Downgrade Resilience in Key-Exchange Protocols

Karthikeyan Bhargavan, Christina Brzuska, Cédric Fournet, Matthew Green, Markulf Kohlweiss, Santiago Zanella Béguelin

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract / Description of output

Key-exchange protocols such as TLS, SSH, IPsec, and ZRTP are highly configurable, with typical deployments supporting multiple protocol versions, cryptographic algorithms and parameters. In the first messages of the protocol, the peers negotiate one specific combination: the protocol mode, based on their local configurations. With few notable exceptions, most cryptographic analyses of configurable protocols consider a single mode at a time. In contrast, downgrade attacks, where a network adversary forces peers to use a mode weaker than the one they would normally negotiate, are a recurrent problem in practice. How to support configurability while at the same time guaranteeing the preferred mode is negotiated? We set to answer this question by designing a formal framework to study downgrade resilience and its relation to other security properties of key-exchange protocols. First, we study the causes of downgrade attacks by dissecting and classifying known and novel attacks against widely used protocols. Second, we survey what is known about the downgrade resilience of existing standards. Third, we combine these findings to define downgrade security, and analyze the conditions under which several protocols achieve it. Finally, we discuss patterns that guarantee downgrade security by design, and explain how to use them to strengthen the security of existing protocols, including a newly proposed draft of TLS 1.3.
Original languageEnglish
Title of host publicationIEEE Symposium on Security and Privacy, SP 2016, San Jose, CA, USA, May 22-26, 2016
Place of PublicationSan Jose, CA, United States
PublisherInstitute of Electrical and Electronics Engineers (IEEE)
Number of pages20
ISBN (Electronic)978-1-5090-0824-7
ISBN (Print)978-1-5090-0825-4
Publication statusPublished - 2016
Event2016 IEEE Symposium on Security and Privacy - The Fairmont, San Jose, CA, United States
Duration: 23 May 201625 May 2016


Conference2016 IEEE Symposium on Security and Privacy
Country/TerritoryUnited States
CitySan Jose, CA
Internet address


Dive into the research topics of 'Downgrade Resilience in Key-Exchange Protocols'. Together they form a unique fingerprint.

Cite this