A downgrade attack tricks a system into selecting an older, weaker security protocol or algorithm when a stronger option is available. In a TLS handshake, an attacker may push a browser and server toward weaker encryption, risking session or message confidentiality. section 10.1.1 section 6.3.1
The defensive pattern is straightforward:
- Reject obsolete choices rather than retaining them solely for backward compatibility. section 6.3.1
- Prefer modern schemes such as OAEP for RSA encryption; its randomized padding prevents predictable ciphertext patterns. section 6.3.1
- Configure both sides of a secure connection to agree only on approved encryption methods. section 10.1.1
Figure 10.3 The SSL handshake in action: Alice and Bob exchange supported encryption methods, validate identities using certificates, and securely agree on a shared secret used to encrypt all future communication.
The handshake diagram makes the attack surface visible: clients advertise supported methods, and servers select one before certificates and shared-secret protection secure communication. section 10.1.1
