中文

Glossary

Downgrade Attack (protocol downgrade, version rollback)

Last verified

Definition

A downgrade attack forces a client and server to negotiate an older protocol version or weaker cipher than both support, so its weaknesses can be exploited.

In a downgrade attack, a man-in-the-middle tampers with negotiation so that both sides settle on something weaker: SSL 3.0 instead of TLS 1.2, export-grade cryptography instead of strong keys, or plaintext instead of TLS. Well-known examples are POODLE, which exploited browsers' fallback to SSL 3.0, and FREAK and Logjam, which forced export-grade RSA and Diffie-Hellman keys. SSL stripping and STARTTLS stripping are downgrades from an encrypted connection to an unencrypted one.

Why it matters

Keeping an old protocol enabled for compatibility is only as safe as the protection against being pushed into it. Several defenses now exist. The handshake authenticates its transcript in the Finished messages, which detects tampering as long as the negotiated algorithms are strong. TLS_FALLBACK_SCSV (RFC 7507) stopped attackers from abusing browsers' retry-with-an-older-version behavior. In TLS 1.3, a server that negotiates TLS 1.2 or below writes a fixed marker into the last bytes of ServerHello.random, so a TLS 1.3 client can detect a forced rollback. The most reliable defense is still removing what you do not need: SSL 3.0 (RFC 7568), TLS 1.0 and 1.1 (RFC 8996), and export or other weak cipher suites.

Example

# a hardened server rejects this (current OpenSSL builds may also refuse TLS 1.1 locally)
openssl s_client -connect example.com:443 -servername example.com -tls1_1 </dev/null

# list every protocol version and cipher suite the server offers
nmap --script ssl-enum-ciphers -p 443 example.com

Common misconceptions

  • Clients always pick the best version, so leaving old ones on is harmless. That holds only while downgrade protections work, and cross-protocol attacks such as DROWN do not need the client to downgrade at all.
  • TLS 1.3 support alone prevents downgrades. The rollback signal helps only clients that themselves implement TLS 1.3.
  • Downgrades only concern protocol versions. Cipher suites, key sizes and even the choice between TLS and plaintext can be downgraded.

See also