C3Subtitles: 32c3: Logjam: Diffie-Hellman, discrete logs, the NSA, and you
back

Logjam: Diffie-Hellman, discrete logs, the NSA, and you

If you suspend your transcription on amara.org, please add a timestamp below to indicate how far you progressed! This will help others to resume your work!

Please do not press “publish” on amara.org to save your progress, use “save draft” instead. Only press “publish” when you're done with quality control.

Video duration
01:01:43
Language
English
Abstract
Earlier this year, we discovered that Diffie-Hellman key
exchange – cornerstone of modern cryptography – is less
secure in practice than the security community believed. In this
talk, we’ll explain how the NSA is likely exploiting this weakness to
allow it to decrypt connections to at least 20% of HTTPS websites, 25% of SSH servers, and 66% of IPsec VPNs.

Unlike the NSA, most of us don’t have a billion-dollar budget, but thanks to 1990s-era U.S. crypto backdoors, even attackers with much more modest resources can break the crypto for a sizable fraction of web sites. We’ll explain these flaws and how to defend yourself, and we’ll demonstrate how you too can experiment with Diffie-Hellman cryptanalysis from the comfort of your local hacker space.

Diffie-Hellman key exchange lets two parties negotiate a shared secret key in the presence of an eavesdropper who can see every message they exchange. This bit of cryptographic magic underlies the security of the Internet, from TLS to SSH, IPsec, Tor, OTR, and beyond.
Diffie-Hellman is widely believed to offer „perfect forward secrecy“ – after you’re done communicating, you can „forget" your
secret key and not even the NSA can later reconstruct it. In recent
years, this property led to the security community (us included!)
promoting Diffie-Hellman over other crypto techniques as a defense
against mass surveillance.

We were wrong. We’re really sorry.

In this talk, we’ll explain how a confluence of number theory, lazy
implementations, and aging protocols has created a world where anyone willing to spend a few hundred million dollars is likely able to
passively decrypt a huge fraction of Internet traffic. We’ll then go
back for a close reading of the Snowden documents that were published at 31C3 and show how such a cryptanalytic exploit lines up exactly with several of the NSA’s most powerful known decryption capabilities.

For those who prefer a more hands-on approach, we’ll tell you how you too can experiment with breaking Diffie-Hellman for the „export-grade“ 512-bit key sizes that were mandated in the 1990s by U.S. crypto regulations. About 8% of popular HTTPS sites still support these weakened keys for use with legacy browsers, but we discovered a TLS protocol flaw, which we named the Logjam attack, that allowed a man-in-the-middle to trick all modern browsers into accepting them.
We’re pretty sure your browser has shipped a security update to fix
this by now...

We’ll conclude the talk by discussing what went wrong with
communication between mathematical cryptographers and security
practitioners, how we can prevent this from happening again, and what flavors of cryptography you should really be using to defend yourself.
(Hint: It starts with „elliptic“ and ends with „curve“.)

Talk ID
7288
Event:
32c3
Day
2
Room
Hall 1
Start
9:45 p.m.
Duration
01:00:00
Track
Security
Type of
lecture
Speaker
Nadia Heninger
J. Alex Halderman

Talk & Speaker speed statistics

Very rough underestimation:
147.5 wpm
841.6 spm
While speaker(s) speak(s):
148.5 wpm
850.8 spm
142.2 wpm
821.8 spm
155.9 wpm
884.3 spm
100.0% Checking done100.0%
0.0% Syncing done0.0%
0.0% Transcribing done0.0%
0.0% Nothing done yet0.0%

Talk & Speaker speed statistics with word clouds

Whole talk:
147.5 wpm
841.6 spm
While speakers speak:
148.5 wpm
850.8 spm
J. Alex Halderman:
142.2 wpm
821.8 spm
Nadia Heninger:
155.9 wpm
884.3 spm