# Insecure Diffie-Hellman Parameters

> Detects use of weak Diffie-Hellman parameters (< 2048 bits, export-grade, or known broken groups).

- Skill: `zakirkun/insecure-diffie-hellman-parameters` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/insecure-diffie-hellman-parameters`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/insecure-diffie-hellman-parameters/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/insecure-diffie-hellman-parameters

---


# Insecure Diffie-Hellman Parameters

## Overview
Diffie-Hellman key exchange with weak parameters is vulnerable to precomputation attacks (LogJam attack, 2015). Common issues:
- DH groups < 2048 bits (export-grade: 512/768/1024 bits)
- Using standard well-known small prime groups (precomputed NFS databases)
- Reusing the same DH parameters across many connections (static DH)

## Remediation
- Use DH groups ≥ 2048 bits or RFC 7919 FFDHE groups
- Prefer ECDH (Elliptic Curve DH) with P-256/P-384/X25519 — more efficient and secure
- Generate unique DH parameters per deployment