Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
DROWN attack
open-in-new
<h2 id="details">Details</h2> <p>DROWN is an acronym for "Decrypting RSA with Obsolete and Weakened eNcryption".<a class="footnote-ref" id="fnref:7" href="#fn:7"><sup>7</sup></a> It exploits a vulnerability in the combination of protocols used and the configuration of the server, rather than any specific implementation error. According to the discoverers, the exploit cannot be fixed by making changes to client software such as web browsers.<a class="footnote-ref" id="fnref:8" href="#fn:8"><sup>8</sup></a> </p><p>The exploit includes a <a href="/facts/Chosen-ciphertext_attack/l9fL7fYR">chosen-ciphertext attack</a> with the use of a SSLv2 server as a <a href="/facts/Adaptive_chosen-ciphertext_attack/SCKGPjI6">Bleichenbacher oracle</a>. SSLv2 worked by encrypting the master secret directly using RSA, and 40-bit export ciphersuites worked by encrypting only 40-bit of the master secret and revealing the other 88-bits as plaintext. The 48-byte SSLv3/TLS encrypted RSA ciphertext is "trimmed" to 40-bit parts and is then used in the SSLv2 ClientMasterKey message, which the server treats as the 40-bit part of the SSLv2 master secret (the other 88 bits can be any value sent by the client as plaintext). By brute forcing the 40-bit encryption, the ServerVerify message can be used as the oracle. The proof-of-concept attack demonstrated how both multi-GPU configurations and commercial <a href="/facts/Cloud_computing/guhg0FGV">cloud computing</a> could perform part of the codebreaking calculations, at a cost of around $18,000 for the GPU setup and a per-attack cost of $400 for the cloud. A successful attack will provide the session key for a captured TLS handshake. </p><p>The investigators, who described the attack above as the <i>general DROWN attack</i> also found a specific weakness in the OpenSSL implementation of SSLv2 that allowed what they called a <i>special DROWN</i> attack. This vastly reduced the effort required to break the encryption, making real-time <a href="/facts/Man-in-the-middle_attack/dx4cojdz">man-in-the-middle attacks</a> possible that required only modest computing resources. The OpenSSL implementation of SSLv2 until 2015 did not check that the clear and encrypted key lengths are correct, allowing for example only 8-bit of the master secret to be encrypted. Until 2015, OpenSSL would also overwrite the wrong bytes in the SSLv2 master secret during its attempt at the Bleichenbacher countermeasure. Until 2016, OpenSSL would also happily negotiate disabled SSLv2 ciphersuites. Unlike SSLv3 and later, in SSLv2 the client was supposed to choose from a list of ciphersuites offered by the server but OpenSSL would allow use of unlisted ciphersuites. </p><p>The original reporters of the bug were the security researchers Nimrod Aviram and Sebastian Schinzel.<a class="footnote-ref" id="fnref:9" href="#fn:9"><sup>9</sup></a> </p> <h2 id="mitigation">Mitigation</h2> <p>To protect against DROWN, server operators need to ensure that their private keys are not used anywhere with server software that allows SSLv2 connections. This includes web servers, SMTP servers, IMAP and POP servers, and any other software that supports SSL/TLS.<a class="footnote-ref" id="fnref:10" href="#fn:10"><sup>10</sup></a> </p><p>The <a href="/facts/OpenSSL/aXvs5fo2">OpenSSL</a> group has released a security advisory, and a set of patches intended to mitigate the vulnerability by removing support for obsolete protocols and ciphers.<a class="footnote-ref" id="fnref:11" href="#fn:11"><sup>11</sup></a> However, if the server's certificate is used on other servers that support SSLv2, it is still vulnerable, and so are the patched servers. </p><p>Numerous sources have recommended that the vulnerability be patched as soon as possible by site operators. </p> <h2 id="external-links">External links</h2> <ul><li><a href="https://drownattack.com">Official website</a></li> <li><a href="https://drownattack.com/drown-attack-paper.pdf">Technical paper</a></li> <li><a href="https://www.cyberwatch.fr/en/vulnerabilities/CVE-2016-0800">List of security notices</a> <a