I am referring this post https://www.openssl.org/blog/blog/2015/05/20/logjam-freak-upcoming-changes/ and trying to see a website is vulnerable to Logjam or not.

I try with www.google.com:443 but I am getting Server Temp Key: X25519, 253 bits. Does this mean Google is vulnerable to LogJam?

(The command to use is $ openssl s_client -connect www.example.com:443 -cipher "EDH")

I would like to try this in my SIT IP and port, which is not open to public, so I am not sure the way I do is correct or not.

As my understanding, Google will not likely be vulnerable to Logjam, right?

If you have a better way to verify, kindly advise.

  • Add the command you ran in the question. 253 bits of security in ECDH should be more secure than 8k bits in regular DH. – user Oct 21 at 13:21
  • How can I verify its vulnerable to Logjam or not? – Panadol Chong Oct 22 at 3:04

The openssl commands that site on the post won't work on any modern versions of openssl. Precisely because they are no longer supporting connections to insecure sites by default. You may compile your own version with support for deprecated ciphers, but I guesss you didn't.

The easiest way for you to verify it would be to briefly open it to be reachable by Qualys checker IP addresses and test it with https://www.ssllabs.com, as that will relieve you the burden of checking -with separate tools- all those things.

  • Hi Angel, so sorry that I am too new on this. Can you teach me how to compile the version with support for deprecated ciphers? Actually the main purpose is, the website I support is being reported having vulnerable to Logjam, I first time see this word, thus I just google around and find something to fix. However, I cant test my solution in production environment. I need to verify in SIT first, but SIT ip is not open to public, its in internal network. Thus, I need something to test the result is vulnerable Logjam or not before and after my solution. – Panadol Chong Oct 22 at 3:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.