中文

Glossary

Logjam (CVE-2015-4000)

Last verified

Definition

Logjam is a 2015 attack (CVE-2015-4000) that downgrades TLS to 512-bit export-grade Diffie-Hellman and exposes servers using small or widely shared DH groups.

Logjam was published in May 2015 by a team of academic researchers in the paper "Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice". It has two parts. First, a man-in-the-middle can trick a client into accepting 512-bit DHE_EXPORT parameters from a server that still supports export cipher suites, because in TLS 1.2 and earlier the server's signature does not cover the chosen cipher suite. Second, breaking finite-field Diffie-Hellman involves a large one-time precomputation per prime, after which individual connections fall quickly; because many servers shared the same few primes, 512-bit groups were practical to break, and the paper argued that 1024-bit groups were within reach of nation-state attackers.

Why it matters

Logjam showed that Diffie-Hellman security depends on group size and that widely shared small groups are attractive targets. The mitigations are to disable all export cipher suites, prefer ECDHE, and, if finite-field DHE is required, use DH parameters of at least 2048 bits, such as the standardized ffdhe groups of RFC 7919. Browsers also raised the minimum DH size they accept. TLS 1.3 negotiates only named groups and has no export cryptography, so it is not affected.

Example

openssl s_client -connect example.com:443 -servername example.com -tls1_2 -cipher 'EDH' </dev/null 2>/dev/null \
  | grep -i 'Server Temp Key'
# Server Temp Key: DH, 2048 bits   (a failed handshake, meaning no DHE at all, is also fine)

ssl_dhparam /etc/nginx/ffdhe2048.pem;   # only matters if DHE suites are enabled

Common misconceptions

  • Every server must generate its own unique DH prime. A vetted standard group of 2048 bits or more, such as ffdhe2048, is fine; the danger was small groups, not shared ones of adequate size.
  • Logjam only matters for servers offering export ciphers. The precomputation risk applies to any server still using 1024-bit or smaller DH groups.
  • Logjam affects ECDHE. It targets finite-field Diffie-Hellman; ECDHE with standard curves is the recommended replacement.

See also