Diffie-Hellman Downgrade Attack (Export-Grade - Weak Group Negotiation)
- •
What it is
- •
A real-world attack class (famously demonstrated as "Logjam" against TLS) against protocols that negotiate which Diffie-Hellman parameter strength to use, supporting legacy "export-grade" weak options (e.g. tiny prime bit-lengths) alongside strong modern ones for backward compatibility. An active man-in-the-middle who can tamper with the negotiation step simply forces both sides down to the weakest mutually-supported option — after which the "hard" discrete logarithm problem is only hard relative to that tiny group, and can often be solved directly and quickly, breaking the "secure" channel that follows.
- •
- •
When to apply
- •
A protocol advertises a list of supported parameter-strength options during setup (rather than using one fixed, strong, pre-agreed group) and an active MITM position lets you tamper with that negotiation.
- •
- •
Math
- •
No special formula — once downgraded to a small enough prime (e.g. 64-bit), the discrete log problem becomes directly solvable via generic algorithms (baby-step giant-step, Pohlig-Hellman if is smooth), recovering either party's private exponent outright.
- •
- •
Worked example
- •
Intercepting Alice's advertised supported options (
["DH1536", "DH1024", "DH512", "DH256", "DH128", "DH64"]) and forwarding only"DH64"to Bob forces a 64-bit prime for the whole exchange — small enough that Sage'sdiscrete_log()recovers either party's private exponent directly, letting the shared secret (and hence the derived AES key) be computed normally from there.
- •
- •
SageMath
- •
F = GF(p) # p is now tiny after the downgrade b = discrete_log(F(B), F(g)) # feasible directly once p is small enough shared_secret = pow(A, b, p)
- •
- •
- •
Cards
- •
What real-world TLS vulnerability does this attack class correspond to?
- •
Logjam — forcing a TLS connection down to legacy "export-grade" (512-bit-class) Diffie-Hellman parameters.
- •
- •
Why does supporting a list of negotiable parameter strengths create a vulnerability, even if the strong options remain available?
- •
An active MITM can simply force the negotiation down to the weakest mutually-supported option, since both parties only see what the attacker chooses to forward.
- •
- •