# What Is DROWN? Definition and Examples

> DROWN is a 2016 cross-protocol attack (CVE-2016-0800) that uses any server supporting SSLv2 to decrypt TLS sessions protected by the same RSA key.

Source: https://ssl.sh/glossary/drown/
Last updated: 2026-11-10

DROWN was disclosed in March 2016 by an academic research team. SSLv2 had been obsolete for many years, but many servers still accepted it, and its export-grade ciphers and handshake flaws turn it into a Bleichenbacher-style padding oracle for [RSA](https://ssl.sh/glossary/rsa/). An attacker records TLS connections that used RSA key exchange, then sends many crafted SSLv2 handshakes to any server holding the same RSA key and uses the responses to decrypt the recorded TLS session. The TLS server itself does not need to support SSLv2; sharing a key or certificate with a server that does is enough.

## Why it matters
DROWN showed that a weak protocol on one port or host can compromise strong TLS elsewhere: a mail server with SSLv2 enabled could expose a web server that never offered it, if both used the same certificate and key. At disclosure, a large share of HTTPS servers was vulnerable, mostly through such key reuse. Mitigation: disable SSLv2 everywhere (OpenSSL removed SSLv2 support in version 1.1.0), avoid sharing [private keys](https://ssl.sh/glossary/private-key/) between services with different configurations, and prefer [ECDHE](https://ssl.sh/glossary/ecdhe/) key exchange, because DROWN decrypts only sessions that used RSA key exchange.

## Example
Check every host and port that uses the same certificate, not only the website:

```bash
nmap --script sslv2 -p 443,25,465,587,993,995 mail.example.com
```

## Common misconceptions
- **My web server does not enable SSLv2, so DROWN cannot affect it.** Any other server using the same RSA key, such as an old mail or VPN server, is enough.
- **TLS 1.2 sessions are immune.** TLS 1.2 sessions that used RSA key exchange were exactly the target; forward-secret ECDHE sessions cannot be decrypted this way.
- **Replacing the certificate fixes it.** Only if the new key is not shared with an SSLv2-enabled host; the root fix is disabling SSLv2.

## Related terms

- [RSA](https://ssl.sh/zh/glossary/rsa/): RSA 是 1977 年提出的公钥算法，TLS 用它对证书和握手进行签名，在 TLS 1.3 之前还用它传输会话密钥。
- [私钥](https://ssl.sh/zh/glossary/private-key/): 私钥是非对称密钥对中保密的那一半，TLS 服务器用它证明自己拥有证书里的那把公钥。
- [密钥交换](https://ssl.sh/zh/glossary/key-exchange/): 密钥交换是 TLS 握手中客户端与服务器建立共享秘密的步骤，保护连接的对称密钥都由这个共享秘密派生而来。
- [ECDHE](https://ssl.sh/zh/glossary/ecdhe/): ECDHE 是椭圆曲线上的临时 Diffie-Hellman 密钥交换，TLS 双方每次握手都生成新的椭圆曲线密钥对，并据此协商出共享密钥。
- [前向保密](https://ssl.sh/zh/glossary/forward-secrecy/): 前向保密是密钥交换的一种安全属性：即使服务器的长期私钥日后泄露，过去连接的会话密钥也不会因此暴露。
- [降级攻击](https://ssl.sh/zh/glossary/downgrade-attack/): 降级攻击是指攻击者迫使客户端和服务器协商出比双方实际支持的更旧的协议版本或更弱的算法，从而利用其中的弱点。
- [ROBOT](https://ssl.sh/zh/glossary/robot/): ROBOT 是 2017 年公布的研究，发现大量 TLS 实现仍存在 1998 年的 Bleichenbacher RSA 填充预言机，攻击者可借此解密 RSA 密钥交换。