Also while the attack is novel it is hard to launch in practice (requires MITM) and even if you manage to pull that off, there isn't much to be gained (even wit

Also while the attack is novel it is hard to launch in practice (requires MITM) and even if you manage to pull that off, there isn't much to be gained (even with the downgrade for authenticated data to use SHA1 as it isn't practical to attack an interactive session).