Logjam (computer security): Difference between revisions

Revision as of 23:14, 6 December 2023

Latest revision as of 06:30, 11 March 2025

(3 intermediate revisions by 3 users not shown)

Line 1:

{{Short description|Security vulnerability in Diffie–Hellman key exchange}}

'''Logjam''' is a [[Vulnerability (computing)|security vulnerability]] in systems that use [[Diffie–Hellman key exchange]] with the same prime number. It was discovered by a team of computer scientists and publicly reported on May 20, 2015.<ref name="paper">{{cite web |url=https://weakdh.org |title=The Logjam Attack |website=weakdh.org |date=2015-05-20 |access-date=2015-05-20 |archive-date=2021-03-29 |archive-url=https://web.archive.org/web/20210329172612/https://weakdh.org/ |url-status=live }}</ref> The discoverers were able to demonstrate their attack on 512-bit ([[export of cryptography from the United States|US export-grade]]) DH systems. They estimated that a state-level attacker could do so for 1024-bit systems, then widely used, thereby allowing decryption of a significant fraction of Internet traffic. They recommended upgrading to at least 2048 bits for shared prime systems.<ref>{{cite web |url=https://arstechnica.com/security/2015/05/https-crippling-attack-threatens-tens-of-thousands-of-web-and-mail-servers/ |title=HTTPS-crippling attack threatens tens of thousands of Web and mail servers |author=Dan Goodin |website=[[Ars Technica]] |date=2015-05-20 |access-date=2022-04-30 |archive-date=2017-05-19 |archive-url=https://web.archive.org/web/20170519130937/https://arstechnica.com/security/2015/05/https-crippling-attack-threatens-tens-of-thousands-of-web-and-mail-servers/ |url-status=live }}</ref><ref>{{cite news |url=httphttps://www.zdnet.com/article/logjam-security-flaw-leaves-tens-of-thousands-of-https-websites-vulnerable/ |title=Logjam security flaw leaves top HTTPS websites, mail servers vulnerable |author=Charlie Osborne |work=[[ZDNet]] |date=2015-05-20 |access-date=2015-05-23 |archive-date=2015-05-23 |archive-url=https://web.archive.org/web/20150523004129/http://www.zdnet.com/article/logjam-security-flaw-leaves-tens-of-thousands-of-https-websites-vulnerable/ |url-status=live }}</ref><ref>{{cite news|url=https://www.wsj.com/articles/new-computer-bug-exposes-broad-security-flaws-1432076565|title=New Computer Bug Exposes Broad Security Flaws|work=The Wall Street Journal|first=Jennifer|last=Valentino-DeVries|date=2015-05-19|url-access=subscription|access-date=2022-04-30|archive-date=2022-02-24|archive-url=https://web.archive.org/web/20220224011050/https://www.wsj.com/articles/new-computer-bug-exposes-broad-security-flaws-1432076565|url-status=live}}</ref>

==Details==

Line 18:

"The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the 'Logjam' issue."</ref>

The authors also estimated the feasibility of the attack against 1024-bit Diffie–Hellman primes. By design, many Diffie–Hellman implementations use the same pre-generated [[prime number|prime]] for their field. This was considered secure, since the [[discrete loglogarithm problem]] is still considered hard for big enough primes even if the group is known and reused. The researchers calculated the cost of creating logjam precomputation for one 1024-bit prime at hundreds of millions of USD, and noted that this was well within range of the FY2012 $10.5 billion [[U.S. Consolidated Cryptologic Program]] (which includes [[NSA]]). Because of the reuse of primes, generating precomputation for just one prime would break two-thirds of [[VPN]]s and a quarter of all [[Secure Shell|SSH]] servers globally. The researchers noted that this attack fits claims in leaked NSA papers that NSA is able to break much current cryptography. They recommend using primes of 2048 bits or more as a defense or switching to [[elliptic-curve Diffie–Hellman]] (ECDH).<ref name="paper" />

Claims on the practical implications of the attack were however disputed by security researchers Eyal Ronen and [[Adi Shamir]] in their paper "Critical Review of Imperfect Forward Secrecy".<ref>{{Cite web | url=http://www.wisdom.weizmann.ac.il/~eyalro/RonenShamirDhReview.pdf | first1=Eyal | last1=Ronen | first2=Adi | last2=Shamir | title=Critical Review of Imperfect Forward Secrecy | date=October 2015 | journal= | access-date=2022-04-30 | archive-date=2021-12-11 | archive-url=https://web.archive.org/web/20211211100114/https://www.wisdom.weizmann.ac.il/~eyalro/RonenShamirDhReview.pdf | url-status=live }}</ref>

== Test tools ==

* [[Transport Layer Security|TLS]]-based services such as web servers offering [[HTTPS]] can be checked for the vulnerability using scanners such as [https://github.com/nabla-c0d3/sslyze SSLyze], the [https://ssllabs.com/ssltest/ Qualys SSL server test], [https://www.immuniweb.com/ssl/ ImmuniWeb SSL Security Test], [https://www.ssltrust.com/ssl-tools/website-security-check SSLTrust], [https://tls.imirhil.fr CryptCheck], [https://www.cyphercraft.io CypherCraft], [https://github.com/drwetter/testssl.sh testssl.sh] or the [https://tools.keycdn.com/logjam keycdn.com scanner].

* [[SSH]] servers can be tested using the [https://github.com/jtesta/ssh-audit ssh-audit] or [https://github.com/GDSSecurity/SSH-Weak-DH SSH-Weak-DH] tools.

== Responses ==

Line 75 ⟶ 70:

* [[POODLE]]

* [[Server-Gated Cryptography]]

* [[TWIRL]]

== References ==