Cryptology ePrint Archive: Report 2016/999

Indiscreet Logs: Persistent Diffie-Hellman Backdoors in TLS

Kristen Dorey and Nicholas Chang-Fong and Aleksander Essex

Abstract: Software implementations of discrete logarithm based cryptosystems over finite fields typically make the assumption that any domain parameters they are presented with are trustworthy, i.e., the parameters implement cyclic groups where the discrete logarithm problem is assumed to be hard. An informal and widespread justification for this seemingly exists that says validating parameters at run time is too computationally expensive relative to the perceived risk of a server sabotaging the privacy of its own connection. In this paper we explore this trust assumption and examine situations where it may not always be justified.

We conducted an investigation of discrete logarithm domain parameters in use across the Internet and discovered evidence of a multitude of potentially backdoored moduli of unknown order in TLS and STARTTLS spanning numerous countries, organizations, and protocols. Although our disclosures resulted in a number of organizations taking down suspicious parameters, we argue the potential for TLS backdoors is systematic and will persist until either until better parameter hygiene is taken up by the community, or finite field based cryptography is eliminated altogether.

Category / Keywords: public-key cryptography / discrete logarithm problem, diffie-hellman, small subgroup attack

Date: received 17 Oct 2016, last revised 17 Oct 2016

Contact author: aessex at uwo ca

Available format(s): PDF | BibTeX Citation

Version: 20161020:181518 (All versions of this report)

Short URL: ia.cr/2016/999

Discussion forum: Show discussion | Start new discussion