# OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701) 

OpenSSL 1.0.2 reused DH private exponents with non-safe RFC 5114 primes, letting an attacker recover the server's private DH exponent via repeated handshakes.

- Payout: $2,500
- Severity: high
- Program: Internet Bug Bounty
- Found by: asanso
- Disclosed: 2016-03-28
- CVE: CVE-2016-0701
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/113288
- Library page: https://bugbountylibrary.com/r/h1%3A113288
- Tags: area:oss domain:oss impact:data-leak kind:bounty platform:hackerone sev:high tech:linux technique:source-review vuln:crypto

**Target:** TLS DH/DHE key exchange in OpenSSL 1.0.2
**Root cause:** OpenSSL 1.0.2 accepted X9.42/RFC 5114 DH parameters whose primes are not safe, and by default reused the same private DH exponent across handshakes (SSL_OP_SINGLE_DH_USE off), enabling small-subgroup key recovery.
**Steps:**
1. Configure a TLS server on OpenSSL 1.0.2 with DH parameters from `genpkey` `dh_rfc5114` (non-safe primes) or `dhparam -dsaparam`, without SSL_OP_SINGLE_DH_USE.
2. Confirm the server reuses the same private DH exponent across connections (DHE via SSL_CTX_set_tmp_dh, or a static DH ciphersuite).
3. Complete multiple handshakes against the server, each probing a small subgroup of the non-safe prime order.
4. Combine residues across handshakes via CRT to recover the server's private DH exponent.
**How found:** Noticed OpenSSL 1.0.2 added X9.42/RFC 5114 parameter support whose primes may not be safe, and that SSL_OP_SINGLE_DH_USE is off by default, so the private exponent is reused and vulnerable to small-subgroup attack.
**Exploitation:** Attacker performs many handshakes against a server that reuses its private DH exponent with non-safe primes, using small-subgroup probes to leak the exponent bit by bit, then reconstructs the private DH exponent.
**Insight:** When a crypto library adds support for externally supplied parameter files (X9.42/RFC 5114), check whether the new parameter class violates assumptions baked into existing key-reuse defaults; non-safe primes plus a reused exponent is a small-subgroup key-recovery oracle.