4 ms·
Not in any way we've been able to think of — and we've spent a lot of time thinking about this and running it by the crypto community. But, if someone can demon
by eastdakota 11y ago
Not in any way we've been able to think of — and we've spent a lot of time thinking about this and running it by the crypto community. But, if someone can demonstrate such an attack and we can't fix it technically, then we will drop support for the SHA1 fallback. And, on a customer-by-customer basis, we'll allow customer to turn off fallback if they're worried about a theoretical, if undemonstrated, attack.
- yaps8 11y agoCould you elaborate or do you have a source on the technique you use to mitigate downgrade attacks ?
- ryan-c 11y agoNo mitigation is required. Part of the data signed by the server certificate in the handshake is the entire ClientHello message. If a MitM attacker did a downgrade, they would have to change the ClientHello, and then the client would notice that what the server signed does not match what they sent.