DROWN: Breaking TLS Using SSLv2
summary
Demonstrates DROWN, a cross‑protocol exploit that uses an SSLv2 server sharing an RSA key as an oracle to decrypt modern TLS sessions. Two variants: the general attack observes ~1,000 TLS handshakes, opens ~40,000 SSLv2 connections and does ~2^50 offline work to recover a 2048-bit RSA premaster (implemented to decrypt TLS 1.2 in under 8 hours for ~$440), and a faster OpenSSL bug variant decrypts in one minute on a single CPU. Internet scans find 33% of HTTPS servers vulnerable (22% with browser‑trusted certs); a QUIC variant requires ~2^17 SSLv2 connections and ~2^58 offline work.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:25A history of obsolete crypto
- 1:42Our results: SSLv2 breaks TLS
- 2:43DROWN - Overview
- 4:30TLS RSA Handshake
- 6:38PKCS#1 v1.5
- 7:59Bleichenbacher's Attack
- 10:23Differences between SSLv2 and TLS
- 13:39An important observation
- 14:39The SSLv2 RSA Decryption Oracle
- 16:05DROWN: Attack Outline
- 17:09Offline work • Attacker executes 10K queries, breaks 40-bit key for each Bleichenbacher query.
- 20:32Impact of Key Reuse
related talks
44mThe DROWN Attack
51mA Retrospective on the Use of Export Cryptography
01h 26mTLS Cryptography for Programmers
49mBar-Mitzva Attack: Breaking SSL with 13-Year Old RC4 Weakness
45mUnlocking The Secrets Of TLS
55mUnlocking The Secrets Of TLS
19mWhat's happening in TLS (transport layer security)?
44mCryptography in the age of Heartbleed