Raccoon

cryptography

A 2020 timing attack on TLS-DH that can recover the session key in rare cases.

The Raccoon attack exploited how TLS derived the premaster secret from Diffie-Hellman, where leading zero bytes and timing could leak enough to reconstruct the key. It is another reason ephemeral DH parameters and constant-time code matter.

The Raccoon attack targets a timing side channel in TLS's Diffie-Hellman key derivation. Leading zero bytes in the shared secret were stripped before hashing, so the length of the input varied, and that variation was observable in how long the hash took.

It is genuinely hard to exploit: it requires precise measurement, a large number of handshakes, and a server reusing the same ephemeral key across connections, which good practice already forbids. The researchers were clear about the limited practicality, and that honesty is worth noting because inflated severity claims are a real problem in vulnerability disclosure.

Its value is as an illustration of where side channels hide. The flaw is not in the mathematics of Diffie-Hellman or in the hash function; it is in a small encoding decision about how to represent a number before hashing it. That is the level at which cryptographic implementations actually fail, and it is why constant-time discipline has to extend to serialization and encoding rather than stopping at the primitives.

Also known as: Raccoon, Raccoon attack, CVE-2020-1968

← All glossary entries