Another hypothetical insider "4" attack exploit spotted in the wild?
we got a new 4
a typo in goahead's tls configuration passes sizeof(dhm_g) instead of sizeof(dhm_p), reducing a 2048-bit diffie-hellman modulus to just 1 byte, the size of the generator.
the first byte happens to be 255. not only is it tiny, it's not even prime (3×5×17).
with g=2, the powers of 2 modulo 255 cycle through just 8 values: 1, 2, 4, 8, 16, 32, 64, 128.
that's just 3 bits of possible shared-secret entropy. an attacker can try all 8 possibilities to decrypt an affected tls session.
the typo has been there since 2018.
important caveat: this only affects tls 1.2 dhe with clients that accept the tiny modulus, using the optional mbedtls backend. goahead uses openssl by default.