.000,0.000) reduced (0.000,0.000) their (0.000,0.000) linear (0.000,0.000) algebra (0.000,0.000) calculation (0.000,0.000) t (0.000,0.000) o (0.000,0.000) 80 (0.000,0.000) core-y (0.000,0.000) ears. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) used (0.000,0.000) this (0.000,0.000) same (0.000,0.000) strategy (0.000,0.000) in (0.000,0.000) our (0.000,0.000) 512-bit (0.000,0.000) exp (0.000,0.000) erimen (0.000,0.000) ts (0.000,0.000) in (0.000,0.000) §3.3. (0.000,0.000) Similarly (0.000,0.000) , (0.000,0.000) the (0.000,0.000) 768-bit (0.000,0.000) RSA (0.000,0.000) factoring (0.000,0.000) record (0.000,0.000) sp (0.000,0.000) en (0.000,0.000) t (0.000,0.000) more (0.000,0.000) time (0.000,0.000) on (0.000,0.000) sieving (0.000,0.000) in (0.000,0.000) order (0.000,0.000) to (0.000,0.000) sa (0.000,0.000) v (0.000,0.000) e (0.000,0.000) t (0.000,0.000) im (0.000,0.000) e (0.000,0.000) on (0.000,0.000) the (0.000,0.000) linear (0.000,0.000) algebra (0.000,0.000) step. (0.000,0.000) T (0.000,0.000) he (0.000,0.000) cost (0.000,0.000) of (0.000,0.000) sieving (0.000,0.000) w (0.000,0.000) as (0.000,0.000) around (0.000,0.000) 1500 (0.000,0.000) core-y (0.000,0.000) ears, (0.000,0.000) and (0.000,0.000) the (0.000,0.000) matrix (0.000,0.000) that (0.000,0.000) w (0.000,0.000) as (0.000,0.000) pro (0.000,0.000) duced (0.000,0.000) had (0.000,0.000) 200M (0.000,0.000) ro (0.000,0.000) ws (0.000,0.000) and (0.000,0.000) columns. (0.000,0.000) As (0.000,0.000) a (0.000,0.000) result, (0.000,0.000) the (0.000,0.000) linear (0.000,0.000) alge (0.000,0.000) bra (0.000,0.000) to (0.000,0.000) ok (0.000,0.000) 150 (0.000,0.000) core-y (0.000,0.000) ears, (0.000,0.000) but (0.000,0.000) tak- (0.000,0.000) ing (0.000,0.000) algorithmic (0.000,0.000) impro (0.000,0.000) v (0.000,0.000) emen (0.000,0.000) ts (0.000,0.000) since (0.000,0.000) 2009 (0.000,0.000) in (0.000,0.000) to (0.000,0.000) accoun (0.000,0.000) t (0.000,0.000) and (0.000,0.000) optimizing (0.000,0.000) for (0.000,0.000) the (0.000,0.000) total (0.000,0.000) time, (0.000,0.000) 3 (0.000,0.000) w (0.000,0.000) e (0.000,0.000) est (0.000,0.000) im (0.000,0.000) at (0.000,0.000) e (0.000,0.000) that (0.000,0.000) factoring (0.000,0.000) an (0.000,0.000) RSA-768 (0.000,0.000) in (0.000,0.000) teger (0.000,0.000) w (0.000,0.000) ould (0.000,0.000) tak (0.000,0.000) e (0.000,0.000) 900 (0.000,0.000) core-y (0.000,0.000) ears (0.000,0.000) in (0.000,0.000) tota (0.000,0.000) l. (0.000,0.000) F (0.000,0.000) or (0.000,0.000) a (0.000,0.000) 768-bit (0.000,0.000) discrete (0.000,0.000) log, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) can (0.000,0.000) exp (0.000,0.000) ect (0.000,0.000) that (0.000,0.000) te (0.000,0.000) n (0.000,0.000) times (0.000,0.000) as (0.000,0.000) m (0.000,0.000) uc (0.000,0.000) h (0.000,0.000) sieving (0.000,0.000) as (0.000,0.000) the (0.000,0.000) RSA (0.000,0.000) case (0.000,0.000) w (0.000,0.000) ould (0.000,0.000) reduce (0.000,0.000) the (0.000,0.000) matrix (0.000,0.000) to (0.000,0.000) around (0.000,0.000) 150M (0.000,0.000) ro (0.000,0.000) ws. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) extrap (0.000,0.000) olate (0.000,0.000) from (0.000,0.000) exp (0.000,0.000) erimen (0.000,0.000) ts (0.000,0.000) with (0.000,0.000) existing (0.000,0.000) soft (0.000,0.000) w (0.000,0.000) are (0.000,0.000) that (0.000,0.000) this (0.000,0.000) linear (0.000,0.000) algebra (0.000,0.000) w (0.000,0.000) ould (0.000,0.000) tak (0.000,0.000) e (0.000,0.000) 28,500 (0.000,0.000) core-y (0.000,0.000) ears, (0.000,0.000) for (0.000,0.000) a (0.000,0.000) total (0.000,0.000) of (0.000,0.000) 36,500 (0.000,0.000) core-y (0.000,0.000) ears. (0.000,0.000) This (0.000,0.000) is (0.000,0.000) w (0.000,0.000) ithin (0.000,0.000) reac (0.000,0.000) h (0.000,0.000) b (0.000,0.000) y (0.000,0.000) computing (0.000,0.000) p (0.000,0.000) o (0.000,0.000) w (0.000,0.000) er (0.000,0.000) a (0.000,0.000) v (0.000,0.000) ailable (0.000,0.000) to (0.000,0.000) academics. (0.000,0.000) The (0.000,0.000) descen (0.000,0.000) t (0.000,0.000) step (0.000,0.000) tak (0.000,0.000) es (0.000,0.000) relativ (0.000,0.000) ely (0.000,0.000) little (0.000,0.000) time. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) exp (0.000,0.000) eri- (0.000,0.000) men (0.000,0.000) ted (0.000,0.000) with (0.000,0.000) b (0.000,0.000) oth (0.000,0.000) CADO-NFS (0.000,0.000) and (0.000,0.000) a (0.000,0.000) new (0.000,0.000) implemen (0.000,0.000) t (0.000,0.000) ation (0.000,0.000) with (0.000,0.000) GMP-ECM (0.000,0.000) based (0.000,0.000) on (0.000,0.000) the (0.000,0.000) early-ab (0.000,0.000) ort (0.000,0.000) strategy (0.000,0.000) describ (0.000,0.000) ed (0.000,0.000) in (0.000,0.000) [6]. (0.000,0.000) Using (0.000,0.000) these (0.000,0.000) tec (0.000,0.000) hniques, (0.000,0.000) the (0.000,0.000) initial (0.000,0.000) descen (0.000,0.000) t (0.000,0.000) phase (0.000,0.000) to (0.000,0.000) ok (0.000,0.000) an (0.000,0.000) a (0.000,0.000) v (0.000,0.000) erage (0.000,0.000) of (0.000,0.000) around (0.000,0.000) 1 (0.000,0.000) core-da (0.000,0.000) y (0.000,0.000) . (0.000,0.000) The (0.000,0.000) remaining (0.000,0.000) phase (0.000,0.000) uses (0.000,0.000) sieving (0.000,0.000) m (0.000,0.000) uc (0.000,0.000) h (0.000,0.000) as (0.000,0.000) in (0.000,0.000) the (0.000,0.000) precomputation; (0.000,0.000) extrap (0.000,0.000) olating (0.000,0.000) from (0.000,0.000) exp (0.000,0.000) erimen (0.000,0.000) ts, (0.000,0.000) the (0.000,0.000) rest (0.000,0.000) of (0.000,0.000) the (0.000,0.000) descen (0.000,0.000) t (0.000,0.000) should (0.000,0.000) tak (0.000,0.000) e (0.000,0.000) at (0.000,0.000) most (0.000,0.000) 1 (0.000,0.000) core-da (0.000,0.000) y (0.000,0.000) . (0.000,0.000) In (0.000,0.000) total, (0.000,0.000) after (0.000,0.000) precomputa (0.000,0.000) tion, (0.000,0.000) the (0.000,0.000) cost (0.000,0.000) of (0.000,0.000) a (0.000,0.000) single (0.000,0.000) 768-bit (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) computat (0.000,0.000) i (0.000,0.000) o (0.000,0.000) n (0.000,0.000) is (0.000,0.000) around (0.000,0.000) 2 (0.000,0.000) core-da (0.000,0.000) ys (0.000,0.000) and (0.000,0.000) is (0.000,0.000) easily (0.000,0.000) parallelizable. (0.000,0.000) DH-1024: (0.000,0.000) Plausible (0.000,0.000) with (0.000,0.000) state-lev (0.000,0.000) el (0.000,0.000) resources (0.000,0.000) Ex- (0.000,0.000) p (0.000,0.000) erimen (0.000,0.000) tally (0.000,0.000) extrap (0.000,0.000) olating (0.000,0.000) sieving (0.000,0.000) parameters (0.000,0.000) to (0.000,0.000) the (0.000,0.000) 1024-bit (0.000,0.000) case (0.000,0.000) is (0.000,0.000) difficult (0.000,0.000) due (0.000,0.000) to (0.000,0.000) the (0.000,0.000) tradeoffs (0.000,0.000) b (0.000,0.000) et (0.000,0.000) w (0.000,0.000) een (0.000,0.000) the (0.000,0.000) steps (0.000,0.000) o (0.000,0.000) f (0.000,0.000) the (0.000,0.000) algorithm (0.000,0.000) and (0.000,0.000) their (0.000,0.000) relativ (0.000,0.000) e (0.000,0.000) parallelism. (0.000,0.000) The (0.000,0.000) prior (0.000,0.000) w (0.000,0.000) ork (0.000,0.000) prop (0.000,0.000) osing (0.000,0.000) parameters (0.000,0.000) for (0.000,0.000) factoring (0.000,0.000) a (0.000,0.000) 1024-bit (0.000,0.000) RSA (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) is (0.000,0.000) thin: (0.000,0.000) [28] (0.000,0.000) prop (0.000,0.000) o (0.000,0.000) s (0.000,0.000) e (0.000,0.000) s (0.000,0.000) smo (0.000,0.000) othness (0.000,0.000) b (0.000,0.000) ounds (0.000,0.000) of (0.000,0.000) 42 (0.000,0.000) bits, (0.000,0.000) but (0.000,0.000) t (0.000,0.000) he (0.000,0.000) prop (0.000,0.000) osed (0.000,0.000) v (0.000,0.000) alue (0.000,0.000) of (0.000,0.000) the (0.000,0.000) sieving (0.000,0.000) region (0.000,0.000) parameter (0.000,0.000) I (0.000,0.000) is (0.000,0.000) clearly (0.000,0.000) to (0.000,0.000) o (0.000,0.000) small, (0.000,0.000) giving (0.000,0.000) to (0.000,0.000) o (0.000,0.000) few (0.000,0.000) smo (0.000,0.000) oth (0.000,0.000) results (0.000,0.000) p (0.000,0.000) er (0.000,0.000) sieving (0.000,0.000) sub- (0.000,0.000) task. (0.000,0.000) Since (0.000,0.000) no (0.000,0.000) publicly (0.000,0.000) a (0.000,0.000) v (0.000,0.000) ailable (0.000,0.000) soft (0.000,0.000) w (0.000,0.000) are (0.000,0.000) can (0.000,0.000) curren (0.000,0.000) tly (0.000,0.000) deal (0.000,0.000) with (0.000,0.000) v (0.000,0.000) alues (0.000,0.000) of (0.000,0.000) I (0.000,0.000) larger (0.000,0.000) than (0.000,0.000) those (0.000,0.000) prop (0.000,0.000) ose (0.000,0.000) d, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) could (0.000,0.000) not (0.000,0.000) exp (0.000,0.000) erimen (0.000,0.000) tally (0.000,0.000) up (0.000,0.000) date (0.000,0.000) the (0.000,0.000) estimates (0.000,0.000) of (0.000,0.000) this (0.000,0.000) pap (0.000,0.000) er (0.000,0.000) with (0.000,0.000) more (0.000,0.000) relev (0.000,0.000) an (0.000,0.000) t (0.000,0.000) parameter (0.000,0.000) c (0.000,0.000) hoices. (0.000,0.000) Without (0.000,0.000) b (0.000,0.000) e (0.000,0.000) tter (0.000,0.000) parameter (0.000,0.000) c (0.000,0.000) hoices, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) resort (0.000,0.000) to (0.000,0.000) extrap (0.000,0.000) olat- (0.000,0.000) ing (0.000,0.000) f (0.000,0.000) rom (0.000,0.000) asymptotic (0.000,0.000) complexit (0.000,0.000) y (0.000,0.000) . (0.000,0.000) F (0.000,0.000) or (0.000,0.000) the (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) field (0.000,0.000) siev (0.000,0.000) e, (0.000,0.000) the (0.000,0.000) complexit (0.000,0.000) y (0.000,0.000) is (0.000,0.000) exp (0.000,0.000) (0.000,0.000) ( (0.000,0.000) k (0.000,0.000) + (0.000,0.000) o (0.000,0.000) (1))( (0.000,0.000) log (0.000,0.000) N (0.000,0.000) ) (0.000,0.000) 1 (0.000,0.000) / (0.000,0.000) 3 (0.000,0.000) ( (0.000,0.000) log (0.000,0.000) log (0.000,0.000) N (0.000,0.000) ) (0.000,0.000) 2 (0.000,0.000) / (0.000,0.000) 3 (0.000,0.000) (0.000,0.000) , (0.000,0.000) where (0.000,0.000) N (0.000,0.000) is (0.000,0.000) t (0.000,0.000) he (0.000,0.000) in (0.000,0.000) teger (0.000,0.000) to (0.000,0.000) factor (0.000,0.000) or (0.000,0.000) the (0.000,0.000) prime (0.000,0.000) mo (0.000,0.000) dulus (0.000,0.000) for (0.000,0.000) discrete (0.000,0.000) log, (0.000,0.000) and (0.000,0.000) k (0.000,0.000) is (0.000,0.000) an (0.000,0.000) algorithm-sp (0.000,0.000) ecific (0.000,0.000) constan (0.000,0.000) t. (0.000,0.000) This (0.000,0.000) form (0.000,0.000) ula (0.000,0.000) is (0.000,0.000) inheren (0.000,0.000) tly (0.000,0.000) imprecise, (0.000,0.000) since (0.000,0.000) the (0.000,0.000) o (0.000,0.000) (1) (0.000,0.000) in (0.000,0.000) the (0.000,0.000) exp (0.000,0.000) o- (0.000,119.552) 3 (0.000,119.552) W (0.000,119.552) e (0.000,119.552) w (0.000,119.552) ould (0.000,119.552) lo (0.000,119.552) w (0.000,119.552) er (0.000,119.552) the (0.000,119.552) smo (0.000,119.552) othness (0.000,119.552) b (0.000,119.552) ounds (0.000,119.552) compared (0.000,119.552) to (0.000,119.552) the (0.000,119.552) parameters (0.000,119.552) in (0.000,119.552) [29]. (0.000,119.552) 7 (0.000,485.375) Sieving (0.000,485.375) Linear (0.000,485.375) Algebra (0.000,485.375) Descen (0.000,485.375) t (0.000,45.111) I (0.000,45.111) log (0.000,45.111) 2 (0.000,45.111) B (0.000,45.111) core-y (0.000,45.111) ears (0.000,45.111) ro (0.000,45.111) ws (0.000,45.111) core-y (0.000,45.111) ears (0.000,45.111) core-time (0.000,485.375) RSA-512 (0.000,485.375) 14 (0.000,485.375) 29 (0.000,485.375) 0.5 (0.000,485.375) 4.3M (0.000,485.375) 0.33 (0.000,485.375) Timings (0.000,485.375) with (0.000,485.375) default (0.000,485.375) CADO-NFS (0.000,485.375) parameters. (0.000,485.375) DH-512 (0.000,485.375) 15 (0.000,485.375) 27 (0.000,485.375) 2 (0.000,485.375) . (0.000,485.375) 5 (0.000,485.375) 2.1M (0.000,485.375) 7.7 (0.000,485.375) 1 (0.000,485.375) 0 (0.000,485.375) mins (0.000,485.375) F (0.000,485.375) or (0.000,485.375) the (0.000,485.375) computations (0.000,485.375) in (0.000,485.375) this (0.000,485.375) pap (0.000,485.375) er; (0.000,485.375) ma (0.000,485.375) y (0.000,485.375) b (0.000,485.375) e (0.000,485.375) sub (0.000,485.375) optimal. (0.000,485.375) RSA-768 (0.000,485.375) 16 (0.000,485.375) 37 (0.000,485.375) 800 (0.000,485.375) 250M (0.000,485.375) 100 (0.000,485.375) Est. (0.000,485.375) based (0.000,485.375) on (0.000,485.375) [29] (0.000,485.375) with (0.000,485.375) less (0.000,485.375) sieving. (0.000,485.375) DH-768 (0.000,485.375) 17 (0.000,485.375) 35 (0.000,485.375) 8,000 (0.000,485.375) 150M (0.000,485.375) 28,50 (0.000,485.375) 0 (0.000,485.375) 2 (0.000,485.375) da (0.000,485.375) ys (0.000,485.375) Est. (0.000,485.375) based (0.000,485.375) on (0.000,485.375) [8, (0.000,485.375) 29] (0.000,485.375) and (0.000,485.375) our (0.000,485.375) o (0.000,485.375) wn (0.000,485.375) exp (0.000,485.375) erimen (0.000,485.375) ts. (0.000,485.375) RSA-1024 (0.000,485.375) 18 (0.000,485.375) 42 (0.000,485.375) 1,000,000 (0.000,485.375) 8.7B (0.000,485.375) 120,000 (0.000,485.375) Est. (0.000,485.375) based (0.000,485.375) on (0.000,485.375) complexit (0.000,485.375) y (0.000,485.375) form (0.000,485.375) ula. (0.000,485.375) DH-1024 (0.000,485.375) 19 (0.000,485.375) 40 (0.000,485.375) 10,000,000 (0.000,485.375) 5.2B (0.000,485.375) 35,000,000 (0.000,485.375) 30 (0.000,485.375) da (0.000,485.375) ys (0.000,485.375) Est. (0.000,485.375) based (0.000,485.375) on (0.000,485.375) complexit (0.000,485.375) y (0.000,485.375) form (0.000,485.375) ula (0.000,485.375) and (0.000,485.375) our (0.000,485.375) exp (0.000,485.375) erimen (0.000,485.375) ts. (0.000,485.375) T (0.000,485.375) able (0.000,485.375) 2: (0.000,485.375) Estimating (0.000,485.375) costs (0.000,485.375) for (0.000,485.375) factoring (0.000,485.375) and (0.000,485.375) discrete (0.000,485.375) log (0.000,485.375) . (0.000,485.375) F (0.000,485.375) or (0.000,485.375) sieving, (0.000,485.375) w (0.000,485.375) e (0.000,485.375) giv (0.000,485.375) e (0.000,485.375) t (0.000,485.375) w (0.000,485.375) o (0.000,485.375) imp (0.000,485.375) ortan (0.000,485.375) t (0.000,485.375) parameters: (0.000,485.375) the (0.000,485.375) n (0.000,485.375) um (0.000,485.375) b (0.000,485.375) er (0.000,485.375) of (0.000,485.375) bits (0.000,485.375) of (0.000,485.375) the (0.000,485.375) smo (0.000,485.375) othness (0.000,485.375) b (0.000,485.375) ound (0.000,485.375) B (0.000,485.375) and (0.000,485.375) the (0.000,485.375) sieving (0.000,485.375) region (0.000,485.375) parameter (0.000,485.375) I (0.000,485.375) . (0.000,485.375) F (0.000,485.375) or (0.000,485.375) linear (0.000,485.375) algebra, (0.000,485.375) a (0.000,485.375) ll (0.000,485.375) costs (0.000,485.375) for (0.000,485.375) DH (0.000,485.375) are (0.000,485.375) for (0.000,485.375) safe (0.000,485.375) primes; (0.000,485.375) for (0.000,485.375) DSA (0.000,485.375) primes (0.000,485.375) with (0.000,485.375) q (0.000,485.375) of (0.000,485.375) 160 (0.000,485.375) bits, (0.000,485.375) this (0.000,485.375) should (0.000,485.375) b (0.000,485.375) e (0.000,485.375) divided (0.000,485.375) b (0.000,485.375) y (0.000,485.375) 6.4 (0.000,485.375) for (0.000,485.375) 1024 (0.000,485.375) bits, (0.000,485.375) 4.8 (0.000,485.375) for (0.000,485.375) 768 (0.000,485.375) bits, (0.000,485.375) and (0.000,485.375) 3.2 (0.000,485.375) for (0.000,485.375) 512 (0.000,485.375) bits. (0.000,485.375) nen (0.000,485.375) t (0.000,485.375) can (0.000,485.375) hide (0.000,485.375) p (0.000,485.375) olynomial (0.000,485.375) factors. (0.000,485.375) This (0.000,485.375) complexit (0.000,485.375) y (0.000,485.375) form (0.000,485.375) ula, (0.000,485.375) with (0.000,485.375) k (0.000,485.375) = (0.000,485.375) 1 (0.000,485.375) . (0.000,485.375) 923 (0.000,485.375) , (0.000,485.375) describ (0.000,485.375) es (0.000,485.375) the (0.000,485.375) o (0.000,485.375) v (0.000,485.375) erall (0.000,485.375) time (0.000,485.375) for (0.000,485.375) b (0.000,485.375) oth (0.000,485.375) discrete (0.000,485.375) log (0.000,485.375) and (0.000,485.375) factoriza (0.000,485.375) tion, (0.000,485.375) whic (0.000,485.375) h (0.000,485.375) are (0.000,485.375) b (0.000,485.375) o (0.000,485.375) th (0.000,485.375) dominated (0.000,485.375) b (0.000,485.375) y (0.000,485.375) sieving (0.000,485.375) and (0.000,485.375) linear (0.000,485.375) algebra (0.000,485.375) in (0.000,485.375) the (0.000,485.375) precomputation. (0.000,485.375) The (0.000,485.375) space (0.000,485.375) com- (0.000,485.375) plexit (0.000,485.375) y (0.000,485.375) (the (0.000,485.375) size (0.000,485.375) of (0.000,485.375) the (0.000,485.375) matrix (0.000,485.375) in (0.000,485.375) memory) (0.000,485.375) is (0.000,485.375) the (0.000,485.375) square (0.000,485.375) ro (0.000,485.375) ot (0.000,485.375) of (0.000,485.375) this (0.000,485.375) function, (0.000,485.375) i.e., (0.000,485.375) the (0.000,485.375) same (0.000,485.375) function, (0.000,485.375) taking (0.000,485.375) k (0.000,485.375) = (0.000,485.375) 0 (0.000,485.375) . (0.000,485.375) 9615 (0.000,485.375) . (0.000,485.375) Discrete (0.000,485.375) log (0.000,485.375) descen (0.000,485.375) t (0.000,485.375) has (0.000,485.375) a (0.000,485.375) complexit (0.000,485.375) y (0.000,485.375) of (0.000,485.375) the (0.000,485.375) same (0.000,485.375) form (0.000,485.375) as (0.000,485.375) w (0.000,485.375) ell; (0.000,485.375) [2, (0.000,485.375) Chapter (0.000,485.375) 4] (0.000,485.375) giv (0.000,485.375) es (0.000,485.375) k (0.000,485.375) = (0.000,485.375) 1 (0.000,485.375) . (0.000,485.375) 232 (0.000,485.375) , (0.000,485.375) using (0.000,485.375) an (0.000,485.375) early-ab (0.000,485.375) ort (0.000,485.375) strategy (0.000,485.375) similar (0.000,485.375) to (0.000,485.375) the (0.000,485.375) one (0.000,485.375) in (0.000,485.375) [6] (0.000,485.375) men (0.000,485.375) tioned (0.000,485.375) ab (0.000,485.375) o (0.000,485.375) v (0.000,485.375) e. (0.000,485.375) Ev (0.000,485.375) aluating (0.000,485.375) the (0.000,485.375) form (0.000,485.375) ula (0.000,485.375) for (0.000,485.375) 768- (0.000,485.375) and (0.000,485.375) 1024-bit (0.000,485.375) N (0.000,485.375) giv (0.000,485.375) es (0.000,485.375) us (0.000,485.375) estimated (0.000,485.375) m (0.000,485.375) ultiplicativ (0.000,485.375) e (0.000,485.375) factors (0.000,485.375) b (0.000,485.375) y (0.000,485.375) whic (0.000,485.375) h (0.000,485.375) time (0.000,485.375) and (0.000,485.375) space (0.000,485.375) will (0.000,485.375) increase (0.000,485.375) from (0.000,485.375) the (0.000,485.375) 768- (0.000,485.375) to (0.000,485.375) the (0.000,485.375) 102 (0.000,485.375) 4-bit (0.000,485.375) case. (0.000,485.375) F (0.000,485.375) or (0.000,485.375) precompu- (0.000,485.375) tation, (0.000,485.375) the (0.000,485.375) tot (0.000,485.375) al (0.000,485.375) time (0.000,485.375) complexit (0.000,485.375) y (0.000,485.375) will (0.000,485.375) increase (0.000,485.375) b (0.000,485.375) y (0.000,485.375) a (0.000,485.375) factor (0.000,485.375) of (0.000,485.375) 1220, (0.000,485.375) while (0.000,485.375) spac (0.000,485.375) e (0.000,485.375) complexit (0.000,485.375) y (0.000,485.375) will (0.000,485.375) increase (0.000,485.375) b (0.000,485.375) y (0.000,485.375) a (0.000,485.375) factor (0.000,485.375) of (0.000,485.375) 35. (0.000,485.375) These (0.000,485.375) are (0.000,485.375) v (0.000,485.375) alid (0.000,485.375) for (0.000,485.375) b (0.000,485.375) oth (0.000,485.375) factoriz (0.000,485.375) ation (0.000,485.375) and (0.000,485.375) discrete (0.000,485.375) log, (0.000,485.375) since (0.000,485.375) they (0.000,485.375) ha (0.000,485.375) v (0.000,485.375) e (0.000,485.375) the (0.000,485.375) same (0.000,485.375) asymptotic (0.000,485.375) b (0.000,485.375) eha (0.000,485.375) vior. (0.000,485.375) Hence, (0.000,485.375) for (0.000,485.375) DH-1024, (0.000,485.375) w (0.000,485.375) e (0.000,485.375) ge (0.000,485.375) t (0.000,485.375) a (0.000,485.375) total (0.000,485.375) cost (0.000,485.375) for (0.000,485.375) the (0.000,485.375) precomputation (0.000,485.375) of (0.000,485.375) ab (0.000,485.375) out (0.000,485.375) 45M (0.000,485.375) core-y (0.000,485.375) ears. (0.000,485.375) The (0.000,485.375) time (0.000,485.375) complexit (0.000,485.375) y (0.000,485.375) for (0.000,485.375) eac (0.000,485.375) h (0.000,485.375) individual (0.000,485.375) log (0.000,485.375) after (0.000,485.375) the (0.000,485.375) precomputation (0.000,485.375) should (0.000,485.375) b (0.000,485.375) e (0.000,485.375) m (0.000,485.375) ultiplied (0.000,485.375) b (0.000,485.375) y (0.000,485.375) 95. (0.000,485.375) This (0.000,485.375) last (0.000,485.375) n (0.000,485.375) um (0.000,485.375) b (0.000,485.375) er (0.000,485.375) do (0.000,485.375) es (0.000,485.375) not (0.000,485.375) corresp (0.000,485.375) ond (0.000,485.375) to (0.000,485.375) what (0.000,485.375) w (0.000,485.375) e (0.000,485.375) observ (0.000,485.375) ed (0.000,485.375) in (0.000,485.375) practice; (0.000,485.375) w (0.000,485.375) e (0.000,485.375) at (0.000,485.375) tribute (0.000,485.375) that (0.000,485.375) to (0.000,485.375) the (0.000,485.375) fact (0.000,485.375) that (0.000,485.375) the (0.000,485.375) descen (0.000,485.375) t (0.000,485.375) step (0.000,485.375) has (0.000,485.375) b (0.000,485.375) een (0.000,485.375) far (0.000,485.375) less (0.000,485.375) studied (0.000,485.375) b (0.000,485.375) oth (0.000,485.375) in (0.000,485.375) theory (0.000,485.375) and (0.000,485.375) in (0.000,485.375) practice (0.000,485.375) compared (0.000,485.375) to (0.000,485.375) the (0.000,485.375) other (0.000,485.375) steps. (0.000,485.375) F (0.000,485.375) or (0.000,485.375) 102 (0.000,485.375) 4-bit (0.000,485.375) descen (0.000,485.375) t, (0.000,485.375) w (0.000,485.375) e (0.000,485.375) exp (0.000,485.375) erimen (0.000,485.375) ted (0.000,485.375) with (0.000,485.375) our (0.000,485.375) early- (0.000,485.375) ab (0.000,485.375) ort (0.000,485.375) implemen (0.000,485.375) tation (0.000,485.375) to (0.000,485.375) inform (0.000,485.375) our (0.000,485.375) estimate (0.000,485.375) s (0.000,485.375) for (0.000,485.375) descen (0.000,485.375) t (0.000,485.375) initialization, (0.000,485.375) whic (0.000,485.375) h (0.000,485.375) should (0.000,485.375) dominate (0.000,485.375) the (0.000,485.375) individual (0.000,485.375) discrete (0.000,485.375) log (0.000,485.375) computation. (0.000,485.375) F (0.000,485.375) or (0.000,485.375) a (0.000,485.375) random (0.000,485.375) target (0.000,485.375) in (0.000,485.375) Oakley (0.000,485.375) Gro (0.000,485.375) up (0.000,485.375) 2, (0.000,485.375) initialization (0.000,485.375) to (0.000,485.375) ok (0.000,485.375) 22 (0.000,485.375) core-da (0.000,485.375) ys, (0.000,485.375) yielding (0.000,485.375) a (0.000,485.375) few (0.000,485.375) primes (0.000,485.375) of (0.000,485.375) at (0.000,485.375) most (0.000,485.375) 130 (0.000,485.375) bits (0.000,485.375) to (0.000,485.375) b (0.000,485.375) e (0.000,485.375) descended (0.000,485.375) further. (0.000,485.375) In (0.000,485.375) t (0.000,485.375) wice (0.000,485.375) this (0.000,485.375) time, (0.000,485.375) w (0.000,485.375) e (0.000,485.375) reac (0.000,485.375) hed (0.000,485.375) primes (0.000,485.375) of (0.000,485.375) ab (0.000,485.375) out (0.000,485.375) 110 (0.000,485.375) bits. (0.000,485.375) A (0.000,485.375) t (0.000,485.375) this (0.000,485.375) p (0.000,485.375) oin (0.000,485.375) t, (0.000,485.375) w (0.000,485.375) e (0.000,485.375) w (0.000,485.375) ere (0.000,485.375) certain (0.000,485.375) to (0.000,485.375) ha (0.000,485.375) v (0.000,485.375) e (0.000,485.375) b (0.000,485.375) o (0.000,485.375) otstrapp (0.000,485.375) ed (0.000,485.375) the (0.000,485.375) descen (0.000,485.375) t, (0.000,485.375) and (0.000,485.375) could (0.000,485.375) con (0.000,485.375) tin (0.000,485.375) ue (0.000,485.375) do (0.000,485.375) wn (0.000,485.375) to (0.000,485.375) the (0.000,485.375) smo (0.000,485.375) othness (0.000,485.375) b (0.000,485.375) ound (0.000,485.375) in (0.000,485.375) a (0.000,485.375) few (0.000,485.375) more (0.000,485.375) core-da (0.000,485.375) ys (0.000,485.375) if (0.000,485.375) prop (0.000,485.375) er (0.000,485.375) sieving (0.000,485.375) soft (0.000,485.375) w (0.000,485.375) are (0.000,485.375) w (0.000,485.375) ere (0.000,485.375) a (0.000,485.375) v (0.000,485.375) ailable. (0.000,485.375) Th (0.000,485.375) us (0.000,485.375) w (0.000,485.375) e (0.000,485.375) estimate (0.000,485.375) that (0.000,485.375) a (0.000,485.375) 1024-bit (0.000,485.375) descen (0.000,485.375) t (0.000,485.375) w (0.000,485.375) ould (0.000,485.375) tak (0.000,485.375) e (0.000,485.375) ab (0.000,485.375) out (0.000,485.375) 30 (0.000,485.375) core (0.000,485.375) -da (0.000,485.375) y (0.000,485.375) s, (0.000,485.375) once (0.000,485.375) again (0.000,485.375) easily (0.000,485.375) parallelizable. (0.000,485.375) Costs (0.000,485.375) in (0.000,485.375) hardw (0.000,485.375) are (0.000,485.375) Although (0.000,485.375) 45M (0.000,485.375) core-y (0.000,485.375) e (0.000,485.375) ars (0.000,485.375) is (0.000,485.375) a (0.000,485.375) h (0.000,485.375) uge (0.000,485.375) computational (0.000,485.375) effort, (0.000,485.375) it (0.000,485.375) is (0.000,485.375) not (0.000,485.375) nece (0.000,485.375) ssarily (0.000,485.375) out (0.000,485.375) of (0.000,485.375) reac (0.000,485.375) h (0.000,485.375) for (0.000,485.375) a (0.000,485.375) nation (0.000,485.375) state. (0.000,485.375) Moreo (0.000,485.375) v (0.000,485.375) er, (0.000,485.375) at (0.000,485.375) this (0.000,485.375) scale (0.000,485.375) , (0.000,485.375) significan (0.000,485.375) t (0.000,485.375) cost (0.000,485.375) sa (0.000,485.375) vings (0.000,485.375) could (0.000,485.375) b (0.000,485.375) e (0.000,485.375) realized (0.000,485.375) b (0.000,485.375) y (0.000,485.375) dev (0.000,485.375) eloping (0.000,485.375) application-sp (0.000,485.375) ecific (0.000,485.375) hardw (0.000,485.375) are. (0.000,485.375) Sieving (0.000,485.375) is (0.000,485.375) a (0.000,485.375) natural (0.000,485.375) target (0.000,485.375) for (0.000,485.375) hardw (0.000,485.375) are (0.000,485.375) im (0.000,485.375) ple (0.000,485.375) m (0.000,485.375) e (0.000,485.375) n (0.000,485.375) tation. (0.000,485.375) T (0.000,485.375) o (0.000,485.375) our (0.000,485.375) k (0.000,485.375) no (0.000,485.375) w (0.000,485.375) ledge, (0.000,485.375) the (0.000,485.375) b (0.000,485.375) est (0.000,485.375) prior (0.000,485.375) description (0.000,485.375) of (0.000,485.375) an (0.000,485.375) ASIC (0.000,485.375) implemen (0.000,485.375) tation (0.000,485.375) of (0.000,485.375) 1024-bit (0.000,485.375) sieving (0.000,485.375) is (0.000,485.375) the (0.000,485.375) 2007 (0.000,485.375) w (0.000,485.375) ork (0.000,485.375) of (0.000,485.375) Geisel- (0.000,485.375) mann (0.000,485.375) and (0.000,485.375) Stein (0.000,485.375) w (0.000,485.375) andt (0.000,485.375) [18]. (0.000,485.375) In (0.000,485.375) the (0.000,485.375) follo (0.000,485.375) wing, (0.000,485.375) w (0.000,485.375) e (0.000,485.375) up (0.000,485.375) date (0.000,485.375) t (0.000,485.375) heir (0.000,485.375) estimates (0.000,485.375) for (0.000,485.375) mo (0.000,485.375) dern (0.000,485.375) tec (0.000,485.375) hniques (0.000,485.375) and (0.000,485.375) adjust (0.000,485.375) parameters (0.000,485.375) f (0.000,485.375) or (0.000,485.375) discrete (0.000,485.375) log. (0.000,485.375) W (0.000,485.375) e (0.000,485.375) increase (0.000,485.375) their (0.000,485.375) c (0.000,485.375) hip (0.000,485.375) coun (0.000,485.375) t (0.000,485.375) b (0.000,485.375) y (0.000,485.375) a (0.000,485.375) fact (0.000,485.375) or (0.000,485.375) of (0.000,485.375) ten (0.000,485.375) to (0.000,485.375) siev (0.000,485.375) e (0.000,485.375) more (0.000,485.375) and (0.000,485.375) sa (0.000,485.375) v (0.000,485.375) e (0.000,485.375) on (0.000,485.375) linear (0.000,485.375) algebra (0.000,485.375) as (0.000,485.375) ab (0.000,485.375) o (0.000,485.375) v (0.000,485.375) e, (0.000,485.375) giving (0.000,485.375) an (0.000,485.375) esti- (0.000,485.375) mate (0.000,485.375) of (0.000,485.375) 3M (0.000,485.375) c (0.000,485.375) hips (0.000,485.375) to (0.000,485.375) complete (0.000,485.375) sieving (0.000,485.375) in (0.000,485.375) one (0.000,485.375) y (0.000,485.375) ear. (0.000,485.375) Shrinking (0.000,485.375) the (0.000,485.375) dies (0.000,485.375) from (0.000,485.375) the (0.000,485.375) 130 (0.000,485.375) nm (0.000,485.375) tec (0.000,485.375) hnology (0.000,485.375) no (0.000,485.375) de (0.000,485.375) used (0.000,485.375) in (0.000,485.375) the (0.000,485.375) pap (0.000,485.375) er (0.000,485.375) t (0.000,485.375) o (0.000,485.375) a (0.000,485.375) more (0.000,485.375) mo (0.000,485.375) dern (0.000,485.375) size (0.000,485.375) reduces (0.000,485.375) costs, (0.000,485.375) as (0.000,485.375) transistors (0.000,485.375) are (0.000,485.375) c (0.000,485.375) heap (0.000,485.375) er (0.000,485.375) at (0.000,485.375) new (0.000,485.375) er (0.000,485.375) tec (0.000,485.375) hnologie (0.000,485.375) s. (0.000,485.375) With (0.000,485.375) standard (0.000,485.375) transistor (0.000,485.375) costs (0.000,485.375) and (0.000,485.375) uti- (0.000,485.375) lization, (0.000,485.375) this (0.000,485.375) w (0.000,485.375) ould (0.000,485.375) cost (0.000,485.375) ab (0.000,485.375) out (0.000,485.375) $2 (0.000,485.375) p (0.000,485.375) er (0.000,485.375) c (0.000,485.375) hip (0.000,485.375) to (0.000,485.375) man (0.000,485.375) ufacture, (0.000,485.375) af- (0.000,485.375) ter (0.000,485.375) fix (0.000,485.375) e (0.000,485.375) d (0.000,485.375) design (0.000,485.375) and (0.000,485.375) tap (0.000,485.375) e-out (0.000,485.375) costs (0.000,485.375) of (0.000,485.375) roughly (0.000,485.375) $2M (0.000,485.375) [32]. (0.000,485.375) This (0.000,485.375) suggests (0.000,485.375) that (0.000,485.375) an (0.000,485.375) $8M (0.000,485.375) in (0.000,485.375) v (0.000,485.375) estmen (0.000,485.375) t (0.000,485.375) w (0.000,485.375) ould (0.000,485.375) buy (0.000,485.375) enough (0.000,485.375) ASIC (0.000,485.375) s (0.000,485.375) to (0.000,485.375) complete (0.000,485.375) the (0.000,485.375) DH (0.000,485.375) -1024 (0.000,485.375) sieving (0.000,485.375) precomputation (0.000,485.375) in (0.000,485.375) one (0.000,485.375) y (0.000,485.375) ear. (0.000,485.375) Since (0.000,485.375) a (0.000,485.375) step (0.000,485.375) of (0.000,485.375) descen (0.000,485.375) t (0.000,485.375) uses (0.000,485.375) sieving, (0.000,485.375) the (0.000,485.375) same (0.000,485.375) hardw (0.000,485.375) are (0.000,485.375) could (0.000,485.375) lik (0.000,485.375) ely (0.000,485.375) b (0.000,485.375) e (0.000,485.375) reused (0.000,485.375) to (0.000,485.375) sp (0.000,485.375) eed (0.000,485.375) calculations (0.000,485.375) of (0.000,485.375) individual (0.000,485.375) logs. (0.000,485.375) Estimating (0.000,485.375) the (0.000,485.375) financial (0.000,485.375) cost (0.000,485.375) for (0.000,485.375) the (0.000,485.375) linear (0.000,485.375) algebra (0.000,485.375) is (0.000,485.375) more (0.000,485.375) difficult, (0.000,485.375) since (0.000,485.375) there (0.000,485.375) has (0.000,485.375) b (0.000,485.375) een (0.000,485.375) little (0.000,485.375) w (0.000,485.375) ork (0.000,485.375) on (0.000,485.375) designing (0.000,485.375) c (0.000,485.375) hips (0.000,485.375) that (0.000,485.375) are (0.000,485.375) suitable (0.000,485.375) for (0.000,485.375) the (0.000,485.375) larger (0.000,485.375) fields (0.000,485.375) in (0.000,485.375) v (0.000,485.375) olv (0.000,485.375) ed (0.000,485.375) in (0.000,485.375) discrete (0.000,485.375) log. (0.000,485.375) T (0.000,485.375) o (0.000,485.375) deriv (0.000,485.375) e (0.000,485.375) a (0.000,485.375) rough (0.000,485.375) estimate, (0.000,485.375) w (0.000,485.375) e (0.000,485.375) can (0.000,485.375) b (0.000,485.375) egin (0.000,485.375) with (0.000,485.375) general (0.000,485.375) purp (0.000,485.375) ose (0.000,485.375) hardw (0.000,485.375) are (0.000,485.375) and (0.000,485.375) the (0.000,485.375) core-y (0.000,485.375) ear (0.000,485.375) estimate (0.000,485.375) from (0.000,485.375) T (0.000,485.375) able (0.000,485.375) 2. (0.000,485.375) The (0.000,485.375) Titan (0.000,485.375) sup (0.000,485.375) ercomputer (0.000,485.375) [39] (0.000,485.375) — (0.000,485.375) at (0.000,485.375) 300,000 (0.000,485.375) CPU (0.000,485.375) cores, (0.000,485.375) curren (0.000,485.375) tly (0.000,485.375) the (0.000,485.375) m (0.000,485.375) o (0.000,485.375) s (0.000,485.375) t (0.000,485.375) p (0.000,485.375) o (0.000,485.375) w (0.000,485.375) erful (0.000,485.375) sup (0.000,485.375) e (0.000,485.375) rcomputer (0.000,485.375) in (0.000,485.375) the (0.000,485.375) U.S. (0.000,485.375) — (0.000,485.375) w (0.000,485.375) ould (0.000,485.375) tak (0.000,485.375) e (0.000,485.375) 117 (0.000,485.375) y (0.000,485.375) ears (0.000,485.375) to (0.000,485.375) complete (0.000,485.375) the (0.000,485.375) 1024-bit (0.000,485.375) linear (0.000,485.375) algebra (0.000,485.375) stage. (0.000,485.375) Titan (0.000,485.375) w (0.000,485.375) as (0.000,485.375) co (0.000,485.375) ns (0.000,485.375) t (0.000,485.375) ructed (0.000,485.375) in (0.000,485.375) 2012 (0.000,485.375) for (0.000,485.375) $94M, (0.000,485.375) suggesting (0.000,485.375) a (0.000,485.375) cost (0.000,485.375) o (0.000,485.375) f (0.000,485.375) $11B (0.000,485.375) in (0.000,485.375) sup (0.000,485.375) e (0.000,485.375) rcomputers (0.000,485.375) to (0.000,485.375) finish (0.000,485.375) this (0.000,485.375) step (0.000,485.375) in (0.000,485.375) a (0.000,485.375) y (0.000,485.375) ear. (0.000,485.375) In (0.000,485.375) the (0.000,485.375) con (0.000,485.375) text (0.000,485.375) of (0.000,485.375) factorization, (0.000,485.375) mo (0.000,485.375) ving (0.000,485.375) linear (0.000,485.375) algebra (0.000,485.375) from (0.000,485.375) general (0.000,485.375) purp (0.000,485.375) ose (0.000,485.375) CPUs (0.000,485.375) to (0.000,485.375) ASICs (0.000,485.375) has (0.000,485.375) b (0.000,485.375) een (0.000,485.375) estimated (0.000,485.375) to (0.000,485.375) reduce (0.000,485.375) costs (0.000,485.375) b (0.000,485.375) y (0.000,485.375) a (0.000,485.375) factor (0.000,485.375) of (0.000,485.375) 80 (0.000,485.375) [17]. (0.000,485.375) If (0.000,485.375) w (0.000,485.375) e (0.000,485.375) optimistically (0.000,485.375) assume (0.000,485.375) that (0.000,485.375) a (0.000,485.375) similar (0.000,485.375) reduction (0.000,485.375) can (0.000,485.375) b (0.000,485.375) e (0.000,485.375) ac (0.000,485.375) hiev (0.000,485.375) ed (0.000,485.375) for (0.000,485.375) discrete (0.000,485.375) log, (0.000,485.375) the (0.000,485.375) hardw (0.000,485.375) are (0.000,485.375) cost (0.000,485.375) to (0.000,485.375) p (0.000,485.375) erform (0.000,485.375) the (0.000,485.375) linear (0.000,485.375) algebra (0.000,485.375) for (0.000,485.375) DH-1024 (0.000,485.375) in (0.000,485.375) one (0.000,485.375) y (0.000,485.375) ear (0.000,485.375) is (0.000,485.375) plausibly (0.000,485.375) on (0.000,485.375) the (0.000,485.375) order (0.000,485.375) of (0.000,485.375) h (0.000,485.375) undreds (0.000,485.375) of (0.000,485.375) m (0.000,485.375) illions (0.000,485.375) of (0.000,485.375) dollars. (0.000,485.375) T (0.000,485.375) o (0.000,485.375) put (0.000,485.375) this (0.000,485.375) dollar (0.000,485.375) figure (0.000,485.375) in (0.000,485.375) con (0.000,485.375) text, (0.000,485.375) t (0.000,485.375) he (0.000,485.375) FY (0.000,485.375) 2012 (0.000,485.375) bud- (0.000,485.375) get (0.000,485.375) f (0.000,485.375) or (0.000,485.375) the (0.000,485.375) U.S. (0.000,485.375) Consolidated (0.000,485.375) C (0.000,485.375) ry (0.000,485.375) pto (0.000,485.375) logic (0.000,485.375) Program (0.000,485.375) (w (0.000,485.375) hic (0.000,485.375) h (0.000,485.375) includes (0.000,485.375) the (0.000,485.375) N (0.000,485.375) SA) (0.000,485.375) w (0.000,485.375) as (0.000,485.375) $10.5 (0.000,485.375) billion (0.000,485.375) 4 (0.000,485.375) [57]. (0.000,485.375) The (0.000,485.375) agency’s (0.000,485.375) classified (0.000,485.375) 2013 (0.000,485.375) budget (0.000,485.375) request, (0.000,485.375) whic (0.000,485.375) h (0.000,485.375) prioritized (0.000,485.375) in (0.000,485.375) v (0.000,485.375) estmen (0.000,485.375) t (0.000,485.375) in (0.000,485.375) “groundbreaking (0.000,485.375) cryptanalytic (0.000,485.375) capabilities (0.000,485.375) to (0.000,485.375) defeat (0.000,485.375) ad- (0.000,485.375) v (0.000,485.375) ersarial (0.000,485.375) cryptograph (0.000,485.375) y (0.000,485.375) and (0.000,485.375) exploit (0.000,485.375) in (0.000,485.375) ternet (0.000,485.375) traffic,” (0.000,485.375) included (0.000,485.375) notable (0.000,485.375) $100M (0.000,485.375) increases (0.000,485.375) in (0.000,485.375) t (0.000,485.375) w (0.000,485.375) o (0.000,485.375) progra (0.000,485.375) m (0.000,485.375) s (0.000,485.375) [57]: (0.000,485.375) “cryptanalytic (0.000,485.375) IT (0.000,485.375) services” (0.000,485.375) (to (0.000,485.375) $247M), (0.000,485.375) and (0.000,485.375) a (0.000,485.375) cryptically (0.000,485.375) named (0.000,485.375) “cryptanal- (0.000,485.375) ysis (0.000,485.375) and (0.000,485.375) exploitation (0.000,485.375) services (0.000,485.375) program (0.000,485.375) C” (0.000,485.375) (to (0.000,485.375) $360M). (0.000,485.375) NSA’s (0.000,485.375) leak (0.000,485.375) ed (0.000,485.375) strategic (0.000,485.375) plan (0.000,485.375) for (0.000,485.375) the (0.000,485.375) p (0.000,485.375) erio (0.000,485.375) d (0.000,485.375) called (0.000,485.375) for (0.000,485.375) it (0.000,485.375) to (0.000,485.375) “c (0.000,485.375) on (0.000,485.375) tin (0.000,485.375) ue (0.000,485.375) to (0.000,485.375) in (0.000,485.375) v (0.000,485.375) est (0.000,485.375) in (0.000,485.375) the (0.000,485.375) industrial (0.000,485.375) base (0.000,485.375) and (0.000,485.375) driv (0.000,485.375) e (0.000,485.375) the (0.000,485.375) state (0.000,485.375) of (0.000,485.375) the (0.000,485.375) art (0.000,485.375) for (0.000,485.375) high (0.000,485.375) p (0.000,485.375) erformance (0.000,485.375) computing (0.000,485.375) to (0.000,485.375) main (0.000,485.375) tain (0.000,485.375) pre-eminen (0.000,485.375) t (0.000,485.375) cryptanalytic (0.000,485.375) ca (0.000,485.375) pabilit (0.000,485.375) y (0.000,485.375) for (0.000,485.375) the (0.000,485.375) nation” (0.000,485.375) [63]. (0.000,485.375) 4.2 (0.000,485.375) Is (0.000,485.375) NSA (0.000,485.375) Br (0.000,485.375) eaking (0.000,485.375) 1024-bit (0.000,485.375) DH? (0.000,485.375) Our (0.000,485.375) calculations (0.000,485.375) suggest (0.000,485.375) that (0.000,485.375) it (0.000,485.375) is (0.000,485.375) plausibly (0.000,485.375) within (0.000,485.375) NSA’s (0.000,485.375) resources (0.000,485.375) to (0.000,485.375) ha (0.000,485.375) v (0.000,485.375) e (0.000,485.375) p (0.000,485.375) erformed (0.000,485.375) n (0.000,485.375) um (0.000,485.375) b (0.000,485.375) er (0.000,485.375) fie (0.000,485.375) ld (0.000,485.375) siev (0.000,485.375) e (0.000,485.375) preco (0.000,485.375) m (0.000,485.375) put (0.000,485.375) a- (0.000,485.375) tions (0.000,485.375) for (0.000,485.375) at (0.000,485.375) least (0.000,485.375) a (0.000,485.375) small (0.000,485.375) n (0.000,485.375) um (0.000,485.375) b (0.000,485.375) er (0.000,485.375) of (0.000,485.375) 1024-bit (0.000,485.375) Diffie-He (0.000,485.375) llm (0.000,485.375) an (0.000,485.375) groups. (0.000,485.375) This (0.000,485.375) w (0.000,485.375) ould (0.000,485.375) allo (0.000,485.375) w (0.000,485.375) the (0.000,485.375) m (0.000,485.375) to (0.000,485.375) break (0.000,485.375) an (0.000,485.375) y (0.000,485.375) k (0.000,485.375) ey (0.000,485.375) exc (0.000,485.375) hanges (0.000,485.375) made (0.000,485.375) with (0.000,485.375) those (0.000,485.375) groups (0.000,485.375) in (0.000,485.375) close (0.000,485.375) to (0.000,485.375) real (0.000,485.375) time. (0.000,485.375) If (0.000,485.375) true, (0.000,485.375) this (0.000,485.375) w (0.000,485.375) ould (0.000,485.375) answ (0.000,485.375) er (0.000,485.375) one (0.000,485.375) of (0.000,485.375) the (0.000,485.375) ma (0.000,485.375) j (0.000,485.375) or (0.000,485.375) cryptographic (0.000,485.375) questions (0.000,485.375) raised (0.000,485.375) b (0.000,485.375) y (0.000,485.375) the (0.000,485.375) Edw (0.000,485.375) ard (0.000,485.375) Sno (0.000,485.375) wden (0.000,485.375) leaks: (0.000,485.375) Ho (0.000,485.375) w (0.000,485.375) is (0.000,485.375) NSA (0.000,485.375) defeating (0.000,485.375) the (0.000,485.375) encryption (0.000,485.375) for (0.000,485.375) widely (0.000,485.375) used (0.000,485.375) VPN (0.000,485.375) proto (0.000,485.375) cols? (0.000,119.552) 4 (0.000,119.552) The (0.000,119.552) National (0.000,119.552) Science (0.000,119.552) F (0.000,119.552) oundation’s (0.000,119.552) budget (0.000,119.552) w (0.000,119.552) as (0.000,119.552) $7 (0.000,119.552) billion. (0.000,119.552) 8 (0.000,0.000) Classified (0.000,0.000) do (0.000,0.000) cumen (0.000,0.000) ts (0.000,0.000) published (0.000,0.000) b (0.000,0.000) y (0.000,0.000) Der (0.000,0.000) Spiegel (0.000,0.000) [46] (0.000,0.000) indi- (0.000,0.000) cate (0.000,0.000) that (0.000,0.000) NSA (0.000,0.000) is (0.000,0.000) passiv (0.000,0.000) ely (0.000,0.000) decrypting (0.000,0.000) IPsec (0.000,0.000) connections (0.000,0.000) at (0.000,0.000) significan (0.000,0.000) t (0.000,0.000) scale. (0.000,0.000) The (0.000,0.000) do (0.000,0.000) cumen (0.000,0.000) ts (0.000,0.000) do (0.000,0.000) not (0.000,0.000) describ (0.000,0.000) e (0.000,0.000) the (0.000,0.000) crypt- (0.000,0.000) analytic (0.000,0.000) tec (0.000,0.000) hniques (0.000,0.000) used, (0.000,0.000) but (0.000,0.000) they (0.000,0.000) do (0.000,0.000) pro (0.000,0.000) vide (0.000,0.000) an (0.000,0.000) o (0.000,0.000) v (0.000,0.000) erview (0.000,0.000) of (0.000,0.000) the (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) system (0.000,0.000) arc (0.000,0.000) hitec (0.000,0.000) ture. (0.000,0.000) After (0.000,0.000) reviewing (0.000,0.000) ho (0.000,0.000) w (0.000,0.000) IPsec (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) establishmen (0.000,0.000) t (0.000,0.000) w (0.000,0.000) orks, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) will (0.000,0.000) use (0.000,0.000) the (0.000,0.000) published (0.000,0.000) informa- (0.000,0.000) tion (0.000,0.000) to (0.000,0.000) ev (0.000,0.000) aluate (0.000,0.000) the (0.000,0.000) h (0.000,0.000) yp (0.000,0.000) ot (0.000,0.000) hesis (0.000,0.000) that (0.000,0.000) the (0.000,0.000) NSA (0.000,0.000) is (0.000,0.000) lev (0.000,0.000) eraging (0.000,0.000) precomputation (0.000,0.000) to (0.000,0.000) calculate (0.000,0.000) discrete (0.000,0.000) logs (0.000,0.000) at (0.000,0.000) scale. (0.000,0.000) IKE (0.000,0.000) In (0.000,0.000) ternet (0.000,0.000) Key (0.000,0.000) Exc (0.000,0.000) hange (0.000,0.000) (IKE) (0.000,0.000) is (0.000,0.000) the (0.000,0.000) main (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) es- (0.000,0.000) tablishmen (0.000,0.000) t (0.000,0.000) proto (0.000,0.000) col (0.000,0.000) used (0.000,0.000) for (0.000,0.000) IPsec (0.000,0.000) VPNs. (0.000,0.000) There (0.000,0.000) are (0.000,0.000) t (0.000,0.000) w (0.000,0.000) o (0.000,0.000) v (0.000,0.000) ersions, (0.000,0.000) IKEv1 (0.000,0.000) [22] (0.000,0.000) and (0.000,0.000) IKEv2 (0.000,0.000) [25], (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) differ (0.000,0.000) in (0.000,0.000) mes- (0.000,0.000) sage (0.000,0.000) structure (0.000,0.000) but (0.000,0.000) are (0.000,0.000) conceptually (0.000,0.000) similar. (0.000,0.000) F (0.000,0.000) or (0.000,0.000) the (0.000,0.000) sak (0.000,0.000) e (0.000,0.000) of (0.000,0.000) brevit (0.000,0.000) y (0.000,0.000) , (0.000,0.000) w (0.000,0.000) e (0.000,0.000) will (0.000,0.000) use (0.000,0.000) IKEv1 (0.000,0.000) terminology (0.000,0.000) . (0.000,0.000) Eac (0.000,0.000) h (0.000,0.000) IKE (0.000,0.000) session (0.000,0.000) b (0.000,0.000) egins (0.000,0.000) with (0.000,0.000) a (0.000,0.000) Phase (0.000,0.000) 1 (0.000,0.000) handshak (0.000,0.000) e, (0.000,0.000) in (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) the (0.000,0.000) clien (0.000,0.000) t (0.000,0.000) and (0.000,0.000) serv (0.000,0.000) er (0.000,0.000) select (0.000,0.000) a (0.000,0.000) Diffie-Hellman (0.000,0.000) group (0.000,0.000) from (0.000,0.000) a (0.000,0.000) small (0.000,0.000) set (0.000,0.000) of (0.000,0.000) standardized (0.000,0.000) parameters (0.000,0.000) and (0.000,0.000) p (0.000,0.000) erform (0.000,0.000) a (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) exc (0.000,0.000) hange (0.000,0.000) to (0.000,0.000) establish (0.000,0.000) a (0.000,0.000) shared (0.000,0.000) secret. (0.000,0.000) The (0.000,0.000) shared (0.000,0.000) secret (0.000,0.000) is (0.000,0.000) com (0.000,0.000) bined (0.000,0.000) with (0.000,0.000) other (0.000,0.000) cleart (0.000,0.000) ext (0.000,0.000) v (0.000,0.000) alues (0.000,0.000) transmitted (0.000,0.000) b (0.000,0.000) y (0.000,0.000) eac (0.000,0.000) h (0.000,0.000) side, (0.000,0.000) suc (0.000,0.000) h (0.000,0.000) as (0.000,0.000) nonces (0.000,0.000) and (0.000,0.000) co (0.000,0.000) okies, (0.000,0.000) to (0.000,0.000) deriv (0.000,0.000) e (0.000,0.000) a (0.000,0.000) v (0.000,0.000) alue (0.000,0.000) called (0.000,0.000) SKEYID (0.000,0.000) . (0.000,0.000) IKE (0.000,0.000) pro (0.000,0.000) vides (0.000,0.000) sev (0.000,0.000) eral (0.000,0.000) authen (0.000,0.000) tication (0.000,0.000) mec (0.000,0.000) hanisms, (0.000,0.000) including (0.000,0.000) sy (0.000,0.000) mmetric (0.000,0.000) pre-shared (0.000,0.000) k (0.000,0.000) eys (0.000,0.000) (PSK); (0.000,0.000) when (0.000,0.000) IKEv1 (0.000,0.000) is (0.000,0.000) authen (0.000,0.000) ticated (0.000,0.000) with (0.000,0.000) a (0.000,0.000) PSK, (0.000,0.000) this (0.000,0.000) v (0.000,0.000) alue (0.000,0.000) is (0.000,0.000) incorp (0.000,0.000) orated (0.000,0.000) in (0.000,0.000) to (0.000,0.000) the (0.000,0.000) deriv (0.000,0.000) ation (0.000,0.000) of (0.000,0.000) SKEYID (0.000,0.000) . (0.000,0.000) The (0.000,0.000) resulting (0.000,0.000) SKEYID (0.000,0.000) is (0.000,0.000) used (0.000,0.000) to (0.000,0.000) encrypt (0.000,0.000) and (0.000,0.000) authen (0.000,0.000) ticate (0.000,0.000) a (0.000,0.000) Phase (0.000,0.000) 2 (0.000,0.000) handshak (0.000,0.000) e. (0.000,0.000) Phase (0.000,0.000) 2 (0.000,0.000) establishes (0.000,0.000) the (0.000,0.000) parameters (0.000,0.000) and (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) material, (0.000,0.000) KEYMA (0.000,0.000) T (0.000,0.000) , (0.000,0.000) for (0.000,0.000) a (0.000,0.000) cryptographic (0.000,0.000) transp (0.000,0.000) ort (0.000,0.000) proto (0.000,0.000) col (0.000,0.000) used (0.000,0.000) to (0.000,0.000) protect (0.000,0.000) subsequen (0.000,0.000) t (0.000,0.000) tra (0.000,0.000) ffi (0.000,0.000) c, (0.000,0.000) suc (0.000,0.000) h (0.000,0.000) as (0.000,0.000) Encapsu- (0.000,0.000) lating (0.000,0.000) Securit (0.000,0.000) y (0.000,0.000) P (0.000,0.000) a (0.000,0.000) yload (0.000,0.000) (ESP) (0.000,0.000) [27] (0.000,0.000) or (0.000,0.000) A (0.000,0.000) uthen (0.000,0.000) ticated (0.000,0.000) Header (0.000,0.000) (AH) (0.000,0.000) [26]. (0.000,0.000) In (0.000,0.000) some (0.000,0.000) circumstances, (0.000,0.000) this (0.000,0.000) phase (0.000,0.000) include (0.000,0.000) s (0.000,0.000) an (0.000,0.000) additional (0.000,0.000) round (0.000,0.000) of (0.000,0.000) Diffie-Hellman. (0.000,0.000) Ultimately (0.000,0.000) , (0.000,0.000) KEYMA (0.000,0.000) T (0.000,0.000) is (0.000,0.000) deriv (0.000,0.000) ed (0.000,0.000) from (0.000,0.000) SKEYID (0.000,0.000) , (0.000,0.000) additional (0.000,0.000) nonces, (0.000,0.000) and (0.000,0.000) the (0.000,0.000) result (0.000,0.000) of (0.000,0.000) the (0.000,0.000) optio (0.000,0.000) nal (0.000,0.000) Phase (0.000,0.000) 2 (0.000,0.000) Diffie-Hellman (0.000,0.000) exc (0.000,0.000) hange. (0.000,0.000) NSA’s (0.000,0.000) VPN (0.000,0.000) exploitation (0.000,0.000) pro (0.000,0.000) cess (0.000,0.000) The (0.000,0.000) do (0.000,0.000) cumen (0.000,0.000) ts (0.000,0.000) pub- (0.000,0.000) lished (0.000,0.000) b (0.000,0.000) y (0.000,0.000) Der (0.000,0.000) Spiegel (0.000,0.000) describ (0.000,0.000) e (0.000,0.000) a (0.000,0.000) system (0.000,0.000) named (0.000,0.000) TURMOIL (0.000,0.000) that (0.000,0.000) is (0.000,0.000) used (0.000,0.000) to (0.000,0.000) collect (0.000,0.000) and (0.000,0.000) decrypt (0.000,0.000) VPN (0.000,0.000) traffic. (0.000,0.000) The (0.000,0.000) evidence (0.000,0.000) indicates (0.000,0.000) that (0.000,0.000) this (0.000,0.000) decryption (0.000,0.000) is (0.000,0.000) p (0.000,0.000) erformed (0.000,0.000) using (0.000,0.000) passiv (0.000,0.000) e (0.000,0.000) ea (0.000,0.000) v (0.000,0.000) esdropping (0.000,0.000) and (0.000,0.000) do (0.000,0.000) es (0.000,0.000) not (0.000,0.000) re (0.000,0.000) q (0.000,0.000) uire (0.000,0.000) message (0.000,0.000) injection (0.000,0.000) or (0.000,0.000) man-in-the-middle (0.000,0.000) attac (0.000,0.000) ks (0.000,0.000) on (0.000,0.000) IPsec (0.000,0.000) or (0.000,0.000) IKE. (0.000,0.000) Figure (0.000,0.000) 4, (0.000,0.000) an (0.000,0.000) excerpt (0.000,0.000) from (0.000,0.000) one (0.000,0.000) of (0.000,0.000) the (0.000,0.000) do (0.000,0.000) cumen (0.000,0.000) ts (0.000,0.000) [67], (0.000,0.000) illustrates (0.000,0.000) the (0.000,0.000) flo (0.000,0.000) w (0.000,0.000) of (0.000,0.000) information (0.000,0.000) through (0.000,0.000) the (0.000,0.000) TURMOIL (0.000,0.000) system (0.000,0.000) The (0.000,0.000) initial (0.000,0.000) pha (0.000,0.000) s (0.000,0.000) e (0.000,0.000) s (0.000,0.000) of (0.000,0.000) the (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) in (0.000,0.000) v (0.000,0.000) olv (0.000,0.000) e (0.000,0.000) c (0.000,0.000) ollecting (0.000,0.000) IKE (0.000,0.000) and (0.000,0.000) ESP (0.000,0.000) pa (0.000,0.000) yloads (0.000,0.000) and (0.000,0.000) dete (0.000,0.000) rm (0.000,0.000) ining (0.000,0.000) w (0.000,0.000) hether (0.000,0.000) the (0.000,0.000) traffic (0.000,0.000) matc (0.000,0.000) hes (0.000,0.000) an (0.000,0.000) y (0.000,0.000) task (0.000,0.000) ed (0.000,0.000) selector (0.000,0.000) [65]. (0.000,0.000) If (0.000,0.000) so (0.000,0.000) , (0.000,0.000) TURMOIL (0.000,0.000) transmits (0.000,0.000) the (0.000,0.000) complete (0.000,0.000) IKE (0.000,0.000) handshak (0.000,0.000) e (0.000,0.000) and (0.000,0.000) ma (0.000,0.000) y (0.000,0.000) transmit (0.000,0.000) a (0.000,0.000) small (0.000,0.000) amoun (0.000,0.000) t (0.000,0.000) of (0.000,0.000) ESP (0.000,0.000) ciphertext (0.000,0.000) to (0.000,0.000) NSA’s (0.000,0.000) Cryptanalysis (0.000,0.000) and (0.000,0.000) Exploitation (0.000,0.000) Services (0.000,0.000) (CES) (0.000,0.000) [56, (0.000,0.000) 65] (0.000,0.000) via (0.000,0.000) a (0.000,0.000) secure (0.000,0.000) tunnel. (0.000,0.000) Within (0.000,0.000) CES, (0.000,0.000) a (0.000,0.000) sp (0.000,0.000) ecialized (0.000,0.000) VPN (0.000,0.000) A (0.000,0.000) ttac (0.000,0.000) k (0.000,0.000) Orc (0.000,0.000) he (0.000,0.000) strator (0.000,0.000) (V (0.000,0.000) A (0.000,0.000) O) (0.000,0.000) system (0.000,0.000) manages (0.000,0.000) a (0.000,0.000) collection (0.000,0.000) of (0.000,0.000) high-p (0.000,0.000) erformance (0.000,0.000) grid (0.000,0.000) computing (0.000,0.000) resources (0.000,0.000) lo (0.000,0.000) cated (0.000,0.000) at (0.000,0.000) NSA (0.000,0.000) Headquarters (0.000,0.000) and (0.000,0.000) in (0.000,0.000) a (0.000,0.000) data (0.000,0.000) cen (0.000,0.000) ter (0.000,0.000) at (0.000,0.000) Oak (0.000,0.000) Ridge (0.000,0.000) National (0.000,0.000) Lab (0.000,0.000) oratory (0.000,0.000) , (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) p (0.000,0.000) erform (0.000,0.000) the (0.000,0.000) computation (0.000,0.000) required (0.000,0.000) to (0.000,0.000) generate (0.000,0.000) the (0.000,0.000) ESP (0.000,0.000) session (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) [61, (0.000,0.000) 62, (0.000,0.000) 67]. (0.000,0.000) V (0.000,0.000) A (0.000,0.000) O (0.000,0.000) also (0.000,0.000) main (0.000,0.000) tains (0.000,0.000) a (0.000,0.000) database, (0.000,0.000) CORALREEF, (0.000,0.000) that (0.000,0.000) stores (0.000,0.000) cryp- (0.000,0.000) tographic (0.000,0.000) v (0.000,0.000) alues, (0.000,0.000) including (0.000,0.000) a (0.000,0.000) set (0.000,0.000) of (0.000,0.000) kno (0.000,0.000) wn (0.000,0.000) PSKs (0.000,0.000) and (0.000,0.000) the (0.000,0.000) resulting (0.000,0.000) “re (0.000,0.000) co (0.000,0.000) v (0.000,0.000) ered” (0.000,0.000) ESP (0.000,0.000) session (0.000,0.000) k (0.000,0.000) e (0.000,0.000) y (0.000,0.000) s (0.000,0.000) [60, (0.000,0.000) 61, (0.000,0.000) 67]. (0.000,0.000) The (0.000,0.000) ESP (0.000,0.000) traffic (0.000,0.000) itself (0.000,0.000) is (0.000,0.000) buff (0.000,0.000) ered (0.000,0.000) for (0.000,0.000) up (0.000,0.000) to (0.000,0.000) 15 (0.000,0.000) min (0.000,0.000) utes (0.000,0.000) [64], (0.000,0.000) un (0.000,0.000) t (0.000,0.000) il (0.000,0.000) CES (0.000,0.000) can (0.000,0.000) resp (0.000,0.000) ond (0.000,0.000) with (0.000,0.000) the (0.000,0.000) reco (0.000,0.000) v (0.000,0.000) ered (0.000,0.000) ESP (0.000,0.000) k (0.000,0.000) eys (0.000,0.000) if (0.000,0.000) they (0.000,0.000) w (0.000,0.000) ere (0.000,0.000) generated (0.000,0.000) correctly (0.000,0.000) . (0.000,0.000) Once (0.000,0.000) k (0.000,0.000) eys (0.000,0.000) ha (0.000,0.000) v (0.000,0.000) e (0.000,0.000) b (0.000,0.000) een (0.000,0.000) returned, (0.000,0.000) the (0.000,0.000) ESP (0.000,0.000) traffic (0.000,0.000) is (0.000,0.000) decrypted (0.000,0.000) via (0.000,0.000) hardw (0.000,0.000) are (0.000,0.000) accelerators (0.000,0.000) [5 (0.000,0.000) 9] (0.000,0.000) or (0.000,0.000) in (0.000,0.000) soft (0.000,0.000) w (0.000,0.000) are (0.000,0.000) [68, (0.000,0.000) 69]. (0.000,0.000) F (0.000,0.000) rom (0.000,0.000) this (0.000,0.000) p (0.000,0.000) oin (0.000,0.000) t, (0.000,0.000) decrypted (0.000,0.000) VPN (0.000,0.000) traffic (0.000,0.000) is (0.000,0.000) reinjected (0.000,0.000) in (0.000,0.000) to (0.000,0.000) TURMOIL (0.000,0.000) pro (0.000,0.000) cessing (0.000,0.000) infrastructure (0.000,0.000) and (0.000,0.000) passed (0.000,0.000) to (0.000,0.000) other (0.000,0.000) systems (0.000,0.000) for (0.000,0.000) storag (0.000,0.000) e (0.000,0.000) and (0.000,0.000) analysis (0.000,0.000) [69]. (0.000,0.000) The (0.000,0.000) do (0.000,0.000) cumen (0.000,0.000) ts (0.000,0.000) indicate (0.000,0.000) that (0.000,0.000) NSA (0.000,0.000) is (0.000,0.000) reco (0.000,0.000) v (0.000,0.000) ering (0.000,0.000) ESP (0.000,0.000) k (0.000,0.000) eys (0.000,0.000) at (0.000,0.000) large (0.000,0.000) scale, (0.000,0.000) wit (0.000,0.000) h (0.000,0.000) a (0.000,0.000) target (0.000,0.000) of (0.000,0.000) 100,000 (0.000,0.000) p (0.000,0.000) er (0.000,0.000) hour (0.000,0.000) [64]. (0.000,0.000) Figure (0.000,0.000) 4: (0.000,0.000) NSA’s (0.000,0.000) VPN (0.000,0.000) decryption (0.000,0.000) infrastructure. (0.000,0.000) This (0.000,0.000) classified (0.000,0.000) illustration (0.000,0.000) published (0.000,0.000) b (0.000,0.000) y (0.000,0.000) Der (0.000,0.000) Spiegel (0.000,0.000) [67] (0.000,0.000) sho (0.000,0.000) ws (0.000,0.000) captured (0.000,0.000) IKE (0.000,0.000) handshak (0.000,0.000) e (0.000,0.000) messages (0.000,0.000) b (0.000,0.000) eing (0.000,0.000) passed (0.000,0.000) to (0.000,0.000) a (0.000,0.000) high- (0.000,0.000) p (0.000,0.000) erformance (0.000,0.000) computing (0.000,0.000) system, (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) returns (0.000,0.000) the (0.000,0.000) symmetric (0.000,0.000) k (0.000,0.000) eys (0.000,0.000) f (0.000,0.000) o (0.000,0.000) r (0.000,0.000) ESP (0.000,0.000) session (0.000,0.000) traffic. (0.000,0.000) The (0.000,0.000) details (0.000,0.000) of (0.000,0.000) this (0.000,0.000) att (0.000,0.000) ac (0.000,0.000) k (0.000,0.000) are (0.000,0.000) consisten (0.000,0.000) t (0.000,0.000) with (0.000,0.000) an (0.000,0.000) efficien (0.000,0.000) t (0.000,0.000) break (0.000,0.000) for (0.000,0.000) 1024-bit (0.000,0.000) Diffie-Hellman. (0.000,0.000) Evidence (0.000,0.000) for (0.000,0.000) a (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) While (0.000,0.000) the (0.000,0.000) abilit (0.000,0.000) y (0.000,0.000) to (0.000,0.000) decrypt (0.000,0.000) VPN (0.000,0.000) traffic (0.000,0.000) do (0.000,0.000) es (0.000,0.000) not (0.000,0.000) b (0.000,0.000) y (0.000,0.000) itself (0.000,0.000) indicate (0.000,0.000) a (0.000,0.000) defeat (0.000,0.000) of (0.000,0.000) Diffie-Hellman, (0.000,0.000) there (0.000,0.000) are (0.000,0.000) sev (0.000,0.000) eral (0.000,0.000) features (0.000,0.000) of (0.000,0.000) IKE (0.000,0.000) and (0.000,0.000) the (0.000,0.000) V (0.000,0.000) A (0.000,0.000) O’s (0.000,0.000) op (0.000,0.000) eration (0.000,0.000) that (0.000,0.000) supp (0.000,0.000) ort (0.000,0.000) this (0.000,0.000) h (0.000,0.000) yp (0.000,0.000) othesis. (0.000,0.000) The (0.000,0.000) IKE (0.000,0.000) proto (0.000,0.000) col (0.000,0.000) has (0.000,0.000) b (0.000,0.000) een (0.000,0.000) extensiv (0.000,0.000) ely (0.000,0.000) analyzed (0.000,0.000) [9, (0.000,0.000) 36], (0.000,0.000) and (0.000,0.000) is (0.000,0.000) not (0.000,0.000) b (0.000,0.000) eliev (0.000,0.000) ed (0.000,0.000) to (0.000,0.000) b (0.000,0.000) e (0.000,0.000) exploitable (0.000,0.000) in (0.000,0.000) standard (0.000,0.000) configu- (0.000,0.000) rations (0.000,0.000) under (0.000,0.000) passiv (0.000,0.000) e (0.000,0.000) ea (0.000,0.000) v (0.000,0.000) esdropping (0.000,0.000) attac (0.000,0.000) ks. (0.000,0.000) In (0.000,0.000) order (0.000,0.000) to (0.000,0.000) reco (0.000,0.000) v (0.000,0.000) er (0.000,0.000) the (0.000,0.000) session (0.000,0.000) k (0.000,0.000) eys (0.000,0.000) for (0.000,0.000) t (0.000,0.000) he (0.000,0.000) ESP (0.000,0.000) or (0.000,0.000) AH (0.000,0.000) proto (0.000,0.000) cols, (0.000,0.000) the (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) m (0.000,0.000) ust (0.000,0.000) at (0.000,0.000) minim (0.000,0.000) um (0.000,0.000) reco (0.000,0.000) v (0.000,0.000) er (0.000,0.000) the (0.000,0.000) SKEYID (0.000,0.000) generated (0.000,0.000) b (0.000,0.000) y (0.000,0.000) the (0.000,0.000) Phase (0.000,0.000) 1 (0.000,0.000) exc (0.000,0.000) hange. (0.000,0.000) Absen (0.000,0.000) t (0.000,0.000) a (0.000,0.000) vulnerabilit (0.000,0.000) y (0.000,0.000) in (0.000,0.000) the (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) deriv (0.000,0.000) ation (0.000,0.000) function (0.000,0.000) or (0.000,0.000) transp (0.000,0.000) ort (0.000,0.000) encryption, (0.000,0.000) this (0.000,0.000) requires (0.000,0.000) the (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) to (0.000,0.000) reco (0.000,0.000) v (0.000,0.000) e (0.000,0.000) r (0.000,0.000) a (0.000,0.000) Diffie-Hellman (0.000,0.000) shared (0.000,0.000) secret (0.000,0.000) after (0.000,0.000) passiv (0.000,0.000) ely (0.000,0.000) observing (0.000,0.000) an (0.000,0.000) IKE (0.000,0.000) handshak (0.000,0.000) e. (0.000,0.000) While (0.000,0.000) IKE (0.000,0.000) is (0.000,0.000) designed (0.000,0.000) to (0.000,0.000) supp (0.000,0.000) ort (0.000,0.000) a (0.000,0.000) range (0.000,0.000) of (0.000,0.000) Diffie-Hellman (0.000,0.000) groups, (0.000,0.000) our (0.000,0.000) In (0.000,0.000) ternet-wide (0.000,0.000) scans (0.000,0.000) (§4.3) (0.000,0.000) sho (0.000,0.000) w (0.000,0.000) that (0.000,0.000) the (0.000,0.000) v (0.000,0.000) ast (0.000,0.000) ma (0.000,0.000) jorit (0.000,0.000) y (0.000,0.000) of (0.000,0.000) IKE (0.000,0.000) systems (0.000,0.000) select (0.000,0.000) one (0.000,0.000) particular (0.000,0.000) 1024-bit (0.000,0.000) DH (0.000,0.000) group, (0.000,0.000) Oakley (0.000,0.000) Group (0.000,0.000) 2, (0.000,0.000) ev (0.000,0.000) en (0.000,0.000) when (0.000,0.000) offered (0.000,0.000) stronger (0.000,0.000) groups. (0.000,0.000) Giv (0.000,0.000) en (0.000,0.000) an (0.000,0.000) efficien (0.000,0.000) t (0.000,0.000) oracle (0.000,0.000) for (0.000,0.000) solving (0.000,0.000) the (0.000,0.000) discrete (0.000,0.000) logarit (0.000,0.000) hm (0.000,0.000) problem, (0.000,0.000) attac (0.000,0.000) ks (0.000,0.000) on (0.000,0.000) IKE (0.000,0.000) a (0.000,0.000) re (0.000,0.000) p (0.000,0.000) ossible (0.000,0.000) pro (0.000,0.000) vided (0.000,0.000) that (0.000,0.000) the (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) can (0.000,0.000) obtain (0.000,0.000) the (0.000,0.000) follo (0.000,0.000) wing: (0.000,0.000) (1) (0.000,0.000) a (0.000,0.000) complete (0.000,0.000) t (0.000,0.000) w (0.000,0.000) o-sided (0.000,0.000) IKE (0.000,0.000) transcript, (0.000,0.000) including (0.000,0.000) the (0.000,0.000) Diffie-Hellman (0.000,0.000) ephemeral (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) s (0.000,0.000) g (0.000,0.000) a (0.000,0.000) and (0.000,0.000) g (0.000,0.000) b (0.000,0.000) as (0.000,0.000) w (0.000,0.000) ell (0.000,0.000) as (0.000,0.000) the (0.000,0.000) nonces (0.000,0.000) and (0.000,0.000) co (0.000,0.000) okies (0.000,0.000) transmitted (0.000,0.000) b (0.000,0.000) y (0.000,0.000) b (0.000,0.000) oth (0.000,0.000) sides (0.000,0.000) of (0.000,0.000) the (0.000,0.000) connection, (0.000,0.000) and (0.000,0.000) (2) (0.000,0.000) in (0.000,0.000) IKEv1 (0.000,0.000) only (0.000,0.000) , (0.000,0.000) the (0.000,0.000) PSK (0.000,0.000) used (0.000,0.000) in (0.000,0.000) deriving (0.000,0.000) SKEYID (0.000,0.000) . (0.000,0.000) Both (0.000,0.000) of (0.000,0.000) the (0.000,0.000) ab (0.000,0.000) o (0.000,0.000) v (0.000,0.000) e (0.000,0.000) requiremen (0.000,0.000) ts (0.000,0.000) are (0.000,0.000) also (0.000,0.000) presen (0.000,0.000) t (0.000,0.000) in (0.000,0.000) the (0.000,0.000) NSA’s (0.000,0.000) VPN (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) system. (0.000,0.000) As (0.000,0.000) Figure (0.000,0.000) 4 (0.000,0.000) illustrates, (0.000,0.000) a (0.000,0.000) hard (0.000,0.000) requiremen (0.000,0.000) t (0.000,0.000) of (0.000,0.000) the (0.000,0.000) V (0.000,0.000) A (0.000,0.000) O (0.000,0.000) is (0.000,0.000) the (0.000,0.000) need (0.000,0.000) to (0.000,0.000) obtain (0.000,0.000) the (0.000,0.000) c (0.000,0.000) omplete (0.000,0.000) t (0.000,0.000) w (0.000,0.000) o-sided (0.000,0.000) IKE (0.000,0.000) transcript (0.000,0.000) [60]. (0.000,0.000) The (0.000,0.000) published (0.000,0.000) do (0.000,0.000) cumen (0.000,0.000) ts (0.000,0.000) indicate (0.000,0.000) that (0.000,0.000) this (0.000,0.000) requiremen (0.000,0.000) t (0.000,0.000) substan (0.000,0.000) tially (0.000,0.000) increases (0.000,0.000) t (0.000,0.000) he (0.000,0.000) complexit (0.000,0.000) y (0.000,0.000) of (0.000,0.000) the (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) execution, (0.000,0.000) since (0.000,0.000) IKE (0.000,0.000) transcripts (0.000,0.000) m (0.000,0.000) ust (0.000,0.000) b (0.000,0.000) e (0.000,0.000) reassem (0.000,0.000) bled (0.000,0.000) (“paired”) (0.000,0.000) whenev (0.000,0.000) er (0.000,0.000) the (0.000,0.000) in (0.000,0.000) teraction (0.000,0.000) tra (0.000,0.000) v (0.000,0.000) erses (0.000,0.000) m (0.000,0.000) ultiple (0.000,0.000) net (0.000,0.000) w (0.000,0.000) ork (0.000,0.000) paths (0.000,0.000) [55, (0.000,0.000) 56, (0.000,0.000) 58, (0.000,0.000) 66]. (0.000,0.000) The (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) system (0.000,0.000) also (0.000,0.000) seems (0.000,0.000) to (0.000,0.000) require (0.000,0.000) kno (0.000,0.000) wledge (0.000,0.000) of (0.000,0.000) the (0.000,0.000) PSK. (0.000,0.000) Sev (0.000,0.000) eral (0.000,0.000) do (0.000,0.000) c (0.000,0.000) um (0.000,0.000) e (0.000,0.000) n (0.000,0.000) ts (0.000,0.000) describ (0.000,0.000) e (0.000,0.000) tec (0.000,0.000) hniques (0.000,0.000) for (0.000,0.000) analysts (0.000,0.000) to (0.000,0.000) lo (0.000,0.000) cate (0.000,0.000) a (0.000,0.000) P (0.000,0.000) SK (0.000,0.000) , (0.000,0.000) including (0.000,0.000) using (0.000,0.000) a (0.000,0.000) database (0.000,0.000) of (0.000,0.000) router (0.000,0.000) con- (0.000,0.000) figurations (0.000,0.000) [70, (0.000,0.000) 71], (0.000,0.000) the (0.000,0.000) CORALREEF (0.000,0.000) database (0.000,0.000) of (0.000,0.000) kno (0.000,0.000) wn (0.000,0.000) PSKs (0.000,0.000) [60], (0.000,0.000) previously (0.000,0.000) decrypted (0.000,0.000) SSH (0.000,0.000) traffic (0.000,0.000) [60], (0.000,0.000) or (0.000,0.000) system (0.000,0.000) administrator (0.000,0.000) “c (0.000,0.000) hatte (0.000,0.000) r” (0.000,0.000) [70]. (0.000,0.000) A (0.000,0.000) dditionally (0.000,0.000) , (0.000,0.000) NSA (0.000,0.000) is (0.000,0.000) willing (0.000,0.000) to (0.000,0.000) “[r]un (0.000,0.000) attac (0.000,0.000) ks (0.000,0.000) to (0.000,0.000) reco (0.000,0.000) v (0.000,0.000) er (0.000,0.000) PSK” (0.000,0.000) [60]. (0.000,0.000) Of (0.000,0.000) course, (0.000,0.000) this (0.000,0.000) explanation (0.000,0.000) is (0.000,0.000) not (0.000,0.000) disp (0.000,0.000) ositiv (0.000,0.000) e. (0.000,0.000) The (0.000,0.000) p (0.000,0.000) ossi- (0.000,0.000) bilit (0.000,0.000) y (0.000,0.000) remains (0.000,0.000) that (0.000,0.000) NSA (0.000,0.000) could (0.000,0.000) defeat (0.000,0.000) IPsec (0.000,0.000) using (0.000,0.000) alterna (0.000,0.000) tiv (0.000,0.000) e (0.000,0.000) means. (0.000,0.000) Certain (0.000,0.000) published (0.000,0.000) NSA (0.000,0.000) do (0.000,0.000) cumen (0.000,0.000) ts (0.000,0.000) refer (0.000,0.000) to (0.000,0.000) soft- (0.000,0.000) w (0.000,0.000) are (0.000,0.000) “implan (0.000,0.000) ts” (0.000,0.000) on (0.000,0.000) VPN (0.000,0.000) devices, (0.000,0.000) indicating (0.000,0.000) that (0.000,0.000) the (0.000,0.000) use (0.000,0.000) of (0.000,0.000) 9 (0.000,483.605) V (0.000,483.605) ulner (0.000,483.605) able (0.000,483.605) servers, (0.000,483.605) if (0.000,483.605) the (0.000,483.605) attac (0.000,483.605) ker (0.000,483.605) c (0.000,483.605) an (0.000,483.605) pr (0.000,483.605) e (0.000,483.605) c (0.000,483.605) ompu (0.000,483.605) te (0.000,483.605) for (0.000,483.605) . (0.000,483.605) . (0.000,483.605) . (0.000,314.666) all (0.000,314.666) 512-bit (0.000,314.666) groups (0.000,314.666) all (0.000,314.666) 768-bit (0.000,314.666) groups (0.000,314.666) one (0.000,314.666) 1024-bit (0.000,314.666) group (0.000,314.666) ten (0.000,314.666) 1024-bit (0.000,314.666) groups (0.000,483.605) HTTPS (0.000,483.605) T (0.000,483.605) op (0.000,483.605) 1M (0.000,483.605) w/ (0.000,483.605) activ (0.000,483.605) e (0.000,483.605) do (0.000,483.605) wngrade (0.000,483.605) 45,10 (0.000,483.605) 0 (0.000,483.605) (8.4%) (0.000,483.605) 45,100 (0.000,483.605) (8.4%) (0.000,483.605) 205,000 (0.000,483.605) (37.1%) (0.000,483.605) 309,000 (0.000,483.605) (56.1%) (0.000,483.605) HTTPS (0.000,483.605) T (0.000,483.605) op (0.000,483.605) 1M (0.000,483.605) 118 (0.000,483.605) (0.0%) (0.000,483.605) 407 (0.000,483.605) ( (0.000,483.605) 0 (0.000,483.605) .1%) (0.000,483.605) 98,500 (0.000,483.605) (17.9%) (0.000,483.605) 132,000 (0.000,483.605) (24.0%) (0.000,483.605) HTTPS (0.000,483.605) T (0.000,483.605) ruste (0.000,483.605) d (0.000,483.605) w/ (0.000,483.605) activ (0.000,483.605) e (0.000,483.605) do (0.000,483.605) wngrade (0.000,483.605) 489,000 (0.000,483.605) (3.4%) (0.000,483.605) 556,000 (0.000,483.605) (3.9%) (0.000,483.605) 1,840,000 (0.000,483.605) (12.8%) (0.000,483.605) 3,410,000 (0.000,483.605) (23.8%) (0.000,483.605) HTTPS (0.000,483.605) T (0.000,483.605) ruste (0.000,483.605) d (0.000,483.605) 1,000 (0.000,483.605) (0.0%) (0.000,483.605) 46,700 (0.000,483.605) (0.3%) (0.000,483.605) 9 (0.000,483.605) 39,000 (0.000,483.605) (6.56%) (0.000,483.605) 1,43 (0.000,483.605) 0,000 (0.000,483.605) (1 (0.000,483.605) 0.0%) (0.000,483.605) IKEv1 (0.000,483.605) IPv4 (0.000,483.605) – (0.000,483.605) 64,700 (0.000,483.605) (2.6%) (0.000,483.605) 1,690,000 (0.000,483.605) (66.1%) (0.000,483.605) 1,690,000 (0.000,483.605) (66.1%) (0.000,483.605) IKEv2 (0.000,483.605) IPv4 (0.000,483.605) – (0.000,483.605) 66,000 (0.000,483.605) (5.8%) (0.000,483.605) 726,000 (0.000,483.605) (63.9%) (0.000,483.605) 726,000 (0.000,483.605) (63.9%) (0.000,483.605) SSH (0.000,483.605) IPv4 (0.000,483.605) – (0.000,483.605) – (0.000,483.605) 3,600,000 (0.000,483.605) (25.7%) (0.000,483.605) 3,600,000 (0.000,483.605) (25.7%) (0.000,483.605) T (0.000,483.605) able (0.000,483.605) 3: (0.000,483.605) Estimated (0.000,483.605) impact (0.000,483.605) of (0.000,483.605) Diffie- (0.000,483.605) Hellman (0.000,483.605) attac (0.000,483.605) ks. (0.000,483.605) W (0.000,483.605) e (0.000,483.605) use (0.000,483.605) In (0.000,483.605) ternet-wide (0.000,483.605) scanning (0.000,483.605) to (0.000,483.605) estimate (0.000,483.605) the (0.000,483.605) n (0.000,483.605) um (0.000,483.605) b (0.000,483.605) er (0.000,483.605) of (0.000,483.605) real- (0.000,483.605) w (0.000,483.605) orld (0.000,483.605) serv (0.000,483.605) ers (0.000,483.605) for (0.000,483.605) whic (0.000,483.605) h (0.000,483.605) t (0.000,483.605) ypical (0.000,483.605) connections (0.000,483.605) could (0.000,483.605) b (0.000,483.605) e (0.000,483.605) compromised (0.000,483.605) b (0.000,483.605) y (0.000,483.605) attac (0.000,483.605) k (0.000,483.605) ers (0.000,483.605) with (0.000,483.605) v (0.000,483.605) arious (0.000,483.605) lev (0.000,483.605) els (0.000,483.605) of (0.000,483.605) computational (0.000,483.605) resources. (0.000,483.605) F (0.000,483.605) or (0.000,483.605) HTTPS, (0.000,483.605) w (0.000,483.605) e (0.000,483.605) pro (0.000,483.605) vide (0.000,483.605) figures (0.000,483.605) with (0.000,483.605) and (0.000,483.605) without (0.000,483.605) do (0.000,483.605) wngrade (0.000,483.605) attac (0.000,483.605) k (0.000,483.605) s (0.000,483.605) on (0.000,483.605) the (0.000,483.605) c (0.000,483.605) hose (0.000,483.605) n (0.000,483.605) ciphersuite. (0.000,483.605) All (0.000,483.605) others (0.000,483.605) are (0.000,483.605) passiv (0.000,483.605) e (0.000,483.605) attac (0.000,483.605) ks. (0.000,483.605) targeted (0.000,483.605) malw (0.000,483.605) are (0.000,483.605) is (0.000,483.605) a (0.000,483.605) piece (0.000,483.605) of (0.000,483.605) the (0.000,483.605) collection (0.000,483.605) strategy (0.000,483.605) [60]; (0.000,483.605) ho (0.000,483.605) w (0.000,483.605) ev (0.000,483.605) er, (0.000,483.605) the (0.000,483.605) same (0.000,483.605) do (0.000,483.605) cumen (0.000,483.605) ts (0.000,483.605) also (0.000,483.605) note (0.000,483.605) that (0.000,483.605) decryption (0.000,483.605) of (0.000,483.605) the (0.000,483.605) resulting (0.000,483.605) traffic (0.000,483.605) do (0.000,483.605) es (0.000,483.605) not (0.000,483.605) require (0.000,483.605) IKE (0.000,483.605) handshak (0.000,483.605) es, (0.000,483.605) and (0.000,483.605) th (0.000,483.605) us (0.000,483.605) app (0.000,483.605) ears (0.000,483.605) to (0.000,483.605) b (0.000,483.605) e (0.000,483.605) an (0.000,483.605) alternativ (0.000,483.605) e (0.000,483.605) mec (0.000,483.605) hanism (0.000,483.605) to (0.000,483.605) the (0.000,483.605) V (0.000,483.605) A (0.000,483.605) O (0.000,483.605) attac (0.000,483.605) k (0.000,483.605) de (0.000,483.605) scrib (0.000,483.605) ed (0.000,483.605) ab (0.000,483.605) o (0.000,483.605) v (0.000,483.605) e (0.000,483.605) . (0.000,483.605) The (0.000,483.605) most (0.000,483.605) comp (0.000,483.605) elling (0.000,483.605) argumen (0.000,483.605) t (0.000,483.605) for (0.000,483.605) a (0.000,483.605) pure (0.000,483.605) cryptographic (0.000,483.605) attac (0.000,483.605) k (0.000,483.605) is (0.000,483.605) the (0.000,483.605) generalit (0.000,483.605) y (0.000,483.605) of (0.000,483.605) the (0.000,483.605) V (0.000,483.605) A (0.000,483.605) O (0.000,483.605) approac (0.000,483.605) h, (0.000,483.605) whic (0.000,483.605) h (0.000,483.605) app (0.000,483.605) ears (0.000,483.605) to (0.000,483.605) succeed (0.000,483.605) across (0.000,483.605) a (0.000,483.605) broad (0.000,483.605) sw (0.000,483.605) ath (0.000,483.605) of (0.000,483.605) non-compromised (0.000,483.605) devices. (0.000,483.605) 4.3 (0.000,483.605) Effects (0.000,483.605) of (0.000,483.605) a (0.000,483.605) 1024-bit (0.000,483.605) Br (0.000,483.605) eak (0.000,483.605) In (0.000,483.605) this (0.000,483.605) section, (0.000,483.605) w (0.000,483.605) e (0.000,483.605) use (0.000,483.605) In (0.000,483.605) ternet-w (0.000,483.605) ide (0.000,483.605) scanning (0.000,483.605) to (0.000,483.605) assess (0.000,483.605) the (0.000,483.605) impact (0.000,483.605) of (0.000,483.605) a (0.000,483.605) h (0.000,483.605) yp (0.000,483.605) othe (0.000,483.605) tical (0.000,483.605) DH-1 (0.000,483.605) 024 (0.000,483.605) break (0.000,483.605) on (0.000,483.605) three (0.000,483.605) p (0.000,483.605) opu- (0.000,483.605) lar (0.000,483.605) proto (0.000,483.605) cols: (0.000,483.605) IKE, (0.000,483.605) SSH, (0.000,483.605) and (0.000,483.605) HTTPS. (0.000,483.605) Our (0.000,483.605) measuremen (0.000,483.605) ts (0.000,483.605) indicate (0.000,483.605) that (0.000,483.605) these (0.000,483.605) proto (0.000,483.605) cols, (0.000,483.605) as (0.000,483.605) they (0.000,483.605) are (0.000,483.605) c (0.000,483.605) om (0.000,483.605) monly (0.000,483.605) used, (0.000,483.605) w (0.000,483.605) ould (0.000,483.605) b (0.000,483.605) e (0.000,483.605) sub (0.000,483.605) ject (0.000,483.605) to (0.000,483.605) widespread (0.000,483.605) compromise (0.000,483.605) b (0.000,483.605) y (0.000,483.605) a (0.000,483.605) state-lev (0.000,483.605) el (0.000,483.605) attac (0.000,483.605) k (0.000,483.605) e (0.000,483.605) r (0.000,483.605) who (0.000,483.605) had (0.000,483.605) the (0.000,483.605) resources (0.000,483.605) to (0.000,483.605) in (0.000,483.605) v (0.000,483.605) est (0.000,483.605) in (0.000,483.605) precomputation (0.000,483.605) for (0.000,483.605) a (0.000,483.605) small (0.000,483.605) n (0.000,483.605) um (0.000,483.605) b (0.000,483.605) er (0.000,483.605) of (0.000,483.605) comm (0.000,483.605) on (0.000,483.605) 1024-bit (0.000,483.605) groups. (0.000,483.605) IKE (0.000,483.605) W (0.000,483.605) e (0.000,483.605) m (0.000,483.605) e (0.000,483.605) asured (0.000,483.605) ho (0.000,483.605) w (0.000,483.605) IPsec (0.000,483.605) VPNs (0.000,483.605) use (0.000,483.605) Diffie-Hellman (0.000,483.605) in (0.000,483.605) practice (0.000,483.605) b (0.000,483.605) y (0.000,483.605) scanning (0.000,483.605) a (0.000,483.605) 1% (0.000,483.605) random (0.000,483.605) sample (0.000,483.605) of (0.000,483.605) the (0.000,483.605) public (0.000,483.605) IPv4 (0.000,483.605) address (0.000,483.605) spac (0.000,483.605) e (0.000,483.605) for (0.000,483.605) IKEv1 (0.000,483.605) and (0.000,483.605) IKEv2 (0.000,483.605) (the (0.000,483.605) proto (0.000,483.605) cols (0.000,483.605) used (0.000,483.605) to (0.000,483.605) initiate (0.000,483.605) an (0.000,483.605) IPsec (0.000,483.605) VPN (0.000,483.605) connection) (0.000,483.605) in (0.000,483.605) Ma (0.000,483.605) y (0.000,483.605) 2015. (0.000,483.605) W (0.000,483.605) e (0.000,483.605) used (0.000,483.605) the (0.000,483.605) ZMap (0.000,483.605) UDP (0.000,483.605) prob (0.000,483.605) e (0.000,483.605) mo (0.000,483.605) dule (0.000,483.605) to (0.000,483.605) measure (0.000,483.605) supp (0.000,483.605) ort (0.000,483.605) for (0.000,483.605) Oakley (0.000,483.605) Groups (0.000,483.605) 1 (0.000,483.605) and (0.000,483.605) 2 (0.000,483.605) (t (0.000,483.605) w (0.000,483.605) o (0.000,483.605) p (0.000,483.605) opula (0.000,483.605) r (0.000,483.605) 768- (0.000,483.605) and (0.000,483.605) 1024-bit, (0.000,483.605) built (0.000,483.605) -in (0.000,483.605) groups) (0.000,483.605) and (0.000,483.605) whic (0.000,483.605) h (0.000,483.605) group (0.000,483.605) serv (0.000,483.605) ers (0.000,483.605) prefer. (0.000,483.605) T (0.000,483.605) o (0.000,483.605) test (0.000,483.605) supp (0.000,483.605) ort (0.000,483.605) for (0.000,483.605) individual (0.000,483.605) groups, (0.000,483.605) w (0.000,483.605) e (0.000,483.605) offered (0.000,483.605) only (0.000,483.605) the (0.000,483.605) single (0.000,483.605) group (0.000,483.605) in (0.000,483.605) question. (0.000,483.605) T (0.000,483.605) o (0.000,483.605) detect (0.000,483.605) default (0.000,483.605) b (0.000,483.605) eha (0.000,483.605) vior, (0.000,483.605) w (0.000,483.605) e (0.000,483.605) offered (0.000,483.605) serv (0.000,483.605) ers (0.000,483.605) a (0.000,483.605) v (0.000,483.605) ariet (0.000,483.605) y (0.000,483.605) of (0.000,483.605) DH (0.000,483.605) groups, (0.000,483.605) with (0.000,483.605) the (0.000,483.605) lo (0.000,483.605) w (0.000,483.605) e (0.000,483.605) st (0.000,483.605) priorit (0.000,483.605) y (0.000,483.605) groups (0.000,483.605) b (0.000,483.605) eing (0.000,483.605) Oakley (0.000,483.605) Groups (0.000,483.605) 1 (0.000,483.605) and (0.000,483.605) 2. (0.000,483.605) When (0.000,483.605) measuring (0.000,483.605) serv (0.000,483.605) er (0.000,483.605) preference, (0.000,483.605) w (0.000,483.605) e (0.000,483.605) scanned (0.000,483.605) with (0.000,483.605) the (0.000,483.605) 3DES (0.000,483.605) symmetric (0.000,483.605) cipher (0.000,483.605) — (0.000,483.605) the (0.000,483.605) most (0.000,483.605) commonly (0.000,483.605) supp (0.000,483.605) orted (0.000,483.605) symmetric (0.000,483.605) cipher (0.000,483.605) in (0.000,483.605) our (0.000,483.605) single (0.000,483.605) group (0.000,483.605) scans. (0.000,483.605) Because (0.000,483.605) of (0.000,483.605) this, (0.000,483.605) the (0.000,483.605) p (0.000,483.605) ercen (0.000,483.605) tages (0.000,483.605) w (0.000,483.605) e (0.000,483.605) presen (0.000,483.605) t (0.000,483.605) for (0.000,483.605) IKEv1 (0.000,483.605) and (0.000,483.605) IKEv (0.000,483.605) 2 (0.000,483.605) are (0.000,483.605) a (0.000,483.605) lo (0.000,483.605) w (0.000,483.605) e (0.000,483.605) r (0.000,483.605) b (0.000,483.605) ound (0.000,483.605) f (0.000,483.605) or (0.000,483.605) the (0.000,483.605) n (0.000,483.605) um (0.000,483.605) b (0.000,483.605) er (0.000,483.605) of (0.000,483.605) serv (0.000,483.605) ers (0.000,483.605) that (0.000,483.605) prefer (0.000,483.605) Oakley (0.000,483.605) Groups (0.000,483.605) 1 (0.000,483.605) and (0.000,483.605) 2. (0.000,483.605) Of (0.000,483.605) the (0.000,483.605) 80K (0.000,483.605) hosts (0.000,483.605) that (0.000,483.605) resp (0.000,483.605) onded (0.000,483.605) with (0.000,483.605) a (0.000,483.605) v (0.000,483.605) alid (0.000,483.605) IKE (0.000,483.605) pac (0.000,483.605) k (0.000,483.605) et, (0.000,483.605) 44.2% (0.000,483.605) w (0.000,483.605) ere (0.000,483.605) willing (0.000,483.605) to (0.000,483.605) accept (0.000,483.605) an (0.000,483.605) offered (0.000,483.605) prop (0.000,483.605) osal (0.000,483.605) from (0.000,483.605) at (0.000,483.605) least (0.000,483.605) one (0.000,483.605) sca (0.000,483.605) n. (0.000,483.605) The (0.000,483.605) ma (0.000,483.605) jorit (0.000,483.605) y (0.000,483.605) of (0.000,483.605) the (0.000,483.605) re (0.000,483.605) m (0.000,483.605) aining (0.000,483.605) hosts (0.000,483.605) resp (0.000,483.605) onde (0.000,483.605) d (0.000,483.605) with (0.000,483.605) a (0.000,483.605) NO-PROPOSAL-CHOSEN (0.000,483.605) message (0.000,483.605) regardless (0.000,483.605) of (0.000,483.605) our (0.000,483.605) pro- (0.000,483.605) p (0.000,483.605) osal. (0.000,483.605) Man (0.000,483.605) y (0.000,483.605) of (0.000,483.605) these (0.000,483.605) ma (0.000,483.605) y (0.000,483.605) b (0.000,483.605) e (0.000,483.605) site-to-site (0.000,483.605) VPNs (0.000,483.605) that (0.000,483.605) reject (0.000,483.605) our (0.000,483.605) source (0.000,483.605) address. (0.000,483.605) W (0.000,483.605) e (0.000,483.605) consider (0.000,483.605) these (0.000,483.605) hosts (0.000,483.605) “unprofiled” (0.000,483.605) and (0.000,483.605) omit (0.000,483.605) them (0.000,483.605) from (0.000,483.605) the (0.000,483.605) results (0.000,483.605) here. (0.000,483.605) W (0.000,483.605) e (0.000,483.605) found (0.000,483.605) that (0.000,483.605) 31.8% (0.000,483.605) of (0.000,483.605) IKEv1 (0.000,483.605) and (0.000,483.605) 19.7% (0.000,483.605) of (0.000,483.605) IKEv2 (0.000,483.605) serv (0.000,483.605) ers (0.000,483.605) supp (0.000,483.605) ort (0.000,483.605) Oakley (0.000,483.605) Group (0.000,483.605) 1 (0.000,483.605) (768-bit) (0.000,483.605) while (0.000,483.605) 86.1% (0.000,483.605) and (0.000,483.605) 91.0% (0.000,483.605) resp (0.000,483.605) ectiv (0.000,483.605) ely (0.000,483.605) supp (0.000,483.605) orted (0.000,483.605) Oakley (0.000,483.605) Group (0.000,483.605) 2 (0.000,483.605) (1024-bit). (0.000,483.605) In (0.000,483.605) our (0.000,483.605) sample (0.000,483.605) of (0.000,483.605) IKEv1 (0.000,483.605) serv (0.000,483.605) ers, (0.000,483.605) 2.6% (0.000,483.605) of (0.000,483.605) profile (0.000,483.605) d (0.000,483.605) serv (0.000,483.605) ers (0.000,483.605) preferred (0.000,483.605) the (0.000,483.605) 768-bit (0.000,483.605) Oakley (0.000,483.605) Group (0.000,483.605) 1 (0.000,483.605) — (0.000,483.605) whic (0.000,483.605) h (0.000,483.605) is (0.000,483.605) w (0.000,483.605) ithin (0.000,483.605) cryptanalytic (0.000,483.605) reac (0.000,483.605) h (0.000,483.605) to (0.000,483.605) da (0.000,483.605) y (0.000,483.605) for (0.000,483.605) mo (0.000,483.605) derately (0.000,483.605) resourced (0.000,483.605) attac (0.000,483.605) k (0.000,483.605) ers (0.000,483.605) — (0.000,483.605) and (0.000,483.605) 66.1% (0.000,483.605) preferred (0.000,483.605) the (0.000,483.605) 1024-bit (0.000,483.605) Oakley (0.000,483.605) Group (0.000,483.605) 2. (0.000,483.605) F (0.000,483.605) or (0.000,483.605) IKEv2, (0.000,483.605) 5.8% (0.000,483.605) of (0.000,483.605) profiled (0.000,483.605) serv (0.000,483.605) ers (0.000,483.605) c (0.000,483.605) hose (0.000,483.605) Oakley (0.000,483.605) Group (0.000,483.605) 1, (0.000,483.605) and (0.000,483.605) 63.9% (0.000,483.605) c (0.000,483.605) hose (0.000,483.605) Oakley (0.000,483.605) Group (0.000,483.605) 2. (0.000,483.605) This (0.000,483.605) coincides (0.000,483.605) with (0.000,483.605) our (0.000,483.605) anecdotal (0.000,483.605) findings (0.000,483.605) that (0.000,483.605) m (0.000,483.605) o (0.000,483.605) s (0.000,483.605) t (0.000,483.605) VPN (0.000,483.605) clien (0.000,483.605) ts (0.000,483.605) only (0.000,483.605) offer (0.000,483.605) Oakley (0.000,483.605) Group (0.000,483.605) 2 (0.000,483.605) b (0.000,483.605) y (0.000,483.605) default. (0.000,483.605) SSH (0.000,483.605) All (0.000,483.605) SSH (0.000,483.605) handshak (0.000,483.605) es (0.000,483.605) complete (0.000,483.605) eit (0.000,483.605) her (0.000,483.605) a (0.000,483.605) finite (0.000,483.605) field (0.000,483.605) Diffie-Hellman (0.000,483.605) or (0.000,483.605) elliptic (0.000,483.605) curv (0.000,483.605) e (0.000,483.605) Diffie-Hellman (0.000,483.605) exc (0.000,483.605) hange (0.000,483.605) as (0.000,483.605) part (0.000,483.605) of (0.000,483.605) the (0.000,483.605) SSH (0.000,483.605) k (0.000,483.605) ey (0.000,483.605) exc (0.000,483.605) hange. (0.000,483.605) The (0.000,483.605) SSH (0.000,483.605) proto (0.000,483.605) col (0.000,483.605) explicitly (0.000,483.605) defines (0.000,483.605) supp (0.000,483.605) ort (0.000,483.605) for (0.000,483.605) O (0.000,483.605) ak (0.000,483.605) le (0.000,483.605) y (0.000,483.605) Group (0.000,483.605) 2 (0.000,483.605) (1024-bit) (0.000,483.605) and (0.000,483.605) Oakley (0.000,483.605) Group (0.000,483.605) 14 (0.000,483.605) (2048 (0.000,483.605) -bit) (0.000,483.605) but (0.000,483.605) also (0.000,483.605) allo (0.000,483.605) ws (0.000,483.605) a (0.000,483.605) serv (0.000,483.605) er-defined (0.000,483.605) group, (0.000,483.605) whic (0.000,483.605) h (0.000,483.605) can (0.000,483.605) b (0.000,483.605) e (0.000,483.605) negotiated (0.000,483.605) through (0.000,483.605) an (0.000,483.605) auxiliary (0.000,483.605) Diffie-Hellman (0.000,483.605) Group (0.000,483.605) Exc (0.000,483.605) hange (0.000,483.605) (DH (0.000,483.605) -GEX) (0.000,483.605) handshak (0.000,483.605) e (0.000,483.605) [16]. (0.000,483.605) In (0.000,483.605) order (0.000,483.605) to (0.000,483.605) measure (0.000,483.605) ho (0.000,483.605) w (0.000,483.605) SSH (0.000,483.605) uses (0.000,483.605) DH (0.000,483.605) in (0.000,483.605) practice, (0.000,483.605) w (0.000,483.605) e (0.000,483.605) implemen (0.000,483.605) ted (0.000,483.605) the (0.000,483.605) SSH (0.000,483.605) prot (0.000,483.605) o (0.000,483.605) c (0.000,483.605) ol (0.000,483.605) in (0.000,483.605) the (0.000,483.605) ZMap (0.000,483.605) to (0.000,483.605) olc (0.000,483.605) hain (0.000,483.605) a (0.000,483.605) nd (0.000,483.605) scanned (0.000,483.605) 1% (0.000,483.605) random (0.000,483.605) samples (0.000,483.605) of (0.000,483.605) the (0.000,483.605) public (0.000,483.605) IPv4 (0.000,483.605) address (0.000,483.605) space (0.000,483.605) in (0.000,483.605) April (0.000,483.605) 2015. (0.000,483.605) W (0.000,483.605) e (0.000,483.605) find (0.000,483.605) that (0.000,483.605) 98.9% (0.000,483.605) of (0.000,483.605) SSH (0.000,483.605) serv (0.000,483.605) ers (0.000,483.605) supp (0.000,483.605) ort (0.000,483.605) the (0.000,483.605) 1024-bit (0.000,483.605) Oakley (0.000,483.605) Group (0.000,483.605) 2, (0.000,483.605) 77.6% (0.000,483.605) supp (0.000,483.605) ort (0.000,483.605) the (0.000,483.605) 2048-bit (0.000,483.605) Oakley (0.000,483.605) Group (0.000,483.605) 14, (0.000,483.605) and (0.000,483.605) 68.7% (0.000,483.605) supp (0.000,483.605) ort (0.000,483.605) DH-GEX. (0.000,483.605) During (0.000,483.605) the (0.000,483.605) SSH (0.000,483.605) handshak (0.000,483.605) e, (0.000,483.605) the (0.000,483.605) clie (0.000,483.605) n (0.000,483.605) t (0.000,483.605) and (0.000,483.605) serv (0.000,483.605) er (0.000,483.605) select (0.000,483.605) the (0.000,483.605) clien (0.000,483.605) t’s (0.000,483.605) highest (0.000,483.605) priorit (0.000,483.605) y (0.000,483.605) m (0.000,483.605) utually (0.000,483.605) supp (0.000,483.605) orted (0.000,483.605) k (0.000,483.605) ey (0.000,483.605) e (0.000,483.605) x (0.000,483.605) c (0.000,483.605) ha (0.000,483.605) nge (0.000,483.605) algorithm. (0.000,483.605) Therefore, (0.000,483.605) w (0.000,483.605) e (0.000,483.605) cannot (0.000,483.605) directly (0.000,483.605) measure (0.000,483.605) w (0.000,483.605) h (0.000,483.605) a (0.000,483.605) t (0.000,483.605) algo- (0.000,483.605) rithm (0.000,483.605) serv (0.000,483.605) ers (0.000,483.605) will (0.000,483.605) prefer (0.000,483.605) in (0.000,483.605) practice. (0.000,483.605) In (0.000,483.605) order (0.000,483.605) to (0.000,483.605) estimate (0.000,483.605) t (0.000,483.605) h (0.000,483.605) i (0.000,483.605) s (0.000,483.605) , (0.000,483.605) w (0.000,483.605) e (0.000,483.605) p (0.000,483.605) erformed (0.000,483.605) a (0.000,483.605) scan (0.000,483.605) in (0.000,483.605) whic (0.000,483.605) h (0.000,483.605) w (0.000,483.605) e (0.000,483.605) mimic (0.000,483.605) k (0.000,483.605) ed (0.000,483.605) the (0.000,483.605) algorithms (0.000,483.605) offered (0.000,483.605) b (0.000,483.605) y (0.000,483.605) Op (0.000,483.605) enSSH (0.000,483.605) 6.6.1p1, (0.000,483.605) the (0.000,483.605) latest (0.000,483.605) v (0.000,483.605) ersion (0.000,483.605) of (0.000,483.605) Op (0.000,483.605) enSSH. (0.000,483.605) In (0.000,483.605) this (0.000,483.605) scan, (0.000,483.605) 21.8% (0.000,483.605) of (0.000,483.605) serv (0.000,483.605) ers (0.000,483.605) pre (0.000,483.605) f (0.000,483.605) e (0.000,483.605) rred (0.000,483.605) the (0.000,483.605) 1024-bit (0.000,483.605) Oakley (0.000,483.605) Group (0.000,483.605) 2, (0.000,483.605) and (0.000,483.605) 37.4% (0.000,483.605) preferred (0.000,483.605) a (0.000,483.605) serv (0.000,483.605) er-defined (0.000,483.605) group. (0.000,483.605) 10% (0.000,483.605) of (0.000,483.605) the (0.000,483.605) serv (0.000,483.605) er-defined (0.000,483.605) groups (0.000,483.605) w (0.000,483.605) ere (0.000,483.605) 1024-bit, (0.000,483.605) but, (0.000,483.605) of (0.000,483.605) those, (0.000,483.605) near (0.000,483.605) all (0.000,483.605) pro (0.000,483.605) vided (0.000,483.605) Oakley (0.000,483.605) Group (0.000,483.605) 2 (0.000,483.605) rather (0.000,483.605) than (0.000,483.605) a (0.000,483.605) custom (0.000,483.605) group. (0.000,483.605) Com (0.000,483.605) bining (0.000,483.605) these (0.000,483.605) equiv (0.000,483.605) alen (0.000,483.605) t (0.000,483.605) c (0.000,483.605) hoice (0.000,483.605) s, (0.000,483.605) w (0.000,483.605) e (0.000,483.605) find (0.000,483.605) that (0.000,483.605) a (0.000,483.605) state- (0.000,483.605) lev (0.000,483.605) el (0.000,483.605) attac (0.000,483.605) k (0.000,483.605) er (0.000,483.605) who (0.000,483.605) p (0.000,483.605) erformed (0.000,483.605) NFS (0.000,483.605) precomputations (0.000,483.605) for (0.000,483.605) the (0.000,483.605) 1024-bit (0.000,483.605) Oakley (0.000,483.605) Group (0.000,483.605) 2 (0.000,483.605) (whic (0.000,483.605) h (0.000,483.605) has (0.000,483.605) b (0.000,483.605) een (0.000,483.605) in (0.000,483.605) standards (0.000,483.605) for (0.000,483.605) almost (0.000,483.605) t (0.000,483.605) w (0.000,483.605) o (0.000,483.605) decades) (0.000,483.605) could (0.000,483.605) passiv (0.000,483.605) e (0.000,483.605) ly (0.000,483.605) ea (0.000,483.605) v (0.000,483.605) esdrop (0.000,483.605) on (0.000,483.605) connections (0.000,483.605) to (0.000,483.605) 3.6M (0.000,483.605) (25.7%) (0.000,483.605) publicly (0.000,483.605) accessible (0.000,483.605) SSH (0.000,483.605) serv (0.000,483.605) ers. (0.000,483.605) HTTPS (0.000,483.605) DHE (0.000,483.605) is (0.000,483.605) commonly (0.000,483.605) deplo (0.000,483.605) y (0.000,483.605) ed (0.000,483.605) on (0.000,483.605) w (0.000,483.605) eb (0.000,483.605) serv (0.000,483.605) ers. (0.000,483.605) 68.3% (0.000,483.605) of (0.000,483.605) Alexa (0.000,483.605) T (0.000,483.605) op (0.000,483.605) 1M (0.000,483.605) sites (0.000,483.605) supp (0.000,483.605) ort (0.000,483.605) DHE (0.000,483.605) , (0.000,483.605) as (0.000,483.605) do (0.000,483.605) 23.9% (0.000,483.605) of (0.000,483.605) sites (0.000,483.605) with (0.000,483.605) bro (0.000,483.605) wser-trusted (0.000,483.605) certificate (0.000,483.605) s. (0.000,483.605) Of (0.000,483.605) t (0.000,483.605) he (0.000,483.605) T (0.000,483.605) op (0.000,483.605) 1M (0.000,483.605) sites (0.000,483.605) that (0.000,483.605) supp (0.000,483.605) ort (0.000,483.605) DHE (0.000,483.605) , (0.000,483.605) 84% (0.000,483.605) use (0.000,483.605) a (0.000,483.605) 1024-bit (0.000,483.605) or (0.000,483.605) smaller (0.000,483.605) group, (0.000,483.605) with (0.000,483.605) 94% (0.000,483.605) of (0.000,483.605) these (0.000,483.605) using (0.000,483.605) one (0.000,483.605) of (0.000,483.605) fiv (0.000,483.605) e (0.000,483.605) groups. (0.000,483.605) Despite (0.000,483.605) widespread (0.000,483.605) supp (0.000,483.605) ort (0.000,483.605) for (0.000,483.605) DHE (0.000,483.605) , (0.000,483.605) a (0.000,483.605) passiv (0.000,483.605) e (0.000,483.605) ea (0.000,483.605) v (0.000,483.605) esdrop- (0.000,483.605) p (0.000,483.605) er (0.000,483.605) can (0.000,483.605) only (0.000,483.605) decrypt (0.000,483.605) connections (0.000,483.605) that (0.000,483.605) organically (0.000,483.605) agree (0.000,483.605) to (0.000,483.605) use (0.000,483.605) Diffie-Hellman. (0.000,483.605) W (0.000,483.605) e (0.000,483.605) can (0.000,483.605) estimate (0.000,483.605) the (0.000,483.605) n (0.000,483.605) um (0.000,483.605) b (0.000,483.605) er (0.000,483.605) of (0.000,483.605) sites (0.000,483.605) for (0.000,483.605) whic (0.000,483.605) h (0.000,483.605) this (0.000,483.605) will (0.000,483.605) o (0.000,483.605) ccur (0.000,483.605) b (0.000,483.605) y (0.000,483.605) offering (0.000,483.605) the (0.000,483.605) same (0.000,483.605) sets (0.000,483.605) of (0.000,483.605) ciphersuites (0.000,483.605) as (0.000,483.605) Chrome, (0.000,483.605) Firefo (0.000,483.605) x, (0.000,483.605) and (0.000,483.605) Safari. (0.000,483.605) While (0.000,483.605) the (0.000,483.605) offered (0.000,483.605) ciphers (0.000,483.605) differ (0.000,483.605) sligh (0.000,483.605) tly (0.000,483.605) b (0.000,483.605) et (0.000,483.605) w (0.000,483.605) een (0.000,483.605) bro (0.000,483.605) wsers, (0.000,483.605) this (0.000,483.605) turns (0.000,483.605) out (0.000,483.605) to (0.000,483.605) result (0.000,483.605) in (0.000,483.605) negligible (0.000,483.605) differences (0.000,483.605) in (0.000,483.605) w (0.000,483.605) hether (0.000,483.605) DHE (0.000,483.605) is (0.000,483.605) c (0.000,483.605) hosen. (0.000,483.605) Appro (0.000,483.605) ximately (0.000,483.605) 24.0% (0.000,483.605) of (0.000,483.605) bro (0.000,483.605) wser (0.000,483.605) connections (0.000,483.605) with (0.000,483.605) HTTPS- (0.000,483.605) enabled (0.000,483.605) T (0.000,483.605) op (0.000,483.605) 1M (0.000,483.605) sites (0.000,483.605) (and (0.000,483.605) 10% (0.000,483.605) with (0.000,483.605) bro (0.000,483.605) wser-trusted (0.000,483.605) sites) (0.000,483.605) will (0.000,483.605) negotiate (0.000,483.605) DHE (0.000,483.605) with (0.000,483.605) one (0.000,483.605) of (0.000,483.605) the (0.000,483.605) ten (0.000,483.605) most (0.000,483.605) p (0.000,483.605) opular (0.000,483.605) 1024-bit (0.000,483.605) primes; (0.000,483.605) 17.9% (0.000,483.605) of (0.000,483.605) connections (0.000,483.605) with (0.000,483.605) T (0.000,483.605) op (0.000,483.605) 1M (0.000,483.605) sites (0.000,483.605) could (0.000,483.605) b (0.000,483.605) e (0.000,483.605) 10 (0.000,0.000) passiv (0.000,0.000) ely (0.000,0.000) ea (0.000,0.000) v (0.000,0.000) esdropp (0.000,0.000) ed (0.000,0.000) giv (0.000,0.000) en (0.000,0.000) the (0.000,0.000) precomputation (0.000,0.000) for (0.000,0.000) a (0.000,0.000) single (0.000,0.000) 1024-bit (0.000,0.000) prime. (0.000,0.000) The (0.000,0.000) most (0.000,0.000) p (0.000,0.000) opular (0.000,0.000) site (0.000,0.000) that (0.000,0.000) negotiates (0.000,0.000) a (0.000,0.000) DHE (0.000,0.000) ciphersuite (0.000,0.000) using (0.000,0.000) one (0.000,0.000) of (0.000,0.000) the (0.000,0.000) t (0.000,0.000) w (0.000,0.000) o (0.000,0.000) most (0.000,0.000) common (0.000,0.000) 1024-bit (0.000,0.000) primes (0.000,0.000) is (0.000,0.000) soh (0.000,0.000) u.com (0.000,0.000) (rank (0.000,0.000) ed (0.000,0.000) 31st (0.000,0.000) globally). (0.000,0.000) Mail (0.000,0.000) TLS (0.000,0.000) is (0.000,0.000) also (0.000,0.000) used (0.000,0.000) to (0.000,0.000) secure (0.000,0.000) email (0.000,0.000) transp (0.000,0.000) ort. (0.000,0.000) SMTP (0.000,0.000) , (0.000,0.000) the (0.000,0.000) proto (0.000,0.000) col (0.000,0.000) used (0.000,0.000) to (0.000,0.000) rela (0.000,0.000) y (0.000,0.000) messages (0.000,0.000) b (0.000,0.000) et (0.000,0.000) w (0.000,0.000) een (0.000,0.000) mail (0.000,0.000) serv (0.000,0.000) ers, (0.000,0.000) allo (0.000,0.000) ws (0.000,0.000) a (0.000,0.000) connection (0.000,0.000) to (0.000,0.000) b (0.000,0.000) e (0.000,0.000) upgraded (0.000,0.000) to (0.000,0.000) TLS (0.000,0.000) b (0.000,0.000) y (0.000,0.000) issuing (0.000,0.000) the (0.000,0.000) STARTTLS (0.000,0.000) command. (0.000,0.000) POP3S (0.000,0.000) and (0.000,0.000) IMAPS, (0.000,0.000) used (0.000,0.000) b (0.000,0.000) y (0.000,0.000) end (0.000,0.000) users (0.000,0.000) to (0.000,0.000) fetc (0.000,0.000) h (0.000,0.000) rec (0.000,0.000) eiv (0.000,0.000) ed (0.000,0.000) mail, (0.000,0.000) wrap (0.000,0.000) the (0.000,0.000) en (0.000,0.000) tire (0.000,0.000) connection (0.000,0.000) in (0.000,0.000) TLS. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) studied (0.000,0.000) 1% (0.000,0.000) samples (0.000,0.000) of (0.000,0.000) the (0.000,0.000) public (0.000,0.000) IPv4 (0.000,0.000) address (0.000,0.000) space (0.000,0.000) for (0.000,0.000) IMAPS, (0.000,0.000) POP3S, (0.000,0.000) and (0.000,0.000) SMTP+StartTLS. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) found (0.000,0.000) that (0.000,0.000) 50.7% (0.000,0.000) of (0.000,0.000) SMTP (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) supp (0.000,0.000) orted (0.000,0.000) STARTTLS (0.000,0.000) , (0.000,0.000) 41.4% (0.000,0.000) sup- (0.000,0.000) p (0.000,0.000) orted (0.000,0.000) DHE (0.000,0.000) , (0.000,0.000) and (0.000,0.000) 14.8% (0.000,0.000) supp (0.000,0.000) orted (0.000,0.000) DHE_EXPORT (0.000,0.000) ciphers. (0.000,0.000) 15.5% (0.000,0.000) of (0.000,0.000) SMTP (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) used (0.000,0.000) one (0.000,0.000) of (0.000,0.000) the (0.000,0.000) ten (0.000,0.000) most (0.000,0.000) common (0.000,0.000) 1024-bit (0.000,0.000) groups. (0.000,0.000) F (0.000,0.000) or (0.000,0.000) IMAPS, (0.000,0.000) 8.4% (0.000,0.000) of (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) supp (0.000,0.000) orted (0.000,0.000) DHE_EXPORT (0.000,0.000) and (0.000,0.000) 75% (0.000,0.000) supp (0.000,0.000) orted (0.000,0.000) DHE (0.000,0.000) . (0.000,0.000) Ho (0.000,0.000) w (0.000,0.000) e (0.000,0.000) v (0.000,0.000) er, (0.000,0.000) the (0.000,0.000) ten (0.000,0.000) m (0.000,0.000) o (0.000,0.000) s (0.000,0.000) t (0.000,0.000) common (0.000,0.000) 1024-bit (0.000,0.000) primes (0.000,0.000) accoun (0.000,0.000) t (0.000,0.000) f (0.000,0.000) o (0.000,0.000) r (0.000,0.000) only (0.000,0.000) 5.4% (0.000,0.000) of (0.000,0.000) serv (0.000,0.000) ers. (0.000,0.000) POP3S (0.000,0.000) deplo (0.000,0.000) ymen (0.000,0.000) t (0.000,0.000) is (0.000,0.000) similar, (0.000,0.000) with (0.000,0.000) 8.9% (0.000,0.000) of (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) supp (0.000,0.000) orting (0.000,0.000) DHE_EXPORT (0.000,0.000) and (0.000,0.000) 74.9% (0.000,0.000) supp (0.000,0.000) orting (0.000,0.000) DHE (0.000,0.000) , (0.000,0.000) but (0.000,0.000) with (0.000,0.000) the (0.000,0.000) ten (0.000,0.000) most (0.000,0.000) common (0.000,0.000) 1024-bit (0.000,0.000) primes (0.000,0.000) accoun (0.000,0.000) t (0.000,0.000) ing (0.000,0.000) for (0.000,0.000) only (0.000,0.000) 4.8% (0.000,0.000) of (0.000,0.000) se (0.000,0.000) rv (0.000,0.000) ers. (0.000,0.000) If (0.000,0.000) eac (0.000,0.000) h (0.000,0.000) of (0.000,0.000) the (0.000,0.000) to (0.000,0.000) p (0.000,0.000) ten (0.000,0.000) 1024-bit (0.000,0.000) primes (0.000,0.000) used (0.000,0.000) b (0.000,0.000) y (0.000,0.000) eac (0.000,0.000) h (0.000,0.000) proto (0.000,0.000) col (0.000,0.000) w (0.000,0.000) ere (0.000,0.000) compromised, (0.000,0.000) this (0.000,0.000) w (0.000,0.000) ould (0.000,0.000) affe (0.000,0.000) ct (0.000,0.000) appro (0.000,0.000) ximately (0.000,0.000) 1.7M (0.000,0.000) SMTP (0.000,0.000) , (0.000,0.000) 276K (0.000,0.000) IMAPS, (0.000,0.000) a (0.000,0.000) nd (0.000,0.000) 245K (0.000,0.000) POP3S (0.000,0.000) serv (0.000,0.000) ers. (0.000,0.000) Using (0.000,0.000) our (0.000,0.000) do (0.000,0.000) wngrade (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) of (0.000,0.000) §3.3, (0.000,0.000) an (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) with (0.000,0.000) mo (0.000,0.000) dest (0.000,0.000) resources (0.000,0.000) can (0.000,0.000) hijac (0.000,0.000) k (0.000,0.000) connections (0.000,0.000) to (0.000,0.000) appro (0.000,0.000) ximately (0.000,0.000) 1.6M (0.000,0.000) SMTP (0.000,0.000) , (0.000,0.000) 429K (0.000,0.000) IMAPS, (0.000,0.000) and (0.000,0.000) 454K (0.000,0.000) POP3S (0.000,0.000) serv (0.000,0.000) ers. (0.000,0.000) 5. (0.000,0.000) RECOMMEND (0.000,0.000) A (0.000,0.000) TIONS (0.000,0.000) Our (0.000,0.000) findings (0.000,0.000) indicate (0.000,0.000) that (0.000,0.000) one (0.000,0.000) of (0.000,0.000) the (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) recommenda- (0.000,0.000) tions (0.000,0.000) from (0.000,0.000) securit (0.000,0.000) y (0.000,0.000) exp (0.000,0.000) e (0.000,0.000) rts (0.000,0.000) in (0.000,0.000) resp (0.000,0.000) onse (0.000,0.000) to (0.000,0.000) the (0.000,0.000) threat (0.000,0.000) of (0.000,0.000) mass (0.000,0.000) surv (0.000,0.000) eillance (0.000,0.000) — (0.000,0.000) promotion (0.000,0.000) of (0.000,0.000) DHE-based (0.000,0.000) TLS (0.000,0.000) ciphersuites (0.000,0.000) offering (0.000,0.000) “p (0.000,0.000) erfec (0.000,0.000) t (0.000,0.000) forw (0.000,0.000) ard (0.000,0.000) secrecy” (0.000,0.000) o (0.000,0.000) v (0.000,0.000) er (0.000,0.000) RSA-based (0.000,0.000) cipher- (0.000,0.000) suites (0.000,0.000) — (0.000,0.000) ma (0.000,0.000) y (0.000,0.000) ha (0.000,0.000) v (0.000,0.000) e (0.000,0.000) actually (0.000,0.000) reduced (0.000,0.000) securit (0.000,0.000) y (0.000,0.000) for (0.000,0.000) man (0.000,0.000) y (0.000,0.000) hosts. (0.000,0.000) In (0.000,0.000) this (0.000,0.000) section, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) presen (0.000,0.000) t (0.000,0.000) concrete (0.000,0.000) recommendations (0.000,0.000) t (0.000,0.000) o (0.000,0.000) re- (0.000,0.000) co (0.000,0.000) v (0.000,0.000) er (0.000,0.000) the (0.000,0.000) exp (0.000,0.000) ected (0.000,0.000) securit (0.000,0.000) y (0.000,0.000) of (0.000,0.000) Diffie-Hellman (0.000,0.000) as (0.000,0.000) it (0.000,0.000) is (0.000,0.000) used (0.000,0.000) in (0.000,0.000) mainstream (0.000,0.000) In (0.000,0.000) ternet (0.000,0.000) pro (0.000,0.000) to (0.000,0.000) cols. (0.000,0.000) T (0.000,0.000) ransition (0.000,0.000) to (0.000,0.000) elliptic (0.000,0.000) curv (0.000,0.000) es. (0.000,0.000) T (0.000,0.000) ransitioning (0.000,0.000) to (0.000,0.000) ellip- (0.000,0.000) tic (0.000,0.000) curv (0.000,0.000) e (0.000,0.000) Diffie-H (0.000,0.000) ellman (0.000,0.000) (ECDH) (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) exc (0.000,0.000) hange (0.000,0.000) with (0.000,0.000) appro- (0.000,0.000) priate (0.000,0.000) parameters (0.000,0.000) a (0.000,0.000) v (0.000,0.000) oids (0.000,0.000) all (0.000,0.000) kno (0.000,0.000) wn (0.000,0.000) feasible (0.000,0.000) cryptanalytic (0.000,0.000) attac (0.000,0.000) ks. (0.000,0.000) Curren (0.000,0.000) t (0.000,0.000) elliptic (0.000,0.000) curv (0.000,0.000) e (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) algorithms (0.000,0.000) for (0.000,0.000) strong (0.000,0.000) curv (0.000,0.000) es (0.000,0.000) do (0.000,0.000) not (0.000,0.000) gain (0.000,0.000) as (0.000,0.000) m (0.000,0.000) uc (0.000,0.000) h (0.000,0.000) of (0.000,0.000) an (0.000,0.000) adv (0.000,0.000) an (0.000,0.000) tage (0.000,0.000) from (0.000,0.000) precomputation. (0.000,0.000) In (0.000,0.000) addition, (0.000,0.000) ECDH (0.000,0.000) k (0.000,0.000) eys (0.000,0.000) are (0.000,0.000) shorter (0.000,0.000) than (0.000,0.000) in (0.000,0.000) “mo (0.000,0.000) d (0.000,0.000) p (0.000,0.000) ” (0.000,0.000) Diffie-Hellman, (0.000,0.000) and (0.000,0.000) shared-secre (0.000,0.000) t (0.000,0.000) computations (0.000,0.000) are (0.000,0.000) faster. (0.000,0.000) Unfortunately (0.000,0.000) , (0.000,0.000) the (0.000,0.000) most (0.000,0.000) widely (0.000,0.000) supp (0.000,0.000) orted (0.000,0.000) ECDH (0.000,0.000) parameters, (0.000,0.000) those (0.000,0.000) sp (0.000,0.000) ecified (0.000,0.000) b (0.000,0.000) y (0.000,0.000) NIST, (0.000,0.000) are (0.000,0.000) no (0.000,0.000) w (0.000,0.000) view (0.000,0.000) ed (0.000,0.000) with (0.000,0.000) suspicion (0.000,0.000) due (0.000,0.000) to (0.000,0.000) NSA (0.000,0.000) influence (0.000,0.000) on (0.000,0.000) their (0.000,0.000) design, (0.000,0.000) despite (0.000,0.000) no (0.000,0.000) kno (0.000,0.000) wn (0.000,0.000) or (0.000,0.000) susp (0.000,0.000) ected (0.000,0.000) w (0.000,0.000) eaknesses. (0.000,0.000) These (0.000,0.000) curv (0.000,0.000) es (0.000,0.000) are (0.000,0.000) under- (0.000,0.000) going (0.000,0.000) scrutin (0.000,0.000) y (0.000,0.000) , (0.000,0.000) and (0.000,0.000) new (0.000,0.000) curv (0.000,0.000) es, (0.000,0.000) suc (0.000,0.000) h (0.000,0.000) as (0.000,0.000) Curv (0.000,0.000) e25519 (0.000,0.000) , (0.000,0.000) are (0.000,0.000) b (0.000,0.000) eing (0.000,0.000) standardized (0.000,0.000) b (0.000,0.000) y (0.000,0.000) the (0.000,0.000) IR (0.000,0.000) TF (0.000,0.000) for (0.000,0.000) use (0.000,0.000) in (0.000,0.000) In (0.000,0.000) ternet (0.000,0.000) proto- (0.000,0.000) cols. