What does "export grade" cryptography mean? And how is this related to the Logjam attack?

Question

I am doing some research on the Logjam attack, and I need help in learning some terms that are new for me.

What does "export grade" cryptography mean? And how is this related to the Logjam attack?

Answer 1

"Export grade" cryptography is a result of The Crypto Wars. Laws were passed in the United States that resulted in the crippling of encryption software that was distributed outside of the United States. This section from wikipedia explains it well enough:

The longest key size allowed for export without individual license proceedings was 40 bits, so Netscape developed two versions of its web browser. The "U.S. edition" had the full 128-bit strength. The "International Edition" had its effective key length reduced to 40 bits by revealing 88 bits of the key in the SSL protocol. Acquiring the 'U.S. domestic' version turned out to be sufficient hassle that most computer users, even in the U.S., ended up with the 'International' version,[7] whose weak 40-bit encryption could be broken in a matter of days using a single personal computer. A similar situation occurred with Lotus Notes for the same reasons

The 40-bit limit was for symmetric ciphers, where there is no (known) attack better than trying all $2^n$ keys. Asymmetric algorithms like DH and RSA need larger key sizes for the same security; see e.g. How much computing resource is required to brute-force RSA? and Security strength of RSA in relation with the modulus size . At the time 512-bit RSA or DH was rated equivalent to 40-bit symmetric, and thus export of those algorithms was limited to 512 bits. (DSA was rated the same, but was not limited because it is not an encryption algorithm.) This is why weakdh.org states that:

The Logjam attack allows a man-in-the-middle attacker to downgrade vulnerable TLS connections to 512-bit export-grade cryptography.

Ultimately, some software was required to be written using key sizes that were understood to be breakable; export grade cryptography refers to this form of an algorithm that uses a reduced and breakable key size. The Logjam attack works by tricking the TLS exchange into using crypto that is weaker and potentially breakable.

Answer 2

I do a research in Logjam attack and I need a help in learning some terms that are new for me. what does "export grade" cryptography mean? and how this related to Logjam attack?

In the 90's the government of USA built the Export Grade as an attempt to control foreign countries usage of cryptography

This list is composed of common crypto algorithms, but with their key length reduced in a way that NSA could eavesdrop on any communication, since they have the power to break the algorithm based in that reduced key length.

In the case of Logjam, it downgrades the selected Diffie-Hellman algorithm in TLS so it uses a 512-bit prime. In these conditions, the researchers (and NSA) are able to compute the symmetric key being used, thus impersonating on the whole TLS Handshake.

Answer 3

During 90's , US government had strict regulation that any software exported outside can have maximum 512 bits of RSA/DH , 40 bits of RC2/RC4 etc. These are called as export grade cipher and example of cipher suite is TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 which means 512 bits of DH keys and 40 bits of RC4 for symmetric encryption. So for example, Netscape browser international version , supports this version and also server supports too because they don't want to miss any connection from internal clients.

Fast forward to 2000 onward

1. ClientHello : Client send list of possibly good strong cipher suites list but a man in the middle changes this packets and send only export grade cipher suites.

2. Server accept the connection and send 512 bit DH parameters(g and p), this DH paramsg^a mod p are once generated when server started and kept forever. This server param is signed by certificate private key. In the logjam attack this MiTM sniff this and solve for secret value a. Similar from Client side MiTM can solve for b from g^b mod p , so attacker also has shared secret g^ab mod p

3. So MiTM can also derive master secret and session keys.

4. One more point to note is last message in TLS handshake is Finished message which is actually hash of all TLS exchange message using the key derived from master secret, note that client will calculate using original ClientHello message, so here too MiTM since he knows master secret too , will block the original Finished message , calculate hash on client behalf and send to server. So now when server verifies this handshake, he will use MiTM ClientHello and hence the check will be passed.Same process MiTM will do for Server to Client Finished Message i.e. MiTM will send Client a hash calculated with original ClientHello and hence the check will pass on client side too. These hash are generally created using a PRF (Pseudo random function) generated with secret, non-secret and a label data.