I am a noob at crypto. IIRC similar attack was used against Tor several years ago. In DSA it is possible to force g=1 or g \equiv -1 \mod p. The first is unit and the second is of multiplicative order 2. This are clearly weak and insane choices, but this might have implications to MITM (might be wrong on this). For DH could generate key with g=1, though couldn't test it. Tested both 1 and -1 cases in DSA, the probability of successful connection was about 1/4 (or maybe 1/2), errors in the other cases. (for $1$ I would expect probability $1$). Attached are cacert.pem and cacert2.pem, the magic word is 1234. To test: $ openssl s_server -accept 8888 -www -cert cacert.pem $ openssl s_client -connect localhost:8888 -showcerts To examine $openssl x509 -text -in cacert2.pem $openssl dhparam -text -in dHParam.pem (not sure if dHParam.pem this is usable, forged generation). Firefox refuses connections, Konqueror works with same probability. Suspect this might be related to EC refusing the point at infinity. Might have MITM implications, don't have working exploit (If a MITM can forge $g=1$ in DH, the private keys are useless).