 | This articleneeds additional citations forverification. Please helpimprove this article byadding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "Downgrade attack" – news ·newspapers ·books ·scholar ·JSTOR(September 2016) (Learn how and when to remove this message) |
Adowngrade attack, also called abidding-down attack,[1] orversion rollback attack, is a form ofcryptographic attack on a computer system or communications protocol that makes it abandon a high-quality mode of operation (e.g. anencrypted connection) in favor of an older, lower-quality mode of operation (e.g.cleartext) that is typically provided for backward compatibility with older systems.[2] An example of such a flaw was found inOpenSSL that allowed the attacker to negotiate the use of a lower version of TLS between the client and server.[3] This is one of the most common types of downgrade attacks.Opportunistic encryption protocols such asSTARTTLS are generally vulnerable to downgrade attacks, as they, by design, fall back to unencrypted communication. Websites which rely on redirects from unencrypted HTTP to encrypted HTTPS can also be vulnerable to downgrade attacks (e.g.,sslstrip), as the initial redirect is not protected by encryption.[4]
Downgrade attacks are often implemented as part of aman-in-the-middle (MITM) attack, and may be used as a way of enabling a cryptographic attack that might not be possible otherwise.[5] Downgrade attacks have been a consistent problem with the SSL/TLS family of protocols; examples of such attacks include thePOODLE attack.
Downgrade attacks in the TLS protocol take many forms.[6] Researchers have classified downgrade attacks with respect to four different vectors, which represents a framework to reason about downgrade attacks as follows:[6]
There are some recent proposals[7][8] that exploit the concept ofprior knowledge to enable TLS clients (e.g. web browsers) to protect sensitive domain names against certain types of downgrade attacks that exploit the clients' support for legacy versions or non-recommended ciphersuites (e.g. those that do not supportforward secrecy orauthenticated encryption) such as the POODLE, ClientHello fragmentation,[9][10] and a variant of the DROWN (aka "the special drown") downgrade attacks.[clarification needed]
Removingbackward compatibility is often the only way to prevent downgrade attacks. However, sometimes the client and server can recognize each other as up-to-date in a manner that prevents them. For example, if a Web server and user agent both implementHTTP Strict Transport Security and the user agent knows this of the server (either by having previously accessed it over HTTPS, or because it is on an "HSTS preload list"[11][12][13]), then the user agent will refuse to access the site over vanilla HTTP, even if a malicious router represents it and the server to each other as not being HTTPS-capable.
{{cite conference}}: CS1 maint: multiple names: authors list (link){{cite conference}}: CS1 maint: multiple names: authors list (link){{cite conference}}: CS1 maint: multiple names: authors list (link){{cite conference}}: CS1 maint: multiple names: authors list (link)