[{"extraction_method":"stream","top":302.0,"left":52.0,"width":507.0,"height":383.0,"right":559.0,"bottom":685.0,"data":[[{"top":303.05,"left":53.8,"width":503.8900146484375,"height":10.350010871887207,"text":"group, we can compute arbitrary discrete logs in that group difficult than factoring an RSA modulus of the same size."}],[{"top":313.51,"left":53.8,"width":502.1100158691406,"height":10.359990119934082,"text":"in about a minute. We find that 82% of vulnerable servers use However, an adversary who performs a large precomputation"}],[{"top":323.97,"left":53.8,"width":502.1099853515625,"height":10.359990119934082,"text":"a single 512-bit group, allowing us to compromise connections for a prime p can then quickly calculate arbitrary discrete logs"}],[{"top":334.43,"left":53.8,"width":502.1000061035156,"height":10.360020637512207,"text":"to 7% of Alexa Top Million HTTPS sites. In response, major in that group, amortizing the cost over all targets that share"}],[{"top":344.89,"left":53.8,"width":502.1100158691406,"height":10.359990119934082,"text":"browsers are being changed to reject short groups. this parameter. Although this fact is well known among"}],[{"top":355.35,"left":62.76,"width":493.3999938964844,"height":10.359990119934082,"text":"We go on to consider Diffie-Hellman with 768- and 1024-bit mathematical cryptographers, it seems to have been lost"}],[{"top":365.81,"left":53.8,"width":502.3599853515625,"height":10.359990119934082,"text":"groups. We estimate that even in the 1024-bit case, the com- among practitioners deploying cryptosystems. We exploit it"}],[{"top":376.28,"left":53.8,"width":386.5299987792969,"height":10.350010871887207,"text":"putations are plausible given nation-state resources. A small to obtain the following results:"}],[{"top":390.72,"left":53.8,"width":502.1099853515625,"height":7.579995155334473,"text":"number of fixed or standardized groups are used by millions Active attacks on export ciphers in TLS. We introduce"}],[{"top":401.18,"left":53.8,"width":502.1100158691406,"height":7.580021858215332,"text":"of servers; performing precomputation for a single 1024-bit Logjam, a new attack on TLS by which a man-in-the-middle"}],[{"top":411.64,"left":53.8,"width":503.6499938964844,"height":7.579991340637207,"text":"group would allow passive eavesdropping on 18% of popular attacker can downgrade a connection to export-grade cryp-"}],[{"top":422.1,"left":53.8,"width":502.1100158691406,"height":7.579991340637207,"text":"HTTPS sites, and a second group would allow decryption tography. This attack is reminiscent of the FREAK attack [7]"}],[{"top":432.56,"left":53.8,"width":502.1100158691406,"height":7.579991340637207,"text":"of traffic to 66% of IPsec VPNs and 26% of SSH servers. A but applies to the ephemeral Diffie-Hellman ciphersuites and"}],[{"top":443.02,"left":53.8,"width":503.6499938964844,"height":7.580021858215332,"text":"close reading of published NSA leaks shows that the agency’s is a TLS protocol flaw rather than an implementation vulner-"}],[{"top":453.49,"left":53.8,"width":502.3500061035156,"height":7.570012092590332,"text":"attacks on VPNs are consistent with having achieved such ability. We present measurements that show that this attack"}],[{"top":463.95,"left":53.8,"width":502.4900207519531,"height":7.569981575012207,"text":"a break. We conclude that moving to stronger key exchange applies to 8.4% of Alexa Top Million HTTPS sites and 3.4%"}],[{"top":474.41,"left":53.8,"width":503.9000244140625,"height":7.569981575012207,"text":"methods should be a priority for the Internet community. of all HTTPS servers that have browser-trusted certificates."}],[{"top":486.08,"left":325.78,"width":230.13002014160156,"height":6.369999885559082,"text":"To exploit this attack, we implemented the number field"}],[{"top":496.54,"left":53.8,"width":502.10003662109375,"height":16.82999038696289,"text":"sieve discrete log algorithm and carried out precomputation1. INTRODUCTION for two 512-bit Diffie-Hellman groups used by more than"}],[{"top":514.57,"left":62.76,"width":493.13995361328125,"height":9.260014533996582,"text":"Diffie-Hellman key exchange is widely used to establish 92% of the vulnerable servers. This allows us to compute"}],[{"top":525.03,"left":53.8,"width":502.1100158691406,"height":9.259953498840332,"text":"session keys in Internet protocols. It is the main key exchange individual discrete logs in about a minute. Using our discrete"}],[{"top":535.49,"left":53.8,"width":502.1000061035156,"height":9.260014533996582,"text":"mechanism in SSH and IPsec and a popular option in TLS. log oracle, we can compromise connections to over 7% of Top"}],[{"top":545.96,"left":53.33,"width":502.5699768066406,"height":9.250004768371582,"text":"We examine how Diffie-Hellman is commonly implemented Million HTTPS sites. Discrete logs over larger groups have"}],[{"top":556.42,"left":53.8,"width":502.1099853515625,"height":9.250004768371582,"text":"and deployed with these protocols and find that, in practice, been computed before [8], but, as far as we are aware, this"}],[{"top":566.88,"left":53.8,"width":502.1100158691406,"height":9.250004768371582,"text":"it frequently offers less security than widely believed. is the first time they have been exploited to expose concrete"}],[{"top":577.34,"left":62.76,"width":401.2799987792969,"height":9.249943733215332,"text":"There are two reasons for this. First, a surprising number vulnerabilities in real-world systems."}],[{"top":587.8,"left":53.8,"width":502.4499816894531,"height":9.250004768371582,"text":"of servers use weak Diffie-Hellman parameters or maintain We were also able to compromise Diffie-Hellman for many"}],[{"top":598.26,"left":53.8,"width":502.1100158691406,"height":9.250004768371582,"text":"support for obsolete 1990s-era export-grade crypto. More other servers because of design and implementation flaws and"}],[{"top":608.72,"left":53.8,"width":502.2900085449219,"height":9.250004768371582,"text":"critically, the common practice of using standardized, hard- configuration mistakes. These include use of composite-order"}],[{"top":622.07,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"subgroups in combination with short exponents, which is"}],[{"top":632.53,"left":316.57,"width":240.61997985839844,"height":6.369999885559082,"text":"vulnerable to a known attack of van Oorschot andWiener [51],"}],[{"top":642.99,"left":53.8,"width":502.1000061035156,"height":6.369999885559082,"text":"Permission to make digital or hard copies of part or all of this work for personal or and the inability of clients to properly validate Diffie-Hellman"}],[{"top":653.45,"left":53.8,"width":502.1100158691406,"height":6.369999885559082,"text":"classroom use is granted without fee provided that copies are not made or distributed parameters without knowing the subgroup order, which TLS"}],[{"top":662.59,"left":53.8,"width":502.1099853515625,"height":7.689946174621582,"text":"for profit or commercial advantage and that copies bear this notice and the full cita- has no provision to communicate. We implement these"}],[{"top":671.55,"left":53.8,"width":240.4659881591797,"height":3.119999885559082,"text":"tion on the first page. Copyrights for third-party components of this work must be"}],[{"top":674.37,"left":53.8,"width":503.8899841308594,"height":9.270024299621582,"text":"attacks too and discover several vulnerable implementations.honored. For all other uses, contact the Owner/Author(s). Copyright is held by the"}]]},{"extraction_method":"stream","top":678.0,"left":52.0,"width":507.0,"height":23.0,"right":559.0,"bottom":701.0,"data":[[{"top":679.49,"left":53.43,"width":502.4800109863281,"height":16.900028228759766,"text":"The typical case 1Recent spectacular advances in discrete log algorithmswith prime fields and large group orders. In this case, the"},{"top":679.56,"left":138.62,"width":155.364990234375,"height":6.369999885559082,"text":"Diffie-Hellman is typically implemented"},{"top":693.01,"left":316.81,"width":240.6300048828125,"height":6.369999885559082,"text":"have resulted in a quasi-polynomial algorithm for small-"}]]},{"extraction_method":"stream","top":373.0,"left":52.0,"width":507.0,"height":292.0,"right":559.0,"bottom":665.0,"data":[[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":374.71,"left":361.28,"width":6.930003643035889,"height":2.650009870529175,"text":"2I"}],[{"top":377.86,"left":53.24,"width":240.8318328857422,"height":6.370003700256348,"text":"Mitigations and lessons. As a short-term countermeasure"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":374.81,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"region of 2 candidates, where I is a parameter. Sieving"}],[{"top":388.32,"left":53.8,"width":240.5960235595703,"height":6.369999885559082,"text":"in response to the Logjam attack, all mainstream browsers"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":385.27,"left":316.81,"width":239.4499969482422,"height":6.369999885559082,"text":"parallelizes well since each special q is handled independently"}],[{"top":398.78,"left":53.8,"width":240.4669952392578,"height":6.369999885559082,"text":"are implementing a more restrictive policy on the size of"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":395.73,"left":316.81,"width":239.10000610351562,"height":6.369999885559082,"text":"of the others, but is computationally expensive, because we"}],[{"top":409.24,"left":53.8,"width":241.04420471191406,"height":6.369999885559082,"text":"Diffie-Hellman groups they accept. We further recommend"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":406.19,"left":316.81,"width":240.87997436523438,"height":6.369999885559082,"text":"must search through and attempt to factor many elements."}],[{"top":419.7,"left":53.8,"width":240.90684509277344,"height":6.369999885559082,"text":"that TLS servers disable export-grade cryptography and"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":416.65,"left":316.48,"width":239.42001342773438,"height":6.369999885559082,"text":"The time for this step depends on heuristic estimates of"}],[{"top":430.16,"left":53.8,"width":240.3441619873047,"height":6.369999885559082,"text":"carefully vet the Diffie-Hellman groups they use. In the"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":427.11,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"the probability of encountering B-smooth numbers in this"}],[{"top":440.62,"left":53.8,"width":240.4055938720703,"height":6.369999885559082,"text":"longer term, we advocate that protocols migrate to stronger"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":437.57,"left":316.81,"width":238.78997802734375,"height":6.369999885559082,"text":"search; it also depends on I and on the number of special q"}],[{"top":451.09,"left":53.8,"width":236.2876434326172,"height":6.369999885559082,"text":"Diffie-Hellman groups, such as those based on elliptic curves."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":448.03,"left":316.81,"width":173.23001098632812,"height":6.369999885559082,"text":"to consider before having enough relations."}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":458.49,"left":325.78,"width":231.41001892089844,"height":6.370003700256348,"text":"In the third stage, linear algebra, we construct a large,"}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":468.95,"left":316.81,"width":239.0899658203125,"height":6.369999885559082,"text":"sparse matrix consisting of the coefficient vectors of prime"}],[{"top":476.25,"left":53.8,"width":229.78797912597656,"height":5.369999885559082,"text":"2. DIFFIE-HELLMAN CRYPTANALYSIS"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":479.41,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"factorizations we have found. A nonzero kernel vector of the"}],[{"top":488.21,"left":62.76,"width":233.9623260498047,"height":6.369999885559082,"text":"Diffie-Hellman key exchange was the first published public-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":489.87,"left":316.81,"width":239.10000610351562,"height":6.370014667510986,"text":"matrix modulo the order q of the group will give us logs of"}],[{"top":498.67,"left":53.8,"width":242.05101013183594,"height":6.369999885559082,"text":"key algorithm [14]. In the simple case of prime groups,"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":500.33,"left":316.81,"width":239.35000610351562,"height":6.369999885559082,"text":"many small elements. This database of logs serves as input"}],[{"top":509.13,"left":53.46,"width":240.4930419921875,"height":6.369999885559082,"text":"Alice and Bob agree on a prime p and a generator g of a"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":510.8,"left":316.81,"width":239.3400115966797,"height":6.369999885559082,"text":"to the final stage. The difficulty depends on q and the matrix"}],[{"top":519.5,"left":53.8,"width":241.46897888183594,"height":6.469975471496582,"text":"multiplicative subgroup modulo p. Alice sends ga mod p,"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":521.26,"left":316.81,"width":194.17001342773438,"height":6.369999885559082,"text":"size and can be parallelized in a limited fashion."}],[{"top":529.96,"left":53.8,"width":241.33599853515625,"height":6.469975471496582,"text":"Bob sends gb mod p, and each computes a shared secret"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":531.72,"left":325.78,"width":230.12001037597656,"height":6.369999885559082,"text":"The final stage, descent, actually deduces the discrete log"}],[{"top":540.42,"left":53.8,"width":240.4459686279297,"height":6.470036506652832,"text":"gab mod p. While there is also a Diffie-Hellman exchange"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":542.18,"left":316.81,"width":239.09002685546875,"height":6.369999885559082,"text":"of the target y. We re-sieve until we can find a set of relations"}],[{"top":550.98,"left":53.8,"width":241.9098663330078,"height":6.369999885559082,"text":"over elliptic curve groups, we address only the “mod p” case."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":552.64,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"that allow us to write the log of y in terms of the logs in the"}],[{"top":561.44,"left":62.76,"width":233.2360076904297,"height":6.369999885559082,"text":"The security of Diffie-Hellman is not known to be equiva-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":563.1,"left":316.81,"width":239.0999755859375,"height":6.369999885559082,"text":"precomputed database. This step is accomplished in three"}],[{"top":571.9,"left":53.8,"width":241.63990783691406,"height":6.369999885559082,"text":"lent to the discrete log problem (except in certain groups [13,"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":573.56,"left":316.81,"width":239.3400115966797,"height":6.369999885559082,"text":"phases: an initialization phase, which tries to write the target"}],[{"top":582.36,"left":53.57,"width":240.10397338867188,"height":6.369999885559082,"text":"33,34]), but computing discrete logs remains the best known"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":584.02,"left":316.81,"width":239.09999084472656,"height":6.369999885559082,"text":"in terms of medium-sized primes, a middle phase, in which"}],[{"top":592.82,"left":53.8,"width":240.20921325683594,"height":6.369999885559082,"text":"cryptanalytic attack. An attacker who can find the discrete"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":594.48,"left":316.81,"width":239.10003662109375,"height":6.369999885559082,"text":"these medium-sized primes are further sieved until they can"}],[{"top":603.18,"left":53.8,"width":235.02601623535156,"height":6.470036506652832,"text":"log x from y \u003d gx mod p can easily find the shared secret."