# What Is ROBOT (Return Of Bleichenbacher's Oracle Threat)?

> ROBOT is a 2017 finding that many TLS implementations still exposed Bleichenbacher's 1998 RSA padding oracle, letting attackers decrypt RSA key exchanges.

Source: https://ssl.sh/glossary/robot/
Last updated: 2026-11-10

ROBOT was published in December 2017 by Hanno Böck, Juraj Somorovsky and Craig Young. In 1998 Daniel Bleichenbacher showed that if a server reveals whether a decrypted RSA PKCS #1 v1.5 message has valid padding, an attacker can use many adaptive queries to decrypt a ciphertext or produce a signature with the server's key. TLS specifications have included countermeasures since then, but the ROBOT team found products from several major vendors, including load balancers and TLS accelerators, that still leaked the oracle through different alerts, timeouts or connection behavior. It is tracked under several vendor-specific CVEs rather than a single one.

## Why it matters
A TLS session that used RSA [key exchange](https://ssl.sh/glossary/key-exchange/) could be decrypted after the fact by an attacker who recorded it and could still query the vulnerable server, and the server's key could be misused to sign data. Patching the affected products closes the specific oracle, but the durable fix is to stop using RSA key exchange: disable suites named `TLS_RSA_WITH_*` (OpenSSL names such as `AES128-GCM-SHA256`) and keep only [ECDHE](https://ssl.sh/glossary/ecdhe/) suites, which also provide [forward secrecy](https://ssl.sh/glossary/forward-secrecy/). TLS 1.3 removed RSA key exchange entirely. RSA certificates remain fine for signatures in ECDHE_RSA suites.

## Example
```bash
nmap --script ssl-enum-ciphers -p 443 example.com | grep 'TLS_RSA_WITH'
```

No output means no RSA key exchange suites are offered. An nginx list with ECDHE only:

```nginx
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
```

## Common misconceptions
- **ROBOT means RSA certificates are broken.** The issue is RSA key exchange (encryption), not RSA signatures; an RSA certificate used with ECDHE is not affected.
- **Bleichenbacher's attack was solved in 1998.** Countermeasures existed, but implementations kept getting the details wrong, which is exactly what ROBOT demonstrated.
- **Only obscure servers were affected.** Products from well-known vendors, and some high-traffic websites, were vulnerable at disclosure.

## Related terms

- [RSA](https://ssl.sh/zh/glossary/rsa/): RSA 是 1977 年提出的公钥算法，TLS 用它对证书和握手进行签名，在 TLS 1.3 之前还用它传输会话密钥。
- [密钥交换](https://ssl.sh/zh/glossary/key-exchange/): 密钥交换是 TLS 握手中客户端与服务器建立共享秘密的步骤，保护连接的对称密钥都由这个共享秘密派生而来。
- [ECDHE](https://ssl.sh/zh/glossary/ecdhe/): ECDHE 是椭圆曲线上的临时 Diffie-Hellman 密钥交换，TLS 双方每次握手都生成新的椭圆曲线密钥对，并据此协商出共享密钥。
- [前向保密](https://ssl.sh/zh/glossary/forward-secrecy/): 前向保密是密钥交换的一种安全属性：即使服务器的长期私钥日后泄露，过去连接的会话密钥也不会因此暴露。
- [DROWN](https://ssl.sh/zh/glossary/drown/): DROWN 是 2016 年公布的跨协议攻击（CVE-2016-0800），借助任何支持 SSLv2 的服务器，解密使用同一 RSA 密钥的 TLS 会话。
- [TLS 1.3](https://ssl.sh/zh/glossary/tls-1-3/): TLS 1.3 是当前最新的传输层安全协议版本（2018 年的 RFC 8446，现行规范为 RFC 9846），完整握手只需一个往返，且只保留 AEAD 加密算法。