According to the full technical paper of DROWN attack,

A typical scenario requires the attacker to observe 1,000 TLS handshakes, then initiate 40,000 SSLv2 connections and perform 2 50 offline work to decrypt a 2048-bit RSA TLS ciphertext

Among theses 1,000 TLS handshakes, one will contains the premaster secret decrypted, which will be used to retrieve the session key.

However, in my opinion, it will be useless if the TLS handshake is not the last one. In fact, after each TLS handshakes between the client and the server, the premaster secret will be different because the TLS session has refreshed...

Can you explain me why the TLS handshake containing the premaster secret decrypted, even if it's not the last exchanged between the victim and the server, will still serve ?


  • 1
    The goal of DROWN is to decrypt an eavesdropped session, which can be complete, not to tamper or hijack it, which would require it still be open. Obviously this is useful only if the sensitive data in the decrypted session is moderately longterm, such as a login password rather than a session token with a 5-minute timeout. – dave_thompson_085 May 6 '16 at 23:01
  • So, can you explain me why you could use DROWN with MITM ? In that case, it's not only an eavesdropped session... – Duke Nukem May 7 '16 at 10:14
  • There are two MITM variants described in the paper: 'Special' DROWN in section 5 leverages a bug in OpenSSL if the server is using an outdated version to make the oracle much faster, fast enough to be realtime, although still only for a fraction of (victim TLS) handshakes, in which case the one handshake that is broken is still the 'current' one; and an attack on QUIC, a new protocol I haven't used yet and which apparently will be fixed before I do. – dave_thompson_085 May 8 '16 at 22:39
  • Thanks for the answer, "fast enough to be realtime" helped me a lot. Also, when you say "broken", do you mean "stolen" ? – Duke Nukem May 9 '16 at 6:16
  • 'break' and its tenses like 'broken' in cryptography means an unauthorized party (called the adversary or attacker, or more colorful names) defeats the purpose intended to be achieved. Since the TLS handshake intends to establish secrecy (confidentiality) and integrity for subsequent session data, this attack which allows the adversary to learn the premaster secret and thus decrypt the data, and if active/MitM also to tamper with or forge it, is a 'break'. – dave_thompson_085 May 10 '16 at 12:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.