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":604.94,"left":316.81,"width":240.38002014160156,"height":6.369999885559082,"text":"be represented by elements in the database of known logs,"}],[{"top":613.74,"left":62.76,"width":231.48902893066406,"height":6.369999885559082,"text":"Textbook descriptions of discrete log can be misleading"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":615.4,"left":316.81,"width":239.08999633789062,"height":6.369999885559082,"text":"and a final phase that actually reconstructs the target using"}],[{"top":624.2,"left":53.8,"width":240.19798278808594,"height":6.369999885559082,"text":"about the computational tradeoffs, for example by balancing"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":625.86,"left":316.81,"width":239.0899658203125,"height":6.369999885559082,"text":"the log database. Crucially, descent is the only NFS stage"}],[{"top":634.66,"left":53.8,"width":240.1799774169922,"height":6.370034217834473,"text":"parameters to minimize overall time to compute a single"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":636.32,"left":316.81,"width":239.10000610351562,"height":6.370014667510986,"text":"that involves y (or g), so polynomial selection, sieving, and"}],[{"top":645.12,"left":53.8,"width":240.0994415283203,"height":6.369999885559082,"text":"discrete log. In fact, as illustrated in Figure 1, a single large"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":646.79,"left":316.81,"width":239.1099853515625,"height":6.369999885559082,"text":"linear algebra can be done once for a prime p and reused to"}],[{"top":655.59,"left":53.8,"width":240.0699920654297,"height":6.369999885559082,"text":"precomputation on p can be used to efficiently break all"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":657.25,"left":316.81,"width":171.45999145507812,"height":6.369999885559082,"text":"compute the discrete logs of many targets."}]]},{"extraction_method":"stream","top":53.0,"left":52.0,"width":507.0,"height":311.0,"right":559.0,"bottom":364.0,"data":[[{"top":57.4,"left":62.76,"width":155.71299743652344,"height":10.069997787475586,"text":"The running time of this algorithm is L ("},{"top":57.3,"left":216.75,"width":62.56000518798828,"height":10.170000076293945,"text":")(1/3, (64/9)1/3p"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":57.4,"left":279.81,"width":14.489990234375,"height":6.369999885559082,"text":") \u003d"},{"top":59.8,"left":322.59,"width":25.913543701171875,"height":3.5199999809265137,"text":"Source"},{"top":59.8,"left":364.95,"width":40.373931884765625,"height":3.5199999809265137,"text":"Popularity"},{"top":59.8,"left":414.65,"width":22.21999168395996,"height":3.5199999809265137,"text":"Prime"}],[{"top":68.83,"left":53.8,"width":241.0019989013672,"height":6.469998359680176,"text":"exp (1.923 + o(1))(log p)1/3(log log p)2/3 . This is obtained"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":73.27,"left":322.59,"width":28.526214599609375,"height":3.5199999809265137,"text":"Apache"},{"top":73.27,"left":364.96,"width":16.789031982421875,"height":3.5199999809265137,"text":"82%"},{"top":73.51,"left":414.65,"width":135.4800262451172,"height":3.2799999713897705,"text":"9fdb8b8a004544f0045f1737d0ba2e0b"}],[{"top":79.39,"left":53.8,"width":240.36900329589844,"height":6.369999885559082,"text":"by tuning many parameters, including the degree of f , the"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":82.48,"left":414.65,"width":135.4800262451172,"height":3.2799999713897705,"text":"274cdf1a9f588218fb435316a16e3741"}],[{"top":89.85,"left":53.8,"width":105.85899353027344,"height":6.369999885559082,"text":"sieving region parameter"},{"top":89.85,"left":163.32,"width":130.8389892578125,"height":6.369999885559082,"text":"I, and, most importantly, the"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":91.45,"left":414.65,"width":135.4800262451172,"height":3.2799999713897705,"text":"71fd19d8d8f37c39bf863fd60e3e3006"}],[{"top":100.31,"left":53.8,"width":240.35902404785156,"height":6.369999885559082,"text":"smoothness bound B. Early articles (e.g. [21]) encountered"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":100.41,"left":414.65,"width":135.4800262451172,"height":3.2799999713897705,"text":"80a3030c6e4c3757d08f70e6aa871033"}],[{"top":110.77,"left":53.8,"width":242.74803161621094,"height":6.369999885559082,"text":"technical difficulties with descent and reported that the com-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":112.13,"left":322.59,"width":32.70428466796875,"height":3.5199999809265137,"text":"mod_ssl"},{"top":112.13,"left":364.96,"width":16.789031982421875,"height":3.5199999809265137,"text":"10%"},{"top":112.37,"left":414.65,"width":135.4700164794922,"height":3.2799999713897705,"text":"d4bcd52406f69b35994b88de5db89682"}],[{"top":121.23,"left":53.8,"width":241.63902282714844,"height":6.369999885559082,"text":"plexity of this step would equal that of the precomputation;"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":121.33,"left":414.65,"width":135.4800262451172,"height":3.2799999713897705,"text":"c8157f62d8f33633ee5772f11f05ab22"}],[{"top":131.69,"left":53.8,"width":241.89903259277344,"height":6.369999885559082,"text":"this may have contributed to misconceptions about the perfor-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":130.3,"left":414.65,"width":135.4800262451172,"height":3.2799999713897705,"text":"d6b5145b9f241e5acc31ff090a4bc711"}],[{"top":142.15,"left":53.8,"width":240.35899353027344,"height":6.369999885559082,"text":"mance of the NFS for discrete logs. More recent analyses have"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":139.27,"left":414.65,"width":135.4700164794922,"height":3.2799999713897705,"text":"48976f76795094e71e7903529f5a824b"}],[{"top":152.61,"left":53.8,"width":159.9580078125,"height":6.369999885559082,"text":"improved the complexity of descent to"},{"top":150.98,"left":216.12,"width":275.7799987792969,"height":8.990011215209961,"text":"(463 distinct primes)Lp"},{"top":152.61,"left":226.73,"width":68.43699645996094,"height":6.369999885559082,"text":"(1 / 3 , 1 442) [10], ."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":150.98,"left":322.59,"width":30.5780029296875,"height":3.5199999809265137,"text":"(others)"},{"top":150.98,"left":367.78,"width":12.629669189453125,"height":3.5199999809265137,"text":"8%"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":163.07,"left":53.8,"width":239.10000610351562,"height":7.359991550445557,"text":"and later to Lp(1/3, 1.232) [2], which is much cheaper than"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":173.53,"left":53.8,"width":128.98194885253906,"height":6.369999885559082,"text":"the precomputation in practice."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":168.33,"left":316.48,"width":239.4400177001953,"height":6.4399919509887695,"text":"Table 1: Top 512-bit DH primes for TLS. 8.4% of Alexa"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":183.99,"left":62.76,"width":231.9636688232422,"height":6.369999885559082,"text":"The numerous parameters of the algorithm allow some"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":178.86,"left":316.48,"width":136.2139892578125,"height":6.369999885559082,"text":"Top 1M HTTPS domains allow"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":178.86,"left":455.46,"width":100.45001220703125,"height":6.369999885559082,"text":"DHE_EXPORT, of which"}],[{"top":194.45,"left":53.8,"width":240.4243927001953,"height":6.369999885559082,"text":"flexibility to reduce time on some computational steps at the"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":189.32,"left":316.81,"width":239.08998107910156,"height":6.369999885559082,"text":"92.3% use one of the two most popular primes, shown here."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":204.92,"left":53.8,"width":239.08999633789062,"height":6.369999885559082,"text":"expense of others. For example, sieving more will result in"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":215.38,"left":53.8,"width":239.10000610351562,"height":6.369999885559082,"text":"a smaller matrix, making linear algebra cheaper, and doing"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":225.84,"left":53.8,"width":240.40541076660156,"height":6.369999885559082,"text":"more work in the precomputation makes the final descent"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":220.19,"left":316.81,"width":239.35000610351562,"height":6.369999885559082,"text":"for both normal and export-grade Diffie-Hellman, the vast"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":236.3,"left":53.8,"width":240.88673400878906,"height":6.369999885559082,"text":"step easier. In §3.3, we show how exploiting these tradeoffs"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":230.65,"left":316.81,"width":211.989990234375,"height":6.369999885559082,"text":"majority of servers use a handful of common groups."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":246.76,"left":53.8,"width":240.26698303222656,"height":6.369999885559082,"text":"allows us to quickly compute 512-bit discrete logs in order"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":241.11,"left":325.78,"width":230.1300048828125,"height":6.369999885559082,"text":"In this section, we exploit these facts to construct a novel"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":257.22,"left":53.8,"width":234.15513610839844,"height":6.369999885559082,"text":"to perform an effective man-in-the-middle attack on TLS."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":251.57,"left":316.48,"width":240.70001220703125,"height":16.82999038696289,"text":"attack against TLS, which we call the Logjam attack. First,we perform NFS precomputations for the two most popular"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":271.09,"left":53.8,"width":140.68499755859375,"height":6.429999828338623,"text":"Improperly generated groups"},{"top":271.15,"left":205.88,"width":88.40597534179688,"height":6.369999885559082,"text":"A different family of"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":272.49,"left":316.81,"width":239.09999084472656,"height":6.369999885559082,"text":"512-bit primes on the web, so that we can quickly compute"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":281.62,"left":53.8,"width":240.66224670410156,"height":6.369999885559082,"text":"algorithms runs in time exponential in group order, and they"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":282.95,"left":316.81,"width":239.09002685546875,"height":6.369999885559082,"text":"the discrete log for any key-exchange message that uses one"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":292.08,"left":53.8,"width":240.4459991455078,"height":6.369999885559082,"text":"are practical even for large primes when the group order is"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":293.41,"left":316.81,"width":240.36997985839844,"height":6.369999885559082,"text":"of them. Next, we show how a man-in-the-middle, so armed,"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":302.54,"left":53.8,"width":240.59397888183594,"height":6.369999885559082,"text":"small or has many small prime factors. To avoid this, most"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":303.87,"left":316.81,"width":239.43003845214844,"height":6.369999885559082,"text":"can attack connections between popular browsers and any"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":313.0,"left":53.8,"width":240.5430145263672,"height":6.369999885559082,"text":"implementations use “safe” primes, which have the property"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":314.33,"left":316.81,"width":239.0900115966797,"height":6.369999885559082,"text":"server that allows export-grade Diffie-Hellman, by using a"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":323.46,"left":53.8,"width":240.6853485107422,"height":6.369999885559082,"text":"that p− 1 \u003d 2q for some prime q, so that the only possible"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":324.79,"left":316.48,"width":240.95999145507812,"height":6.369999885559082,"text":"TLS protocol flaw to downgrade the connection to export-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":333.92,"left":53.8,"width":240.50526428222656,"height":6.369999885559082,"text":"subgroups have order 2, q, or 2q. However, as we show in"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":335.26,"left":316.81,"width":239.3500213623047,"height":6.369999885559082,"text":"strength and then recovering the session key. We find that"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":344.38,"left":53.8,"width":240.1430206298828,"height":6.369999885559082,"text":"§3.5, improperly generated groups are sometimes used in"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":345.72,"left":316.81,"width":239.3400115966797,"height":6.369999885559082,"text":"this attack with our precomputations can compromise about"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":354.84,"left":53.8,"width":139.5733642578125,"height":6.369999885559082,"text":"practice and susceptible to attack."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":356.18,"left":316.58,"width":239.92001342773438,"height":6.369999885559082,"text":"7.8% of HTTPS servers among Alexa Top Million domains."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}]]},{"extraction_method":"stream","top":61.0,"left":52.0,"width":507.0,"height":626.0,"right":559.0,"bottom":687.0,"data":[[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":67.86,"left":316.81,"width":239.0899658203125,"height":6.369999885559082,"text":"show how an attacker who can compute 512-bit discrete"}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":78.32,"left":316.81,"width":239.10000610351562,"height":6.369999885559082,"text":"logs in real time can downgrade a regular DHE connection"}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":88.78,"left":316.81,"width":239.0999755859375,"height":6.369999885559082,"text":"to use a DHE_EXPORT group, and thereby break both the"}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":99.24,"left":316.81,"width":193.79998779296875,"height":6.369999885559082,"text":"confidentiality and integrity of application data."