The initial TLS handshake agrees on a cipher suite to use, but what stops an attacker from MITM-ing the initial handshake and downgrading the cipher suites?


In short, the Finished message is a hash of the entire handshake, encrypted with the negotiated keys. The negotiated keys are derived by something protected by asymmetric cryptography. Validation of the Finished message validates the transcript of the handshake.

This is probably answered in multiple answers on SE for "How does TLS work?".

|improve this answer|||||

Not the answer you're looking for? Browse other questions tagged or ask your own question.