{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T04:31:27Z","timestamp":1750221087679,"version":"3.41.0"},"reference-count":25,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2018,12,19]],"date-time":"2018-12-19T00:00:00Z","timestamp":1545177600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Commun. ACM"],"published-print":{"date-parts":[[2018,12,19]]},"abstract":"<jats:p>We investigate the security of Diffie-Hellman key exchange as used in popular Internet protocols and find it to be less secure than widely believed. First, we present Logjam, a novel flaw in TLS that lets a man-in-the-middle downgrade connections to \"export-grade\" Diffie-Hellman. To carry out this attack, we implement the number field sieve discrete logarithm algorithm. After a week-long precomputation for a specified 512-bit group, we can compute arbitrary discrete logarithms in that group in about a minute. We find that 82% of vulnerable servers use a single 512-bit group, and that 8.4% of Alexa Top Million HTTPS sites are vulnerable to the attack. In response, major browsers have changed to reject short groups.<\/jats:p>\n          <jats:p>We go on to consider Diffie-Hellman with 768- and 1024-bit groups. We estimate that even in the 1024-bit case, the computations are plausible given nation-state resources. A small number of fixed or standardized groups are used by millions of servers; performing precomputation for a single 1024-bit group would allow passive eavesdropping on 18% of popular HTTPS sites, and a second group would allow decryption of traffic to 66% of IPsec VPNs and 26% of SSH servers. A close reading of published NSA leaks shows that the agency's attacks on VPNs are consistent with having achieved such a break. We conclude that moving to stronger key exchange methods should be a priority for the Internet community.<\/jats:p>","DOI":"10.1145\/3292035","type":"journal-article","created":{"date-parts":[[2018,12,20]],"date-time":"2018-12-20T13:35:46Z","timestamp":1545312946000},"page":"106-114","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":7,"title":["Imperfect forward secrecy"],"prefix":"10.1145","volume":"62","author":[{"given":"David","family":"Adrian","sequence":"first","affiliation":[{"name":"University of Michigan, Ann Arbor, MI"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Karthikeyan","family":"Bhargavan","sequence":"additional","affiliation":[{"name":"INRIA Paris-Rocquencourt, Paris, France"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zakir","family":"Durumeric","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Pierrick","family":"Gaudry","sequence":"additional","affiliation":[{"name":"INRIA Nancy-Grand Est, CNRS, and Universit\u00e9 de Lorraine, France"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Matthew","family":"Green","sequence":"additional","affiliation":[{"name":"Johns Hopkins University, Baltimore, MD"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"J. Alex","family":"Halderman","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Nadia","family":"Heninger","sequence":"additional","affiliation":[{"name":"University of Pennsylvania, Philadelphia, PA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Drew","family":"Springall","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Emmanuel","family":"Thom\u00e9","sequence":"additional","affiliation":[{"name":"INRIA Nancy-Grand Est, CNRS, and Universit\u00e9 de Lorraine, France"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Luke","family":"Valenta","sequence":"additional","affiliation":[{"name":"University of Pennsylvania, Philadelphia, PA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Benjamin","family":"VanderSloot","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Eric","family":"Wustrow","sequence":"additional","affiliation":[{"name":"University of Michigan, Ann Arbor, MI"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Santiago","family":"Zanella-B\u00e9guelin","sequence":"additional","affiliation":[{"name":"Microsoft Research, Cambridge, England"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Paul","family":"Zimmermann","sequence":"additional","affiliation":[{"name":"INRIA Nancy-Grand Est, CNRS, and Universit\u00e9 de Lorraine, France"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2018,12,19]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.39"},{"key":"e_1_2_1_2_1","volume-title":"New record for discrete logarithm in a prime finite field of 180 decimal digits","author":"Bouvier C.","year":"2014","unstructured":"Bouvier , C. , Gaudry , P. , Imbert , L. , Jeljeli , H. , Thom\u00e9 , E. New record for discrete logarithm in a prime finite field of 180 decimal digits , 2014 . http:\/\/caramel.loria.fr\/p180.txt. Bouvier, C., Gaudry, P., Imbert, L., Jeljeli, H., Thom\u00e9, E. New record for discrete logarithm in a prime finite field of 180 decimal digits, 2014. http:\/\/caramel.loria.fr\/p180.txt."},{"key":"e_1_2_1_3_1","volume-title":"Crypto","author":"Canetti R.","year":"2002","unstructured":"Canetti , R. , Krawczyk , H. Security analysis of IKE's signature-based key-exchange protocol . In Crypto ( 2002 ). Canetti, R., Krawczyk, H. Security analysis of IKE's signature-based key-exchange protocol. In Crypto (2002)."