}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":109.7,"left":325.78,"width":230.3600311279297,"height":6.369999885559082,"text":"The attack, which we call Logjam, is depicted in Figure 2"}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":120.16,"left":316.81,"width":239.10000610351562,"height":6.369999885559082,"text":"and relies on a flaw in the way TLS composes DHE and"}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":130.62,"left":316.81,"width":239.1000213623047,"height":6.370001792907715,"text":"DHE_EXPORT. When a server selects DHE_EXPORT for a"}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":141.08,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"handshake, it proceeds by issuing a signed ServerKeyExchange"}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":151.54,"left":316.81,"width":239.10000610351562,"height":7.360001564025879,"text":"message containing a 512-bit p512, but the structure of this"}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":162.0,"left":316.81,"width":239.11000061035156,"height":6.370001792907715,"text":"message is identical to the message sent during standard DHE"}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":172.46,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"ciphersuites. Critically, the signed portion of the server’s"}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":182.92,"left":316.81,"width":240.62998962402344,"height":6.369999885559082,"text":"message fails to include any indication of the specific cipher-"}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":193.39,"left":316.81,"width":239.09002685546875,"height":6.369999885559082,"text":"suite that the server has chosen. Provided that a client offers"}],[{"top":207.79,"left":53.8,"width":240.8193817138672,"height":6.440007209777832,"text":"Figure 2: The Logjam attack. A man-in-the-middle can"},{"top":203.85,"left":316.81,"width":239.1100311279297,"height":6.369999885559082,"text":"DHE, an active attacker can rewrite the client’s ClientHello to"}],[{"top":218.32,"left":53.8,"width":240.53663635253906,"height":6.369999885559082,"text":"force TLS clients to use export-strength DH with any server"},{"top":214.31,"left":316.81,"width":239.42999267578125,"height":6.369999885559082,"text":"offer a corresponding DHE_EXPORT ciphersuite accepted by"}],[{"top":228.78,"left":53.8,"width":241.6670379638672,"height":6.370001792907715,"text":"that allows DHE_EXPORT. Then, by finding the 512-bit dis-"},{"top":224.77,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"the server and remove other ciphersuites that could be chosen"}],[{"top":239.24,"left":53.8,"width":240.2129669189453,"height":6.369999885559082,"text":"crete log, the attacker can learn the session key and arbitrarily"},{"top":235.23,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"instead. The attacker rewrites the ServerHello response to"}],[{"top":249.61,"left":53.8,"width":240.14292907714844,"height":6.470005989074707,"text":"read or modify the contents. Datafs refers to False Start [30]"},{"top":245.69,"left":316.81,"width":239.1100311279297,"height":6.370001792907715,"text":"replace the chosen DHE_EXPORT ciphersuite with a matching"}],[{"top":260.17,"left":53.8,"width":240.5033416748047,"height":6.369999885559082,"text":"application data that some TLS clients send before receiving"},{"top":256.15,"left":316.81,"width":239.1100311279297,"height":6.370014667510986,"text":"non-export ciphersuite and forwards the ServerKeyExchange"}],[{"top":270.63,"left":53.8,"width":120.69685363769531,"height":6.369999885559082,"text":"the server’s Finishedmessage."},{"top":266.61,"left":316.81,"width":239.0899658203125,"height":6.369999885559082,"text":"message to the client as is. The client will interpret the"}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":276.97,"left":316.81,"width":240.63999938964844,"height":7.460007667541504,"text":"export-grade tuple (p512, g, gb) as valid DHE parameters cho-"}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":287.53,"left":316.81,"width":239.0899658203125,"height":6.369999885559082,"text":"sen by the server and proceed with the handshake. The"}],[{"top":302.32,"left":53.8,"width":240.3994903564453,"height":6.369999885559082,"text":"DHE_EXPORTciphersuites that were restricted to primes no"},{"top":297.99,"left":316.81,"width":239.09002685546875,"height":6.369999885559082,"text":"client and server have different handshake transcripts at this"}],[{"top":312.78,"left":53.8,"width":239.3900146484375,"height":6.369999885559082,"text":"longer than 512 bits. In all other respects, DHE_EXPORT"},{"top":308.45,"left":316.81,"width":239.09999084472656,"height":6.369999885559082,"text":"stage, but an attacker who can compute b in close to real"}],[{"top":323.24,"left":53.8,"width":240.45225524902344,"height":6.370017051696777,"text":"protocol messages are identical to DHE. The relevant export"},{"top":318.91,"left":316.81,"width":239.09002685546875,"height":6.369999885559082,"text":"time can then derive the master secret and connection keys"}],[{"top":333.7,"left":53.8,"width":240.3955841064453,"height":6.369999885559082,"text":"restrictions are no longer in effect, but many libraries and"},{"top":329.38,"left":316.81,"width":239.44000244140625,"height":6.369999885559082,"text":"to complete the handshake with the client, and then freely"}],[{"top":344.16,"left":53.8,"width":240.70140075683594,"height":6.369999885559082,"text":"servers maintain support for backwards compatibility. Many"},{"top":339.84,"left":316.81,"width":240.88002014160156,"height":6.369999885559082,"text":"read and write application data pretending to be the server."}],[{"top":354.62,"left":53.47,"width":241.13424682617188,"height":6.369999885559082,"text":"TLS servers are still configured with two groups: a strong"},{"top":350.3,"left":325.78,"width":230.1199951171875,"height":6.369999885559082,"text":"There are two remaining challenges in implementing this"}],[{"top":365.08,"left":53.34,"width":241.01712036132812,"height":6.370017051696777,"text":"1024-bit group for regular DHE key exchanges and a 512-bit"},{"top":360.76,"left":316.81,"width":239.09999084472656,"height":6.369999885559082,"text":"active downgrade attack. The first is to compute individual"}],[{"top":375.54,"left":53.8,"width":240.60899353027344,"height":6.369999885559082,"text":"group for legacy DHE_EXPORT. This has been considered"},{"top":371.22,"left":316.81,"width":239.43997192382812,"height":6.369999885559082,"text":"discrete logs in close to real time, and the second is to delay"}],[{"top":386.0,"left":53.8,"width":240.6975860595703,"height":6.369999885559082,"text":"safe because most modern TLS clients do not offer or accept"},{"top":381.68,"left":316.81,"width":239.09002685546875,"height":6.369999885559082,"text":"handshake completion until the discrete log computation has"}],[{"top":396.46,"left":53.8,"width":110.55450439453125,"height":6.370017051696777,"text":"DHE_EXPORTciphersuites."},{"top":392.14,"left":316.81,"width":240.87998962402344,"height":6.369999885559082,"text":"had time to finish. We address these in the next subsections."}],[{"top":406.93,"left":62.76,"width":233.95799255371094,"height":6.369999885559082,"text":"To understand how HTTPS servers in the wild use Diffie-"},{"top":407.51,"left":316.81,"width":240.6400146484375,"height":6.439976692199707,"text":"Comparison with previous attacks Logjam is remi-"}],[{"top":417.39,"left":53.8,"width":240.6060028076172,"height":6.369999885559082,"text":"Hellman, we modified the ZMap [15] toolchain to offer DHE"},{"top":418.04,"left":316.81,"width":239.27999877929688,"height":6.369999885559082,"text":"niscent of the recent FREAK [7] attack, in which an attacker"}],[{"top":427.85,"left":53.8,"width":240.67262268066406,"height":6.369999885559082,"text":"and DHE_EXPORT ciphersuites and scanned TCP/443 on"},{"top":428.5,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"downgrades a regular RSA key exchange to one that uses"}],[{"top":438.31,"left":53.8,"width":240.3140106201172,"height":6.369999885559082,"text":"both the full public IPv4 address space and the Alexa"},{"top":438.96,"left":316.81,"width":239.0900115966797,"height":6.369999885559082,"text":"export-grade 512-bit ephemeral RSA keys, relying on a bug"}],[{"top":448.77,"left":53.47,"width":240.38900756835938,"height":6.369999885559082,"text":"Top 1M domains. The scans took place in March 2015. Of"},{"top":449.43,"left":316.81,"width":239.10000610351562,"height":6.369999885559082,"text":"in several TLS client implementations. The attacker then"}],[{"top":459.23,"left":53.8,"width":240.38844299316406,"height":6.369999885559082,"text":"539,000 HTTPS sites among Top 1M domains, we found that"},{"top":459.89,"left":316.81,"width":239.33999633789062,"height":6.369999885559082,"text":"factors the ephemeral key to hijack future connections that"}],[{"top":469.69,"left":53.8,"width":242.05397033691406,"height":6.369999885559082,"text":"68.3% supported DHE and 8.4% supported DHE_EXPORT."},{"top":470.35,"left":316.81,"width":239.10000610351562,"height":6.369999885559082,"text":"use the same key. The cryptanalysis takes several hours on"}],[{"top":480.15,"left":53.8,"width":240.2930145263672,"height":6.369999885559082,"text":"Of 14.3 million IPv4 HTTPS servers with browser-trusted"},{"top":480.81,"left":316.81,"width":239.09002685546875,"height":6.369999885559082,"text":"commodity hardware and is usable until the server generates"}],[{"top":490.61,"left":53.8,"width":239.9755096435547,"height":6.370017051696777,"text":"certificates, 23.9% supported DHE and 4.9% DHE_EXPORT."},{"top":491.27,"left":316.81,"width":223.59002685546875,"height":6.369999885559082,"text":"a fresh ephemeral RSA key (typically when it restarts)."}],[{"top":501.07,"left":62.76,"width":231.41123962402344,"height":6.369999885559082,"text":"While the TLS protocol allows servers to generate their own"},{"top":501.73,"left":325.78,"width":230.38003540039062,"height":6.369999885559082,"text":"In contrast, Logjam is due to a protocol flaw in TLS, not"}],[{"top":511.53,"left":53.8,"width":240.46400451660156,"height":6.369999885559082,"text":"Diffie-Hellman parameters, the overwhelming majority use"},{"top":512.19,"left":316.81,"width":239.43002319335938,"height":6.369999885559082,"text":"an implementation bug. From a client perspective, the only"}],[{"top":521.99,"left":53.8,"width":241.9763946533203,"height":6.369999885559082,"text":"one of a handful of primes. As shown in Table 1, just two 512-"},{"top":522.65,"left":316.81,"width":239.29000854492188,"height":6.369999885559082,"text":"defense is to reject small primes in DHE handshakes. (Prior"}],[{"top":532.45,"left":53.8,"width":240.47291564941406,"height":6.369999885559082,"text":"bit primes account for 92.3% of Alexa Top 1M domains that"},{"top":533.11,"left":316.81,"width":239.3400115966797,"height":6.370014667510986,"text":"to this work, most popular browsers accepted p of size ≥ 512"}],[{"top":542.92,"left":53.8,"width":241.9131622314453,"height":6.369999885559082,"text":"support DHE_EXPORT, and 92.5% of all servers with browser-"},{"top":543.57,"left":316.81,"width":239.10000610351562,"height":6.369999885559082,"text":"bits.) Logjam affects fewer servers than FREAK, but, as we"}],[{"top":553.38,"left":53.8,"width":240.44798278808594,"height":6.369999885559082,"text":"trusted certificates that support DHE_EXPORT. (Non-export"},{"top":554.03,"left":316.81,"width":240.37998962402344,"height":6.369999885559082,"text":"shall see, the cost per compromised connection is far lower,"}],[{"top":563.84,"left":53.8,"width":240.31080627441406,"height":6.369999885559082,"text":"DHE follows a similar distribution with longer primes.) The"},{"top":564.49,"left":316.81,"width":239.0900115966797,"height":6.369999885559082,"text":"since the precomputation for each 512-bit group can be used"}],[{"top":574.3,"left":53.8,"width":241.3829803466797,"height":6.369999885559082,"text":"most popular 512-bit prime was hard-coded into many ver-"},{"top":574.95,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"indefinitely against all servers that use that group, and since"}],[{"top":584.76,"left":53.8,"width":240.5800018310547,"height":6.369999885559082,"text":"sions of Apache. Introduced in 2005 with Apache 2.1.5, it"},{"top":585.42,"left":316.81,"width":221.03997802734375,"height":6.369999885559082,"text":"each individual discrete log only takes about a minute."}],[{"top":595.22,"left":53.47,"width":240.96429443359375,"height":6.369999885559082,"text":"was used until 2.4.7, which disabled export ciphersuites. We"},{"top":595.88,"left":325.78,"width":230.30999755859375,"height":6.369999885559082,"text":"Logjam and FREAK both follow the same pattern as other"}],[{"top":605.68,"left":53.8,"width":240.35789489746094,"height":6.369999885559082,"text":"found it in use by about 564,000 servers with browser-trusted"},{"top":606.34,"left":316.81,"width":240.37998962402344,"height":6.369999885559082,"text":"cross-protocol attacks discovered in TLS. As early as SSL 3.0,"}],[{"top":616.14,"left":53.8,"width":240.5959930419922,"height":6.369999885559082,"text":"certificates. The second most popular 512-bit prime is the"},{"top":616.8,"left":316.81,"width":239.4399871826172,"height":6.369999885559082,"text":"Schneier and Wagner noted a related vulnerability that they"}],[{"top":626.6,"left":53.8,"width":240.34886169433594,"height":6.370053768157959,"text":"default used for DHE_EXPORT when using mod_ssl. It was"},{"top":627.26,"left":316.81,"width":240.88998413085938,"height":6.369999885559082,"text":"called key exchange rollback [52]. Mavrogiannopoulos et al."}],[{"top":637.06,"left":53.8,"width":240.4979705810547,"height":6.369999885559082,"text":"introduced in version 2.3.0 in 1999. We found it in use by"},{"top":637.72,"left":316.81,"width":240.63999938964844,"height":6.369999885559082,"text":"showed how explicit-curve ECDHE handshakes could be con-"}],[{"top":647.52,"left":53.8,"width":218.8409881591797,"height":6.369999885559082,"text":"about 89,000 servers with browser-trusted certificates."