Their feat? Uncovering a flaw, which they named Logjam, in the TLS cryptographic protocol used to protect every website whose address starts with HTTPS.
Last spring, a collaboration between researchers from Inria Paris-Rocquencourt, the CNRS, Microsoft Research and the American universities Johns Hopkins, Michigan and Pennsylvania brought this flaw to light.
Data exchanges between your computer and a server over HTTPS are encrypted using the TLS (Transport Layer Security) protocol, which is often achieved using the Diffie–Hellman algorithm. Put simply, the security of this algorithm rests on the fact that working out 75 from 16,807 is far more complicated than calculating 75: this is the discrete logarithm problem, in which the task is to find the smallest integer k such that *ak = b, that is, to invert the exponentiation operation. The algorithm relies on a prime number p*. The larger it is, the more secure the communication. Yet American legislation, until 1990, limited these numbers to 155 digits, which is still very often the case today. The catch is that the discrete logarithm problem can now be solved for numbers of that size! In particular, the Franco-American team mentioned above managed to do so for a number of about 300 digits… ten thousand times faster than the previous record. How did they go about it? This is where the "cheating" comes in: they used whichever prime number p suited them to speed up their calculations, without anyone noticing…
