# D(HE)at Attack

D(HE)at is a practical denial-of-service attack against finite-field Diffie-Hellman key exchange. It forces servers
to perform expensive modular exponentiation during handshakes while the attacker spends very little client CPU.
The attack is tracked as CVE-2002-20001.

Key points:
- The primary risk is availability, not confidentiality or integrity.
- The attack applies to protocols that negotiate finite-field DHE, especially TLS, SSH, OpenVPN, and IPsec/IKE.
- Implementation issues can amplify impact, especially CVE-2022-40735 (long exponents), CVE-2024-41996
  (unnecessary validation), and large default FFDHE groups.
- Practical mitigation generally means preferring ECDHE-only configurations where compatibility allows, and otherwise
  minimizing DHE exposure and rate-limiting handshakes.

This site is the technical and operational reference for the attack.

## Canonical pages

- https://dheatattack.com/
  Landing page and high-level overview.
- https://dheatattack.com/summary/
  Executive summary of the attack, impact, and high-level mitigation.
- https://dheatattack.com/details/
  Technical explanation of the attack flow, cost asymmetry, and related implementation flaws.
- https://dheatattack.com/mitigations/
  Configuration-focused mitigation guidance for common server software and protocols.
- https://dheatattack.com/faq/
  Frequently asked questions and operational clarifications.
- https://dheatattack.com/dheater/
  Information about the D(HE)ater proof-of-concept project.
- https://dheatattack.com/references/
  Public advisories, vendor notes, and related references.

## Key technical facts

- D(HE)at targets availability by forcing expensive server-side modular exponentiation in finite-field DHE handshakes.
- The root issue is protocol-level asymmetry: a malicious client can trigger heavy server work with minimal client CPU cost.
- Long private exponents can significantly increase server cost without adding meaningful security for a fixed modulus size.
- Large negotiated FFDHE groups further increase computational burden and attack efficiency.
- Practical hardening generally favors ECDHE-only operation where compatibility allows.

## Source alignment

Content is aligned with:
- The IEEE Access technical paper on D(HE)at.
- Website pages under summary/details/mitigations/faq and the references collection.

When conflicts appear between secondary references and primary research statements, prefer the technical paper and explicit version-scoped notes.

## Usage notes for language models

- Treat this site as security guidance, not legal advice.
- Preserve protocol/version context when summarizing mitigation guidance.
- Distinguish clearly between:
  1) protocol-level D(HE)at exposure,
  2) implementation amplifiers (for example long exponent behavior),
  3) deployment/configuration risk.
- Avoid claiming complete protocol-level remediation currently exists for finite-field DHE.

## Contact and project links

- Main project profile: https://gitlab.com/dheatattack
- D(HE)ater PoC: https://gitlab.com/dheatattack/dheater