},{"top":648.18,"left":316.81,"width":239.08999633789062,"height":6.369999885559082,"text":"fused with DHE handshakes [35]. All these attacks could"}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":658.64,"left":316.81,"width":239.10000610351562,"height":6.369999885559082,"text":"be prevented by additionally signing the ciphersuite in the"}],[{"top":667.6,"left":53.8,"width":239.7422332763672,"height":5.369999885559082,"text":"3.2 Active Downgrade to Export-Grade DHE"},{"top":669.1,"left":316.81,"width":239.3400115966797,"height":6.370014667510986,"text":"ServerKeyExchange message. We expect that TLS 1.3 will fix"}],[{"top":679.56,"left":62.76,"width":231.30967712402344,"height":6.369999885559082,"text":"Given the widespread use of these primes, an attacker with"},{"top":679.56,"left":316.81,"width":240.62998962402344,"height":6.369999885559082,"text":"this protocol flaw. More generally, Logjam can also be inter-"}]]},{"extraction_method":"stream","top":316.0,"left":52.0,"width":681.0,"height":330.0,"right":733.0,"bottom":646.0,"data":[[{"top":317.34,"left":53.8,"width":206.4769744873047,"height":6.450016975402832,"text":"of at most 27 bits (hence bound B from §2 is 227)."},{"top":321.12,"left":325.78,"width":231.32162475585938,"height":6.470005989074707,"text":"The main challenge is to compute the shared secret gab"},{"top":322.19,"left":675.74,"width":55.80002975463867,"height":5.090000152587891,"text":"CDF of keys"}],[{"top":327.88,"left":62.76,"width":231.6630096435547,"height":6.369999885559082,"text":"From this data set, we obtained a square matrix with"},{"top":331.68,"left":316.81,"width":239.0999755859375,"height":6.369999885559082,"text":"before the handshake completes in order to forge a Finished"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":338.34,"left":53.57,"width":241.245361328125,"height":6.369999885559082,"text":"2,157,378 rows and columns, with 113 nonzero coefficients per"},{"top":342.14,"left":316.81,"width":240.38002014160156,"height":6.369999885559082,"text":"message from the server. With our descent implementation,"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":348.8,"left":53.8,"width":240.1849822998047,"height":6.369999885559082,"text":"row on average. We solved the corresponding linear system on"},{"top":352.6,"left":316.81,"width":239.0999755859375,"height":6.369999885559082,"text":"the computation takes an average of 70 seconds, but there"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":359.26,"left":53.8,"width":240.54283142089844,"height":6.369999885559082,"text":"a 36-node cluster with two 8-core Intel Xeon E5-2650 CPUs"},{"top":363.06,"left":316.81,"width":228.5999755859375,"height":6.369999885559082,"text":"are several ways an attacker can work around this delay:"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":369.72,"left":53.8,"width":239.33999633789062,"height":6.369999885559082,"text":"per node, connected with Infiniband FDR. We used the block"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":380.18,"left":53.33,"width":241.3426055908203,"height":6.370014667510986,"text":"Wiedemann algorithm [11,49] with parameters m \u003d 18 and"},{"top":377.9,"left":316.3,"width":239.84999084472656,"height":6.370003700256348,"text":"Non-browser clients. Different TLS clients impose different"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":390.65,"left":53.8,"width":241.7279815673828,"height":6.369999885559082,"text":"n \u003d 6. Using the unoptimized implementation from CADO-"},{"top":388.36,"left":316.81,"width":239.0899658203125,"height":6.369999885559082,"text":"time limits for the handshake, after which they kill the"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":401.11,"left":53.8,"width":240.41148376464844,"height":6.369999885559082,"text":"NFS [1] for linear algebra over GF(p), the computation"},{"top":398.82,"left":316.81,"width":239.1100311279297,"height":6.369999885559082,"text":"connection. Command-line clients such as curl and git"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":411.57,"left":53.8,"width":242.23597717285156,"height":6.369999885559082,"text":"finished in 120 hours, corresponding to 60,000 core-hours."},{"top":409.28,"left":316.81,"width":239.0900115966797,"height":6.369999885559082,"text":"often run unattended, so they have long or no timeouts, and"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":422.03,"left":53.33,"width":241.70347595214844,"height":6.369999885559082,"text":"We expect that optimizations could bring this cost down by"},{"top":419.74,"left":316.48,"width":200.50997924804688,"height":6.369999885559082,"text":"we can hijack their connections without difficulty."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":432.49,"left":53.8,"width":102.23207092285156,"height":6.369999885559082,"text":"at least a factor of three."},{"top":434.58,"left":315.35,"width":240.74996948242188,"height":6.370003700256348,"text":"TLS warning alerts. Web browsers tend to have shorter"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":442.95,"left":62.76,"width":231.32972717285156,"height":6.369999885559082,"text":"In total, the wall-clock time for each precomputation was"},{"top":445.05,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"timeouts, but we can keep their connections alive by sending"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":453.41,"left":53.8,"width":240.93223571777344,"height":6.369999885559082,"text":"slightly over one week. Each resulting database of known"},{"top":455.51,"left":316.48,"width":239.67999267578125,"height":6.369999885559082,"text":"TLS warning alerts, which are ignored by the browser but"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":463.87,"left":53.8,"width":241.9224090576172,"height":6.369999885559082,"text":"logs for the descent occupies about 2.5 GB in ASCII format."},{"top":465.97,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"reset the handshake timer. For example, this allows us to keep"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":480.74,"left":53.8,"width":240.59620666503906,"height":6.440007209777832,"text":"Descent Once this precomputation was finished, we were"},{"top":476.43,"left":316.81,"width":239.09002685546875,"height":6.369999885559082,"text":"Firefox’s TLS connections alive indefinitely. (Other browsers"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":491.27,"left":53.8,"width":242.66697692871094,"height":6.369999885559082,"text":"able to run the final descent step to compute individual dis-"},{"top":486.89,"left":316.48,"width":239.41998291015625,"height":6.369999885559082,"text":"we tested close the connection after a minute.) Although"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":501.73,"left":53.8,"width":241.97801208496094,"height":6.369999885559082,"text":"crete logs in about a minute for targets in each of these groups."},{"top":497.35,"left":316.81,"width":240.37001037597656,"height":6.369999885559082,"text":"the victim connection still takes much longer than usual,"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":512.19,"left":53.8,"width":241.7379913330078,"height":6.369999885559082,"text":"In order to save time on individual computations, we imple-"},{"top":507.81,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"the attacker might choose to compromise a request for a"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":522.65,"left":53.8,"width":242.1389923095703,"height":6.369999885559082,"text":"mented a client-server architecture using the ZeroMQ mes-"},{"top":518.27,"left":316.81,"width":240.88999938964844,"height":6.369999885559082,"text":"background resource that does not delay rendering the page."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":533.11,"left":53.8,"width":240.8878631591797,"height":6.369999885559082,"text":"saging library. The server maintains the precomputed data"},{"top":533.11,"left":316.31,"width":239.6000213623047,"height":6.370034217834473,"text":"Ephemeral key caching. Many TLS servers do not use a"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":543.57,"left":53.8,"width":237.12098693847656,"height":6.369999885559082,"text":"in RAM and returns logs for values passed to it by clients."},{"top":543.47,"left":316.81,"width":238.6000213623047,"height":6.470051288604736,"text":"fresh value b for each connection, but instead compute gb"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":554.03,"left":62.76,"width":231.52540588378906,"height":6.369999885559082,"text":"We implemented the descent calculation in a mix of Python"},{"top":554.03,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"once and reuse it for multiple negotiations. Without enabling"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":564.49,"left":53.8,"width":240.18800354003906,"height":6.369999885559082,"text":"and C. The first and second stages are parallelized and run"},{"top":564.4,"left":316.81,"width":238.6000213623047,"height":6.459980487823486,"text":"the SSL_OP_SINGLE_DH_USE option, OpenSSL will reuse gb"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":574.95,"left":53.8,"width":241.75099182128906,"height":6.369999885559082,"text":"sieving in C, and the final discrete log is deduced in Python."},{"top":574.95,"left":316.81,"width":239.08999633789062,"height":6.369999885559082,"text":"for the lifetime of a TLS context. While both Apache and"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":585.42,"left":53.33,"width":241.6849822998047,"height":6.369999885559082,"text":"We ran the server on a machine with two 18-core Intel Xeon"},{"top":585.42,"left":316.81,"width":240.37001037597656,"height":6.369999885559082,"text":"Nginx internally apply this option, certain load balancers,"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":595.88,"left":53.8,"width":240.20298767089844,"height":6.369999885559082,"text":"E5-2699 CPUs and 128 GB of RAM. On average, computing"},{"top":595.88,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"such as stud [48], do not. The F5 BIG-IP load balancers"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":606.34,"left":53.8,"width":240.4459686279297,"height":6.369999885559082,"text":"individual logs took about 70 seconds, but the time varied"},{"top":606.24,"left":316.81,"width":239.1000213623047,"height":6.470036506652832,"text":"and hardware TLS frontends will reuse gb unless the “Single"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":616.8,"left":53.8,"width":240.8279266357422,"height":6.369999885559082,"text":"from 34 to 206 seconds (see Fig. 3). This is divided between"},{"top":616.7,"left":316.81,"width":239.29000854492188,"height":6.469975471496582,"text":"DH” option is checked [53]. Microsoft Schannel caches gb for"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":627.26,"left":53.8,"width":240.4009246826172,"height":6.369999885559082,"text":"about 20 seconds for descent initialization and the remainder"},{"top":627.26,"left":316.81,"width":239.08999633789062,"height":6.369999885559082,"text":"two hours—this setting is hard-coded. For these servers, an"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":637.72,"left":53.8,"width":240.40574645996094,"height":6.369999885559082,"text":"on the middle phase. Further optimizations—such as more"},{"top":637.62,"left":316.81,"width":240.63999938964844,"height":6.469975471496582,"text":"attacker can compute the discrete log of gb from one connec-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}]]},{"extraction_method":"stream","top":161.0,"left":52.0,"width":507.0,"height":539.0,"right":559.0,"bottom":700.0,"data":[[{"top":162.0,"left":53.8,"width":240.38975524902344,"height":6.370001792907715,"text":"dows 10) send False Start data with DHE. In these cases, a"},{"top":162.0,"left":316.81,"width":239.3499755859375,"height":6.369999885559082,"text":"of the order of g, and ordered them by the estimated work"}],[{"top":172.46,"left":53.8,"width":240.27784729003906,"height":6.369999885559082,"text":"man-in-the-middle can record the handshake and decrypt the"},{"top":172.46,"left":316.81,"width":239.27999877929688,"height":6.369999885559082,"text":"required using Pohlig-Hellman and Pollard lambda to recover"}],[{"top":182.92,"left":53.8,"width":240.3965606689453,"height":6.369999885559082,"text":"False Start payload at leisure. We note that this initial data"},{"top":182.92,"left":316.81,"width":239.3400115966797,"height":6.369999885559082,"text":"a target private exponent x of length ranging from 64 to 256"}],[{"top":193.39,"left":53.8,"width":240.66600036621094,"height":6.369999885559082,"text":"sent by a browser often contains sensitive user authentication"},{"top":193.39,"left":316.81,"width":239.09002685546875,"height":6.369999885559082,"text":"bits. There were 753 (p, g) pairs where we knew factors of"}],[{"top":203.85,"left":53.8,"width":178.23095703125,"height":6.369999885559082,"text":"information, such as passwords and cookies."},{"top":203.85,"left":316.81,"width":239.3300018310547,"height":6.369999885559082,"text":"the subgroup generated by g; these had been used for 40,903"}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":214.31,"left":316.81,"width":140.32000732421875,"height":6.369999885559082,"text":"connections across all of our scans."}],[{"top":226.83,"left":53.8,"width":231.48606872558594,"height":5.369999885559082,"text":"3.5 Other Weak and Misconfigured Groups"},{"top":224.77,"left":325.78,"width":230.13002014160156,"height":6.369999885559082,"text":"We implemented the van Oorschot andWiener algorithm in"}],[{"top":238.79,"left":62.76,"width":231.9860076904297,"height":6.369999885559082,"text":"In our scans, we found several other exploitable security"},{"top":235.23,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"Sage [47] using a parallel Pollard rho implementation that we"}],[{"top":249.25,"left":53.8,"width":220.8745880126953,"height":6.369999885559082,"text":"issues in the DHE configurations used by TLS servers."},{"top":245.69,"left":316.48,"width":239.4199981689453,"height":6.369999885559082,"text":"wrote in C using the GMP library. We used the distinguished"}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":256.15,"left":316.81,"width":239.10000610351562,"height":6.369999885559082,"text":"points method for collision detection; for a prime known in"}],[{"top":264.41,"left":53.8,"width":241.4029998779297,"height":6.440007209777832,"text":"512-bit primes in non-export DHE We found 2,631"},{"top":266.61,"left":316.81,"width":239.4300079345703,"height":6.369999885559082,"text":"advance, this implementation can be arbitrarily sped up by"}],[{"top":274.94,"left":53.8,"width":240.62599182128906,"height":6.369999885559082,"text":"servers with browser-trusted certificates (and 118 in the"},{"top":277.07,"left":316.81,"width":182.70001220703125,"height":6.369999885559082,"text":"precomputing a table of distinguished points."