% !TEX root = ../../../proposal.tex
We present DROWN, a novel cross-protocol attack on TLS that uses a server
supporting SSLv2 as an oracle to decrypt modern TLS connections. We introduce
two versions of the attack. The more general form exploits multiple unnoticed
protocol flaws in SSLv2 to develop a new and stronger variant of the
Bleichenbacher RSA padding-oracle attack. To decrypt a 2048-bit RSA TLS
ciphertext, an attacker must observe 1,000 TLS handshakes, initiate 40,000
\ssltwo connections, and perform $2^{50}$ offline work. The victim client
never initiates \ssltwo connections. We implemented the attack and can
decrypt a TLS 1.2 handshake using 2048-bit RSA in under 8 hours, at a cost of
\$440 on Amazon EC2\@. Using Internet-wide scans, we find that 33\% of all
HTTPS servers and 22\% of those with browser-trusted certificates are
vulnerable to this protocol-level attack due to widespread key and
certificate reuse.

For an even cheaper attack, we apply our new techniques together with a newly
discovered vulnerability in OpenSSL that was present in releases from 1998 to
early 2015. Given an unpatched SSLv2 server to use as an oracle, we can
decrypt a TLS ciphertext in one minute on a single CPU---fast enough to
enable man-in-the-middle attacks against modern browsers. We find that 26\%
of HTTPS servers are vulnerable to this attack.

We further observe that the QUIC protocol is vulnerable to a variant of our
attack that allows an attacker to impersonate a server indefinitely after
performing as few as $2^{17}$ \ssltwo connections and $2^{58}$ offline work.

We conclude that \ssltwo is not only weak, but actively harmful to the TLS ecosystem.

