Everything about Downgrade attack
Cryptographic attack that forces the use of weaker or no encryption
A downgrade attack, also called a bidding-down attack, or version rollback attack, is a form of cryptographic attack on a computer system or communications protocol that makes it abandon a high-quality mode of operation in favor of an older, lower-quality mode of operation that is typically provided for backward compatibility with older systems. An example of such a flaw was found in OpenSSL that allowed the attacker to negotiate the use of a lower version of TLS between the client and server. This is one of the most common types of downgrade attacks. Wikipedia →
🧭 Start here: a 6-step reading path
- Read the overview: Downgrade attackA 5-minute orientation
- Skim a recent paper: Security Symmetry in Embedded Systems: Using Microsoft Defender for IoT to Detect Firmware Downgrade AttacksInfluential work since 2022
- Pick up a classic book: Local journalism and local mediaThe most-reprinted book on the subject
- Read the landmark paper: Solving Downgrade and DoS Attack Due to the Four Ways Handshake Vulnerabilities (WIFI)Cited 1 times
- Go sideways: Transport Layer SecurityA closely related topic
- Go sideways: Man-in-the-middle attackA closely related topic
📖 Definitions
No dictionary entry for this exact phrase.
🗂️ The subject at a glance
🏆 Landmark papers (most cited)
Solving Downgrade and DoS Attack Due to the Four Ways Handshake Vulnerabilities (WIFI)
A Hybrid Post-Quantum Cryptography and Machine Learning and Framework for Intrusion Detection and Downgrade Attack Prevention throughout PQC Migration
Legacy Encryption Downgrade Attacks against LibrePGP and CMS
🆕 Influential since 2022
📚 Books worth reading
Local journalism and local mediaBob Franklin · 2006- 📕Egypt and the second Palestinian intifadaRami Ginat · 2011
- 📕Some of my best friendsBen Cohen · 2014
A TOUR OF THE WORLDMalik Mansab Khan, Muhammad Rafique Abdul Aziz · 2025
Ranked by number of editions on Open Library, a rough measure of how lasting a book is.
🔗 Related topics
- Transport Layer Security Transport Layer Security (TLS) is a cryptographic protocol designed to provide secured communications over a computer network, such as the Internet. The…
- Man-in-the-middle attack In information security, a man-in-the-middle (MITM) attack, or on-path attack, is a scenario where an attacker secretly relays and possibly alters the…
- HTTPS Hypertext Transfer Protocol Secure (HTTPS) is an extension of the Hypertext Transfer Protocol (HTTP). It uses encryption for secure communication over…
- HTTP Strict Transport Security HTTP Strict Transport Security (HSTS) is a policy mechanism that helps to protect websites against man-in-the-middle attacks such as protocol downgrade…
- Cipher suite A cipher suite is a set of algorithms that help secure a network connection. Suites typically use Transport Layer Security (TLS) or its deprecated predecessor…
- Obfuscated TCP Obfuscated TCP (ObsTCP) was a proposal for a transport layer protocol which implements opportunistic encryption over Transmission Control Protocol (TCP)…
- Padding oracle attack In cryptography, a padding oracle attack is an attack which uses the padding validation of a cryptographic message to decrypt the ciphertext. In cryptography…
- Opportunistic TLS Opportunistic TLS (Transport Layer Security) refers to extensions in plain text communication protocols, which offer a way to upgrade a plain text connection…