# What Is Downgrade Attack? Definition and Examples

> A downgrade attack forces a client and server to negotiate an older protocol version or weaker cipher than both support, so its weaknesses can be exploited.

Source: https://ssl.sh/glossary/downgrade-attack/
Last updated: 2026-11-10

In a downgrade attack, a man-in-the-middle tampers with negotiation so that both sides settle on something weaker: SSL 3.0 instead of TLS 1.2, export-grade cryptography instead of strong keys, or plaintext instead of TLS. Well-known examples are [POODLE](https://ssl.sh/glossary/poodle/), which exploited browsers' fallback to SSL 3.0, and [FREAK](https://ssl.sh/glossary/freak/) and [Logjam](https://ssl.sh/glossary/logjam/), which forced export-grade RSA and Diffie-Hellman keys. [SSL stripping](https://ssl.sh/glossary/ssl-stripping/) and STARTTLS stripping are downgrades from an encrypted connection to an unencrypted one.

## Why it matters
Keeping an old protocol enabled for compatibility is only as safe as the protection against being pushed into it. Several defenses now exist. The handshake authenticates its transcript in the Finished messages, which detects tampering as long as the negotiated algorithms are strong. TLS_FALLBACK_SCSV (RFC 7507) stopped attackers from abusing browsers' retry-with-an-older-version behavior. In TLS 1.3, a server that negotiates TLS 1.2 or below writes a fixed marker into the last bytes of ServerHello.random, so a TLS 1.3 client can detect a forced rollback. The most reliable defense is still removing what you do not need: SSL 3.0 (RFC 7568), TLS 1.0 and 1.1 (RFC 8996), and export or other weak cipher suites.

## Example
```bash
# a hardened server rejects this (current OpenSSL builds may also refuse TLS 1.1 locally)
openssl s_client -connect example.com:443 -servername example.com -tls1_1 </dev/null

# list every protocol version and cipher suite the server offers
nmap --script ssl-enum-ciphers -p 443 example.com
```

## Common misconceptions
- **Clients always pick the best version, so leaving old ones on is harmless.** That holds only while downgrade protections work, and cross-protocol attacks such as DROWN do not need the client to downgrade at all.
- **TLS 1.3 support alone prevents downgrades.** The rollback signal helps only clients that themselves implement TLS 1.3.
- **Downgrades only concern protocol versions.** Cipher suites, key sizes and even the choice between TLS and plaintext can be downgraded.

## Related terms

- [POODLE](https://ssl.sh/zh/glossary/poodle/): POODLE 是 2014 年公布的攻击（CVE-2014-3566），利用 SSL 3.0 不校验 CBC 填充的缺陷，从加密连接中逐字节还原 Cookie 等秘密。
- [FREAK](https://ssl.sh/zh/glossary/freak/): FREAK 是 2015 年公布的攻击，中间人诱使有漏洞的 TLS 客户端接受可被分解的 512 位出口级 RSA 密钥，从而解密和篡改流量。
- [Logjam](https://ssl.sh/zh/glossary/logjam/): Logjam 是 2015 年公布的攻击（CVE-2015-4000），可把 TLS 降级到 512 位出口级 Diffie-Hellman，并威胁使用过小或被大量共用 DH 参数的服务器。
- [DROWN](https://ssl.sh/zh/glossary/drown/): DROWN 是 2016 年公布的跨协议攻击（CVE-2016-0800），借助任何支持 SSLv2 的服务器，解密使用同一 RSA 密钥的 TLS 会话。
- [SSL 剥离](https://ssl.sh/zh/glossary/ssl-stripping/): SSL 剥离是一种中间人攻击，攻击者截获本应把用户引向 HTTPS 的跳转或链接，让用户一直停留在明文 HTTP 上。
- [TLS 1.3](https://ssl.sh/zh/glossary/tls-1-3/): TLS 1.3 是当前最新的传输层安全协议版本（2018 年的 RFC 8446，现行规范为 RFC 9846），完整握手只需一个往返，且只保留 AEAD 加密算法。
- [中间人攻击](https://ssl.sh/zh/glossary/man-in-the-middle/): 中间人攻击是指攻击者暗中插入通信双方之间，转发并可能篡改流量，而双方都以为自己在直接和对方通信。