}],[{"top":285.4,"left":53.47,"width":241.93798828125,"height":6.369999885559082,"text":"Top 1M domains) that used 512-bit or weaker primes for"},{"top":287.53,"left":325.78,"width":230.3699951171875,"height":6.369999885559082,"text":"We computed partial information about the server secret"}],[{"top":295.86,"left":53.8,"width":240.83091735839844,"height":6.370017051696777,"text":"non-export DHE. In these instances, active attacks may"},{"top":297.99,"left":316.81,"width":239.28997802734375,"height":6.369999885559082,"text":"exponent used in 460 exchanges and were able to recover"}],[{"top":306.32,"left":53.8,"width":240.1649932861328,"height":6.369999885559082,"text":"be unnecessary. If a browser negotiates a DHE ciphersuite"},{"top":308.45,"left":316.81,"width":239.09002685546875,"height":6.369999885559082,"text":"the whole exponent used by 159 different hosts, 53 of which"}],[{"top":316.79,"left":53.47,"width":240.9073486328125,"height":6.369999885559082,"text":"with one of these servers, a passive eavesdropper can later"},{"top":318.91,"left":316.81,"width":239.10003662109375,"height":6.369999885559082,"text":"authenticated with valid browser-trusted certificates. In all"}],[{"top":327.25,"left":53.8,"width":240.2989959716797,"height":6.369999885559082,"text":"compute the discrete log and obtain the TLS session keys"},{"top":329.38,"left":316.81,"width":239.08999633789062,"height":6.369999885559082,"text":"cases, the vulnerable hosts used 512-bit prime moduli; three"}],[{"top":337.71,"left":53.8,"width":240.7969512939453,"height":6.369999885559082,"text":"for the connection. An active attack may still be necessary"},{"top":339.84,"left":316.81,"width":240.89002990722656,"height":6.369999885559082,"text":"of them used 160-bit exponents and the rest used 128 bits."}],[{"top":348.17,"left":53.47,"width":241.0938720703125,"height":6.369999885559082,"text":"when the client’s ordering of ciphersuites would result in the"},{"top":350.3,"left":316.48,"width":239.4199981689453,"height":6.369999885559082,"text":"The order of the largest-order subgroup ranged from 46 bits"}],[{"top":358.63,"left":53.8,"width":240.4879913330078,"height":6.369999885559082,"text":"server not selecting DHE. In this case, as in the DHE_EXPORT"},{"top":360.76,"left":315.73,"width":240.16998291015625,"height":6.369999885559082,"text":"(which finishes in seconds) to 81 bits (which took between"}],[{"top":369.09,"left":53.8,"width":240.50001525878906,"height":6.369999885559082,"text":"downgrade attack, an active attacker can force the server to"},{"top":371.22,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"50 and 176 hours) implementation. The Pollard lambda"}],[{"top":379.55,"left":53.8,"width":149.23382568359375,"height":6.370017051696777,"text":"choose a vulnerable DHE ciphersuite."},{"top":381.68,"left":316.81,"width":238.530029296875,"height":6.369999885559082,"text":"calculations used interval width varying from 40 to 70 bits."}],[{"top":390.01,"left":62.76,"width":233.30979919433594,"height":6.369999885559082,"text":"As a proof-of-concept, we implemented a passive eaves-"},{"top":392.14,"left":325.78,"width":231.66000366210938,"height":6.369999885559082,"text":"Our computations would have allowed us to hijack con-"}],[{"top":400.47,"left":53.8,"width":240.91600036621094,"height":6.369999885559082,"text":"dropper for regular DHE connections and used it to decrypt"},{"top":402.6,"left":316.81,"width":239.0900115966797,"height":6.369999885559082,"text":"nections to a variety of vulnerable TLS servers, including"}],[{"top":410.93,"left":53.8,"width":240.84645080566406,"height":6.369999885559082,"text":"test connections to www.fbi.gov. Until April 2015, this server"},{"top":413.06,"left":316.48,"width":239.4300079345703,"height":6.369999885559082,"text":"web interfaces for VPN devices (48 hosts), communications"}],[{"top":421.39,"left":53.8,"width":240.1580047607422,"height":6.369999885559082,"text":"used the default 512-bit DH group from OpenSSL, which"},{"top":423.52,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"software (21 hosts), web conferencing servers (27 hosts), and"}],[{"top":431.85,"left":53.47,"width":242.45501708984375,"height":6.369999885559082,"text":"was the third group for which we performed the NFS pre-"},{"top":433.98,"left":316.81,"width":239.08999633789062,"height":6.369999885559082,"text":"FTP servers (6 hosts). As a proof-of-concept, we modified"}],[{"top":442.31,"left":53.8,"width":208.21998596191406,"height":6.370017051696777,"text":"computation. The website no longer supports DHE."},{"top":444.44,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"our man-in-the-middle attacker of §3.3 to impersonate a"}],[{"top":457.48,"left":53.4,"width":240.94183349609375,"height":6.429999828338623,"text":"Attacks on composite-order subgroups Failure to"},{"top":454.9,"left":316.57,"width":239.33999633789062,"height":6.369999885559082,"text":"vulnerable server and capture user credentials. Compared"}],[{"top":468.01,"left":53.8,"width":240.2053985595703,"height":6.369999885559082,"text":"generate Diffie-Hellman primes according to best practices"},{"top":465.37,"left":316.81,"width":239.08999633789062,"height":6.369999885559082,"text":"to an attack using NFS, we could compute the discrete log"}],[{"top":478.47,"left":53.8,"width":241.27796936035156,"height":6.369999885559082,"text":"can result in devastating attacks. Not every TLS server"},{"top":475.83,"left":316.48,"width":196.0999755859375,"height":6.369999885559082,"text":"with a delay hardly noticeable for browser users."}],[{"top":488.93,"left":53.8,"width":241.8412628173828,"height":6.369999885559082,"text":"uses “safe” primes. Out of approximately 70,000 distinct"},{"top":491.2,"left":316.81,"width":239.1000213623047,"height":6.439976692199707,"text":"Misconfigured groups The Digital Signature Algorithm"}],[{"top":499.39,"left":53.8,"width":241.4443817138672,"height":6.369999885559082,"text":"primes seen across both export and non-export TLS scans,"},{"top":501.73,"left":315.73,"width":240.17999267578125,"height":6.369999885559082,"text":"(DSA) [38] uses primes p such that p− 1 has a large prime"}],[{"top":509.85,"left":53.48,"width":242.11756896972656,"height":6.369999885559082,"text":"4,800 were not safe, meaning that (p− 1)/2 was composite."},{"top":512.19,"left":316.81,"width":239.10000610351562,"height":6.369999885559082,"text":"factor q and g generates only a subgroup of order q. When"}],[{"top":520.31,"left":52.72,"width":241.70098876953125,"height":6.369999885559082,"text":"(Incidentally, we also found 9 composite p.) These groups"},{"top":522.65,"left":316.81,"width":239.09002685546875,"height":6.369999885559082,"text":"using properly generated DSA parameters, these groups are"}],[{"top":530.77,"left":53.8,"width":240.3651580810547,"height":6.369999885559082,"text":"are not necessarily vulnerable, as long as g generates a group"},{"top":533.11,"left":316.81,"width":239.4399871826172,"height":6.369999885559082,"text":"secure for use in Diffie-Hellman key exchanges. Notably, DSA"}],[{"top":541.23,"left":53.47,"width":241.07000732421875,"height":6.369999885559082,"text":"with at least one sufficiently large subgroup order to rule out"},{"top":543.57,"left":316.81,"width":239.33999633789062,"height":6.369999885559082,"text":"groups are hard-coded in Java’s sun.security.provider"}],[{"top":551.69,"left":53.8,"width":176.3459930419922,"height":6.369999885559082,"text":"the Pohlig-Hellman algorithm as an attack."},{"top":554.03,"left":316.81,"width":239.08999633789062,"height":6.369999885559082,"text":"package and are used by default in many Java-based TLS"}],[{"top":562.15,"left":62.76,"width":231.19801330566406,"height":6.369999885559082,"text":"In some real-life configurations, however, choosing such"},{"top":564.49,"left":316.81,"width":239.4299774169922,"height":6.369999885559082,"text":"servers. However, some servers in our scans used Java’s DSA"}],[{"top":572.61,"left":53.8,"width":240.5959930419922,"height":6.369999885559082,"text":"primes can lead to an attack. For efficiency reasons, some"},{"top":574.95,"left":316.81,"width":239.1000213623047,"height":6.370014667510986,"text":"primes as p but mistakenly used the DSA group order q in the"}],[{"top":582.98,"left":53.8,"width":240.72056579589844,"height":6.460041522979736,"text":"implementations use ephemeral keys gx with a short exponent"},{"top":585.42,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"place of the generator g. We found 5,741 hosts misconfigured"}],[{"top":593.53,"left":53.8,"width":240.64988708496094,"height":6.369999885559082,"text":"x; commonly suggested sizes for x are as small as 160 or 224"},{"top":595.88,"left":316.81,"width":35.380008697509766,"height":6.369999885559082,"text":"this way."}],[{"top":604.0,"left":53.8,"width":240.8407745361328,"height":6.369999885559082,"text":"bits, intended to match the estimated strength of a 1024- or"},{"top":606.34,"left":325.78,"width":231.6699981689453,"height":6.369999885559082,"text":"This substitution of q for g is likely due to a usability prob-"}],[{"top":614.46,"left":53.57,"width":240.61538696289062,"height":6.369999885559082,"text":"2048-bit group. For safe p, such exponent lengths are not"},{"top":616.8,"left":316.81,"width":239.0900115966797,"height":6.369999885559082,"text":"lem: the canonical ASN.1 representation of Diffie-Hellman"}],[{"top":624.92,"left":53.8,"width":240.57798767089844,"height":6.369999885559082,"text":"known to decrease security, as the most efficient attack will"},{"top":627.26,"left":316.81,"width":240.6400146484375,"height":6.369999885559082,"text":"key exchange parameters (coming from PKCS#3) is a se-"}],[{"top":635.38,"left":53.8,"width":240.4877471923828,"height":6.369999885559082,"text":"be the Pollard lambda algorithm. But if the order of the"},{"top":637.72,"left":316.81,"width":239.0900115966797,"height":6.369999885559082,"text":"quence (p, g), while that of DSA parameters (coming from"}],[{"top":645.84,"left":53.8,"width":240.7220001220703,"height":6.369999885559082,"text":"subgroup generated by g has small factors, they can be used"},{"top":648.18,"left":316.81,"width":239.0999755859375,"height":6.369999885559082,"text":"PKIX) is (p, q, g); we conjecture that the confusion between"}],[{"top":656.3,"left":53.8,"width":239.08999633789062,"height":6.369999885559082,"text":"to recover information about exponents. From a subset of"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":662.71,"left":159.4,"width":10.4840087890625,"height":3.190000057220459,"text":"∏"},{"top":658.64,"left":316.81,"width":198.67999267578125,"height":6.369999885559082,"text":"these formats led to a simple programming error."}],[{"top":665.98,"left":53.8,"width":239.10000610351562,"height":21.840002059936523,"text":"factors recover x {q z, Pohlig-Hellman can1 e1 mod z in time . . . q } k ek with ∑ qi. If x ≤ z, this suffices toi i ei q i√ ei \u003d"},{"top":669.1,"left":316.81,"width":239.44998168945312,"height":16.830036163330078,"text":"In a DSA group, the subgroup generated by to have many small prime factors in its order, since for pq is likely"}],[{"top":688.68,"left":53.8,"width":239.0900115966797,"height":6.369999885559082,"text":"recover x. If not, Pollard lambda can use this information"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":695.39,"left":137.15,"width":11.370010375976562,"height":3.190000057220459,"text":"√"},{"top":690.02,"left":316.81,"width":240.89002990722656,"height":6.369999885559082,"text":"generated according to [38], (p − 1)/q is a random integer."}]]},{"extraction_method":"stream","top":144.0,"left":52.0,"width":506.0,"height":136.0,"right":558.0,"bottom":280.0,"data":[[{"top":146.23,"left":53.8,"width":240.9960174560547,"height":6.369999885559082,"text":"cal attacks against Diffie-Hellman key exchange as currently"},{"top":145.03,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"no longer Boolean. We can reduce overall time by sieving"}],[{"top":156.69,"left":53.8,"width":240.9864959716797,"height":6.369999885559082,"text":"used by TLS. However, these attacks rely on the ability to"},{"top":155.49,"left":316.81,"width":239.27996826171875,"height":6.369999885559082,"text":"more, thus generating a smaller input matrix to the linear"}],[{"top":167.15,"left":53.8,"width":240.49998474121094,"height":6.369999885559082,"text":"downgrade connections to export-grade crypto or on the use"},{"top":165.95,"left":316.81,"width":239.27996826171875,"height":6.369999885559082,"text":"algebra step. Since sieving parallelizes better than linear"}],[{"top":177.61,"left":53.8,"width":240.4521026611328,"height":6.369999885559082,"text":"of unsafe parameters. In this section we address the following"},{"top":176.41,"left":316.81,"width":198.969970703125,"height":6.369999885559082,"text":"algebra, this tradeoff is desirable for large inputs."}],[{"top":188.07,"left":53.8,"width":241.93003845214844,"height":6.369999885559082,"text":"question: how secure is Diffie-Hellman in broader practice,"},{"top":186.87,"left":325.78,"width":230.3800048828125,"height":6.369999885559082,"text":"A 596-bit factorization takes about 5 core-years, most"}],[{"top":198.53,"left":53.8,"width":241.78001403808594,"height":6.369999885559082,"text":"as used in other protocols that do not suffer from downgrade,"},{"top":197.33,"left":316.81,"width":239.35000610351562,"height":6.369999885559082,"text":"of it spent on sieving. In comparison, the record 596-bit"}],[{"top":208.99,"left":53.8,"width":163.7760009765625,"height":6.369999885559082,"text":"and when applied with stronger groups?"},{"top":207.79,"left":316.81,"width":239.35000610351562,"height":6.369999885559082,"text":"discrete log effort tuned parameters such that they spent"}],[{"top":219.45,"left":62.76,"width":231.5878448486328,"height":6.369999885559082,"text":"To answer this question we must first examine how the"},{"top":218.26,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"50 core-years on sieving. This reduced their linear algebra"}],[{"top":229.92,"left":53.8,"width":240.5760040283203,"height":6.369999885559082,"text":"number field sieve for discrete log scales to 768- and 1024-bit"},{"top":228.72,"left":316.81,"width":239.10000610351562,"height":6.369999885559082,"text":"calculation to 80 core-years. We used this same strategy in"}],[{"top":240.38,"left":53.8,"width":240.3791046142578,"height":6.369999885559082,"text":"groups. As we argue below, 768-bit groups, which are still in"},{"top":239.18,"left":316.81,"width":128.72000122070312,"height":6.369999885559082,"text":"our 512-bit experiments in §3.3."