D(HE)at Attack Analysis: CVE-2022-40735/CVE-2024-41996 & Affected Libraries

Technical Details Attack Principle Attack Method - A malicious client initiates an encrypted handshake, masquerading as supporting only ephemeral finite field Diffie-Hellman key exchange (DHE), triggering key pair generation and shared secret computation on the server side. The server performs computationally intensive modular exponentiation, while the malicious client requires minimal computational resources. Normal Process - Under normal circumstances, both parties perform identical key generation and shared secret computation in the Diffie-Hellman key exchange, theoretically incurring equal computational costs. - The malicious client can force the server to perform modular exponentiation, then abruptly terminate the connection. In TLS < 1.3, the initial encrypted handshake message can be sent without requiring the client’s public key. Other Protocols - In TLS 1.3, SSH, and similar protocols, the client must send its public key before the server computes its key. In this case, the malicious client sends an arbitrary number as the public key, avoiding modular exponentiation. However, the shared secret computation still causes the server to perform repeated modular exponentiation, ultimately resulting in a failed key exchange. Severity and Evolution Core Issue - The D(HE)at attack stems from protocol flaws, exploiting the specific nature of the Diffie-Hellman key exchange. A malicious client forces the server to perform CPU-intensive operations without incurring significant resource costs itself. This is an implementation issue, not a flaw in the cryptographic library. Severity - The attack prevents the server from distinguishing between the result of modular exponentiation and a randomly selected number from $\mathbb{Z}_p^$ ($A\equiv g^a\mod p$), leading to wasteful CPU resource consumption without any proof-of-work mechanism. - Implementation flaws amplify the attack’s effectiveness, such as the large exponent issue (CVE-2022-40735). Affected Libraries Large Exponent Issue (CVE-2022-40735) - Some cryptographic libraries use long exponents $(a, b)$, making the public key computation $(B\equiv g^b\mod p)$ excessively expensive. Unnecessary Validation (CVE-2024-41996) - To prevent small subgroup confinement attacks, peer public keys must be validated according to NIST SP 800-56A Rev 3. Some libraries skip this validation, allowing attackers to trigger resource-intensive public key generation. Default Large Key Sizes - Cryptographic libraries or application servers may use larger parameter sizes (e.g., ffdhe6 44th or ffdhe8 92nd), increasing resource demands under default configurations, such as OpenSSL. List of Affected Libraries

Goal Reached Thanks to every supporter — we hit 100%!

D(HE)at Attack Analysis: CVE-2022-40735/CVE-2024-41996 & Affected Libraries