DROWN

cryptographysecurity

A 2016 attack that breaks TLS by exploiting a server's support for obsolete SSLv2.

Decrypting RSA with Obsolete and Weakened eNcryption used a still-enabled SSLv2 endpoint sharing the same RSA key as a cross-protocol oracle to decrypt modern TLS sessions. The lesson was to fully disable SSLv2 everywhere a key is used.

DROWN broke modern TLS connections by attacking an obsolete protocol running somewhere else. If a server still supported SSLv2 anywhere, even on a different port or a different service sharing the same certificate and key, an attacker could use that weak endpoint as an oracle to decrypt sessions from the modern, correctly configured one.

That cross-protocol shape is the lesson. The vulnerable server did not have to be the one under attack; it only had to share key material. Mail servers were a common culprit, because a certificate reused across web and mail meant a forgotten SSLv2-capable mail daemon undermined the website nobody thought was related to it.

The remediation is the general principle it demonstrates: an obsolete protocol is not disabled until it is disabled everywhere the key appears, and key reuse across services silently couples their security. Inventory is the actual defence, which is unglamorous and is why this class keeps recurring. Anyone confident their TLS configuration is modern should confirm what else holds the same private key.

Also known as: DROWN, Decrypting RSA with Obsolete and Weakened eNcryption, CVE-2016-0800

← All glossary entries