}],[{"top":250.84,"left":53.8,"width":240.64601135253906,"height":6.369999885559082,"text":"relatively widespread use, are now within reach for academic"},{"top":249.64,"left":325.78,"width":230.11996459960938,"height":6.369999885559082,"text":"Similarly, the 768-bit RSA factoring record spent more"}],[{"top":261.3,"left":53.8,"width":240.2628936767578,"height":6.369999885559082,"text":"computational resources, and performing precomputations"},{"top":260.1,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"time on sieving in order to save time on the linear algebra"}],[{"top":271.76,"left":53.8,"width":240.30870056152344,"height":6.369999885559082,"text":"for a small number of 1024-bit groups is plausibly within"},{"top":270.56,"left":316.81,"width":239.08999633789062,"height":6.369999885559082,"text":"step. The cost of sieving was around 1500 core-years, and"}]]},{"extraction_method":"stream","top":280.0,"left":52.0,"width":507.0,"height":188.0,"right":559.0,"bottom":468.0,"data":[[{"top":282.22,"left":53.8,"width":240.16102600097656,"height":6.369999885559082,"text":"the resources of state-level attackers. The precomputation"},{"top":281.02,"left":316.81,"width":240.88002014160156,"height":6.369999885559082,"text":"the matrix that was produced had 200M rows and columns."}],[{"top":292.68,"left":53.47,"width":241.75201416015625,"height":6.369999885559082,"text":"would likely require special-purpose hardware, but would not"},{"top":291.48,"left":316.47,"width":240.97998046875,"height":6.369999885559082,"text":"As a result, the linear algebra took 150 core-years, but tak-"}],[{"top":303.14,"left":53.8,"width":239.8729705810547,"height":6.369999885559082,"text":"require any major algorithmic improvements beyond what is"},{"top":301.94,"left":316.81,"width":239.10000610351562,"height":6.369999885559082,"text":"ing algorithmic improvements since 2009 into account and"}],[{"top":313.6,"left":53.8,"width":240.4681854248047,"height":6.369999885559082,"text":"known in the academic literature. We further show that even"},{"top":312.32,"left":316.81,"width":239.1100311279297,"height":6.449986457824707,"text":"optimizing for the total time,3 we estimate that factoring an"}],[{"top":324.06,"left":53.8,"width":241.1239776611328,"height":6.369999885559082,"text":"in the 1024-bit case, the descent time—necessary to solve"},{"top":322.86,"left":316.81,"width":208.3599853515625,"height":6.369999885559082,"text":"RSA-768 integer would take 900 core-years in total."}],[{"top":334.52,"left":53.8,"width":242.88050842285156,"height":6.369999885559082,"text":"any specific discrete log instance within a common group—"},{"top":333.32,"left":325.78,"width":230.12997436523438,"height":6.369999885559082,"text":"For a 768-bit discrete log, we can expect that ten times as"}],[{"top":344.98,"left":53.47,"width":241.28607177734375,"height":6.369999885559082,"text":"would be fast enough to break individual key exchanges in"},{"top":343.78,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"much sieving as the RSA case would reduce the matrix to"}],[{"top":355.44,"left":53.8,"width":73.15499877929688,"height":6.369999885559082,"text":"close to real time."},{"top":354.25,"left":316.81,"width":239.09999084472656,"height":6.369999885559082,"text":"around 150M rows. We extrapolate from experiments with"}],[{"top":365.91,"left":62.76,"width":232.90602111816406,"height":6.369999885559082,"text":"In light of these results, we examine several standard Inter-"},{"top":364.71,"left":316.81,"width":239.33001708984375,"height":6.369999885559082,"text":"existing software that this linear algebra would take 28,500"}],[{"top":376.37,"left":53.8,"width":240.34397888183594,"height":6.369999885559082,"text":"net security protocols—IKE, SSH, and TLS—to determine"},{"top":375.17,"left":316.81,"width":239.08999633789062,"height":6.369999885559082,"text":"core-years, for a total of 36,500 core-years. This is within"}],[{"top":386.83,"left":53.8,"width":241.6984405517578,"height":6.369999885559082,"text":"the vulnerability of their key exchanges to attacks by resource-"},{"top":385.63,"left":316.81,"width":201.82000732421875,"height":6.369999885559082,"text":"reach by computing power available to academics."}],[{"top":397.29,"left":53.8,"width":241.13697814941406,"height":6.369999885559082,"text":"ful attackers. Although the cost of the precomputation for a"},{"top":396.09,"left":325.78,"width":231.66000366210938,"height":6.369999885559082,"text":"The descent step takes relatively little time. We experi-"}],[{"top":407.75,"left":53.34,"width":241.85498046875,"height":6.369999885559082,"text":"1024-bit group is several times higher than for an RSA key"},{"top":406.55,"left":316.81,"width":239.08999633789062,"height":6.369999885559082,"text":"mented with both CADO-NFS and a new implementation"}],[{"top":418.21,"left":53.8,"width":240.78550720214844,"height":6.369999885559082,"text":"of equal size, we observe that a one-time investment could be"},{"top":417.01,"left":316.48,"width":239.4300079345703,"height":6.369999885559082,"text":"with GMP-ECM based on the early-abort strategy described"}],[{"top":428.67,"left":53.8,"width":240.0476531982422,"height":6.369999885559082,"text":"used to attack millions of hosts, due to widespread reuse of"},{"top":427.47,"left":316.81,"width":239.32998657226562,"height":6.369999885559082,"text":"in [6]. Using these techniques, the initial descent phase took"}],[{"top":439.13,"left":53.8,"width":241.55140686035156,"height":6.369999885559082,"text":"the most common Diffie-Hellman parameters. Unfortunately,"},{"top":437.93,"left":316.81,"width":239.09002685546875,"height":6.369999885559082,"text":"an average of around 1 core-day. The remaining phase uses"}],[{"top":449.59,"left":53.8,"width":240.44798278808594,"height":6.369999885559082,"text":"our measurements also indicate that it may be very difficult"},{"top":448.39,"left":316.81,"width":239.08999633789062,"height":6.369999885559082,"text":"sieving much as in the precomputation; extrapolating from"}],[{"top":460.05,"left":53.8,"width":240.59400939941406,"height":6.369999885559082,"text":"to sunset the use of fixed 1024-bit Diffie-Hellman groups that"},{"top":458.85,"left":316.81,"width":239.35000610351562,"height":6.369999885559082,"text":"experiments, the rest of the descent should take at most"}]]},{"extraction_method":"stream","top":53.0,"left":61.0,"width":488.0,"height":97.0,"right":549.0,"bottom":150.0,"data":[[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":59.8,"left":147.96,"width":27.987106323242188,"height":3.5199999809265137,"text":"Sieving"},{"top":59.8,"left":225.12,"width":56.970245361328125,"height":3.5199999809265137,"text":"Linear Algebra"},{"top":59.8,"left":301.23,"width":28.849998474121094,"height":3.5199999809265137,"text":"Descent"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":73.33,"left":119.58,"width":4.935005187988281,"height":3.2799999713897705,"text":"I"},{"top":73.07,"left":134.57,"width":73.62059020996094,"height":5.589997291564941,"text":"log2 B core-years"},{"top":73.09,"left":221.63,"width":67.17919921875,"height":3.5199999809265137,"text":"rows core-years"},{"top":73.09,"left":298.48,"width":34.33998489379883,"height":3.5199999809265137,"text":"core-time"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":86.56,"left":71.78,"width":34.06925964355469,"height":3.5199999809265137,"text":"RSA-512"},{"top":86.56,"left":115.35,"width":9.776634216308594,"height":3.5199999809265137,"text":"14"},{"top":86.56,"left":149.36,"width":59.02677917480469,"height":3.5199999809265137,"text":"29 0.5"},{"top":86.56,"left":219.81,"width":69.44680786132812,"height":3.5199999809265137,"text":"4.3M 0.33"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":87.0,"left":351.53,"width":161.13999938964844,"height":3.0799999237060547,"text":"Timings with default CADO-NFS parameters."}],[{"top":95.53,"left":76.25,"width":29.606124877929688,"height":3.5199999809265137,"text":"DH-512"},{"top":95.53,"left":115.35,"width":9.777755737304688,"height":3.5199999809265137,"text":"15"},{"top":95.53,"left":149.36,"width":59.02679443359375,"height":3.5199999809265137,"text":"27 2.5"},{"top":95.53,"left":219.81,"width":69.20773315429688,"height":3.5199999809265137,"text":"2.1M 7.7"},{"top":95.53,"left":305.5,"width":28.871978759765625,"height":3.5199999809265137,"text":"10mins"},{"top":95.97,"left":351.53,"width":196.0299835205078,"height":3.0799999237060547,"text":"For the computations in this paper; may be suboptimal."}],[{"top":108.82,"left":71.78,"width":34.07146453857422,"height":3.5199999809265137,"text":"RSA-768"},{"top":108.82,"left":115.35,"width":9.776992797851562,"height":3.5199999809265137,"text":"16"},{"top":108.82,"left":149.36,"width":59.09727478027344,"height":3.5199999809265137,"text":"37 800"},{"top":108.82,"left":217.92,"width":71.34678649902344,"height":3.5199999809265137,"text":"250M 100"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":109.26,"left":351.53,"width":123.87999725341797,"height":3.0799999237060547,"text":"Est. based on [29] with less sieving."}],[{"top":117.79,"left":76.25,"width":29.606124877929688,"height":3.5199999809265137,"text":"DH-768"},{"top":117.79,"left":115.35,"width":9.777755737304688,"height":3.5199999809265137,"text":"17"},{"top":117.79,"left":149.36,"width":59.058441162109375,"height":3.5199999809265137,"text":"35 8,000"},{"top":117.79,"left":217.92,"width":71.05543518066406,"height":3.5199999809265137,"text":"150M 28,500"},{"top":117.79,"left":310.67,"width":23.706756591796875,"height":3.5199999809265137,"text":"2days"},{"top":118.23,"left":351.53,"width":162.38999938964844,"height":3.0799999237060547,"text":"Est. based on [8, 29] and our own experiments."}],[{"top":131.08,"left":67.55,"width":38.30023193359375,"height":3.5199999809265137,"text":"RSA-1024"},{"top":131.08,"left":115.35,"width":9.77679443359375,"height":3.5199999809265137,"text":"18"},{"top":131.08,"left":149.36,"width":59.05070495605469,"height":3.5199999809265137,"text":"42 1,000,000"},{"top":131.08,"left":221.57,"width":67.68679809570312,"height":3.5199999809265137,"text":"8.7B 120,000"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":131.52,"left":351.53,"width":119.02001190185547,"height":3.0799999237060547,"text":"Est. based on complexity formula."}],[{"top":140.05,"left":72.02,"width":33.83256530761719,"height":3.5199999809265137,"text":"DH-1024"},{"top":140.05,"left":115.35,"width":9.777175903320312,"height":3.5199999809265137,"text":"19"},{"top":140.05,"left":149.36,"width":59.05047607421875,"height":3.5199999809265137,"text":"40 10,000,000"},{"top":140.05,"left":221.56,"width":67.40081787109375,"height":3.5199999809265137,"text":"5.2B 35,000,000"},{"top":140.05,"left":306.44,"width":27.936767578125,"height":3.5199999809265137,"text":"30 days"},{"top":140.49,"left":351.53,"width":193.12001037597656,"height":3.0799999237060547,"text":"Est. based on complexity formula and our experiments."}]]},{"extraction_method":"stream","top":362.0,"left":52.0,"width":507.0,"height":325.0,"right":559.0,"bottom":687.0,"data":[[{"top":363.25,"left":53.8,"width":240.6360321044922,"height":6.369999885559082,"text":"additional round of Diffie-Hellman. Ultimately, KEYMAT is"},{"top":365.74,"left":316.81,"width":239.4400177001953,"height":6.369999885559082,"text":"by the Phase 1 exchange. Absent a vulnerability in the key"}],[{"top":373.71,"left":53.8,"width":240.42897033691406,"height":6.370017051696777,"text":"derived from SKEYID, additional nonces, and the result of"},{"top":376.2,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"derivation function or transport encryption, this requires"}],[{"top":384.17,"left":53.8,"width":187.24598693847656,"height":6.369999885559082,"text":"the optional Phase 2 Diffie-Hellman exchange."},{"top":386.66,"left":316.81,"width":239.28001403808594,"height":6.369999885559082,"text":"the attacker to recover a Diffie-Hellman shared secret after"}],[{"top":397.05,"left":53.8,"width":242.0039825439453,"height":6.440007209777832,"text":"NSA’s VPN exploitation process The documents pub-"},{"top":397.12,"left":316.81,"width":157.26998901367188,"height":6.369999885559082,"text":"passively observing an IKE handshake."}],[{"top":407.58,"left":53.8,"width":241.6657257080078,"height":6.369999885559082,"text":"lished by Der Spiegel describe a system named TURMOIL"},{"top":407.58,"left":325.78,"width":230.13002014160156,"height":6.369999885559082,"text":"While IKE is designed to support a range of Diffie-Hellman"}],[{"top":418.04,"left":53.8,"width":240.49998474121094,"height":6.369999885559082,"text":"that is used to collect and decrypt VPN traffic. The evidence"},{"top":418.04,"left":316.81,"width":239.35000610351562,"height":6.369999885559082,"text":"groups, our Internet-wide scans (§4.3) show that the vast"}],[{"top":428.5,"left":53.8,"width":240.88157653808594,"height":6.369999885559082,"text":"indicates that this decryption is performed using passive"},{"top":428.5,"left":316.81,"width":239.0999755859375,"height":6.369999885559082,"text":"majority of IKE systems select one particular 1024-bit DH"}],[{"top":438.96,"left":53.8,"width":240.66297912597656,"height":6.369999885559082,"text":"eavesdropping and does not require message injection or"},{"top":438.96,"left":316.81,"width":239.1400146484375,"height":6.369999885559082,"text":"group, Oakley Group 2, even when offered stronger groups."}],[{"top":449.43,"left":53.8,"width":241.2100067138672,"height":6.369999885559082,"text":"man-in-the-middle attacks on IPsec or IKE. Figure 4, an"},{"top":449.43,"left":325.78,"width":230.11997985839844,"height":6.369999885559082,"text":"Given an efficient oracle for solving the discrete logarithm"}],[{"top":459.89,"left":53.8,"width":241.0821075439453,"height":6.369999885559082,"text":"excerpt from one of the documents [67], illustrates the flow"},{"top":459.89,"left":316.81,"width":239.0999755859375,"height":6.369999885559082,"text":"problem, attacks on IKE are possible provided that the"}],[{"top":470.35,"left":53.8,"width":188.32264709472656,"height":6.369999885559082,"text":"of information through the TURMOIL system"},{"top":470.35,"left":316.81,"width":239.09002685546875,"height":6.369999885559082,"text":"attacker can obtain the following: (1) a complete two-sided"}],[{"top":480.81,"left":62.76,"width":231.42884826660156,"height":6.369999885559082,"text":"The initial phases of the attack involve collecting IKE and"},{"top":480.81,"left":316.81,"width":239.10003662109375,"height":6.369999885559082,"text":"IKE transcript, including the Diffie-Hellman ephemeral keys"}],[{"top":491.27,"left":53.8,"width":240.40696716308594,"height":6.369999885559082,"text":"ESP payloads and determining whether the traffic matches"},{"top":491.17,"left":316.81,"width":239.4399871826172,"height":6.469975471496582,"text":"ga and gb as well as the nonces and cookies transmitted by"}],[{"top":501.73,"left":53.8,"width":240.5959930419922,"height":6.369999885559082,"text":"any tasked selector [65]. If so, TURMOIL transmits the"},{"top":501.73,"left":316.81,"width":239.4499969482422,"height":6.369999885559082,"text":"both sides of the connection, and (2) in IKEv1 only, the PSK"}],[{"top":512.19,"left":53.8,"width":240.75563049316406,"height":6.369999885559082,"text":"complete IKE handshake and may transmit a small amount"},{"top":512.19,"left":316.81,"width":99.8599853515625,"height":6.370017051696777,"text":"used in deriving SKEYID."