"This server is vulnerable to Logjam attacks. Make sure you have the TLSv1.2 protocol enabled on your server. Disable support for any export suites on your server and all insecure ciphers."
During the 1990s, the US government set up restrictions for exporting encryption systems. These rules, aimed at SSL 3.0 and TLS 1.0, enforced support for weaker DHE_EXPORT cipher suites. Eventually, the rules were changed, and export restrictions were removed. Unfortunately, some TLS servers still used a two-group configuration: 1024-bit for standard DHE key exchanges and 512-bit for legacy DHE_EXPORT, while all browsers still support weak DHE_EXPORT ciphers.
A team of researchers revealed (see Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice) that old DHE export-grade cryptographic suites are still used. They also discovered that servers with enabled support for these DHE_EXPORT cipher suites could allow a man-in-the-middle (MITM) to trick clients that support weak DHE_EXPORT cipher suites into downgrading their connection to a 512-bit key exchange. Then MITM attackers could use preconfigured data along with today’s computing power to crack the keys. Once the encryption of the session is cracked, the MITM can steal any ‘secured’ personal information from the session.
To be vulnerable, both these conditions must be met:
Vulnerable clients include Internet Explorer, Chrome, Safari, and Mozilla.
As part of the research team's disclosure, they created a comprehensive guide to mitigate this vulnerability for both servers and clients. See Guide to Deploying Diffie-Hellman for TLS.
DigiCert is the world's leading provider of scalable TLS/SSL, IoT and PKI solutions for identity and encryption. The most innovative companies, including 89% of the Fortune 500 and 97 of the 100 top global banks, choose DigiCert for its expertise in identity and encryption for web servers and Internet of Things devices. DigiCert supports TLS and other digital certificates for PKI deployments at any scale through its certificate lifecycle management solution, CertCentral®. The company is recognized for its enterprise-grade certificate management platform, fast and knowledgeable customer support, and market-leading security solutions. For the latest DigiCert news and updates, visit digicert.com or follow @digicert.
©2020 DigiCert, Inc. All rights reserved. DigiCert, its logo and CertCentral are registered trademarks of DigiCert, Inc. Norton and the Checkmark Logo are trademarks of NortonLifeLock Inc. used under license. Other names may be trademarks of their respective owners.