[Paper Review] The problem of popular primes: Logjam

Wouter Bokslag|arXiv (Cornell University)|Feb 7, 2016

Analytic Number Theory Research3 references3 citations

TL;DR

This paper analyzes the Logjam attack, a critical vulnerability in TLS that exploits weak Diffie-Hellman parameters to enable man-in-the-middle decryption. By tricking clients and servers into using 512-bit export-grade primes, attackers can precompute discrete logarithms and break key exchanges, undermining TLS security—especially against nation-state adversaries.

ABSTRACT

This paper will discuss the Logjam attack on TLS. The Logjam attack allows, under certain conditions, to defeat the security provided by TLS. This is done by manipulating server and client into using weak and deprecated export grade crypto, and subsequently breaking the Diffie-Hellman key exchange. We explore how the attack works conceptually and how exactly TLS is vulnerable to this attack. Also, the conditions under which the attack can be mounted are discussed, and an estimate of the impact of the attack is presented. Lastly, several mitigations are presented.

Motivation & Objective

• To analyze the Logjam attack's mechanism in exploiting weak Diffie-Hellman parameters in TLS.
• To identify the conditions under which the attack is feasible, particularly the use of commonly shared primes.
• To evaluate the real-world impact of the attack, especially for 1024-bit and 512-bit primes.
• To propose and evaluate server- and client-side countermeasures to mitigate the vulnerability.
• To advocate for the adoption of stronger key exchange mechanisms like ECDHE to prevent future exploitation.

Proposed method

• Analyzes the structure of the TLS 1.2 handshake, focusing on the ServerKeyExchange message and cipher suite negotiation.
• Explains how the Logjam attack manipulates the client and server into using export-grade DHE cipher suites with 512-bit primes.
• Describes the use of the number field sieve (NFS) algorithm to precompute discrete logarithms for commonly used primes.
• Demonstrates that precomputation for a single 1024-bit prime can be reused across multiple servers, increasing the attacker's efficiency.
• Proposes client-side checks to enforce minimum prime size (e.g., >2048 bits) and reduce handshake timeout to limit attack window.
• Recommends server-side migration to ECDHE or random, periodically regenerated DHE parameters to prevent precomputation gains.

Experimental results

Research questions

• RQ1 How does the Logjam attack exploit the TLS handshake to downgrade to weak 512-bit Diffie-Hellman parameters?
• RQ2 What is the computational feasibility of precomputing discrete logarithms for commonly used 1024-bit primes in real-world deployments?
• RQ3 To what extent do widely shared primes increase the risk of mass surveillance by nation-state actors?
• RQ4 What client- and server-side countermeasures can effectively prevent or limit the impact of the Logjam attack?
• RQ5 How does the transition to ECDHE or dynamic prime generation reduce the long-term risk of precomputation attacks?

Key findings

• The Logjam attack can be mounted against TLS 1.0, 1.1, and 1.2 when servers use weak, commonly shared 1024-bit or 512-bit primes.
• Precomputation for a single 1024-bit prime can be reused to break connections to multiple servers, significantly increasing the attacker’s return on investment.
• Approximately 6.8% of servers use insecure primes where (p−1)/2 is composite and potentially factorable, increasing vulnerability to discrete logarithm attacks.
• The attack is feasible against 1024-bit primes with nation-state level resources, but 2048-bit primes remain secure against current precomputation capabilities.
• Client-side measures such as enforcing minimum prime size and reducing handshake timeouts can limit the attack window and increase detection probability.
• Migrating to ECDHE or using dynamically generated, periodically refreshed DHE parameters can effectively neutralize the precomputation advantage of attackers.