}],[{"top":522.65,"left":53.8,"width":241.0879669189453,"height":6.369999885559082,"text":"of ESP ciphertext to NSA’s Cryptanalysis and Exploitation"},{"top":522.65,"left":325.78,"width":230.11996459960938,"height":6.369999885559082,"text":"Both of the above requirements are also present in the"}],[{"top":533.11,"left":53.8,"width":240.7793426513672,"height":6.369999885559082,"text":"Services (CES) [56,65] via a secure tunnel. Within CES, a"},{"top":533.11,"left":316.81,"width":239.0900115966797,"height":6.369999885559082,"text":"NSA’s VPN attack system. As Figure 4 illustrates, a hard"}],[{"top":543.57,"left":53.8,"width":240.17897033691406,"height":6.369999885559082,"text":"specialized VPN Attack Orchestrator (VAO) system manages"},{"top":543.57,"left":316.81,"width":239.1100311279297,"height":6.369999885559082,"text":"requirement of the VAO is the need to obtain the complete"}],[{"top":554.03,"left":53.8,"width":240.23207092285156,"height":6.369999885559082,"text":"a collection of high-performance grid computing resources"},{"top":554.03,"left":316.81,"width":239.10000610351562,"height":6.369999885559082,"text":"two-sided IKE transcript [60]. The published documents"}],[{"top":564.49,"left":53.8,"width":240.47813415527344,"height":6.369999885559082,"text":"located at NSA Headquarters and in a data center at Oak"},{"top":564.49,"left":316.81,"width":239.0899658203125,"height":6.369999885559082,"text":"indicate that this requirement substantially increases the"}],[{"top":574.95,"left":53.8,"width":240.34397888183594,"height":6.369999885559082,"text":"Ridge National Laboratory, which perform the computation"},{"top":574.95,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"complexity of the attack execution, since IKE transcripts"}],[{"top":585.42,"left":53.8,"width":241.24925231933594,"height":6.369999885559082,"text":"required to generate the ESP session key [61,62,67]. VAO"},{"top":585.42,"left":316.81,"width":239.10000610351562,"height":6.369999885559082,"text":"must be reassembled (“paired”) whenever the interaction"}],[{"top":595.88,"left":53.8,"width":241.75526428222656,"height":6.369999885559082,"text":"also maintains a database, CORALREEF, that stores cryp-"},{"top":595.88,"left":316.81,"width":190.42999267578125,"height":6.369999885559082,"text":"traverses multiple network paths [55,56, 58,66]."}],[{"top":606.34,"left":53.8,"width":241.06398010253906,"height":6.369999885559082,"text":"tographic values, including a set of known PSKs and the"},{"top":606.34,"left":325.78,"width":230.12998962402344,"height":6.369999885559082,"text":"The attack system also seems to require knowledge of the"}],[{"top":616.8,"left":53.8,"width":203.5500030517578,"height":6.369999885559082,"text":"resulting “recovered” ESP session keys [60,61,67]."},{"top":616.8,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"PSK. Several documents describe techniques for analysts"}],[{"top":627.26,"left":62.76,"width":232.5080108642578,"height":6.369999885559082,"text":"The ESP traffic itself is buffered for up to 15 minutes [64],"},{"top":627.26,"left":316.81,"width":240.6400146484375,"height":6.369999885559082,"text":"to locate a PSK, including using a database of router con-"}],[{"top":637.72,"left":53.8,"width":240.99598693847656,"height":6.369999885559082,"text":"until CES can respond with the recovered ESP keys if they"},{"top":637.72,"left":316.81,"width":239.08999633789062,"height":6.369999885559082,"text":"figurations [70, 71], the CORALREEF database of known"}],[{"top":648.18,"left":53.47,"width":241.322998046875,"height":6.369999885559082,"text":"were generated correctly. Once keys have been returned, the"},{"top":648.18,"left":316.81,"width":239.08999633789062,"height":6.369999885559082,"text":"PSKs [60], previously decrypted SSH traffic [60], or system"}],[{"top":658.64,"left":53.8,"width":240.63597106933594,"height":6.369999885559082,"text":"ESP traffic is decrypted via hardware accelerators [59] or"},{"top":658.64,"left":316.81,"width":239.0900115966797,"height":6.369999885559082,"text":"administrator “chatter” [70]. Additionally, NSA is willing to"}],[{"top":669.1,"left":53.8,"width":240.53309631347656,"height":6.369999885559082,"text":"in software [68,69]. From this point, decrypted VPN traffic"},{"top":669.1,"left":315.5,"width":143.8599853515625,"height":6.369999885559082,"text":"“[r]un attacks to recover PSK” [60]."}],[{"top":679.56,"left":53.8,"width":240.9640350341797,"height":6.369999885559082,"text":"is reinjected into TURMOIL processing infrastructure and"},{"top":679.56,"left":325.78,"width":231.66000366210938,"height":6.369999885559082,"text":"Of course, this explanation is not dispositive. The possi-"}]]},{"extraction_method":"stream","top":54.0,"left":52.0,"width":507.0,"height":278.0,"right":559.0,"bottom":332.0,"data":[[{"top":57.4,"left":62.76,"width":231.66998291015625,"height":6.369999885559082,"text":"Classified documents published by Der Spiegel [46] indi-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":67.86,"left":53.8,"width":239.33999633789062,"height":6.369999885559082,"text":"cate that NSA is passively decrypting IPsec connections at"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":78.32,"left":53.8,"width":240.62998962402344,"height":6.369999885559082,"text":"significant scale. The documents do not describe the crypt-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":88.78,"left":53.8,"width":239.0900115966797,"height":6.369999885559082,"text":"analytic techniques used, but they do provide an overview of"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":99.24,"left":53.8,"width":239.08999633789062,"height":6.369999885559082,"text":"the attack system architecture. After reviewing how IPsec"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":109.7,"left":53.8,"width":240.6300048828125,"height":6.369999885559082,"text":"key establishment works, we will use the published informa-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":120.16,"left":53.8,"width":239.10000610351562,"height":6.369999885559082,"text":"tion to evaluate the hypothesis that the NSA is leveraging"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":130.62,"left":53.8,"width":201.39999389648438,"height":6.369999885559082,"text":"precomputation to calculate discrete logs at scale."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":143.5,"left":53.8,"width":240.62998962402344,"height":6.440007209777832,"text":"IKE Internet Key Exchange (IKE) is the main key es-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":154.03,"left":53.8,"width":239.08999633789062,"height":6.369999885559082,"text":"tablishment protocol used for IPsec VPNs. There are two"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":164.49,"left":53.56,"width":240.86997985839844,"height":6.369999885559082,"text":"versions, IKEv1 [22] and IKEv2 [25], which differ in mes-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":174.95,"left":53.8,"width":239.09999084472656,"height":6.369999885559082,"text":"sage structure but are conceptually similar. For the sake of"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":185.42,"left":53.8,"width":160.6011505126953,"height":6.369999885559082,"text":"brevity, we will use IKEv1 terminology."},{"top":187.56,"left":316.81,"width":239.0999755859375,"height":6.440007209777832,"text":"Figure 4: NSA’s VPN decryption infrastructure. This"}],[{"top":195.88,"left":62.76,"width":231.3969268798828,"height":6.369999885559082,"text":"Each IKE session begins with a Phase 1 handshake, in"},{"top":198.09,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"classified illustration published by Der Spiegel [67] shows"}],[{"top":206.34,"left":53.47,"width":240.8114013671875,"height":6.369999885559082,"text":"which the client and server select a Diffie-Hellman group"},{"top":208.55,"left":316.81,"width":240.6300048828125,"height":6.369999885559082,"text":"captured IKE handshake messages being passed to a high-"}],[{"top":216.8,"left":53.8,"width":240.6060333251953,"height":6.369999885559082,"text":"from a small set of standardized parameters and perform a"},{"top":219.01,"left":316.81,"width":239.0900115966797,"height":6.369999885559082,"text":"performance computing system, which returns the symmetric"}],[{"top":227.26,"left":53.8,"width":240.82798767089844,"height":6.369999885559082,"text":"key exchange to establish a shared secret. The shared secret"},{"top":229.47,"left":316.81,"width":239.0999755859375,"height":6.369999885559082,"text":"keys for ESP session traffic. The details of this attack are"}],[{"top":237.72,"left":53.8,"width":240.40846252441406,"height":6.369999885559082,"text":"is combined with other cleartext values transmitted by each"},{"top":239.93,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"consistent with an efficient break for 1024-bit Diffie-Hellman."}],[{"top":248.18,"left":53.8,"width":239.0900115966797,"height":6.369999885559082,"text":"side, such as nonces and cookies, to derive a value called"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":258.64,"left":53.8,"width":240.3699951171875,"height":6.369999885559082,"text":"SKEYID. IKE provides several authentication mechanisms,"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":269.1,"left":53.8,"width":241.1780242919922,"height":6.369999885559082,"text":"including symmetric pre-shared keys (PSK); when IKEv1 is"},{"top":271.52,"left":316.81,"width":239.43997192382812,"height":6.440007209777832,"text":"Evidence for a discrete log attack While the ability"}],[{"top":279.56,"left":53.8,"width":240.31993103027344,"height":6.369999885559082,"text":"authenticated with a PSK, this value is incorporated into"},{"top":282.05,"left":316.81,"width":239.35000610351562,"height":6.369999885559082,"text":"to decrypt VPN traffic does not by itself indicate a defeat"}],[{"top":290.02,"left":53.8,"width":103.78549194335938,"height":6.370017051696777,"text":"the derivation of SKEYID."},{"top":292.51,"left":316.81,"width":239.10000610351562,"height":6.369999885559082,"text":"of Diffie-Hellman, there are several features of IKE and the"}],[{"top":300.48,"left":62.76,"width":231.7674102783203,"height":6.369999885559082,"text":"The resulting SKEYID is used to encrypt and authenticate"},{"top":302.97,"left":316.47,"width":187.16000366210938,"height":6.369999885559082,"text":"VAO’s operation that support this hypothesis."}],[{"top":310.94,"left":53.8,"width":240.68592834472656,"height":6.369999885559082,"text":"a Phase 2 handshake. Phase 2 establishes the parameters"},{"top":313.44,"left":325.78,"width":231.41001892089844,"height":6.369999885559082,"text":"The IKE protocol has been extensively analyzed [9, 36],"}],[{"top":321.41,"left":53.8,"width":240.64451599121094,"height":6.369999885559082,"text":"and key material, KEYMAT, for a cryptographic transport"},{"top":323.9,"left":316.81,"width":240.6300048828125,"height":6.369999885559082,"text":"and is not believed to be exploitable in standard configu-"}]]},{"extraction_method":"stream","top":53.0,"left":62.0,"width":486.0,"height":109.0,"right":548.0,"bottom":162.0,"data":[[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":59.8,"left":281.87,"width":213.60000610351562,"height":3.5199999809265137,"text":"Vulnerable servers, if the attacker can precompute for . . ."}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":73.09,"left":237.37,"width":303.8999938964844,"height":3.5199999809265137,"text":"all 512-bit groups all 768-bit groups one 1024-bit group ten 1024-bit groups"}],[{"top":86.56,"left":68.43,"width":142.4862060546875,"height":3.5199999809265137,"text":"HTTPS Top 1M w/ active downgrade"},{"top":86.56,"left":251.55,"width":289.72998046875,"height":3.5199999809265137,"text":"45,100 (8.4%) 45,100 (8.4%) 205,000 (37.1%) 309,000 (56.1%)"}],[{"top":95.53,"left":68.43,"width":62.635047912597656,"height":3.5199999809265137,"text":"HTTPS Top 1M"},{"top":95.53,"left":262.36,"width":278.9200134277344,"height":3.5199999809265137,"text":"118 (0.0%) 407 (0.1%) 98,500 (17.9%) 132,000 (24.0%)"}],[{"top":104.5,"left":68.43,"width":141.84622192382812,"height":3.5199999809265137,"text":"HTTPS Trusted w/ active downgrade"},{"top":104.5,"left":247.31,"width":293.9599914550781,"height":3.5199999809265137,"text":"489,000 (3.4%) 556,000 (3.9%) 1,840,000 (12.8%) 3,410,000 (23.8%)"}],[{"top":113.46,"left":68.43,"width":61.64495086669922,"height":3.5199999809265137,"text":"HTTPS Trusted"},{"top":113.46,"left":255.77,"width":285.4999694824219,"height":3.5199999809265137,"text":"1,000 (0.0%) 46,700 (0.3%) 939,000 (6.56%) 1,430,000 (10.0%)"}],[{"top":128.41,"left":68.43,"width":45.73362731933594,"height":3.5199999809265137,"text":"IKEv1 IPv4"},{"top":128.41,"left":298.12,"width":243.14999389648438,"height":3.5199999809265137,"text":"– 64,700 (2.6%) 1,690,000 (66.1%) 1,690,000 (66.1%)"}],[{"top":137.37,"left":68.43,"width":45.73362731933594,"height":3.5199999809265137,"text":"IKEv2 IPv4"},{"top":137.37,"left":298.12,"width":243.16000366210938,"height":3.5199999809265137,"text":"– 66,000 (5.8%) 726,000 (63.9%) 726,000 (63.9%)"}],[{"top":152.32,"left":68.43,"width":37.42877960205078,"height":3.5199999809265137,"text":"SSH IPv4"},{"top":152.32,"left":298.12,"width":243.14999389648438,"height":3.5199999809265137,"text":"– – 3,600,000 (25.7%) 3,600,000 (25.7%)"}]]},{"extraction_method":"stream","top":174.0,"left":52.0,"width":507.0,"height":534.0,"right":559.0,"bottom":708.0,"data":[[{"top":175.6,"left":53.8,"width":243.0430145263672,"height":6.369999885559082,"text":"50.7% of SMTP servers supported STARTTLS, 41.4% sup-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":175.14,"left":316.41,"width":241.02999877929688,"height":6.429999828338623,"text":"Avoid fixed-prime 1024-bit groups. For implementa-"}],[{"top":186.06,"left":53.8,"width":241.9209442138672,"height":6.369999885559082,"text":"ported DHE, and 14.8% supported DHE_EXPORT ciphers."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":185.66,"left":316.81,"width":239.08999633789062,"height":6.369999885559082,"text":"tions that must continue to use or support 1024-bit groups"}],[{"top":196.52,"left":53.34,"width":240.39300537109375,"height":6.369999885559082,"text":"15.5% of SMTP servers used one of the ten most common"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":196.13,"left":316.81,"width":239.08998107910156,"height":6.369999885559082,"text":"for compatibility reasons, generating fresh groups may help"}],[{"top":206.98,"left":53.34,"width":67.41339111328125,"height":6.369999885559082,"text":"1024-bit groups."