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) recommend (0.000,0.000) transitioning (0.000,0.000) to (0.000,0.000) elliptic (0.000,0.000) curv (0.000,0.000) es (0.000,0.000) where (0.000,0.000) p (0.000,0.000) ossible; (0.000,0.000) this (0.000,0.000) is (0.000,0.000) the (0.000,0.000) most (0.000,0.000) e (0.000,0.000) ffectiv (0.000,0.000) e (0.000,0.000) long-term (0.000,0.000) solution (0.000,0.000) t (0.000,0.000) o (0.000,0.000) the (0.000,0.000) vulnerabilities (0.000,0.000) describ (0.000,0.000) ed (0.000,0.000) in (0.000,0.000) this (0.000,0.000) pap (0.000,0.000) er. (0.000,0.000) Increase (0.000,0.000) minim (0.000,0.000) um (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) strengths. (0.000,0.000) Serv (0.000,0.000) er (0.000,0.000) op (0.000,0.000) erators (0.000,0.000) should (0.000,0.000) disable (0.000,0.000) DHE_EXPORT (0.000,0.000) and (0.000,0.000) configure (0.000,0.000) DHE (0.000,0.000) ciphersuites (0.000,0.000) to (0.000,0.000) use (0.000,0.000) primes (0.000,0.000) of (0.000,0.000) 2048 (0.000,0.000) bits (0.000,0.000) or (0.000,0.000) larger. (0.000,0.000) Bro (0.000,0.000) wsers (0.000,0.000) and (0.000,0.000) clien (0.000,0.000) ts (0.000,0.000) should (0.000,0.000) raise (0.000,0.000) the (0.000,0.000) minim (0.000,0.000) um (0.000,0.000) accepted (0.000,0.000) size (0.000,0.000) for (0.000,0.000) Diffie-Hellman (0.000,0.000) groups (0.000,0.000) to (0.000,0.000) at (0.000,0.000) least (0.000,0.000) 1024 (0.000,0.000) bits (0.000,0.000) in (0.000,0.000) order (0.000,0.000) to (0.000,0.000) a (0.000,0.000) v (0.000,0.000) oid (0.000,0.000) do (0.000,0.000) wngrade (0.000,0.000) a (0.000,0.000) t- (0.000,0.000) tac (0.000,0.000) ks (0.000,0.000) when (0.000,0.000) comm (0.000,0.000) unicating (0.000,0.000) with (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) that (0.000,0.000) still (0.000,0.000) use (0.000,0.000) smaller (0.000,0.000) groups. (0.000,0.000) Primes (0.000,0.000) of (0.000,0.000) less (0.000,0.000) than (0.000,0.000) 1024 (0.000,0.000) bits (0.000,0.000) should (0.000,0.000) not (0.000,0.000) b (0.000,0.000) e (0.000,0.000) con- (0.000,0.000) sidered (0.000,0.000) secure, (0.000,0.000) ev (0.000,0.000) en (0.000,0.000) against (0.000,0.000) an (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) with (0.000,0.000) mo (0.000,0.000) derate (0.000,0.000) re- (0.000,0.000) sources. (0.000,0.000) Our (0.000,0.000) analysis (0.000,0.000) suggests (0.000,0.000) that (0.000,0.000) 1024-bit (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) ma (0.000,0.000) y (0.000,0.000) b (0.000,0.000) e (0.000,0.000) within (0.000,0.000) reac (0.000,0.000) h (0.000,0.000) for (0.000,0.000) state-lev (0.000,0.000) el (0.000,0.000) ac (0.000,0.000) tors. (0.000,0.000) As (0.000,0.000) suc (0.000,0.000) h, (0.000,0.000) 1024-bit (0.000,0.000) DHE (0.000,0.000) (and (0.000,0.000) 1024-bit (0.000,0.000) RSA) (0.000,0.000) m (0.000,0.000) ust (0.000,0.000) b (0.000,0.000) e (0.000,0.000) phased (0.000,0.000) out (0.000,0.000) in (0.000,0.000) the (0.000,0.000) near (0.000,0.000) term. (0.000,0.000) NIST (0.000,0.000) has (0.000,0.000) recommended (0.000,0.000) suc (0.000,0.000) h (0.000,0.000) a (0.000,0.000) transition (0.000,0.000) since (0.000,0.000) 2010 (0.000,0.000) [4]. (0.000,0.000) W (0.000,0.000) e (0.000,0.000) recommend (0.000,0.000) that (0.000,0.000) clien (0.000,0.000) ts (0.000,0.000) raise (0.000,0.000) the (0.000,0.000) minim (0.000,0.000) um (0.000,0.000) DHE (0.000,0.000) group (0.000,0.000) size (0.000,0.000) to (0.000,0.000) 2048 (0.000,0.000) bits (0.000,0.000) as (0.000,0.000) so (0.000,0.000) on (0.000,0.000) as (0.000,0.000) serv (0.000,0.000) er (0.000,0.000) configurations (0.000,0.000) allo (0.000,0.000) w. (0.000,0.000) Serv (0.000,0.000) er (0.000,0.000) op (0.000,0.000) era- (0.000,0.000) tors (0.000,0.000) should (0.000,0.000) mo (0.000,0.000) v (0.000,0.000) e (0.000,0.000) to (0.000,0.000) 2048-bit (0.000,0.000) or (0.000,0.000) larger (0.000,0.000) groups (0.000,0.000) to (0.000,0.000) facilitate (0.000,0.000) this (0.000,0.000) transition. (0.000,0.000) Precomputation (0.000,0.000) for (0.000,0.000) a (0.000,0.000) 2048-bit (0.000,0.000) non-trap (0.000,0.000) do (0.000,0.000) ored (0.000,0.000) group (0.000,0.000) is (0.000,0.000) around (0.000,0.000) 10 (0.000,0.000) 9 (0.000,0.000) times (0.000,0.000) harder (0.000,0.000) than (0.000,0.000) for (0.000,0.000) a (0.000,0.000) 1024-bit (0.000,0.000) group, (0.000,0.000) so (0.000,0.000) 2048-bit (0.000,0.000) Diffie-H (0.000,0.000) ellman (0.000,0.000) will (0.000,0.000) remain (0.000,0.000) secure (0.000,0.000) barring (0.000,0.000) a (0.000,0.000) ma (0.000,0.000) jor (0.000,0.000) algorithmic (0.000,0.000) impro (0.000,0.000) v (0.000,0.000) em (0.000,0.000) e (0.000,0.000) n (0.000,0.000) t. (0.000,0.000) A (0.000,0.000) v (0.000,0.000) oid (0.000,0.000) fixed-prime (0.000,0.000) 1024-bit (0.000,0.000) groups. (0.000,0.000) F (0.000,0.000) or (0.000,0.000) implemen (0.000,0.000) t (0.000,0.000) a- (0.000,0.000) tions (0.000,0.000) t (0.000,0.000) hat (0.000,0.000) m (0.000,0.000) ust (0.000,0.000) con (0.000,0.000) tin (0.000,0.000) ue (0.000,0.000) to (0.000,0.000) use (0.000,0.000) or (0.000,0.000) supp (0.000,0.000) ort (0.000,0.000) 1024-bit (0.000,0.000) groups (0.000,0.000) for (0.000,0.000) compatibilit (0.000,0.000) y (0.000,0.000) reasons, (0.000,0.000) generating (0.000,0.000) fresh (0.000,0.000) groups (0.000,0.000) ma (0.000,0.000) y (0.000,0.000) help (0.000,0.000) mitigate (0.000,0.000) some (0.000,0.000) of (0.000,0.000) the (0.000,0.000) damage (0.000,0.000) caused (0.000,0.000) b (0.000,0.000) y (0.000,0.000) NFS-st (0.000,0.000) yle (0.000,0.000) precom- (0.000,0.000) putation (0.000,0.000) for (0.000,0.000) v (0.000,0.000) ery (0.000,0.000) common (0.000,0.000) fixed (0.000,0.000) groups. (0.000,0.000) Ho (0.000,0.000) w (0.000,0.000) ev (0.000,0.000) er, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) note (0.000,0.000) that (0.000,0.000) it (0.000,0.000) is (0.000,0.000) p (0.000,0.000) ossible (0.000,0.000) to (0.000,0.000) create (0.000,0.000) trap (0.000,0.000) do (0.000,0.000) ored (0.000,0.000) primes (0.000,0.000) [20, (0.000,0.000) 44] (0.000,0.000) that (0.000,0.000) are (0.000,0.000) computationally (0.000,0.000) difficult (0.000,0.000) to (0.000,0.000) detect. (0.000,0.000) A (0.000,0.000) t (0.000,0.000) minim (0.000,0.000) um, (0.000,0.000) clien (0.000,0.000) ts (0.000,0.000) should (0.000,0.000) c (0.000,0.000) hec (0.000,0.000) k (0.000,0.000) that (0.000,0.000) serv (0.000,0.000) ers’ (0.000,0.000) parameters (0.000,0.000) use (0.000,0.000) safe (0.000,0.000) primes (0.000,0.000) or (0.000,0.000) a (0.000,0.000) v (0.000,0.000) erifiable (0.000,0.000) generation (0.000,0.000) pro (0.000,0.000) cess, (0.000,0.000) suc (0.000,0.000) h (0.000,0.000) as (0.000,0.000) that (0.000,0.000) prop (0.000,0.000) osed (0.000,0.000) in (0.000,0.000) FIPS (0.000,0.000) 186 (0.000,0.000) [38]. (0.000,0.000) Ide (0.000,0.000) ally (0.000,0.000) , (0.000,0.000) the (0.000,0.000) pro (0.000,0.000) cess (0.000,0.000) for (0.000,0.000) generating (0.000,0.000) and (0.000,0.000) v (0.000,0.000) alidating (0.000,0.000) parameters (0.000,0.000) in (0.000,0.000) TLS (0.000,0.000) should (0.000,0.000) b (0.000,0.000) e (0.000,0.000) standardized (0.000,0.000) so (0.000,0.000) as (0.000,0.000) to (0.000,0.000) th (0.000,0.000) w (0.000,0.000) art (0.000,0.000) the (0.000,0.000) risk (0.000,0.000) of (0.000,0.000) trap (0.000,0.000) do (0.000,0.000) ors. (0.000,0.000) Don’t (0.000,0.000) delib (0.000,0.000) erately (0.000,0.000) w (0.000,0.000) eak (0.000,0.000) en (0.000,0.000) crypto. (0.000,0.000) Our (0.000,0.000) do (0.000,0.000) wngrade (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) on (0.000,0.000) exp (0.000,0.000) ort-grade (0.000,0.000) 512-bit (0.000,0.000) Diffie-Hellman (0.000,0.000) groups (0.000,0.000) in (0.000,0.000) TLS (0.000,0.000) illustrates (0.000,0.000) the (0.000,0.000) fragilit (0.000,0.000) y (0.000,0.000) of (0.000,0.000) cryptographic (0.000,0.000) “fron (0.000,0.000) t (0.000,0.000) do (0.000,0.000) ors” (0.000,0.000) . (0.000,0.000) Al- (0.000,0.000) though (0.000,0.000) the (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) sizes (0.000,0.000) originally (0.000,0.000) used (0.000,0.000) in (0.000,0.000) DHE_EXPORT (0.000,0.000) w (0.000,0.000) ere (0.000,0.000) in (0.000,0.000) tended (0.000,0.000) to (0.000,0.000) b (0.000,0.000) e (0.000,0.000) tractable (0.000,0.000) only (0.000,0.000) to (0.000,0.000) NSA, (0.000,0.000) t (0.000,0.000) w (0.000,0.000) o (0.000,0.000) decades (0.000,0.000) of (0.000,0.000) algo- (0.000,0.000) rithmic (0.000,0.000) and (0.000,0.000) computational (0.000,0.000) impro (0.000,0.000) v (0.000,0.000) emen (0.000,0.000) ts (0.000,0.000) ha (0.000,0.000) v (0.000,0.000) e (0.000,0.000) significan (0.000,0.000) tly (0.000,0.000) lo (0.000,0.000) w (0.000,0.000) ered (0.000,0.000) the (0.000,0.000) bar (0.000,0.000) to (0.000,0.000) attac (0.000,0.000) ks (0.000,0.000) on (0.000,0.000) suc (0.000,0.000) h (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) sizes. (0.000,0.000) Despite (0.000,0.000) the (0.000,0.000) ev (0.000,0.000) en (0.000,0.000) tual (0.000,0.000) relaxation (0.000,0.000) of (0.000,0.000) crypto (0.000,0.000) exp (0.000,0.000) ort (0.000,0.000) restrictions (0.000,0.000) and (0.000,0.000) subse- (0.000,0.000) quen (0.000,0.000) t (0.000,0.000) attempts (0.000,0.000) to (0.000,0.000) remo (0.000,0.000) v (0.000,0.000) e (0.000,0.000) supp (0.000,0.000) ort (0.000,0.000) for (0.000,0.000) DHE_EXPORT (0.000,0.000) , (0.000,0.000) the (0.000,0.000) tec (0.000,0.000) hnical (0.000,0.000) debt (0.000,0.000) induced (0.000,0.000) b (0.000,0.000) y (0.000,0.000) the (0.000,0.000) additional (0.000,0.000) complexit (0.000,0.000) y (0.000,0.000) has (0.000,0.000) left (0.000,0.000) implemen (0.000,0.000) tations (0.000,0.000) vulnerable (0.000,0.000) for (0.000,0.000) decades. (0.000,0.000) Lik (0.000,0.000) e (0.000,0.000) FREAK (0.000,0.000) [7], (0.000,0.000) our (0.000,0.000) attac (0.000,0.000) ks (0.000,0.000) w (0.000,0.000) arn (0.000,0.000) of (0.000,0.000) the (0.000,0.000) long-term (0.000,0.000) debilitating (0.000,0.000) effects (0.000,0.000) of (0.000,0.000) delib (0.000,0.000) e (0.000,0.000) rately (0.000,0.000) w (0.000,0.000) eak (0.000,0.000) ening (0.000,0.000) cryptograph (0.000,0.000) y (0.000,0.000) . (0.000,0.000) 6. (0.000,0.000) DISCLOSURE (0.000,0.000) AND (0.000,0.000) RESPONSE (0.000,0.000) W (0.000,0.000) e (0.000,0.000) notified (0.000,0.000) ma (0.000,0.000) jor (0.000,0.000) clien (0.000,0.000) t (0.000,0.000) and (0.000,0.000) serv (0.000,0.000) er (0.000,0.000) dev (0.000,0.000) elop (0.000,0.000) e (0.000,0.000) rs (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) the (0.000,0.000) vulnerabilities (0.000,0.000) discusse (0.000,0.000) d (0.000,0.000) in (0.000,0.000) this (0.000,0.000) pap (0.000,0.000) er (0.000,0.000) b (0.000,0.000) efore (0.000,0.000) w (0.000,0.000) e (0.000,0.000) made (0.000,0.000) our (0.000,0.000) findings (0.000,0.000) public. (0.000,0.000) Prior (0.000,0.000) to (0.000,0.000) our (0.000,0.000) w (0.000,0.000) ork, (0.000,0.000) In (0.000,0.000) ternet (0.000,0.000) Explorer, (0.000,0.000) Chrome, (0.000,0.000) F (0.000,0.000) ire (0.000,0.000) f (0.000,0.000) o (0.000,0.000) x, (0.000,0.000) and (0.000,0.000) Op (0.000,0.000) era (0.000,0.000) all (0.000,0.000) accepted (0.000,0.000) 512-bit (0.000,0.000) primes, (0.000,0.000) whereas (0.000,0.000) Safari (0.000,0.000) allo (0.000,0.000) w (0.000,0.000) ed (0.000,0.000) groups (0.000,0.000) as (0.000,0.000) small (0.000,0.000) as (0.000,0.000) 16 (0.000,0.000) bits. (0.000,0.000) As (0.000,0.000) a (0.000,0.000) result (0.000,0.000) of (0.000,0.000) our (0.000,0.000) disclosures, (0.000,0.000) In (0.000,0.000) ternet (0.000,0.000) Explorer (0.000,0.000) [37], (0.000,0.000) Firefo (0.000,0.000) x, (0.000,0.000) and (0.000,0.000) Chrome (0.000,0.000) are (0.000,0.000) transitioning (0.000,0.000) the (0.000,0.000) minim (0.000,0.000) um (0.000,0.000) size (0.000,0.000) of (0.000,0.000) the (0.000,0.000) DHE (0.000,0.000) groups (0.000,0.000) they (0.000,0.000) accept (0.000,0.000) to (0.000,0.000) 1024 (0.000,0.000) bits, (0.000,0.000) and (0.000,0.000) Op (0.000,0.000) enSSL (0.000,0.000) and (0.000,0.000) Safari (0.000,0.000) are (0.000,0.000) ex- (0.000,0.000) p (0.000,0.000) ected (0.000,0.000) to (0.000,0.000) follo (0.000,0.000) w (0.000,0.000) suit. (0.000,0.000) On (0.000,0.000) the (0.000,0.000) serv (0.000,0.000) e (0.000,0.000) r (0.000,0.000) side, (0.000,0.000) w (0.000,0.000) e (0.000,0.000) notified (0.000,0.000) Apac (0.000,0.000) he, (0.000,0.000) Oracle, (0.000,0.000) IBM, (0.000,0.000) Cisco, (0.000,0.000) and (0.000,0.000) v (0.000,0.000) arious (0.000,0.000) hosting (0.000,0.000) pro (0.000,0.000) viders. (0.000,0.000) Aka- (0.000,0.000) mai (0.000,0.000) has (0.000,0.000) remo (0.000,0.000) v (0.000,0.000) e (0.000,0.000) d (0.000,0.000) all (0.000,0.000) supp (0.000,0.000) ort (0.000,0.000) for (0.000,0.000) exp (0.000,0.000) ort (0.000,0.000) c (0.000,0.000) iphersuites. (0.000,0.000) Man (0.000,0.000) y (0.000,0.000) TLS (0.000,0.000) dev (0.000,0.000) elop (0.000,0.000) ers (0.000,0.000) plan (0.000,0.000) to (0.000,0.000) supp (0.000,0.000) ort (0.000,0.000) a (0.000,0.000) new (0.000,0.000) extension (0.000,0.000) that (0.000,0.000) allo (0.000,0.000) ws (0.000,0.000) clien (0.000,0.000) ts (0.000,0.000) a (0.000,0.000) n (0.000,0.000) d (0.000,0.000) serv (0.000,0.000) ers (0.000,0.000) to (0.000,0.000) negotiate (0.000,0.000) a (0.000,0.000) few (0.000,0.000) w (0.000,0.000) ell-kno (0.000,0.000) wn (0.000,0.000) groups (0.000,0.000) of (0.000,0.000) 2048-bits (0.000,0.000) and (0.000,0.000) higher (0.000,0.000) and (0.000,0.000) to (0.000,0.000) gracefully (0.000,0.000) reject (0.000,0.000) w (0.000,0.000) eak (0.000,0.000) ones (0.000,0.000) [19]. (0.000,0.000) 7. (0.000,0.000) CONCLUSION (0.000,0.000) Diffie-Hellman (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) exc (0.000,0.000) hange (0.000,0.000) is (0.000,0.000) a (0.000,0.000) cornerstone (0.000,0.000) of (0.000,0.000) applied (0.000,0.000) cryptograph (0.000,0.000) y (0.000,0.000) , (0.000,0.000) but (0.000,0.000) w (0.000,0.000) e (0.000,0.000) find (0.000,0.000) that, (0.000,0.000) as (0.000,0.000) used (0.000,0.000) in (0.000,0.000) practice, (0.000,0.000) it (0.000,0.000) is (0.000,0.000) often (0.000,0.000) less (0.000,0.000) secure (0.000,0.000) than (0.000,0.000) widely (0.000,0.000) b (0.000,0.000) eliev (0.000,0.000) ed. (0.000,0.000) The (0.000,0.000) proble (0.000,0.000) m (0.000,0.000) s (0.000,0.000) stem (0.000,0.000) from (0.000,0.000) the (0.000,0.000) fact (0.000,0.000) that (0.000,0.000) the (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) field (0.000,0.000) siev (0.000,0.000) e (0.000,0.000) for (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) allo (0.000,0.000) ws (0.000,0.000) an (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) er (0.000,0.000) to (0.000,0.000) p (0.000,0.000) erform (0.000,0.000) a (0.000,0.000) single (0.000,0.000) precomputation (0.000,0.000) that (0.000,0.000) dep (0.000,0.000) ends (0.000,0.000) only (0.000,0.000) on (0.000,0.000) the (0.000,0.000) group, (0.000,0.000) after (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) computing (0.000,0.000) individual (0.000,0.000) logs (0.000,0.000) in (0.000,0.000) that (0.000,0.000) group (0.000,0.000) has (0.000,0.000) a (0.000,0.000) far (0.000,0.000) lo (0.000,0.000) w (0.000,0.000) er (0.000,0.000) cost. (0.000,0.000) Although (0.000,0.000) this (0.000,0.000) fact (0.000,0.000) is (0.000,0.000) w (0.000,0.000) ell (0.000,0.000) kno (0.000,0.000) wn (0.000,0.000) to (0.000,0.000) cryptographers, (0.000,0.000) it (0.000,0.000) apparen (0.000,0.000) tly (0.000,0.000) has (0.000,0.000) not (0.000,0.000) b (0.000,0.000) een (0.000,0.000) widely (0.000,0.000) 11 (0.000,0.000) understo (0.000,0.000) o (0.000,0.000) d (0.000,0.000) b (0.000,0.000) y (0.000,0.000) system (0.000,0.000) builders. (0.000,0.000) Lik (0.000,0.000) ewise, (0.000,0.000) man (0.000,0.000) y (0.000,0.000) cryptogra- (0.000,0.000) phers (0.000,0.000) did (0.000,0.000) not (0.000,0.000) appreciate (0.000,0.000) that (0.000,0.000) the (0.000,0.000) securit (0.000,0.000) y (0.000,0.000) of (0.000,0.000) a (0.000,0.000) large (0.000,0.000) fraction (0.000,0.000) of (0.000,0.000) In (0.000,0.000) ternet (0.000,0.000) comm (0.000,0.000) unication (0.000,0.000) dep (0.000,0.000) ends (0.000,0.000) on (0.000,0.000) Diffie-Hellman (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) exc (0.000,0.000) hanges (0.000,0.000) that (0.000,0.000) use (0.000,0.000) a (0.000,0.000) few (0.000,0.000) small, (0.000,0.000) widely (0.000,0.000) shared (0.000,0.000) groups. (0.000,0.000) A (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) lesson (0.000,0.000) from (0.000,0.000) this (0.000,0.000) state (0.000,0.000) of (0.000,0.000) affairs (0.000,0.000) is (0.000,0.000) that (0.000,0.000) cryptogra- (0.000,0.000) phers (0.000,0.000) and (0.000,0.000) creators (0.000,0.000) of (0.000,0.000) practical (0.000,0.000) systems (0.000,0.000) need (0.000,0.000) to (0.000,0.000) w (0.000,0.000) ork (0.000,0.000) t (0.000,0.000) ogether (0.000,0.000) more (0.000,0.000) effectiv (0.000,0.000) ely (0.000,0.000) . (0.000,0.000) System (0.000,0.000) builders (0.000,0.000) sho (0.000,0.000) uld (0.000,0.000) ta (0.000,0.000) k (0.000,0.000) e (0.000,0.000) resp (0.000,0.000) o (0.000,0.000) ns (0.000,0.000) i (0.000,0.000) b (0.000,0.000) i (0.000,0.000) l (0.000,0.000) i (0.000,0.000) t (0.000,0.000) y (0.000,0.000) for (0.000,0.000) b (0.000,0.000) eing (0.000,0.000) a (0.000,0.000) w (0.000,0.000) are (0.000,0.000) of (0.000,0.000) applicable (0.000,0.000) cryptanalytic (0.000,0.000) attac (0.000,0.000) ks. (0.000,0.000) Cryp- (0.000,0.000) tographers, (0.000,0.000) for (0.000,0.000) t (0.000,0.000) heir (0.000,0.000) part, (0.000,0.000) should (0.000,0.000) in (0.000,0.000) v (0.000,0.000) olv (0.000,0.000) e (0.000,0.000) themselv (0.000,0.000) es (0.000,0.000) in (0.000,0.000) ho (0.000,0.000) w (0.000,0.000) crypto (0.000,0.000) is (0.000,0.000) actually (0.000,0.000) b (0.000,0.000) eing (0.000,0.000) applied, (0.000,0.000) suc (0.000,0.000) h (0.000,0.000) as (0.000,0.000) through (0.000,0.000) engagemen (0.000,0.000) t (0.000,0.000) with (0.000,0.000) standards (0.000,0.000) efforts (0.000,0.000) and (0.000,0.000) soft (0.000,0.000) w (0.000,0.000) are (0.000,0.000) re (0.000,0.000) v (0.000,0.000) ie (0.000,0.000) w. (0.000,0.000) Bridging (0.000,0.000) the (0.000,0.000) p (0.000,0.000) er- (0.000,0.000) ilous (0.000,0.000) gap (0.000,0.000) that (0.000,0.000) separates (0.000,0.000) these (0.000,0.000) comm (0.000,0.000) unities (0.000,0.000) will (0.000,0.000) b (0.000,0.000) e (0.000,0.000) essen (0.000,0.000) tial (0.000,0.000) for (0.000,0.000) k (0.000,0.000) eeping (0.000,0.000) future (0.000,0.000) systems (0.000,0.000) secure. (0.000,0.000) Ackno (0.000,0.000) wledgments (0.000,0.000) The (0.000,0.000) authors (0.000,0.000) wish (0.000,0.000) to (0.000,0.000) thank (0.000,0.000) Mic (0.000,0.000) hael (0.000,0.000) B (0.000,0.000) aile (0.000,0.000) y (0.000,0.000) , (0.000,0.000) Daniel (0.000,0.000) Bernstein, (0.000,0.000) Ron (0.000,0.000) Dreslinski, (0.000,0.000) T (0.000,0.000) anja (0.000,0.000) L (0.000,0.000) ange, (0.000,0.000) A (0.000,0.000) dam (0.000,0.000) Langley (0.000,0.000) , (0.000,0.000) Kenn (0.000,0.000) y (0.000,0.000) P (0.000,0.000) aterson, (0.000,0.000) Andrei (0.000,0.000) P (0.000,0.000) op (0.000,0.000) o (0.000,0.000) v, (0.000,0.000) Iv (0.000,0.000) an (0.000,0.000) Ristic, (0.000,0.000) Edw (0.000,0.000) ard (0.000,0.000) Sno (0.000,0.000) wden, (0.000,0.000) Brian (0.000,0.000) Smith, (0.000,0.000) Martin (0.000,0.000) Thomson, (0.000,0.000) and (0.000,0.000) Eric (0.000,0.000) Rescorla. (0.000,0.000) This (0.000,0.000) material (0.000,0.000) is (0.000,0.000) based (0.000,0.000) in (0.000,0.000) part (0.000,0.000) up (0.000,0.000) on (0.000,0.000) w (0.000,0.000) ork (0.000,0.000) supp (0.000,0.000) orted (0.000,0.000) b (0.000,0.000) y (0.000,0.000) the (0.000,0.000) U.S. (0.000,0.000) National (0.000,0.000) Science (0.000,0.000) F (0.000,0.000) oundation (0.000,0.000) under (0.000,0.000) con (0.000,0.000) tracts (0.000,0.000) CNS-1345254, (0.000,0.000) CNS-1409505, (0.000,0.000) CNS-1518741, (0.000,0.000) and (0.000,0.000) EFRI-1441209, (0.000,0.000) b (0.000,0.000) y (0.000,0.000) the (0.000,0.000) Office (0.000,0.000) of (0.000,0.000) Na (0.000,0.000) v (0.000,0.000) al (0.000,0.000) Researc (0.000,0.000) h (0.000,0.000) under (0.000,0.000) con (0.000,0.000) tract (0.000,0.000) N00014-11-1-0470, (0.000,0.000) b (0.000,0.000) y (0.000,0.000) the (0.000,0.000) ER (0.000,0.000) C (0.000,0.000) Starting (0.000,0.000) Gran (0.000,0.000) t (0.000,0.000) 259639 (0.000,0.000) (CR (0.000,0.000) YSP), (0.000,0.000) b (0.000,0.000) y (0.000,0.000) the (0.000,0.000) F (0.000,0.000) renc (0.000,0.000) h (0.000,0.000) ANR (0.000,0.000) re- (0.000,0.000) searc (0.000,0.000) h (0.000,0.000) gran (0.000,0.000) t (0.000,0.000) ANR-12-BS02-001-01, (0.000,0.000) b (0.000,0.000) y (0.000,0.000) the (0.000,0.000) NSF (0.000,0.000) Graduate (0.000,0.000) Researc (0.000,0.000) h (0.000,0.000) F (0.000,0.000) ello (0.000,0.000) wship (0.000,0.000) Program (0.000,0.000) under (0.000,0.000) gran (0.000,0.000) t (0.000,0.000) DGE-1256260, (0.000,0.000) b (0.000,0.000) y (0.000,0.000) the (0.000,0.000) Mozilla (0.000,0.000) F (0.000,0.000) oundat (0.000,0.000) ion, (0.000,0.000) b (0.000,0.000) y (0.000,0.000) a (0.000,0.000) gift (0.000,0.000) from (0.000,0.000) Sup (0.000,0.000) ermicro, (0.000,0.000) b (0.000,0.000) y (0.000,0.000) the (0.000,0.000) Go (0.000,0.000) ogle (0.000,0.000) Ph.D. (0.000,0.000) F (0.000,0.000) ello (0.000,0.000) wship (0.000,0.000) in (0.000,0.000) Computer (0.000,0.000) Securit (0.000,0.000) y (0.000,0.000) , (0.000,0.000) b (0.000,0.000) y (0.000,0.000) the (0.000,0.000) Morris (0.000,0.000) W (0.000,0.000) ellman (0.000,0.000) F (0.000,0.000) acult (0.000,0.000) y (0.000,0.000) Dev (0.000,0.000) elopmen (0.000,0.000) t (0.000,0.000) Assistan (0.000,0.000) t (0.000,0.000) Professor- (0.000,0.000) ship, (0.000,0.000) and (0.000,0.000) b (0.000,0.000) y (0.000,0.000) an (0.000,0.000) Alfred (0.000,0.000) P (0.000,0.000) . (0.000,0.000) Sloan (0.000,0.000) F (0.000,0.000) oundation (0.000,0.000) Researc (0.000,0.000) h (0.000,0.000) F (0.000,0.000) ello (0.000,0.000) w- (0.000,0.000) ship. (0.000,0.000) Some (0.000,0.000) exp (0.000,0.000) erimen (0.000,0.000) ts (0.000,0.000) w (0.000,0.000) ere (0.000,0.000) conducted (0.000,0.000) using (0.000,0.000) the (0.000,0.000) Grid’5000 (0.000,0.000) testb (0.000,0.000) ed, (0.000,0.000) whic (0.000,0.000) h (0.000,0.000) is (0.000,0.000) supp (0.000,0.000) ort (0.000,0.000) ed (0.000,0.000) b (0.000,0.000) y (0.000,0.000) INRIA, (0.000,0.000) CNRS, (0.000,0.000) RENA (0.000,0.000) TER, (0.000,0.000) and (0.000,0.000) sev (0.000,0.000) eral (0.000,0.000) other (0.000,0.000) univ (0.000,0.000) ersities (0.000,0.000) and (0.000,0.000) organizations; (0.000,0.000) additional (0.000,0.000) exp (0.000,0.000) erimen (0.000,0.000) ts (0.000,0.000) used (0.000,0.000) UCS (0.000,0.000) hardw (0.000,0.000) are (0.000,0.000) donated (0.000,0.000) b (0.000,0.000) y (0.000,0.000) Cisco. (0.000,0.000) 8. (0.000,0.000) REFERENCES (0.000,0.000) [1] (0.000,0.000) S. (0.000,0.000) Bai, (0.000,0.000) C. (0.000,0.000) Bouvier, (0.000,0.000) A (0.000,0.000) . (0.000,0.000) Filb (0.000,0.000) ois, (0.000,0.000) P (0.000,0.000) . (0.000,0.000) Gaudry (0.000,0.000) , (0.000,0.000) L. (0.000,0.000) Im (0.000,0.000) b (0.000,0.000) ert, (0.000,0.000) A. (0.000,0.000) Kruppa, (0.000,0.000) F. (0.000,0.000) Morain, (0.000,0.000) E. (0.000,0.000) Thomé, (0.000,0.000) and (0.000,0.000) P (0.000,0.000) . (0.000,0.000) Zimmermann. (0.000,0.000) cado-nfs (0.000,0.000) , (0.000,0.000) an (0.000,0.000) imple (0.000,0.000) men (0.000,0.000) tation (0.000,0.000) of (0.000,0.000) the (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) field (0.000,0.000) si (0.000,0.000) ev (0.000,0.000) e (0.000,0.000) algorithm, (0.000,0.000) 2014. (0.000,0.000) Release (0.000,0.000) 2.1.1. (0.000,0.000) [2] (0.000,0.000) R. (0.000,0.000) Barbulescu. (0.000,0.000) A (0.000,0.000) lgorithmes (0.000,0.000) de (0.000,0.000) lo (0.000,0.000) garithmes (0.000,0.000) discr (0.000,0.000) ets (0.000,0.000) da (0.000,0.000) ns (0.000,0.000) les (0.000,0.000) c (0.000,0.000) orps (0.000,0.000) finis (0.000,0.000) . (0.000,0.000) PhD (0.000,0.000) thesis, (0.000,0.000) Univ (0.000,0.000) ersité (0.000,0.000) de (0.000,0.000) Lorraine, (0.000,0.000) F (0.000,0.000) rance, (0.000,0.000) 2013. (0.000,0.000) [3] (0.000,0.000) R. (0.000,0.000) Barbulescu, (0.000,0.000) P (0.000,0.000) . (0.000,0.000) Gaudry (0.000,0.000) , (0.000,0.000) A. (0.000,0.000) Joux, (0.000,0.000) and (0.000,0.000) E. (0.000,0.000) Thomé. (0.000,0.000) A (0.000,0.000) heuristic (0.000,0.000) quasi-p (0.000,0.000) olynomial (0.000,0.000) algorithm (0.000,0.000) for (0.000,0.000) discrete (0.000,0.000) logarithm (0.000,0.000) in (0.000,0.000) finite (0.000,0.000) fields (0.000,0.000) of (0.000,0.000) small (0.000,0.000) c (0.000,0.000) haracteristic. (0.000,0.000) In (0.000,0.000) Eur (0.000,0.000) o (0.000,0.000) crypt (0.000,0.000) , (0.000,0.000) 2014. (0.000,0.000) [4] (0.000,0.000) E. (0.000,0.000) Bark (0.000,0.000) er, (0.000,0.000) W. (0.000,0.000) Bark (0.000,0.000) er, (0.000,0.000) W. (0.000,0.000) Burr, (0.000,0.000) W. (0.000,0.000) P (0.000,0.000) olk, (0.000,0.000) and (0.000,0.000) M. (0.000,0.000) Smid. (0.000,0.000) NIST (0.000,0.000) Sp (0.000,0.000) e (0.000,0.000) cial (0.000,0.000) Public (0.000,0.000) ation (0.000,0.000) 800-57: (0.000,0.000) R (0.000,0.000) e (0.000,0.000) c (0.000,0.000) ommendation (0.000,0.000) for (0.000,0.000) K (0.000,0.000) ey (0.000,0.000) Management (0.000,0.000) , (0.000,0.000) 2007. (0.000,0.000) [5] (0.000,0.000) D. (0.000,0.000) J. (0.000,0.000) Bernstein. (0.000,0.000) Ho (0.000,0.000) w (0.000,0.000) to (0.000,0.000) find (0.000,0.000) smo (0.000,0.000) oth (0.000,0.000) parts (0.000,0.000) of (0.000,0.000) in (0.000,0.000) tegers, (0.000,0.000) 2004. (0.000,0.000) h (0.000,0.000) ttp:// (0.000,0.000) c (0.000,0.000) r (0.000,0.000) . (0.000,0.000) yp.to/f (0.000,0.000) actorization/smo (0.000,0.000) othparts- (0.000,0.000) 20040510.p (0.000,0.000) df (0.000,0.000) . (0.000,0.000) [6] (0.000,0.000) D. (0.000,0.000) J. (0.000,0.000) Bernstein (0.000,0.000) and (0.000,0.000) T. (0.000,0.000) Lange. (0.000,0.000) Batc (0.000,0.000) h (0.000,0.000) NFS. (0.000,0.000) In (0.000,0.000) Sele (0.000,0.000) cte (0.000,0.000) d (0.000,0.000) A (0.000,0.000) r (0.000,0.000) e (0.000,0.000) as (0.000,0.000) in (0.000,0.000) Crypto (0.000,0.000) gr (0.000,0.000) aphy (0.000,0.000) , (0.000,0.000) 2014. (0.000,0.000) [7] (0.000,0.000) B. (0.000,0.000) Beurdouc (0.000,0.000) he, (0.000,0.000) K. (0.000,0.000) Bharga (0.000,0.000) v (0.000,0.000) an, (0.000,0.000) A. (0.000,0.000) De (0.000,0.000) lignat- (0.000,0.000) L (0.000,0.000) a (0.000,0.000) v (0.000,0.000) aud, (0.000,0.000) C. (0.000,0.000) F (0.000,0.000) ournet, (0.000,0.000) M. (0.000,0.000) K (0.000,0.000) ohlw (0.000,0.000) eiss, (0.000,0.000) A. (0.000,0.000) Piron (0.000,0.000) ti, (0.000,0.000) P (0.000,0.000) .-Y. (0.000,0.000) Strub, (0.000,0.000) and (0.000,0.000) J. (0.000,0.000) K. (0.000,0.000) Zinzindohoue. (0.000,0.000) A (0.000,0.000) m (0.000,0.000) essy (0.000,0.000) state (0.000,0.000) of (0.000,0.000) the (0.000,0.000) union: (0.000,0.000) T (0.000,0.000) aming (0.000,0.000) the (0.000,0.000) comp (0.000,0.000) osite (0.000,0.000) state (0.000,0.000) mac (0.000,0.000) hines (0.000,0.000) of (0.000,0.000) TLS. (0.000,0.000) In (0.000,0.000) IEEE (0.000,0.000) Symp (0.000,0.000) osium (0.000,0.000) on (0.000,0.000) Se (0.000,0.000) curity (0.000,0.000) and (0.000,0.000) Privac (0.000,0.000) y (0.000,0.000) , (0.000,0.000) 2015. (0.000,0.000) [8] (0.000,0.000) C. (0.000,0.000) Bouvier, (0.000,0.000) P (0.000,0.000) . (0.000,0.000) Gaudry (0.000,0.000) , (0.000,0.000) L. (0.000,0.000) Im (0.000,0.000) b (0.000,0.000) ert, (0.000,0.000) H. (0.000,0.000) Jeljeli, (0.000,0.000) and (0.000,0.000) E. (0.000,0.000) Thomé. (0.000,0.000) New (0.000,0.000) record (0.000,0.000) for (0.000,0.000) disc (0.000,0.000) r (0.000,0.000) e (0.000,0.000) te (0.000,0.000) logarithm (0.000,0.000) in (0.000,0.000) a (0.000,0.000) prime (0.000,0.000) finite (0.000,0.000) field (0.000,0.000) of (0.000,0.000) 180 (0.000,0.000) decimal (0.000,0.000) digits, (0.000,0.000) 201 (0.000,0.000) 4. (0.000,0.000) h (0.000,0.000) ttp://caramel.loria.fr/p180.txt. (0.000,0.000) [9] (0.000,0.000) R. (0.000,0.000) Canetti (0.000,0.000) and (0.000,0.000) H. (0.000,0.000) Kra (0.000,0.000) w (0.000,0.000) czyk. (0.000,0.000) Securit (0.000,0.000) y (0.000,0.000) analysis (0.000,0.000) of (0.000,0.000) IKE’s (0.000,0.000) signature-based (0.000,0.000) k (0.000,0.000) ey-exc (0.000,0.000) hange (0.000,0.000) p (0.000,0.000) roto (0.000,0.000) col. (0.000,0.000) In (0.000,0.000) Crypto (0.000,0.000) , (0.000,0.000) 2002. (0.000,0.000) [10] (0.000,0.000) A (0.000,0.000) . (0.000,0.000) Commeine (0.000,0.000) and (0.000,0.000) I. (0.000,0.000) Semaev. (0.000,0.000) An (0.000,0.000) algorithm (0.000,0.000) to (0.000,0.000) solv (0.000,0.000) e (0.000,0.000) the (0.000,0.000) discrete (0.000,0.000) logarithm (0.000,0.000) pr (0.000,0.000) oblem (0.000,0.000) with (0.000,0.000) the (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) field (0.000,0.000) siev (0.000,0.000) e. (0.000,0.000) In (0.000,0.000) PK (0.000,0.000) C (0.000,0.000) , (0.000,0.000) 2006. (0.000,0.000) [11] (0.000,0.000) D (0.000,0.000) . (0.000,0.000) Copp (0.000,0.000) ersmith. (0.000,0.000) Solv (0.000,0.000) ing (0.000,0.000) linear (0.000,0.000) equations (0.000,0.000) o (0.000,0.000) v (0.000,0.000) er (0.000,0.000) GF(2) (0.000,0.000) via (0.000,0.000) blo (0.000,0.000) c (0.000,0.000) k (0.000,0.000) Wiedemann (0.000,0.000) a (0.000,0.000) l (0.000,0.000) g (0.000,0.000) orithm. (0.000,0.000) Math. (0.000,0.000) Comp. (0.000,0.000) , (0.000,0.000) 62(205), (0.000,0.000) 1994. (0.000,0.000) [12] (0.000,0.000) R (0.000,0.000) . (0.000,0.000) Crandall (0.000,0.000) and (0.000,0.000) C. (0.000,0.000) B. (0.000,0.000) P (0.000,0.000) omerance. (0.000,0.000) Prime (0.000,0.000) Numb (0.000,0.000) ers: (0.000,0.000) A (0.000,0.000) Computational (0.000,0.000) Persp (0.000,0.000) e (0.000,0.000) c (0.000,0.000) tive (0.000,0.000) . (0.000,0.000) Springer, (0.000,0.000) 2001. (0.000,0.000) [13] (0.000,0.000) B (0.000,0.000) . (0.000,0.000) den (0.000,0.000) Bo (0.000,0.000) er. (0.000,0.000) Diffie-Hellman (0.000,0.000) is (0.000,0.000) as (0.000,0.000) strong (0.000,0.000) as (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) for (0.000,0.000) certain (0.000,0.000) primes. (0.000,0.000) In (0.000,0.000) Crypto (0.000,0.000) , (0.000,0.000) 1988. (0.000,0.000) [14] (0.000,0.000) W. (0.000,0.000) Diffie (0.000,0.000) and (0.000,0.000) M. (0.000,0.000) E. (0.000,0.000) Hellman. (0.000,0.000) New (0.000,0.000) directions (0.000,0.000) in (0.000,0.000) cryptograph (0.000,0.000) y (0.000,0.000) . (0.000,0.000) IEEE (0.000,0.000) T (0.000,0.000) r (0.000,0.000) ans. (0.000,0.000) Inform. (0.000,0.000) The (0.000,0.000) ory (0.000,0.000) , (0.000,0.000) 22(6):644–654, (0.000,0.000) 1976. (0.000,0.000) [15] (0.000,0.000) Z. (0.000,0.000) Durumeric, (0.000,0.000) E. (0.000,0.000) W (0.000,0.000) ustro (0.000,0.000) w, (0.000,0.000) and (0.000,0.000) J. (0.000,0.000) A. (0.000,0.000) Halderman. (0.000,0.000) ZMap: (0.000,0.000) F (0.000,0.000) ast (0.000,0.000) In (0.000,0.000) ternet-wide (0.000,0.000) scanning (0.000,0.000) and (0.000,0.000) i (0.000,0.000) ts (0.000,0.000) securit (0.000,0.000) y (0.000,0.000) applications. (0.000,0.000) In (0.000,0.000) U (0.000,0.000) senix (0.000,0.000) Se (0.000,0.000) curity (0.000,0.000) , (0.000,0.000) 2013. (0.000,0.000) [16] (0.000,0.000) M. (0.000,0.000) F (0.000,0.000) riedl, (0.000,0.000) N. (0.000,0.000) Pro (0.000,0.000) v (0.000,0.000) os, (0.000,0.000) and (0.000,0.000) W. (0.000,0.000) Simpson. (0.000,0.000) Diffie-Hellman (0.000,0.000) group (0.000,0.000) exc (0.000,0.000) hange (0.000,0.000) for (0.000,0.000) the (0.000,0.000) secure (0.000,0.000) she (0.000,0.000) ll (0.000,0.000) (SSH) (0.000,0.000) transp (0.000,0.000) ort (0.000,0.000) la (0.000,0.000) y (0.000,0.000) er (0.000,0.000) proto (0.000,0.000) col. (0.000,0.000) RF (0.000,0.000) C (0.000,0.000) 441 (0.000,0.000) 9, (0.000,0.000) Mar. (0.000,0.000) 2006. (0.000,0.000) [17] (0.000,0.000) W. (0.000,0.000) Geiselmann, (0.000,0.000) H. (0.000,0.000) K (0.000,0.000) opfer, (0.000,0.000) R. (0.000,0.000) Stein (0.000,0.000) w (0.000,0.000) andt, (0.000,0.000) and (0.000,0.000) E. (0.000,0.000) T (0.000,0.000) romer. (0.000,0.000) Impro (0.000,0.000) v (0.000,0.000) ed (0.000,0.000) routing-based (0.000,0.000) linear (0.000,0.000) algebra (0.000,0.000) fo (0.000,0.000) r (0.000,0.000) the (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) fie (0.000,0.000) ld (0.000,0.000) siev (0.000,0.000) e. (0.000,0.000) In (0.000,0.000) Information (0.000,0.000) T (0.000,0.000) e (0.000,0.000) chnolo (0.000,0.000) gy: (0.000,0.000) Co (0.000,0.000) ding (0.000,0.000) and (0.000,0.000) Computing (0.000,0.000) , (0.000,0.000) 2005. (0.000,0.000) [18] (0.000,0.000) W. (0.000,0.000) Geiselmann (0.000,0.000) and (0.000,0.000) R. (0.000,0.000) Stein (0.000,0.000) w (0.000,0.000) andt. (0.000,0.000) Non- (0.000,0.000) w (0.000,0.000) afer-scale (0.000,0.000) sieving (0.000,0.000) hardw (0.000,0.000) are (0.000,0.000) f (0.000,0.000) or (0.000,0.000) the (0.000,0.000) NFS: (0.000,0.000) Another (0.000,0.000) attempt (0.000,0.000) to (0.000,0.000) cop (0.000,0.000) e (0.000,0.000) with (0.000,0.000) 1024-bit. (0.000,0.000) In (0.000,0.000) Eur (0.000,0.000) o (0.000,0.000) c (0.000,0.000) rypt (0.000,0.000) , (0.000,0.000) 2007. (0.000,0.000) [19] (0.000,0.000) D. (0.000,0.000) Gillmor. (0.000,0.000) Negotiated (0.000,0.000) finite (0.000,0.000) field (0.000,0.000) Diffie-Hellman (0.000,0.000) ephemeral (0.000,0.000) parameters (0.000,0.000) for (0.000,0.000) TLS. (0.000,0.000) IETF (0.000,0.000) In (0.000,0.000) ternet (0.000,0.000) Draft, (0.000,0.000) Ma (0.000,0.000) y (0.000,0.000) 2015. (0.000,0.000) [20] (0.000,0.000) D (0.000,0.000) . (0.000,0.000) M. (0.000,0.000) Gordon. (0.000,0.000) Designing (0.000,0.000) and (0.000,0.000) detec (0.000,0.000) ting (0.000,0.000) trap (0.000,0.000) do (0.000,0.000) ors (0.000,0.000) for (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) c (0.000,0.000) r (0.000,0.000) y (0.000,0.000) pto (0.000,0.000) s (0.000,0.000) ystems. (0.000,0.000) In (0.000,0.000) Crypto (0.000,0.000) , (0.000,0.000) 1992. (0.000,0.000) [21] (0.000,0.000) D (0.000,0.000) . (0.000,0.000) M. (0.000,0.000) Gordon. (0.000,0.000) Discrete (0.000,0.000) logarithms (0.000,0.000) in (0.000,0.000) GF( (0.000,0.000) p (0.000,0.000) ) (0.000,0.000) using (0.000,0.000) the (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) e (0.000,0.000) r (0.000,0.000) field (0.000,0.000) siev (0.000,0.000) e. (0.000,0.000) SIAM (0.000,0.000) J. (0.000,0.000) Discr (0.000,0.000) ete (0.000,0.000) Math. (0.000,0.000) , (0.000,0.000) 6(1), (0.000,0.000) 1993. (0.000,0.000) [22] (0.000,0.000) D. (0.000,0.000) Harkins (0.000,0.000) and (0.000,0.000) D. (0.000,0.000) Ca (0.000,0.000) rrel. (0.000,0.000) The (0.000,0.000) In (0.000,0.000) ternet (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) exc (0.000,0.000) hange (0.000,0.000) (IKE). (0.000,0.000) RF (0.000,0.000) C (0.000,0.000) 240 (0.000,0.000) 9, (0.000,0.000) No (0.000,0.000) v. (0.000,0.000) 1998. (0.000,0.000) [23] (0.000,0.000) T. (0.000,0.000) Jager, (0.000,0.000) K. (0.000,0.000) G. (0.000,0.000) P (0.000,0.000) aterson, (0.000,0.000) and (0.000,0.000) J. (0.000,0.000) Somoro (0.000,0.000) v (0.000,0.000) sky (0.000,0.000) . (0.000,0.000) One (0.000,0.000) bad (0.000,0.000) apple: (0.000,0.000) Bac (0.000,0.000) kw (0.000,0.000) ards (0.000,0.000) compatibil (0.000,0.000) it (0.000,0.000) y (0.000,0.000) attac (0.000,0.000) ks (0.000,0.000) on (0.000,0.000) state-of-the-art (0.000,0.000) cryptograph (0.000,0.000) y (0.000,0.000) . (0.000,0.000) In (0.000,0.000) NDSS (0.000,0.000) , (0.000,0.000) 2013. (0.000,0.000) [24] (0.000,0.000) A. (0.000,0.000) Joux (0.000,0.000) and (0.000,0.000) R. (0.000,0.000) Lercier. (0.000,0.000) Impro (0.000,0.000) v (0.000,0.000) emen (0.000,0.000) ts (0.000,0.000) to (0.000,0.000) t (0.000,0.000) he (0.000,0.000) general (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) field (0.000,0.000) siev (0.000,0.000) e (0.000,0.000) for (0.000,0.000) discrete (0.000,0.000) logarithms (0.000,0.000) in (0.000,0.000) prime (0.000,0.000) fields. (0.000,0.000) A (0.000,0.000) comparison (0.000,0.000) with (0.000,0.000) the (0.000,0.000) Gau (0.000,0.000) s (0.000,0.000) sian (0.000,0.000) in (0.000,0.000) teger (0.000,0.000) met (0.000,0.000) h (0.000,0.000) o (0.000,0.000) d. (0.000,0.000) Math. (0.000,0.000) Comp. (0.000,0.000) , (0.000,0.000) 72(242):953–967, (0.000,0.000) 2003. (0.000,0.000) [25] (0.000,0.000) C. (0.000,0.000) Kaufman, (0.000,0.000) P (0.000,0.000) . (0.000,0.000) Hoffman, (0.000,0.000) Y. (0.000,0.000) Nir, (0.000,0.000) P (0.000,0.000) . (0.000,0.000) Eronen, (0.000,0.000) and (0.000,0.000) T. (0.000,0.000) Kivinen. (0.000,0.000) In (0.000,0.000) ternet (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) exc (0.000,0.000) hange (0.000,0.000) proto (0.000,0.000) col (0.000,0.000) v (0.000,0.000) ersi (0.000,0.000) o (0.000,0.000) n (0.000,0.000) 2 (0.000,0.000) (IKEv2). (0.000,0.000) RF (0.000,0.000) C (0.000,0.000) 729 (0.000,0.000) 6, (0.000,0.000) Oct. (0.000,0.000) 2014. (0.000,0.000) [26] (0.000,0.000) S. (0.000,0.000) Ken (0.000,0.000) t. (0.000,0.000) IP (0.000,0.000) authen (0.000,0.000) tication (0.000,0.000) header. (0.000,0.000) R (0.000,0.000) F (0.000,0.000) C (0.000,0.000) 4302, (0.000,0.000) Dec. (0.000,0.000) 2005. (0.000,0.000) [27] (0.000,0.000) S. (0.000,0.000) Ken (0.000,0.000) t. (0.000,0.000) IP (0.000,0.000) encapsulating (0.000,0.000) securit (0.000,0.000) y (0.000,0.000) pa (0.000,0.000) yload (0.000,0.000) (ESP). (0.000,0.000) RF (0.000,0.000) C (0.000,0.000) 430 (0.000,0.000) 3, (0.000,0.000) Dec. (0.000,0.000) 2005. (0.000,0.000) [28] (0.000,0.000) T. (0.000,0.000) Kl (0.000,0.000) einjung (0.000,0.000) . (0.000,0.000) Cofactorisation (0.000,0.000) strategies (0.000,0.000) for (0.000,0.000) the (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er (0.000,0.000) fiel (0.000,0.000) d (0.000,0.000) siev (0.000,0.000) e (0.000,0.000) and (0.000,0.000) an (0.000,0.000) estimate (0.000,0.000) for (0.000,0.000) the (0.000,0.000) sieving (0.000,0.000) step (0.000,0.000) for (0.000,0.000) factoring (0.000,0.000) 1024 (0.000,0.000) bit (0.000,0.000) in (0.000,0.000) tegers, (0.000,0.000) 2006. (0.000,0.000) h (0.000,0.000) ttp:// (0.000,0.000) www.h (0.000,0.000) yp (0.000,0.000) e (0.000,0.000) r (0.000,0.000) e (0.000,0.000) lliptic.org/tanja (0.000,0.000) / (0.000,0.000) SHAR (0.000,0.000) CS/talks06/thorsten.p (0.000,0.000) df (0.000,0.000) . (0.000,0.000) [29] (0.000,0.000) T. (0.000,0.000) Kleinjung, (0.000,0.000) K. (0.000,0.000) A (0.000,0.000) o (0.000,0.000) k (0.000,0.000) i, (0.000,0.000) J. (0.000,0.000) F (0.000,0.000) rank (0.000,0.000) e, (0.000,0.000) A. (0.000,0.000) K. (0.000,0.000) Lenstra, (0.000,0.000) E. (0.000,0.000) Thomé, (0.000,0.000) J. (0.000,0.000) W. (0.000,0.000) Bos, (0.000,0.000) P (0.000,0.000) . (0.000,0.000) Gaudry (0.000,0.000) , (0.000,0.000) A. (0.000,0.000) Kruppa, (0.000,0.000) P (0.000,0.000) . (0.000,0.000) L. (0.000,0.000) Mon (0.000,0.000) tg (0.000,0.000) ome (0.000,0.000) r (0.000,0.000) y (0.000,0.000) , (0.000,0.000) D. (0.000,0.000) A. (0.000,0.000) Osvik, (0.000,0.000) H. (0.000,0.000) te (0.000,0.000) Riele, (0.000,0.000) A. (0.000,0.000) Timofeev (0.000,0.000) , (0.000,0.000) and (0.000,0.000) P (0.000,0.000) . (0.000,0.000) Zi (0.000,0.000) mmermann. (0.000,0.000) F (0.000,0.000) actorization (0.000,0.000) of (0.000,0.000) a (0.000,0.000) 768-bit (0.000,0.000) RSA (0.000,0.000) mo (0.000,0.000) dulus (0.000,0.000) . (0.000,0.000) In (0.000,0.000) Crypto (0.000,0.000) , (0.000,0.000) 2010. (0.000,0.000) [30] (0.000,0.000) A. (0.000,0.000) Langley (0.000,0.000) , (0.000,0.000) N. (0.000,0.000) Mo (0.000,0.000) dadugu, (0.000,0.000) and (0.000,0.000) B. (0.000,0.000) Mo (0.000,0.000) eller. (0.000,0.000) T (0.000,0.000) ransp (0.000,0.000) ort (0.000,0.000) la (0.000,0.000) y (0.000,0.000) er (0.000,0.000) securit (0.000,0.000) y (0.000,0.000) (TLS) (0.000,0.000) false (0.000,0.000) start. (0.000,0.000) IETF (0.000,0.000) In (0.000,0.000) ternet (0.000,0.000) Draft, (0.000,0.000) 2010. (0.000,0.000) [31] (0.000,0.000) A. (0.000,0.000) K. (0.000,0.000) Lenstra (0.000,0.000) and (0.000,0.000) H. (0.000,0.000) W. (0.000,0.000) Lenstra, (0.000,0.000) Jr., (0.000,0.000) editors. (0.000,0.000) The (0.000,0.000) Development (0.000,0.000) of (0.000,0.000) the (0.000,0.000) Numb (0.000,0.000) er (0.000,0.000) Field (0.000,0.000) Sieve (0.000,0.000) . (0.000,0.000) Springer, (0.000,0.000) 1993. (0.000,0.000) [32] (0.000,0.000) M (0.000,0.000) . (0.000,0.000) Lipacis. (0.000,0.000) Semiconductors: (0.000,0.000) M (0.000,0.000) o (0.000,0.000) ore (0.000,0.000) stress (0.000,0.000) = (0.000,0.000) stru (0.000,0.000) c (0.000,0.000) tura (0.000,0.000) l (0.000,0.000) industry (0.000,0.000) shift. (0.000,0.000) T (0.000,0.000) ec (0.000,0.000) h (0.000,0.000) ni (0.000,0.000) cal (0.000,0.000) rep (0.000,0.000) ort, (0.000,0.000) Jeffe (0.000,0.000) r (0.000,0.000) i (0.000,0.000) es, (0.000,0.000) 2012. (0.000,0.000) [33] (0.000,0.000) U. (0.000,0.000) M. (0.000,0.000) Maurer. (0.000,0.000) T (0.000,0.000) o (0.000,0.000) w (0.000,0.000) ards (0.000,0.000) the (0.000,0.000) equiv (0.000,0.000) alence (0.000,0.000) of (0.000,0.000) breaking (0.000,0.000) the (0.000,0.000) Diffie-Hellman (0.000,0.000) proto (0.000,0.000) col (0.000,0.000) and (0.000,0.000) computing (0.000,0.000) discrete (0.000,0.000) logarithms. (0.000,0.000) In (0.000,0.000) Crypto (0.000,0.000) , (0.000,0.000) 1994. (0.000,0.000) [34] (0.000,0.000) U. (0.000,0.000) M. (0.000,0.000) Maurer (0.000,0.000) and (0.000,0.000) S. (0.000,0.000) W (0.000,0.000) olf. (0.000,0.000) Diffie-Hellman (0.000,0.000) oracles. (0.000,0.000) In (0.000,0.000) Crypto (0.000,0.000) , (0.000,0.000) 1996. (0.000,0.000) [35] (0.000,0.000) N. (0.000,0.000) Ma (0.000,0.000) vrogiannop (0.000,0.000) oulos, (0.000,0.000) F. (0.000,0.000) V (0.000,0.000) ercauteren, (0.000,0.000) V. (0.000,0.000) V (0.000,0.000) elic (0.000,0.000) hk (0.000,0.000) o (0.000,0.000) v, (0.000,0.000) and (0.000,0.000) B. (0.000,0.000) Preneel. (0.000,0.000) A (0.000,0.000) cross-proto (0.000,0.000) col (0.000,0.000) attac (0.000,0.000) k (0.000,0.000) on (0.000,0.000) the (0.000,0.000) TLS (0.000,0.000) proto (0.000,0.000) col. (0.000,0.000) In (0.000,0.000) A (0.000,0.000) CM (0.000,0.000) CCS (0.000,0.000) , (0.000,0.000) pages (0.000,0.000) 62–72, (0.000,0.000) 2012. (0.000,0.000) [36] (0.000,0.000) C. (0.000,0.000) Meado (0.000,0.000) ws. (0.000,0.000) Analysis (0.000,0.000) of (0.000,0.000) the (0.000,0.000) In (0.000,0.000) ternet (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) exc (0.000,0.000) hange (0.000,0.000) pro (0.000,0.000) to (0.000,0.000) col (0.000,0.000) using (0.000,0.000) the (0.000,0.000) NRL (0.000,0.000) proto (0.000,0.000) col (0.000,0.000) analyzer. (0.000,0.000) In (0.000,0.000) IEEE (0.000,0.000) Symp (0.000,0.000) osium (0.000,0.000) on (0.000,0.000) Se (0.000,0.000) curity (0.000,0.000) and (0.000,0.000) Privacy (0.000,0.000) , (0.000,0.000) 1999. (0.000,0.000) [37] (0.000,0.000) M (0.000,0.000) icrosof (0.000,0.000) t (0.000,0.000) Securit (0.000,0.000) y (0.000,0.000) Bull (0.000,0.000) etin (0.000,0.000) MS15-055. (0.000,0.000) V (0.000,0.000) ulnerabilit (0.000,0.000) y (0.000,0.000) in (0.000,0.000) Sc (0.000,0.000) ha (0.000,0.000) nne (0.000,0.000) l (0.000,0.000) could (0.000,0.000) allo (0.000,0.000) w (0.000,0.000) infor (0.000,0.000) mati (0.000,0.000) o (0.000,0.000) n (0.000,0.000) disclosure, (0.000,0.000) Ma (0.000,0.000) y (0.000,0.000) 2015 (0.000,0.000) . (0.000,0.000) 12 (0.000,0.000) [38] (0.000,0.000) N (0.000,0.000) I (0.000,0.000) ST (0.000,0.000) . (0.000,0.000) FIPS (0.000,0.000) PUB (0.000,0.000) 186-4: (0.000,0.000) Digital (0.000,0.000) signature (0.000,0.000) standard, (0.000,0.000) 2013. (0.000,0.000) [39] (0.000,0.000) O (0.000,0.000) ak (0.000,0.000) Ridge (0.000,0.000) National (0.000,0.000) Lab (0.000,0.000) oratory. (0.000,0.000) In (0.000,0.000) tro (0.000,0.000) duc (0.000,0.000) ing (0.000,0.000) Titan, (0.000,0.000) 2012. (0.000,0.000) h (0.000,0.000) ttps:// (0.000,0.000) www.olc (0.000,0.000) f (0.000,0.000) . (0.000,0.000) o (0.000,0.000) rnl. (0.000,0.000) g (0.000,0.000) o (0.000,0.000) v/titan. (0.000,0.000) [40] (0.000,0.000) H (0.000,0.000) . (0.000,0.000) Orman. (0.000,0.000) The (0.000,0.000) Oakley (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) determination (0.000,0.000) proto (0.000,0.000) col. (0.000,0.000) RF (0.000,0.000) C (0.000,0.000) 2412 (0.000,0.000) , (0.000,0.000) No (0.000,0.000) v. (0.000,0.000) 1998. (0.000,0.000) [41] (0.000,0.000) S. (0.000,0.000) C. (0.000,0.000) P (0.000,0.000) ohlig (0.000,0.000) and (0.000,0.000) M. (0.000,0.000) E. (0.000,0.000) Hellman. (0.000,0.000) An (0.000,0.000) impro (0.000,0.000) v (0.000,0.000) ed (0.000,0.000) algo (0.000,0.000) rithm (0.000,0.000) for (0.000,0.000) computing (0.000,0.000) logarithms (0.000,0.000) o (0.000,0.000) v (0.000,0.000) er (0.000,0.000) GF( (0.000,0.000) p (0.000,0.000) ) (0.000,0.000) and (0.000,0.000) its (0.000,0.000) cryptographic (0.000,0.000) significance (0.000,0.000) (corresp.). (0.000,0.000) T (0.000,0.000) r (0.000,0.000) ans. (0.000,0.000) Inform. (0.000,0.000) The (0.000,0.000) ory (0.000,0.000) , (0.000,0.000) 24(1), (0.000,0.000) 1978. (0.000,0.000) [42] (0.000,0.000) J. (0.000,0.000) M. (0.000,0.000) P (0.000,0.000) ollard. (0.000,0.000) A (0.000,0.000) Mon (0.000,0.000) te (0.000,0.000) Carlo (0.000,0.000) metho (0.000,0.000) d (0.000,0.000) f (0.000,0.000) or (0.000,0.000) factor (0.000,0.000) i (0.000,0.000) zation. (0.000,0.000) BIT (0.000,0.000) Numeric (0.000,0.000) al (0.000,0.000) Mathematics (0.000,0.000) , (0.000,0.000) 15(3):331–334, (0.000,0.000) 1975. (0.000,0.000) [43] (0.000,0.000) O (0.000,0.000) . (0.000,0.000) Sc (0.000,0.000) hirokauer. (0.000,0.000) Virtual (0.000,0.000) loga (0.000,0.000) rithms (0.000,0.000) . (0.000,0.000) J. (0.000,0.000) A (0.000,0.000) lgorithms (0.000,0.000) , (0.000,0.000) 57(2):140–147, (0.000,0.000) 2005. (0.000,0.000) [44] (0.000,0.000) I. (0.000,0.000) A. (0.000,0.000) Semaev. (0.000,0.000) Sp (0.000,0.000) ecial (0.000,0.000) prime (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) ers (0.000,0.000) and (0.000,0.000) discrete (0.000,0.000) log (0.000,0.000) s (0.000,0.000) in (0.000,0.000) finite (0.000,0.000) prime (0.000,0.000) fields. (0.000,0.000) Math. (0.000,0.000) Comp. (0.000,0.000) , (0.000,0.000) 71(237):363–377, (0.000,0.000) 2002. (0.000,0.000) [45] (0.000,0.000) D. (0.000,0.000) Shanks. (0.000,0.000) Class (0.000,0.000) n (0.000,0.000) um (0.000,0.000) b (0.000,0.000) er, (0.000,0.000) a (0.000,0.000) theory (0.000,0.000) of (0.000,0.000) factorization, (0.000,0.000) and (0.000,0.000) genera. (0.000,0.000) In (0.000,0.000) Pr (0.000,0.000) o (0.000,0.000) c. (0.000,0.000) Symp (0.000,0.000) os. (0.000,0.000) Pur (0.000,0.000) e (0.000,0.000) Math. (0.000,0.000) , (0.000,0.000) v (0.000,0.000) olume (0.000,0.000) 20. (0.000,0.000) 1971. (0.000,0.000) [46] (0.000,0.000) Spiegel (0.000,0.000) Staff. (0.000,0.000) Prying (0.000,0.000) ey (0.000,0.000) e (0.000,0.000) s: (0.000,0.000) Inside (0.000,0.000) the (0.000,0.000) NSA’s (0.000,0.000) w (0.000,0.000) ar (0.000,0.000) on (0.000,0.000) In (0.000,0.000) ternet (0.000,0.000) securit (0.000,0.000) y (0.000,0.000) . (0.000,0.000) Der (0.000,0.000) Spiegel, (0.000,0.000) Dec (0.000,0.000) 2014. (0.000,0.000) h (0.000,0.000) ttp:// (0.000,0.000) www.spi (0.000,0.000) egel.de/in (0.000,0.000) ternational/german (0.000,0.000) y (0.000,0.000) / (0.000,0.000) inside- (0.000,0.000) the- (0.000,0.000) nsa- (0.000,0.000) s- (0.000,0.000) w (0.000,0.000) ar (0.000,0.000) - (0.000,0.000) on- (0.000,0.000) in (0.000,0.000) ternet- (0.000,0.000) sec (0.000,0.000) ur (0.000,0.000) i (0.000,0.000) t (0.000,0.000) y- (0.000,0.000) a (0.000,0.000) - (0.000,0.000) 1010361.h (0.000,0.000) tml. (0.000,0.000) [47] (0.000,0.000) W. (0.000,0.000) Stein (0.000,0.000) et (0.000,0.000) al. (0.000,0.000) Sage (0.000,0.000) Mathematics (0.000,0.000) Softwar (0.000,0.000) e (0.000,0.000) (Version (0.000,0.000) 6.5) (0.000,0.000) . (0.000,0.000) The (0.000,0.000) Sage (0.000,0.000) Dev (0.000,0.000) elopmen (0.000,0.000) t (0.000,0.000) T (0.000,0.000) eam, (0.000,0.000) 2015. (0.000,0.000) h (0.000,0.000) ttp:// (0.000,0.000) www.sagemath.org (0.000,0.000) . (0.000,0.000) [48] (0.000,0.000) stud: (0.000,0.000) The (0.000,0.000) scalable (0.000,0.000) TLS (0.000,0.000) un (0.000,0.000) wrapping (0.000,0.000) daemon, (0.000,0.000) 2012. (0.000,0.000) h (0.000,0.000) ttps:// (0.000,0.000) gith (0.000,0.000) ub.com/bumptec (0.000,0.000) h/stud/b (0.000,0.000) l (0.000,0.000) o (0.000,0.000) b/ (0.000,0.000) 19a7f19686 (0.000,0.000) b (0.000,0.000) cdb (0.000,0.000) d6 (0.000,0.000) 89c6fb (0.000,0.000) ea31f68a27 (0.000,0.000) 6e62d886/stud.c#L593. (0.000,0.000) [49] (0.000,0.000) E (0.000,0.000) . (0.000,0.000) Thomé. (0.000,0.000) Sub (0.000,0.000) quadratic (0.000,0.000) computation (0.000,0.000) of (0.000,0.000) v (0.000,0.000) ector (0.000,0.000) g (0.000,0.000) e (0.000,0.000) nera (0.000,0.000) ti (0.000,0.000) ng (0.000,0.000) p (0.000,0.000) o (0.000,0.000) l (0.000,0.000) ynomials (0.000,0.000) and (0.000,0.000) impro (0.000,0.000) v (0.000,0.000) emen (0.000,0.000) t (0.000,0.000) of (0.000,0.000) the (0.000,0.000) blo (0.000,0.000) c (0.000,0.000) k (0.000,0.000) Wiedemann (0.000,0.000) algorithm. (0.000,0.000) J. (0.000,0.000) Symb (0.000,0.000) olic (0.000,0.000) Comput. (0.000,0.000) , (0.000,0.000) 33(5):757–775, (0.000,0.000) 2002. (0.000,0.000) [50] (0.000,0.000) P (0.000,0.000) . (0.000,0.000) C. (0.000,0.000) V (0.000,0.000) an (0.000,0.000) Oorsc (0.000,0.000) hot (0.000,0.000) and (0.000,0.000) M. (0.000,0.000) J. (0.000,0.000) Wiener. (0.000,0.000) P (0.000,0.000) arallel (0.000,0.000) collision (0.000,0.000) searc (0.000,0.000) h (0.000,0.000) with (0.000,0.000) application (0.000,0.000) to (0.000,0.000) hash (0.000,0.000) functions (0.000,0.000) a (0.000,0.000) nd (0.000,0.000) discrete (0.000,0.000) logarithms. (0.000,0.000) In (0.000,0.000) A (0.000,0.000) CM (0.000,0.000) CCS (0.000,0.000) , (0.000,0.000) 1994. (0.000,0.000) [51] (0.000,0.000) P (0.000,0.000) . (0.000,0.000) C. (0.000,0.000) V (0.000,0.000) an (0.000,0.000) Oorsc (0.000,0.000) hot (0.000,0.000) and (0.000,0.000) M. (0.000,0.000) J. (0.000,0.000) Wiener. (0.000,0.000) On (0.000,0.000) D (0.000,0.000) iffie-Hellman (0.000,0.000) k (0.000,0.000) ey (0.000,0.000) agreemen (0.000,0.000) t (0.000,0.000) with (0.000,0.000) short (0.000,0.000) exp (0.000,0.000) onen (0.000,0.000) ts. (0.000,0.000) In (0.000,0.000) Eur (0.000,0.000) o (0.000,0.000) crypt (0.000,0.000) , (0.000,0.000) 1996. (0.000,0.000) [52] (0.000,0.000) D. (0.000,0.000) W (0.000,0.000) agner (0.000,0.000) and (0.000,0.000) B. (0.000,0.000) Sc (0.000,0.000) hneier. (0.000,0.000) Analysis (0.000,0.000) of (0.000,0.000) the (0.000,0.000) SSL (0.000,0.000) 3.0 (0.000,0.000) proto (0.000,0.000) col. (0.000,0.000) In (0.000,0.000) 2nd (0.000,0.000) U (0.000,0.000) senix (0.000,0.000) W (0.000,0.000) orkshop (0.000,0.000) on (0.000,0.000) Ele (0.000,0.000) ctr (0.000,0.000) onic (0.000,0.000) Commer (0.000,0.000) c (0.000,0.000) e (0.000,0.000) , (0.000,0.000) 1996. (0.000,0.000) [53] (0.000,0.000) J. (0.000,0.000) W (0.000,0.000) agnon. (0.000,0.000) SSL (0.000,0.000) profiles (0.000,0.000) part (0.000,0.000) 5: (0.000,0.000) SSL (0.000,0.000) options, (0.000,0.000) 2013. (0.000,0.000) h (0.000,0.000) ttps:// (0.000,0.000) dev (0.000,0.000) cen (0.000,0.000) tral.f5.com/articles/ssl- (0.000,0.000) profiles- (0.000,0.000) part- (0.000,0.000) 5- (0.000,0.000) ssl- (0.000,0.000) options. (0.000,0.000) [54] (0.000,0.000) P (0.000,0.000) . (0.000,0.000) Zimmermann (0.000,0.000) et (0.000,0.000) al. (0.000,0.000) GMP-ECM, (0.000,0.000) 2012. (0.000,0.000) h (0.000,0.000) ttps (0.000,0.000) :// (0.000,0.000) gforge.inria.fr/pro (0.000,0.000) jects/ecm. (0.000,0.000) [55] (0.000,0.000) APEX (0.000,0.000) a (0.000,0.000) c (0.000,0.000) tiv (0.000,0.000) e/passiv (0.000,0.000) e (0.000,0.000) exfiltration. (0.000,0.000) Media (0.000,0.000) le (0.000,0.000) a (0.000,0.000) k (0.000,0.000) , (0.000,0.000) A (0.000,0.000) ug. (0.000,0.000) 2009. (0.000,0.000) h (0.000,0.000) ttp: (0.000,0.000) / (0.000,0.000) /www.spie (0.000,0.000) g (0.000,0.000) e (0.000,0.000) l.de/media/media- (0.000,0.000) 35671.p (0.000,0.000) df (0.000,0.000) . (0.000,0.000) [56] (0.000,0.000) Fie (0.000,0.000) lded (0.000,0.000) capabilit (0.000,0.000) y: (0.000,0.000) End-to-end (0.000,0.000) VPN (0.000,0.000) SPIN (0.000,0.000) 9 (0.000,0.000) design (0.000,0.000) review. (0.000,0.000) Media (0.000,0.000) leak. (0.000,0.000) h (0.000,0.000) ttp://www.spiegel.de/media/media- (0.000,0.000) 35529 (0.000,0.000) . (0.000,0.000) p (0.000,0.000) df (0.000,0.000) . (0.000,0.000) [57] (0.000,0.000) FY (0.000,0.000) 20 (0.000,0.000) 13 (0.000,0.000) congr (0.000,0.000) e (0.000,0.000) ssional (0.000,0.000) budget (0.000,0.000) justification. (0.000,0.000) Media (0.000,0.000) leak. (0.000,0.000) h (0.000,0.000) ttp: (0.000,0.000) / (0.000,0.000) /cryptome (0.000,0.000) .or (0.000,0.000) g/2013/08/sp (0.000,0.000) y (0.000,0.000) - (0.000,0.000) budget- (0.000,0.000) fy13.p (0.000,0.000) df (0.000,0.000) . (0.000,0.000) [58] (0.000,0.000) GALL (0.000,0.000) AN (0.000,0.000) TW (0.000,0.000) A (0.000,0.000) VE@scale. (0.000,0.000) Media (0.000,0.000) leak. (0.000,0.000) h (0.000,0.000) ttp: (0.000,0.000) / (0.000,0.000) /www.spie (0.000,0.000) g (0.000,0.000) e (0.000,0.000) l.de/media/media- (0.000,0.000) 35514.p (0.000,0.000) df (0.000,0.000) . (0.000,0.000) [59] (0.000,0.000) I (0.000,0.000) n (0.000,0.000) no (0.000,0.000) v8 (0.000,0.000) exp (0.000,0.000) erimen (0.000,0.000) t (0.000,0.000) p (0.000,0.000) rofile. (0.000,0.000) Media (0.000,0.000) leak. (0.000,0.000) h (0.000,0.000) ttp: (0.000,0.000) / (0.000,0.000) /www.spie (0.000,0.000) g (0.000,0.000) e (0.000,0.000) l.de/media/media- (0.000,0.000) 35509.p (0.000,0.000) df (0.000,0.000) . (0.000,0.000) [60] (0.000,0.000) I (0.000,0.000) n (0.000,0.000) tro (0.000,0.000) to (0.000,0.000) the (0.000,0.000) VPN (0.000,0.000) exploitation (0.000,0.000) pro (0.000,0.000) cess. (0.000,0.000) Media (0.000,0.000) leak, (0.000,0.000) Sept. (0.000,0.000) 2010. (0.000,0.000) h (0.000,0.000) ttp:// (0.000,0.000) www.spi (0.000,0.000) egel.de/media/media- (0.000,0.000) 35515.p (0.000,0.000) df (0.000,0.000) . (0.000,0.000) [61] (0.000,0.000) L (0.000,0.000) O (0.000,0.000) NGHA (0.000,0.000) UL (0.000,0.000) – (0.000,0.000) WikiInfo. (0.000,0.000) M (0.000,0.000) edia (0.000,0.000) leak. (0.000,0.000) h (0.000,0.000) ttp: (0.000,0.000) / (0.000,0.000) /www.spie (0.000,0.000) g (0.000,0.000) e (0.000,0.000) l.de/media/media- (0.000,0.000) 35533.p (0.000,0.000) df (0.000,0.000) . (0.000,0.000) [62] (0.000,0.000) POISONNUT (0.000,0.000) – (0.000,0.000) WikiInfo. (0.000,0.000) Media (0.000,0.000) leak. (0.000,0.000) h (0.000,0.000) ttp: (0.000,0.000) / (0.000,0.000) /www.spie (0.000,0.000) g (0.000,0.000) e (0.000,0.000) l.de/media/media- (0.000,0.000) 35519.p (0.000,0.000) df (0.000,0.000) . (0.000,0.000) [63] (0.000,0.000) SIGI (0.000,0.000) NT (0.000,0.000) strategy (0.000,0.000) . (0.000,0.000) Media (0.000,0.000) leak. (0.000,0.000) h (0.000,0.000) ttp: (0.000,0.000) / (0.000,0.000) /www.n (0.000,0.000) ytimes.com/in (0.000,0.000) teractiv (0.000,0.000) e/2013/11/23/us/ (0.000,0.000) p (0.000,0.000) o (0.000,0.000) l (0.000,0.000) itics/23nsa (0.000,0.000) - (0.000,0.000) sigin (0.000,0.000) t (0.000,0.000) - (0.000,0.000) strategy- (0.000,0.000) do (0.000,0.000) cumen (0.000,0.000) t.h (0.000,0.000) tml. (0.000,0.000) [64] (0.000,0.000) SPIN (0.000,0.000) 15 (0.000,0.000) VPN (0.000,0.000) story (0.000,0.000) . (0.000,0.000) Me (0.000,0.000) dia (0.000,0.000) leak. (0.000,0.000) h (0.000,0.000) ttp: (0.000,0.000) / (0.000,0.000) /www.spie (0.000,0.000) g (0.000,0.000) e (0.000,0.000) l.de/media/media- (0.000,0.000) 35522.p (0.000,0.000) df (0.000,0.000) . (0.000,0.000) [65] (0.000,0.000) TURMOIL (0.000,0.000) / (0.000,0.000) APEX/APEX (0.000,0.000) high (0.000,0.000) lev (0.000,0.000) el (0.000,0.000) desc (0.000,0.000) r (0.000,0.000) i (0.000,0.000) ption (0.000,0.000) do (0.000,0.000) cumen (0.000,0.000) t. (0.000,0.000) Media (0.000,0.000) leak. (0.000,0.000) h (0.000,0.000) ttp://www.spiegel.de/media/media- (0.000,0.000) 35513 (0.000,0.000) . (0.000,0.000) p (0.000,0.000) df (0.000,0.000) . (0.000,0.000) [66] (0.000,0.000) TURMOIL (0.000,0.000) IPsec (0.000,0.000) VPN (0.000,0.000) sessionization. (0.000,0.000) Media (0.000,0.000) leak, (0.000,0.000) A (0.000,0.000) ug. (0.000,0.000) 2009. (0.000,0.000) h (0.000,0.000) ttp: (0.000,0.000) / (0.000,0.000) /www.spie (0.000,0.000) g (0.000,0.000) e (0.000,0.000) l.de/media/media- (0.000,0.000) 35528.p (0.000,0.000) df (0.000,0.000) . (0.000,0.000) [67] (0.000,0.000) TURMOIL (0.000,0.000) VPN (0.000,0.000) pro (0.000,0.000) cessing. (0.000,0.000) Media (0.000,0.000) leak, (0.000,0.000) Oct. (0.000,0.000) 2009. (0.000,0.000) h (0.000,0.000) ttp: (0.000,0.000) / (0.000,0.000) /www.spie (0.000,0.000) g (0.000,0.000) e (0.000,0.000) l.de/media/media- (0.000,0.000) 35526.p (0.000,0.000) df (0.000,0.000) . (0.000,0.000) [68] (0.000,0.000) V (0.000,0.000) ALIANTSURF (0.000,0.000) (V (0.000,0.000) S): (0.000,0.000) Capabilit (0.000,0.000) y (0.000,0.000) le (0.000,0.000) v (0.000,0.000) els. (0.000,0.000) Media (0.000,0.000) leak. (0.000,0.000) h (0.000,0.000) ttp: (0.000,0.000) / (0.000,0.000) /www.spie (0.000,0.000) g (0.000,0.000) e (0.000,0.000) l.de/media/media- (0.000,0.000) 35517.p (0.000,0.000) df (0.000,0.000) . (0.000,0.000) [69] (0.000,0.000) V (0.000,0.000) ALIANTSURF (0.000,0.000) – (0.000,0.000) WikiInfo. (0.000,0.000) Media (0.000,0.000) leak. (0.000,0.000) h (0.000,0.000) ttp: (0.000,0.000) / (0.000,0.000) /www.spie (0.000,0.000) g (0.000,0.000) e (0.000,0.000) l.de/media/media- (0.000,0.000) 35527.p (0.000,0.000) df (0.000,0.000) . (0.000,0.000) [70] (0.000,0.000) VPN (0.000,0.000) SigDev (0.000,0.000) basics. (0.000,0.000) Media (0.000,0.000) leak. (0.000,0.000) h (0.000,0.000) ttp: (0.000,0.000) / (0.000,0.000) /www.spie (0.000,0.000) g (0.000,0.000) e (0.000,0.000) l.de/media/media- (0.000,0.000) 35520.p (0.000,0.000) df (0.000,0.000) . (0.000,0.000) [71] (0.000,0.000) What (0.000,0.000) y (0.000,0.000) our (0.000,0.000) mother (0.000,0.000) nev (0.000,0.000) er (0.000,0.000) told (0.000,0.000) y (0.000,0.000) ou (0.000,0.000) ab (0.000,0.000) out (0.000,0.000) SIGDEV (0.000,0.000) analysis. (0.000,0.000) Media (0.000,0.000) leak. (0.000,0.000) h (0.000,0.000) ttp://www.spiegel.de/media/media- (0.000,0.000) 35551 (0.000,0.000) . (0.000,0.000) p (0.000,0.000) df (0.000,0.000) . (0.000,0.000) 13