Logjam TLS attack

#1

Post by noondip » Wed, May 20, 2015, 2:51 AM UTC

Logjam TLS attack
weakdh.org

Re: Logjam TLS attack

#2

Post by jvehent » Wed, May 20, 2015, 3:08 AM UTC

Use a proper ciphersuite and stop worrying about downgrade attacks. https://wiki.mozilla.org/Security/Server_Side_TLS

Re: Logjam TLS attack

#3

Post by agl » Wed, May 20, 2015, 3:17 AM UTC

Chrome will be increasing it's minimum DH group size to 1024 bits: https://groups.google.com/a/chromium.org/forum/#!topic/secur...

But, if you need to spend the time updating a server configuration, just switch to ECDHE instead.

Re: Logjam TLS attack

#4

Post by 0x0 » Wed, May 20, 2015, 3:32 AM UTC

Why are export grade ciphers even still a thing. I can't believe that libraries are still shipped with implementations for those.

Also, scary that SSH appears to be partially affected(?)

Re: Logjam TLS attack

#5

Post by pbsd » Wed, May 20, 2015, 3:35 AM UTC

This is not at all surprising; even I had pointed out the looming DH problem in an earlier thread: https://news.ycombinator.com/item?id=8810316

One small nit with the paper: it is claimed that there had been technical difficulties with the individual logarithm step of the NFS applied to discrete logarithms, making individual logs asymptotically as expensive as the precomputation. Commeine and Semaev [1] deserve the credit for breaking this barrier; Barbulescu did improve their L[1/3, 1.44] to L[1/3, 1.232] by using smarter early-abort strategies, but was not the first to come up with 'cheap' individual logs.

[1] http://link.springer.com/chapter/10.1007%2F11745853_12

Re: Logjam TLS attack

#6

Post by methou » Wed, May 20, 2015, 3:36 AM UTC

I'm using Version 42.0.2311.152 (64-bit) Chrome, so far it's still vulnerable to this. I believe it's the latest production version.

Re: Logjam TLS attack

#7

Post by buu700 » Wed, May 20, 2015, 3:41 AM UTC

methou wrote: post #6

I'm using Version 42.0.2311.152 (64-bit) Chrome, so far it's still vulnerable to this. I believe it's the latest production version.

I'm running Version 43.0.2357.65 (64-bit) Chrome, which is also vulnerable to this. I believe it's the latest production version.

Re: Logjam TLS attack

#8

Post by nodesocket » Wed, May 20, 2015, 3:45 AM UTC

buu700 wrote: post #7

methou wrote: post #6

I'm using Version 42.0.2311.152 (64-bit) Chrome, so far it's still vulnerable to this. I believe it's the latest production version.

I'm running Version 43.0.2357.65 (64-bit) Chrome, which is also vulnerable to this. I believe it's the latest production version.

43.0.2357.65 (64-bit) as well (latest), says is vulnerable.

Re: Logjam TLS attack

#9

Post by 0x0 » Wed, May 20, 2015, 3:48 AM UTC

jvehent wrote: post #2

Use a proper ciphersuite and stop worrying about downgrade attacks. https://wiki.mozilla.org/Security/Server_Side_TLS

Looks like it's not enough just to set a proper ciphersuite, it's also important to reconfigure the dhparams (which apparently isn't even possible in most common apache versions). Interestingly, Dovecot seems to have had the foresight to automatically regenerate dhparams weekly by default.

Re: Logjam TLS attack

#10

Post by yeukhon » Wed, May 20, 2015, 3:49 AM UTC

For Nginx I think you can simply do !EXPORT to not support *EXPORT. There was a similar security bug which advised users to disable some EXPORT ciphers... correct me if I am wrong.