How do you mitigate logjam?

How do you mitigate logjam?

The best way to mitigate the risk is to deploy Diffie-Hellman correctly for TLS by following below implementation:

1. Disable Export Cipher Suites.
2. Deploy (Ephemeral) Elliptic-Curve Diffie-Hellman (ECDHE)
3. Generate a Strong, Unique Diffie Hellman Group.

What is Diffie Hellman vulnerability?

Logjam is a security vulnerability against a Diffie–Hellman key exchange ranging from 512-bit (US export-grade) to 1024-bit keys. It was discovered by a group of computer scientists and publicly reported on May 20, 2015.

What is ECDHE cipher?

ECDHE cipher suites use elliptical curve cryptography (ECC). Because of its smaller key size, ECC is especially useful in a mobile (wireless) environment or an interactive voice response environment, where every millisecond is important. Smaller key sizes save power, memory, bandwidth, and computational cost.

What is a widely used privacy ensuring program by individuals and corporations?

Previously available as freeware and now only available as a low-cost commercial version, PGP was once the most widely used privacy-ensuring program by individuals and is also used by many corporations. It was developed by Philip R. Zimmermann in 1991 and has become a de facto standard for email security.

What is the Logjam vulnerability in TLS server?

The Logjam is a security vulnerability against a Diffie–Hellman key exchange. It ranges from 512-bit to 1024-bit keys. It was publicly reported on May 20, 2015, by a group of scientists. This server is vulnerable to Logjam attack. This vulnerability allows an attacker to downgrade vulnerable TLS connections using Man-In-The-Middle (MITM) attack.

How big is the DHE key in logjam?

The Logjam research paper discusses the following issues related to weak DH keys: The use of DHE_EXPORT cipher suites in the TLS protocol, or DHE keys with export-grade cipher strength: these keys are 512 bits in size and given enough computing power and time, they can be broken.

Which is weak DH key for Logjam attack?

This attack can be conduted by pre-computation of the 512-bit primes given in two popular sets of weak Diffie-Hellman parameters, namely Apache’s httpd versions 2.1.5 to 2.4.7, and all versions of OpenSSL. The Logjam research paper discusses the following issues related to weak DH keys:

Is the logjam downgrade attack applicable to Ike?

The Logjam downgrade attack against TLS does not apply to IKE in Openswan and Libreswan. The pluto daemon provided by the openswan and libreswan packages provides the IKEv1 and IKEv2 protocols to establish IPsec VPN tunnels whereas the Logjam attack targets TLS.