href="https://web.archive.org/web/20180719233834/https://www.cyberwatch.fr/en/vulnerabilities/CVE-2016-0800">Archived</a> 2018-07-19 at the <a href="/facts/Wayback_Machine/nmQ3a6JC">Wayback Machine</a></li></ul> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>Leyden, John (1 March 2016). "One-third of all HTTPS websites open to DROWN attack". The Register. Retrieved 2016-03-02. <a href="https://www.theregister.co.uk/2016/03/01/drown_tls_protocol_flaw/" target="_blank">https://www.theregister.co.uk/2016/03/01/drown_tls_protocol_flaw/</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>Goodin, Dan (1 March 2016). "More than 11 million HTTPS websites imperiled by new decryption attack". Ars Technica. Retrieved 2016-03-02. <a href="https://arstechnica.com/security/2016/03/more-than-13-million-https-websites-imperiled-by-new-decryption-attack/" target="_blank">https://arstechnica.com/security/2016/03/more-than-13-million-https-websites-imperiled-by-new-decryption-attack/</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> <li id="fn:3"><p>Nimrod Aviram, Sebastian Schinzel, Juraj Somorovsky, Nadia Heninger, Maik Dankel, Jens Steube, Luke Valenta, David Adrian, J. Alex Halderman, Viktor Dukhovni, Emilia Käsper, Shaanan Cohney, Susanne Engels, Christof Paar, and Yuval Shavitt. DROWN: Breaking TLS using SSLv2, 2016 <a href="/wiki/Nadia_Heninger" target="_blank">/wiki/Nadia_Heninger</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li> <li id="fn:4"><p>Nimrod Aviram, Sebastian Schinzel, Juraj Somorovsky, Nadia Heninger, Maik Dankel, Jens Steube, Luke Valenta, David Adrian, J. Alex Halderman, Viktor Dukhovni, Emilia Käsper, Shaanan Cohney, Susanne Engels, Christof Paar, and Yuval Shavitt. DROWN: Breaking TLS using SSLv2, 2016 <a href="/wiki/Nadia_Heninger" target="_blank">/wiki/Nadia_Heninger</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li> <li id="fn:5"><p>"National Cyber Awareness System Vulnerability Summary for CVE-2016-0800". web.nvd.nist.gov. Retrieved 2016-03-02. <a href="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0800" target="_blank">https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0800</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li> <li id="fn:6"><p>"DROWN Attack". drownattack.com. Retrieved 2016-03-24. <a href="https://drownattack.com/" target="_blank">https://drownattack.com/</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li> <li id="fn:7"><p>"New TLS decryption attack affects one in three servers due to legacy SSLv2 support". PCWorld. Retrieved 2016-03-02. <a href="http://www.pcworld.com/article/3039369/new-tls-decryption-attack-affects-one-in-three-servers-due-to-legacy-sslv2-support.html" target="_blank">http://www.pcworld.com/article/3039369/new-tls-decryption-attack-affects-one-in-three-servers-due-to-legacy-sslv2-support.html</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></p></li> <li id="fn:8"><p>Nimrod Aviram, Sebastian Schinzel, Juraj Somorovsky, Nadia Heninger, Maik Dankel, Jens Steube, Luke Valenta, David Adrian, J. Alex Halderman, Viktor Dukhovni, Emilia Käsper, Shaanan Cohney, Susanne Engels, Christof Paar, and Yuval Shavitt. DROWN: Breaking TLS using SSLv2, 2016 <a href="/wiki/Nadia_Heninger" target="_blank">/wiki/Nadia_Heninger</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></p></li> <li id="fn:9"><p>"DROWN - Cross-protocol attack on TLS using SSLv2 - CVE-2016-0800 - Red Hat Customer Portal". access.redhat.com. Retrieved 2016-03-02. <a href="https://access.redhat.com/security/vulnerabilities/drown" target="_blank">https://access.redhat.com/security/vulnerabilities/drown</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></p></li> <li id="fn:10"><p>"DROWN Attack". 1 March 2016. <a href="https://drownattack.com/#mitigation" target="_blank">https://drownattack.com/#mitigation</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></p></li> <li id="fn:11"><p>"Cross-protocol attack on TLS using SSLv2 (DROWN) (CVE-2016-0800)". OpenSSL. 1 March 2016. <a href="https://www.openssl.org/news/secadv/20160301.txt" target="_blank">https://www.openssl.org/news/secadv/20160301.txt</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></p></li> </ol>