},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.2307\/2153413"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.1976.1055638"},{"key":"e_1_2_1_6_1","volume-title":"Usenix Security","author":"Durumeric Z.","year":"2013","unstructured":"Durumeric , Z. , Wustrow , E. , Halderman , J.A. ZMap: Fast Internet-wide scanning and its security applications . In Usenix Security ( 2013 ). Durumeric, Z., Wustrow, E., Halderman, J.A. ZMap: Fast Internet-wide scanning and its security applications. In Usenix Security (2013)."},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/ITCC.2005.173"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-72540-4_27"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1137\/0406010"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.17487\/RFC2409"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1090\/S0025-5718-02-01482-5"},{"key":"e_1_2_1_12_1","volume-title":"H., Timofeev, A., Zimmermann, P. Factorization of a 768-bit RSA modulus. In Crypto","author":"Kleinjung T.","year":"2010","unstructured":"Kleinjung , T. , Aoki , K. , Franke , J. , Lenstra , A.K. , Thom\u00e9 , E. , Bos , J.W. , Gaudry , P. , Kruppa , A. , Montgomery , P.L. , Osvik , D.A. , te Riele , H., Timofeev, A., Zimmermann, P. Factorization of a 768-bit RSA modulus. In Crypto ( 2010 ). Kleinjung, T., Aoki, K., Franke, J., Lenstra, A.K., Thom\u00e9, E., Bos, J.W., Gaudry, P., Kruppa, A., Montgomery, P.L., Osvik, D.A., te Riele, H., Timofeev, A., Zimmermann, P. Factorization of a 768-bit RSA modulus. In Crypto (2010)."},{"key":"e_1_2_1_13_1","volume-title":"EUROCRYPT","author":"Kleinjung T.","year":"2017","unstructured":"Kleinjung , T. , Diem , C. , Lenstra , A.K. , Priplata , C. , Stahlke , C. Computation of a 768-bit prime field discrete logarithm . In EUROCRYPT ( 2017 ). Kleinjung, T., Diem, C., Lenstra, A.K., Priplata, C., Stahlke, C. Computation of a 768-bit prime field discrete logarithm. In EUROCRYPT (2017)."},{"key":"e_1_2_1_14_1","volume-title":"Jefferies","author":"Lipacis M.","year":"2012","unstructured":"Lipacis , M. Semiconductors : Moore stress = structural industry shift. Technical report , Jefferies , 2012 . Lipacis, M. Semiconductors: Moore stress = structural industry shift. Technical report, Jefferies, 2012."},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.21236\/ADA465466"},{"key":"e_1_2_1_16_1","volume-title":"August","author":"National Security Agency.","year":"2015","unstructured":"National Security Agency. Cryptography today , August 2015 . https:\/\/web.archive.org\/web\/20150905185709\/https:\/\/www.nsa.gov\/ia\/programs\/suiteb_cryptography\/. National Security Agency. Cryptography today, August 2015. https:\/\/web.archive.org\/web\/20150905185709\/https:\/\/www.nsa.gov\/ia\/programs\/suiteb_cryptography\/."},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.17487\/RFC2412"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.5555\/1120060.1712353"},{"key":"e_1_2_1_19_1","unstructured":"The CADO-NFS Development Team. CADO-NFS an implementation of the number field sieve algorithm. http:\/\/cado-nfs.gforge.inria.fr\/ 2017. Release 2.3.0.  The CADO-NFS Development Team. CADO-NFS an implementation of the number field sieve algorithm. http:\/\/cado-nfs.gforge.inria.fr\/ 2017. Release 2.3.0."},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1006\/jsco.2002.0533"},{"key":"e_1_2_1_21_1","unstructured":"Fielded capability: End-to-end VPN SPIN 9 design review. Media leak. http:\/\/www.spiegel.de\/media\/media-35529.pdf.  Fielded capability: End-to-end VPN SPIN 9 design review. Media leak. http:\/\/www.spiegel.de\/media\/media-35529.pdf."},{"key":"e_1_2_1_22_1","unstructured":"FY 2013 congressional budget justification. Media leak. https:\/\/cryptome.org\/2013\/08\/spy-budget-fy13.pdf.  FY 2013 congressional budget justification. Media leak. https:\/\/cryptome.org\/2013\/08\/spy-budget-fy13.pdf."},{"key":"e_1_2_1_23_1","volume-title":"Sept.","author":"Intro","year":"2010","unstructured":"Intro to the VPN exploitation process. Media leak , Sept. 2010 . http:\/\/www.spiegel.de\/media\/media-35515.pdf. Intro to the VPN exploitation process. Media leak, Sept. 2010. http:\/\/www.spiegel.de\/media\/media-35515.pdf."},{"key":"e_1_2_1_24_1","unstructured":"SPIN 15 VPN story. Media leak. http:\/\/www.spiegel.de\/media\/media-35522.pdf.  SPIN 15 VPN story. Media leak. http:\/\/www.spiegel.de\/media\/media-35522.pdf."},{"volume-title":"Oct.","year":"2009","key":"e_1_2_1_25_1","unstructured":"TURMOIL VPN processing. Media leak , Oct. 2009 . http:\/\/www.spiegel.de\/media\/media-35526.pdf. TURMOIL VPN processing. Media leak, Oct. 2009. http:\/\/www.spiegel.de\/media\/media-35526.pdf."}],"container-title":["Communications of the ACM"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3292035","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3292035","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T00:57:51Z","timestamp":1750208271000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3292035"}},"subtitle":["how Diffie-Hellman fails in practice"],"short-title":[],"issued":{"date-parts":[[2018,12,19]]},"references-count":25,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2018,12,19]]}},"alternative-id":["10.1145\/3292035"],"URL":"https:\/\/doi.org\/10.1145\/3292035","relation":{},"ISSN":["0001-0782","1557-7317"],"issn-type":[{"type":"print","value":"0001-0782"},{"type":"electronic","value":"1557-7317"}],"subject":[],"published":{"date-parts":[[2018,12,19]]},"assertion":[{"value":"2018-12-19","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}