Editing Diffie–Hellman key exchange (section)

=== Denial-of-service attack ===

A [[Common Vulnerabilities and Exposures|CVE]] released in 2021 (''[https://nvd.nist.gov/vuln/detail/CVE-2002-20001 CVE-2002-20001]'') disclosed a [[denial-of-service attack]] (DoS) against the protocol variants use ephemeral keys, called D(HE)at attack.<ref name=dheatattack>{{cite journal|last1=Pfeiffer|first1=Szilárd|last2=Tihanyi|first2=Norbert|date=25 December 2023|title=D(HE)at: A Practical Denial-of-Service Attack on the Finite Field Diffie-Hellman Key Exchange|journal=[[IEEE Access]]|volume=12|pages=957–980|doi=10.1109/ACCESS.2023.3347422|doi-access=free}}</ref> The attack exploits that the Diffie–Hellman key exchange allows attackers to send arbitrary numbers that are actually not public keys, triggering expensive modular exponentiation calculations on the victim's side. Another CVEs released  disclosed that the Diffie–Hellman key exchange implementations may use long private exponents  (''[https://nvd.nist.gov/vuln/detail/CVE-2022-40735 CVE-2022-40735]'') that arguably make modular exponentiation calculations unnecessarily expensive<ref name="Oorschot Wiener 1996">{{cite book|last1=van Oorschot|first1=P.C.|last2=Wiener|first2=M.J.|date=1996|title=Advances in Cryptology — EUROCRYPT '96|chapter=On Diffie-Hellman Key Agreement with Short Exponents|series=Lecture Notes in Computer Science |volume=1070 |chapter-url=https://link.springer.com/chapter/10.1007/3-540-68339-9_29|url-status=live|publication-date=2001|publisher=Springer, Berlin, Heidelberg|pages=332–343|doi=10.1007/3-540-68339-9_29|isbn=978-3-540-61186-8 |archive-url=https://web.archive.org/web/20230219191210/https://link.springer.com/chapter/10.1007/3-540-68339-9_29|archive-date=2023-02-19}}</ref> or may unnecessary check peer's public key (''[https://nvd.nist.gov/vuln/detail/CVE-2024-41996 CVE-2024-41996]'') has similar resource requirement as key calculation using a long exponent.<ref>{{cite web |last1=Elaine |first1=Barker |last2=Lily |first2=Chen |last3=Allen |first3=Roginsky |last4=Apostol |first4=Vassilev |last5=Richard |first5=Davis |title=Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography |url=https://csrc.nist.gov/pubs/sp/800/56/a/r3/final |publisher=National Institute of Standards and Technology|doi=10.6028/NIST.SP.800-56Ar3|doi-access=free|publication-date=2018}}</ref> An attacker can exploit both vulnerabilities together.