So I saw this blog post on “How is NSA breaking so much crypto?”. The basic idea of this blog post is this: There is an inherent weakness in Diffie-Hellman that stems from services using the same large prime number by default. Meaning, if that one default large prime number is not changed, then that becomes a potential weakness since if that default large prime number is hacked and commonly known, access to systems in which that value has not been changed becomes relatively simple.

For the nerds in the audience, here’s what’s wrong: If a client and server are speaking Diffie-Hellman, they first need to agree on a large prime number with a particular form. There seemed to be no reason why everyone couldn’t just use the same prime, and, in fact, many applications tend to use standardized or hard-coded primes. But there was a very important detail that got lost in translation between the mathematicians and the practitioners: an adversary can perform a single enormous computation to “crack” a particular prime, then easily break any individual connection that uses that prime.

Okay, I haven’t completely bought the concept here. But assuming this article’s assumptions are true—that usage of similar default prime numbers in various Diffie-Hellman deployments invites an inherent weakness—then my question is this:

If deployment laziness—as marked by providing a default large prime number—is the primary attack surface of a Diffie-Hellman implementation, then what can be done by average end users and systems administrators—if anything—to pre-emptively neutralize this issue?

I might be treading a bit into the deep end of my abilities of understanding the building blocks of encryption, but is the concept of a weakness presented in that article something that would require—for example—certificate authorities to issue new root certificates? And unless that happens, a commonly used default Diffie-Hellman large prime number vulnerability would still be a concern and potential vulnerability?

Or is the whole assumption of that blog post based on a “thruthy” analysis that could be considered to be akin to the panic surrounding Y2K bugs that—while a valid concern on some level—never really manifested itself on a scale large enough to justify the panic associated with the concern?

  • 1
    My understanding is that as far as TLS is concerned, if the cipher suite uses ephemeral Diffie-Hellman there would be little to no effect as the server can choose the DH params when the connection is being negotiated and can thus pick a different prime for the group order. Commented Oct 16, 2015 at 2:56

1 Answer 1


Don't use any cipher suite involving DH on a prime group smaller than 2048 or even better 3072 bits. That's what you can do as a sysadmin...

The EFF has practical advice : https://www.eff.org/deeplinks/2015/10/how-to-protect-yourself-from-nsa-attacks-1024-bit-DH

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .