Diffie-Hellman key exchange is used to securely exchange cryptographic keys over an insecure public channel. The parties in the exchange choose a private key and come up with a public key. They both share the keys and calculate a shared secret key, which they will use for symmetric key algorithms and secure communications. In the case of a Man-in-the-Middle attack, the attackers can intercept the DH exchange, but they cannot compute the final symmetric keys.
With Ephemeral Diffie-Hellman key exchanges, temporary DH secret keys are generated for the connections. Therefore, the same key pairs are never used twice.
The Diffie-Hellman key exchange is secure. However, its security depends on the size of the prime modulus. Older protocols and implementations use 512-bit or 1024-bit moduli. These smaller keys are considered weak and can be easily compromised, leading to problems such as weak DH keys.
ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY (Weak Diffie-Hellman Key)
Yeah, this is one of the new features coming with the latest version of Google Chrome (45). It basically means that the most used browser is becoming unusable to manage older Cisco products. I faced the problem when I was trying to access one CUCM version 9.x in my lab.
I’m pretty sure there are thousands of products working pretty fine sitting in your private LAN behind a firewall, but you simply cannot use Chrome to access them as all of them require https. I’ve spent probably half a day looking for a workaround in Chrome but so far I wasn’t able to find such.
The message in the browser says, “This error can occur when connecting to a secure (HTTPS) server. It means that the server is trying to set up a secure connection but, due to a disastrous misconfiguration, the connection wouldn’t be secure at all! In this case, the server needs to be fixed. Google Chrome won’t use insecure connections to protect your privacy.” There is even a link with more instructions about how to fix the problem, but all of them are asking you to make the changes on the server side. Well, thanks for that, but I simply cannot do it, as Cisco’s back end is pretty much closed for changes. Honestly, I think this time Google overdid it!
The “fix” in the browser is related to a well-known security attack called Logjam. You can find more details about it here: https://weakdh.org/.
Workaround for Google Chrome
So, you have some old Cisco products that you cannot access with Google Chrome. What should I do now? You have to create a new shortcut for your Chrome by adding the following startup parameter:
“C:Program Files (x86)GoogleChromeApplicationchrome.exe” –cipher-suite-blacklist=0x0039,0x0033
By doing this, you are allowing the weak Diffie-Hellman public keys – TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33) and TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39), which is absolutely enough to be able to access your Cisco environment with Google Chrome.
Workaround for Mozilla Firefox
When I switched from Firefox to Chrome as my primary browser a couple of years ago, I did it with some reserves. And here comes probably the biggest proof that Firefox is a much more mature browser. Mozilla Firefox has the same fix (Error code: ssl_error_weak_server_ephemeral_dh_key) as Google Chrome, and it was even released a couple of weeks earlier, but together with that, there is a workaround by modifying some of the advanced settings. Here is a step-by-step guide on how to do that.
Open your Firefox and type in the address bar about:config. There will be a warning message, so you will have to promise that you will be careful.
Once you open the advanced configuration section, type in the search field ssl3. Change the values of security.ssl3.dhe_rsa_aes_128_sha and security.ssl3.dhe_rsa_aes_256_sha from true to false by simply double-clicking on them.
That’s it! Now you can use Firefox to access your devices, which are still running weak Diffie-Hellman ciphers.