CVE-2002-20001

Vulnerability

The Diffie-Hellman Key Agreement Protocol, as used in TLS, allows remote attackers to send arbitrary numbers that are not valid public keys, forcing the server to perform expensive modular exponentiation calculations. This is inherent to the protocol and affects any server that supports DHE key exchange, especially those allowing large key sizes. The attack is known as D(HE)at and is assigned CVE-2002-20001 [1][2][3].

Exploitation

An attacker on the client side simply claims it can only communicate with DHE, and the server must be configured to allow DHE. The attacker sends arbitrary large numbers, causing the server to compute modular exponentiation with very little CPU and bandwidth on the client side. No authentication or privileges are required. The attack can be amplified if the server selects its largest supported key size [1][2].

Impact

Successful exploitation leads to high CPU usage on the server, potentially resulting in denial-of-service (DoS). The attacker gains no access to data or privileges; the impact is limited to resource exhaustion and service disruption [1][3].

Mitigation

Limit supported Diffie-Hellman groups to appropriate sizes (e.g., up to ffdhe3072) or disable finite field DH entirely in favor of ECDH where possible. Implement per-client CPU usage limits if available. Configuration guidance is provided by OpenSSL and HTTP server documentation [1]. Use tools like CryptoLyzer, ssh-audit, or Scanigma to test vulnerability [3][4]. Note: this is a protocol-level issue; no single patch exists, but mitigations significantly reduce risk.