Is there a complete summarized list of attacks on Diffie-Hellman?

Question

Is there a complete summarized list of attacks on Diffie-Hellman?

For RSA, there is this paper by Boneh, so I was wondering whether there is such a list for attacks on DHKE. I have been looking everywhere. Surprisingly, I can't find one. Could you please tell me whether such a list exists?

Answer 1

Here is a basic non-exhaustive list of threats facing Diffie-Hellman Key Exchange (DHKE, sometime abbreviated DH), starting with the most general:

1. DHKE is vulnerable to a Man in the Middle attack (MitM), where an adversary actively inserted between A and B masquerades as B w.r.t. A, and as A w.r.t. B. The problem is solved by Authenticated Diffie-Hellman key exchange, but that requires prior exchange of trusted (possibly public) information, as everything cryptography has on offer to counter MitM. In the following, in order to keep that answer short, we disregard the many threats against the authentication part of authenticated DHKE.
2. DHKE is theoretically vulnerable to adversaries with arbitrary computing power. Quantum Key Distribution (QKD) theoretically solves that problem (not MitM). However in practice adversaries are computationally bounded. QKD devices face severe operational restrictions, and several implementations have been demonstrated insecure by exploiting deviations of the devices from their theoretical model. Thus the dominant opinion is that key distribution practice, rather than using QKD, can safely keep assuming computationally bounded adversaries, for a definition of that considering technical progress in computational abilities. That's assumed in the following.
3. DHKE would be insecure with parameters making the Discrete Logarithm Problem (DLP) computationally tractable in the finite group used. An hypothetical Cryptographically Relevant Quantum Computer would make commonly used practical instances of the DLP tractable by e.g. Schor's algorithm, thus rendering DHKE insecure. That legitimately fuels Post Quantum Cryptography (PQC), which researches cryptography that would resist CRQC. Some (including me) see no public experimental progress of Quantum Computers since the early 2000s when it comes to attacking any cryptographic problem with an algorithm that scales, and no evidence of urgency to adopt PQC at least in commercial applications. In the following we disregard the possibility of CRQC.
4. The security of DHKE formally relies on a possibly stronger assumption than hardness of the DLP: the Computational Diffie-Hellman (CDH) assumption, which states the shared secret can't be computed. There is however no known attack exploiting that distinction.
5. In applications directly using the shared secret, the security of DHKE would rely on an even stronger assumption than CDH: the Decisional Diffie-Hellman (DDH) assumption, which states the shared secret is undistinguishable from a random element of the group generated by the public parameter $g$. A simple case where that does not hold occurs when the group is the multiplicative group modulo a prime $p$, and public DH parameter $g$ is a generator of that group: the Legendre symbol of the shared secret leaks to a passive eavesdropper.
6. Further, even if DDH holds, the bitwise representation of group elements may not be uniform. The standard defense against both this and 5 is to use the shared secret constructed by ECDH exclusively as the key input of a symmetric Key Derivation Function (KDF), which constructs essentially uniformly random key(s) for use in other cryptographic primitives. That's assumed in the following.
7. The DLP in any group of size $n$ where $n$ is composite with known factors can be reduced to easier DLPs by the Pohlig-Hellman algorithm. That's a threat to use of DHKE with such composite $n$, and a reason to ensure that the generator $g$ used in DHKE has order a multiple of a large prime $q$. One common practice is using a public parameter $g$ with that prime order $q$. That also defends against the threat in 5.
8. The DLP in any finite group of size $n$ can theoretically be solved by the Baby-Step/Giant-Step algorithm with $2\sqrt n$ group operations. Pollard's rho is a practical variant of that algorithm, with comparable computational cost and modest memory requirements. It can be efficiently distributed. That's a potential threat to every use of DHKE, and requires $q$ as discussed above high enough that $\sqrt q$ group operations is computationally infeasible for adversaries. If we assume computational abilities of adversaries double every 2 years (for a combination of technical progress and increased resource dedicated to attack) cumulated over over $y$ years, we thus need to add $y$ bits to the bit size of $q$. Current recommendations are $q$ of at least about 256-bit (160-bit is still around in some applications, but I would recommend to phase it out ASAP).
9. DHKE was initially proposed in the multiplicative group modulo a prime $p$ (noted $\mathbb Z_p^*$), or a subgroup thereof. In these specific kind of groups, the DLP can be attacked by the General Number Field Sieve and the Function Field Sieve (I'm out of my comfort zone to comment on which is best for which $p$). Current recommendations when using such groups are $p$ of at least about 2048-bit or 3072-bit (1024-bit or even lower is still around in some applications, but I would recommend to phase it out ASAP). Also, unless the size of $p$ is further increased, $p$ should not be of the form $r^e\pm s$ for small $(r,e,s)$. One of many ways to insure that condition is to randomly select say 128 bits among the say 1/5 most significant bits of $p$.
10. A now extremely popular choice of group for DHKE is an Elliptic Curve finite group. DHKE then becomes ECDHKE, often abbreviated ECDH. The advantages are faster computation and smaller representation of group elements. Beside 5/6/7/8 which apply, there are many complex possible pitfalls in choice of an Elliptic Curve group, including using a singular Elliptic Curve, which makes the DLP polynomial time. See Safecurves and the reference pointed by that other answer for many others.
11. Use of various other groups has been proposed, but with little practical adoption. The risk is lurking that the DLP turns out to be easier than initially thought, e.g. by exhibiting a computable isomorphism with a group where the DLP is easy.
12. Imperfect Random Number Generator (e.g. initialized with insufficient entropy thus producing output vulnerable to enumeration, perturbed by a fault attack) is a critical threat to DHKE implementations.
13. Side channel leakage is a threat to DHKE implementations. The ephemeral nature and single use of secrets in DHKE tends to mitigates that issue; but that does not hold for long term secrets of authenticated DHKE, and for the symmetric crypto which key is established by DHKE.

Answer 2

After hours of reading, here's my best find, page 28.