Logjam (computer security)

They estimated that a state-level attacker could do so for 1024-bit systems, then widely used, thereby allowing decryption of a significant fraction of Internet traffic.

The authors took advantage of the fact that the number field sieve algorithm, which is generally the most effective method for finding discrete logarithms, consists of four large computational steps, of which the first three depend only on the order of the group G, not on the specific number whose finite log is desired.

If the results of the first three steps are precomputed and saved, they can be used to solve any discrete log problem for that prime group in relatively short time.

The researchers calculated the cost of creating logjam precomputation for one 1024-bit prime at hundreds of millions of USD, and noted that this was well within range of the FY2012 $10.5 billion U.S. Consolidated Cryptologic Program (which includes NSA).

[1] Claims on the practical implications of the attack were however disputed by security researchers Eyal Ronen and Adi Shamir in their paper "Critical Review of Imperfect Forward Secrecy".