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":206.59,"left":316.81,"width":240.6300048828125,"height":6.369999885559082,"text":"mitigate some of the damage caused by NFS-style precom-"}],[{"top":217.44,"left":62.76,"width":231.7060089111328,"height":6.370001792907715,"text":"For IMAPS, 8.4% of servers supported DHE_EXPORT and"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":217.05,"left":316.81,"width":239.0899658203125,"height":6.369999885559082,"text":"putation for very common fixed groups. However, we note"}],[{"top":227.9,"left":53.57,"width":240.66201782226562,"height":6.370001792907715,"text":"75% supported DHE. However, the ten most common 1024-bit"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":227.51,"left":316.81,"width":239.3500213623047,"height":6.369999885559082,"text":"that it is possible to create trapdoored primes [20,44] that"}],[{"top":238.36,"left":53.8,"width":240.6601104736328,"height":6.369999885559082,"text":"primes account for only 5.4% of servers. POP3S deployment"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":237.97,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"are computationally difficult to detect. At minimum, clients"}],[{"top":248.82,"left":53.8,"width":240.5030059814453,"height":6.369999885559082,"text":"is similar, with 8.9% of servers supporting DHE_EXPORT"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":248.43,"left":316.81,"width":239.0900115966797,"height":6.369999885559082,"text":"should check that servers’ parameters use safe primes or a"}],[{"top":259.28,"left":53.8,"width":240.6302947998047,"height":6.369999885559082,"text":"and 74.9% supporting DHE, but with the ten most common"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":258.89,"left":316.57,"width":239.33001708984375,"height":6.369999885559082,"text":"verifiable generation process, such as that proposed in FIPS"}],[{"top":269.74,"left":53.34,"width":210.52999877929688,"height":6.369999885559082,"text":"1024-bit primes accounting for only 4.8% of servers."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":269.35,"left":316.35,"width":239.5500030517578,"height":6.369999885559082,"text":"186 [38]. Ideally, the process for generating and validating"}],[{"top":280.2,"left":62.76,"width":231.70301818847656,"height":6.369999885559082,"text":"If each of the top ten 1024-bit primes used by each protocol"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":279.81,"left":316.81,"width":239.3400115966797,"height":6.369999885559082,"text":"parameters in TLS should be standardized so as to thwart"}],[{"top":290.66,"left":53.47,"width":240.49398803710938,"height":6.369999885559082,"text":"were compromised, this would affect approximately 1.7M"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":290.27,"left":316.81,"width":85.67001342773438,"height":6.369999885559082,"text":"the risk of trapdoors."}],[{"top":301.12,"left":53.8,"width":241.71897888183594,"height":6.369999885559082,"text":"SMTP, 276K IMAPS, and 245K POP3S servers. Using our"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":303.4,"left":316.81,"width":239.0999755859375,"height":6.440007209777832,"text":"Don’t deliberately weaken crypto. Our downgrade"}],[{"top":311.59,"left":53.8,"width":240.3370819091797,"height":6.369999885559082,"text":"downgrade attack of §3.3, an attacker with modest resources"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":313.93,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"attack on export-grade 512-bit Diffie-Hellman groups in TLS"}],[{"top":322.05,"left":53.8,"width":240.2429962158203,"height":6.369999885559082,"text":"can hijack connections to approximately 1.6M SMTP, 429K"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":324.39,"left":316.81,"width":240.6300048828125,"height":6.369999885559082,"text":"illustrates the fragility of cryptographic “front doors”. Al-"}],[{"top":332.51,"left":53.8,"width":141.125,"height":6.369999885559082,"text":"IMAPS, and 454K POP3S servers."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":334.85,"left":316.81,"width":239.1099853515625,"height":6.369999885559082,"text":"though the key sizes originally used in DHE_EXPORT were"}],[{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":345.32,"left":316.81,"width":240.6300048828125,"height":6.369999885559082,"text":"intended to be tractable only to NSA, two decades of algo-"}],[{"top":357.98,"left":53.8,"width":148.62998962402344,"height":5.369999885559082,"text":"5. RECOMMENDATIONS"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":355.78,"left":316.81,"width":239.4300079345703,"height":6.369999885559082,"text":"rithmic and computational improvements have significantly"}],[{"top":369.94,"left":62.76,"width":232.6717987060547,"height":6.369999885559082,"text":"Our findings indicate that one of the key recommenda-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":366.24,"left":316.81,"width":239.0999755859375,"height":6.369999885559082,"text":"lowered the bar to attacks on such key sizes. Despite the"}],[{"top":380.4,"left":53.8,"width":240.32899475097656,"height":6.369999885559082,"text":"tions from security experts in response to the threat of mass"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":376.7,"left":316.81,"width":240.63998413085938,"height":6.369999885559082,"text":"eventual relaxation of crypto export restrictions and subse-"}],[{"top":390.86,"left":53.8,"width":240.40492248535156,"height":6.369999885559082,"text":"surveillance—promotion of DHE-based TLS ciphersuites"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":387.16,"left":316.81,"width":239.0999755859375,"height":6.369999885559082,"text":"quent attempts to remove support for DHE_EXPORT, the"}],[{"top":401.32,"left":53.8,"width":241.68898010253906,"height":6.369999885559082,"text":"offering “perfect forward secrecy” over RSA-based cipher-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":397.62,"left":316.81,"width":239.33999633789062,"height":6.369999885559082,"text":"technical debt induced by the additional complexity has left"}],[{"top":411.78,"left":53.8,"width":241.65296936035156,"height":6.369999885559082,"text":"suites—may have actually reduced security for many hosts."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":408.08,"left":316.81,"width":240.38002014160156,"height":6.369999885559082,"text":"implementations vulnerable for decades. Like FREAK [7],"}],[{"top":422.24,"left":53.8,"width":242.0399932861328,"height":6.369999885559082,"text":"In this section, we present concrete recommendations to re-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":418.54,"left":316.81,"width":239.0999755859375,"height":6.369999885559082,"text":"our attacks warn of the long-term debilitating effects of"}],[{"top":432.7,"left":53.8,"width":240.59742736816406,"height":6.369999885559082,"text":"cover the expected security of Diffie-Hellman as it is used in"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":429.0,"left":316.81,"width":149.82000732421875,"height":6.369999885559082,"text":"deliberately weakening cryptography."}],[{"top":443.16,"left":53.8,"width":124.83000946044922,"height":6.369999885559082,"text":"mainstream Internet protocols."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":456.69,"left":53.43,"width":242.80401611328125,"height":6.429999828338623,"text":"Transition to elliptic curves. Transitioning to ellip-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":453.41,"left":316.81,"width":193.6199951171875,"height":5.369999885559082,"text":"6. DISCLOSURE AND RESPONSE"}],[{"top":467.22,"left":53.8,"width":242.65122985839844,"height":6.369999885559082,"text":"tic curve Diffie-Hellman (ECDH) key exchange with appro-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":465.37,"left":325.78,"width":230.3800048828125,"height":6.369999885559082,"text":"We notified major client and server developers about"}],[{"top":477.68,"left":53.8,"width":240.2001190185547,"height":6.369999885559082,"text":"priate parameters avoids all known feasible cryptanalytic"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":475.83,"left":316.81,"width":239.0899658203125,"height":6.369999885559082,"text":"the vulnerabilities discussed in this paper before we made"}],[{"top":488.14,"left":53.8,"width":240.60154724121094,"height":6.369999885559082,"text":"attacks. Current elliptic curve discrete log algorithms for"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":486.29,"left":316.81,"width":240.38002014160156,"height":6.369999885559082,"text":"our findings public. Prior to our work, Internet Explorer,"}],[{"top":498.6,"left":53.8,"width":241.0244598388672,"height":6.369999885559082,"text":"strong curves do not gain as much of an advantage from"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":496.75,"left":316.81,"width":240.38002014160156,"height":6.369999885559082,"text":"Chrome, Firefox, and Opera all accepted 512-bit primes,"}],[{"top":509.06,"left":53.8,"width":240.8514862060547,"height":6.369999885559082,"text":"precomputation. In addition, ECDH keys are shorter than"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":507.21,"left":316.48,"width":239.4300079345703,"height":6.369999885559082,"text":"whereas Safari allowed groups as small as 16 bits. As a"}],[{"top":519.52,"left":53.8,"width":240.23374938964844,"height":6.369999885559082,"text":"in “mod p” Diffie-Hellman, and shared-secret computations"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":517.67,"left":316.81,"width":239.08999633789062,"height":6.369999885559082,"text":"result of our disclosures, Internet Explorer [37], Firefox, and"}],[{"top":529.98,"left":53.8,"width":241.0685272216797,"height":6.369999885559082,"text":"are faster. Unfortunately, the most widely supported ECDH"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":528.13,"left":316.81,"width":239.0999755859375,"height":6.370017051696777,"text":"Chrome are transitioning the minimum size of the DHE groups"}],[{"top":540.44,"left":53.8,"width":240.33787536621094,"height":6.369999885559082,"text":"parameters, those specified by NIST, are now viewed with"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":538.59,"left":316.81,"width":240.6300048828125,"height":6.369999885559082,"text":"they accept to 1024 bits, and OpenSSL and Safari are ex-"}],[{"top":550.9,"left":53.8,"width":240.5960235595703,"height":6.369999885559082,"text":"suspicion due to NSA influence on their design, despite no"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":549.05,"left":316.81,"width":240.37998962402344,"height":6.369999885559082,"text":"pected to follow suit. On the server side, we notified Apache,"}],[{"top":561.36,"left":53.8,"width":242.27516174316406,"height":6.369999885559082,"text":"known or suspected weaknesses. These curves are under-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":559.51,"left":316.81,"width":240.6300048828125,"height":6.369999885559082,"text":"Oracle, IBM, Cisco, and various hosting providers. Aka-"}],[{"top":571.82,"left":53.8,"width":240.85169982910156,"height":6.369999885559082,"text":"going scrutiny, and new curves, such as Curve25519, are"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":569.97,"left":316.81,"width":239.43997192382812,"height":6.369999885559082,"text":"mai has removed all support for export ciphersuites. Many"}],[{"top":582.28,"left":53.8,"width":242.58201599121094,"height":6.369999885559082,"text":"being standardized by the IRTF for use in Internet proto-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":580.43,"left":316.48,"width":239.43002319335938,"height":6.369999885559082,"text":"TLS developers plan to support a new extension that allows"}],[{"top":592.74,"left":53.8,"width":240.33872985839844,"height":6.369999885559082,"text":"cols. We recommend transitioning to elliptic curves where"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":590.89,"left":316.81,"width":239.10000610351562,"height":6.369999885559082,"text":"clients and servers to negotiate a few well-known groups of"}],[{"top":603.21,"left":53.8,"width":240.45591735839844,"height":6.369999885559082,"text":"possible; this is the most effective long-term solution to the"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":601.36,"left":316.58,"width":235.33998107910156,"height":6.369999885559082,"text":"2048-bits and higher and to gracefully reject weak ones [19]."}],[{"top":613.67,"left":53.56,"width":154.5800018310547,"height":6.369999885559082,"text":"vulnerabilities described in this paper."},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""}],[{"top":627.19,"left":53.8,"width":240.8939971923828,"height":6.440007209777832,"text":"Increase minimum key strengths. Server operators"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":625.76,"left":316.81,"width":101.95000457763672,"height":5.369999885559082,"text":"7. CONCLUSION"}],[{"top":637.72,"left":53.8,"width":241.2539825439453,"height":6.370017051696777,"text":"should disable DHE_EXPORT and configure DHE ciphersuites"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":637.72,"left":325.78,"width":230.1199951171875,"height":6.369999885559082,"text":"Diffie-Hellman key exchange is a cornerstone of applied"}],[{"top":648.18,"left":53.8,"width":240.29298400878906,"height":6.369999885559082,"text":"to use primes of 2048 bits or larger. Browsers and clients"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":648.18,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"cryptography, but we find that, as used in practice, it is often"}],[{"top":658.64,"left":53.8,"width":240.2542266845703,"height":6.369999885559082,"text":"should raise the minimum accepted size for Diffie-Hellman"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":658.64,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"less secure than widely believed. The problems stem from"}],[{"top":669.1,"left":53.8,"width":241.70628356933594,"height":6.369999885559082,"text":"groups to at least 1024 bits in order to avoid downgrade at-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":669.1,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"the fact that the number field sieve for discrete log allows an"}],[{"top":679.56,"left":53.8,"width":240.6800079345703,"height":6.369999885559082,"text":"tacks when communicating with servers that still use smaller"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":679.56,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"attacker to perform a single precomputation that depends"}],[{"top":690.02,"left":53.8,"width":241.9910125732422,"height":6.369999885559082,"text":"groups. Primes of less than 1024 bits should not be con-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":690.02,"left":316.81,"width":239.1000213623047,"height":6.369999885559082,"text":"only on the group, after which computing individual logs in"}],[{"top":700.48,"left":53.8,"width":241.73399353027344,"height":6.369999885559082,"text":"sidered secure, even against an attacker with moderate re-"},{"top":0.0,"left":0.0,"width":0.0,"height":0.0,"text":""},{"top":700.48,"left":316.81,"width":239.08998107910156,"height":6.369999885559082,"text":"that group has a far lower cost. Although this fact is well"}]]}]