no-weak-dh-parameters

Detects Diffie-Hellman key agreement configured with a modulus or curve too small to resist a precomputation attack. This rule is part of eslint-plugin-node-security and provides LLM-optimized error messages with fix suggestions.

🚨 Security rule | ⚠️ Set to error in recommended

Quick Summary

Vulnerability and Risk

Vulnerability: A named Diffie-Hellman group is a fixed prime. The expensive part of breaking DH depends only on that prime, not on the session — so an attacker pays the cost once and then breaks every session that used the group cheaply. This is Logjam (CVE-2015-4000): the 512-bit export groups fell to an academic budget, and the 768- and 1024-bit groups (modp1, modp2) are within reach of a well-resourced adversary.

The same reasoning applies to elliptic curves by field size: a curve under 224 bits does not offer contemporary security margins.

Risk: Recorded traffic is decrypted retroactively. Forward secrecy, which is the entire reason for ephemeral key agreement, is lost.

Rule Details

Three call shapes are checked, all by their literal argument:

A constant is followed to its declaration, so const GROUP = 'modp2' is the same finding as the literal spelled at the call site.

What this rule deliberately does not do

• An unrecognised group name is not reported. A future RFC group must not become a finding by being unknown to this list.
• createDiffieHellman(prime, encoding) — the string/Buffer overload — is not reported. That form supplies a prime chosen elsewhere; judging its strength means reading the prime, which a structural rule cannot do.
• A computed group or curve name is not reported. There is nothing to measure.

Why This Matters

Configuration

{
  rules: {
    'node-security/no-weak-dh-parameters': ['error', {
      minPrimeBits: 3072,
      additionalWeakCurves: ['brainpoolP224r1'],
      allowInTests: false
    }]
  }
}

Examples

❌ Incorrect

import crypto from 'crypto';

// modp1 is the 768-bit group Logjam broke
const dh = crypto.getDiffieHellman('modp1');

// modp2 is 1024-bit — within reach of a state-level adversary
const dh2 = crypto.getDiffieHellman('modp2');

// A generated prime below the floor
const weak = crypto.createDiffieHellman(1024);

// A curve with a field size under 224 bits
const ecdh = crypto.createECDH('secp192k1');

✅ Correct

import crypto from 'crypto';

// modp14 is the 2048-bit group
const dh = crypto.getDiffieHellman('modp14');

// Or generate at or above the floor
const generated = crypto.createDiffieHellman(3072);

// ECDH on a modern curve
const ecdh = crypto.createECDH('prime256v1');
const wider = crypto.createECDH('secp384r1');

Security Impact

Migration Guide

Phase 1: Discovery

Run the rule as a warning to find every key-agreement site:

{
  rules: {
    'node-security/no-weak-dh-parameters': 'warn'
  }
}

Phase 2: Replace

Named groups move to modp14 or larger. Generated primes move to 3072. Anything doing DH for a new protocol should use ECDH on prime256v1 or secp384r1 instead — it is faster and the parameters are not shared across the internet.

Phase 3: Raise the floor

Once the codebase is clean, set minPrimeBits to whatever your compliance regime requires and let the rule hold the line.

Related Rules

• no-weak-cipher-algorithm — weak symmetric ciphers
• no-weak-hash-algorithm — weak digests
• no-insecure-rsa-padding — RSA padding modes

⚙️ Options