Mozilla Foundation Security Advisory 2015-70
NSS accepts export-length DHE keys with regular DHE cipher suites
- Announced
- July 2, 2015
- Reporter
- Matthew Green, authors of the paper
- Impact
- Moderate
- Products
- Firefox, Firefox ESR, Firefox OS, SeaMonkey, Thunderbird
- Fixed in
-
- Firefox 39
- Firefox ESR 31.8
- Firefox ESR 38.1
- Firefox OS 2.2
- SeaMonkey 2.35
- Thunderbird 31.8
- Thunderbird 38.1
Description
Security researcher Matthew Green reported a Diffie–Hellman (DHE) key processing issue in Network Security Services (NSS) where a man-in-the-middle (MITM) attacker can force a server to downgrade TLS connections to 512-bit export-grade cryptography by modifying client requests to include only export-grade cipher suites. The resulting weak key can then be leveraged to impersonate the server. This attack is detailed in the "Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice" paper and is known as the "Logjam Attack."
This issue was fixed in NSS version 3.19.1 by limiting the lower strength of supported DHE keys to use 1023 bit primes.