# What Is BEAST (Browser Exploit Against SSL/TLS)?

> BEAST is a 2011 attack (CVE-2011-3389) on CBC encryption in SSL 3.0 and TLS 1.0 that exploits predictable IVs to decrypt secrets such as cookies.

Source: https://ssl.sh/glossary/beast/
Last updated: 2026-11-10

BEAST was demonstrated by Thai Duong and Juliano Rizzo in 2011, turning a weakness described years earlier into a practical attack. In SSL 3.0 and [TLS 1.0](https://ssl.sh/glossary/tls-1-0/), each CBC-encrypted record uses the last ciphertext block of the previous record as its IV, so the next IV is predictable. An attacker who can inject chosen plaintext into the victim's connection, for example through script running in the browser, and observe the ciphertext can test guesses about a secret such as a session cookie one byte at a time.

## Why it matters
[TLS 1.1](https://ssl.sh/glossary/tls-1-1/) had already fixed the problem with an explicit IV per record, but in 2011 few servers or browsers supported it. Browsers responded with client-side mitigations, notably 1/n-1 record splitting, which makes the effective IV unpredictable again. Many server operators were told to prefer [RC4](https://ssl.sh/glossary/rc4/) to avoid CBC, advice that backfired when RC4 itself was broken and later prohibited by RFC 7465. Today BEAST is simply one more reason to disable TLS 1.0, which major browsers removed in 2020 and RFC 8996 formally deprecated in 2021.

## Example
```nginx
ssl_protocols TLSv1.2 TLSv1.3;   # no SSL 3.0 or TLS 1.0, so no BEAST exposure
```

Vulnerability scanners may still flag "BEAST" on servers that enable TLS 1.0 with CBC cipher suites.

## Common misconceptions
- **The fix for BEAST is to prefer RC4.** That was a stopgap from 2011, and RC4 is now prohibited. Disable TLS 1.0 instead.
- **BEAST breaks all CBC cipher suites.** It depends on predictable IVs, which TLS 1.1 and 1.2 do not have; CBC has other weaknesses there, but BEAST is not one of them.
- **Servers need a patch to stop BEAST.** The mitigation shipped in clients; on the server side the relevant step is removing SSL 3.0 and TLS 1.0.

## Related terms

- [TLS 1.0](https://ssl.sh/zh/glossary/tls-1-0/): TLS 1.0 是传输层安全协议的第一个版本，1999 年以 RFC 2246 发布，2021 年被 RFC 8996 正式废弃，主流浏览器已不再支持。
- [TLS 1.1](https://ssl.sh/zh/glossary/tls-1-1/): TLS 1.1 是 2006 年以 RFC 4346 发布的 TLS 第二个版本，主要为 CBC 加入显式 IV，2021 年与 TLS 1.0 一起被 RFC 8996 废弃。
- [RC4](https://ssl.sh/zh/glossary/rc4/): RC4 是 Ron Rivest 在 1987 年设计的流密码，曾在 SSL/TLS 中广泛使用，因密钥流存在统计偏差，2015 年被 RFC 7465 禁止用于 TLS。
- [POODLE](https://ssl.sh/zh/glossary/poodle/): POODLE 是 2014 年公布的攻击（CVE-2014-3566），利用 SSL 3.0 不校验 CBC 填充的缺陷，从加密连接中逐字节还原 Cookie 等秘密。
- [CRIME](https://ssl.sh/zh/glossary/crime/): CRIME 是 2012 年公布的攻击（CVE-2012-4929），通过观察 TLS 层压缩对密文长度的影响，从加密连接中还原 Cookie 等秘密。
- [密码套件](https://ssl.sh/zh/glossary/cipher-suite/): 密码套件是 TLS 客户端和服务器协商使用的一组命名的加密算法组合，例如 TLS_AES_128_GCM_SHA256，决定连接用什么算法保护数据。