D(HE)at Attack: 20-Year-Old Diffie-Hellman Flaw Lets Hackers Overheat Your CPU

In a DHE attack, a malicious client initiates a cryptographic handshake, falsely claiming to support only the ephemeral variant of the Diffie-Hellman key agreement protocol (DHE), which prompts the server to generate a key pair and compute a shared secret, both of which require computationally intensive modular exponentiation operations. 

The malicious client avoids performing these calculations, exploiting the asymmetry in computational workload between the server and client to launch a denial-of-service attack.

The Diffie-Hellman key agreement typically involves equal computational effort for both parties, as a malicious client can exploit this by pretending to support only Diffie-Hellman and waiting for the server to generate its public key. 

Once the server has performed the computationally expensive modular exponentiation, the client can terminate the connection, while this attack is more effective in protocols like TLS < 1.3, where the client can send an initial message without revealing its public key, forcing the server to complete the expensive operation before the client’s intentions are clear.

In certain key agreement protocols, a malicious client can exploit the server’s reliance on the client’s public key by sending a fabricated value, which causes the server to perform computationally expensive operations to calculate its shared secret, only to discover later that the key agreement has failed. 

This attack can be mitigated by requiring the client to prove that it has performed the necessary modular exponentiation before the server proceeds with its own calculations.

The D(HE)at attack exploits a fundamental flaw in the Diffie-Hellman key agreement protocol. Unlike software vulnerabilities, this attack is a protocol-level issue that cannot be addressed with simple software updates. 

By leveraging the indistinguishability of random numbers from modular exponentiation results, malicious clients can force servers to perform computationally expensive operations without any significant resource investment, which leaves servers vulnerable to exploitation. 

Implementation flaws can exacerbate the severity of the D(HE)at attack, emphasizing the need for careful protocol design and implementation.

Cryptographic libraries can be vulnerable to attacks that exploit the resource-intensive nature of modular exponentiation. Malicious clients can force the use of larger exponents, leading to significantly more expensive public key calculations. 

Some libraries may always perform unnecessary public key validation, even when using approved safe-prime groups, which can be exploited by attackers to trigger expensive modular exponentiation operations, potentially impacting system performance and security.

The use of large parameter sizes in cryptographic libraries, such as ffdhe6144 or ffhde8192, increases the computational overhead for generating public keys, which can be exploited in a D(HE)at attack, where attackers send numerous connection requests to overwhelm servers. 

Popular libraries often default to the largest parameter size, which can pose a significant risk if not properly configured on application servers and leading to successful DoS attacks, especially if the server implementations fail to override the library defaults.

Also Read:

Hillstone WAF Flaw Allows Dangerous Command Injection Attacks

See more