BEAST (Browser Exploit Against SSL/TLS)

BEAST was demonstrated by Thai Duong and Juliano Rizzo in 2011, turning a weakness described years earlier into a practical attack. In SSL 3.0 and TLS 1.0, each CBC-encrypted record uses the last ciphertext block of the previous record as its IV, so the next IV is predictable. An attacker who can inject chosen plaintext into the victim's connection, for example through script running in the browser, and observe the ciphertext can test guesses about a secret such as a session cookie one byte at a time.

Why it matters

TLS 1.1 had already fixed the problem with an explicit IV per record, but in 2011 few servers or browsers supported it. Browsers responded with client-side mitigations, notably 1/n-1 record splitting, which makes the effective IV unpredictable again. Many server operators were told to prefer RC4 to avoid CBC, advice that backfired when RC4 itself was broken and later prohibited by RFC 7465. Today BEAST is simply one more reason to disable TLS 1.0, which major browsers removed in 2020 and RFC 8996 formally deprecated in 2021.

Example

ssl_protocols TLSv1.2 TLSv1.3;   # no SSL 3.0 or TLS 1.0, so no BEAST exposure

Vulnerability scanners may still flag "BEAST" on servers that enable TLS 1.0 with CBC cipher suites.

Common misconceptions

• The fix for BEAST is to prefer RC4. That was a stopgap from 2011, and RC4 is now prohibited. Disable TLS 1.0 instead.
• BEAST breaks all CBC cipher suites. It depends on predictable IVs, which TLS 1.1 and 1.2 do not have; CBC has other weaknesses there, but BEAST is not one of them.
• Servers need a patch to stop BEAST. The mitigation shipped in clients; on the server side the relevant step is removing SSL 3.0 and TLS 1.0.