# What Is Logjam (CVE-2015-4000)? Definition and Examples

> Logjam is a 2015 attack (CVE-2015-4000) that downgrades TLS to 512-bit export-grade Diffie-Hellman and exposes servers using small or widely shared DH groups.

Source: https://ssl.sh/glossary/logjam/
Last updated: 2026-11-10

Logjam was published in May 2015 by a team of academic researchers in the paper "Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice". It has two parts. First, a man-in-the-middle can trick a client into accepting 512-bit DHE_EXPORT parameters from a server that still supports export cipher suites, because in TLS 1.2 and earlier the server's signature does not cover the chosen cipher suite. Second, breaking finite-field Diffie-Hellman involves a large one-time precomputation per prime, after which individual connections fall quickly; because many servers shared the same few primes, 512-bit groups were practical to break, and the paper argued that 1024-bit groups were within reach of nation-state attackers.

## Why it matters
Logjam showed that [Diffie-Hellman](https://ssl.sh/glossary/diffie-hellman/) security depends on group size and that widely shared small groups are attractive targets. The mitigations are to disable all export cipher suites, prefer [ECDHE](https://ssl.sh/glossary/ecdhe/), and, if finite-field DHE is required, use [DH parameters](https://ssl.sh/glossary/dh-parameters/) of at least 2048 bits, such as the standardized ffdhe groups of RFC 7919. Browsers also raised the minimum DH size they accept. TLS 1.3 negotiates only named groups and has no export cryptography, so it is not affected.

## Example
```bash
openssl s_client -connect example.com:443 -servername example.com -tls1_2 -cipher 'EDH' </dev/null 2>/dev/null \
  | grep -i 'Server Temp Key'
# Server Temp Key: DH, 2048 bits   (a failed handshake, meaning no DHE at all, is also fine)
```

```nginx
ssl_dhparam /etc/nginx/ffdhe2048.pem;   # only matters if DHE suites are enabled
```

## Common misconceptions
- **Every server must generate its own unique DH prime.** A vetted standard group of 2048 bits or more, such as ffdhe2048, is fine; the danger was small groups, not shared ones of adequate size.
- **Logjam only matters for servers offering export ciphers.** The precomputation risk applies to any server still using 1024-bit or smaller DH groups.
- **Logjam affects ECDHE.** It targets finite-field Diffie-Hellman; ECDHE with standard curves is the recommended replacement.

## Related terms

- [Diffie-Hellman](https://ssl.sh/zh/glossary/diffie-hellman/): Diffie-Hellman 是 1976 年提出的密钥协商方法，让通信双方在公开信道上各自算出相同的共享秘密，而无需传输这个秘密本身。
- [DH 参数](https://ssl.sh/zh/glossary/dh-parameters/): DH 参数是定义有限域 Diffie-Hellman 群的大素数模数和生成元，TLS 服务器要提供 DHE 密码套件就必须配置它。
- [ECDHE](https://ssl.sh/zh/glossary/ecdhe/): ECDHE 是椭圆曲线上的临时 Diffie-Hellman 密钥交换，TLS 双方每次握手都生成新的椭圆曲线密钥对，并据此协商出共享密钥。
- [FREAK](https://ssl.sh/zh/glossary/freak/): FREAK 是 2015 年公布的攻击，中间人诱使有漏洞的 TLS 客户端接受可被分解的 512 位出口级 RSA 密钥，从而解密和篡改流量。
- [降级攻击](https://ssl.sh/zh/glossary/downgrade-attack/): 降级攻击是指攻击者迫使客户端和服务器协商出比双方实际支持的更旧的协议版本或更弱的算法，从而利用其中的弱点。
- [前向保密](https://ssl.sh/zh/glossary/forward-secrecy/): 前向保密是密钥交换的一种安全属性：即使服务器的长期私钥日后泄露，过去连接的会话密钥也不会因此暴露。