Hacker News Reader

The flip side is: Just imagine if Kerberos 1.0 with 40-bit DES was baked into X11 or even IPv4. We'd still be fighting those downgrade attacks. Or maybe we'd be layering real encryption over the broken-but-unremovable encryption, with all the overhead that entails.

View on HN

True enough, but unless there is some way humanity is going to jump immediately to perfect protocols, then then the tradeoff between backwards-compatibility and downgrade attacks was always going to be with us.

The mere lack of any kind of encryption in our basic protocols can be considered the most important "downgrade attack" around since we never are quite sure when something is going to leak out into the huge background of plaintext.

Why do you think that is true? Cipher suite selection and whitelisting is not a new thing--even if plaintext with CRC32 is in the mix--we deal with it successfully enough in TLS and SSH all the time.

“we deal with it successfully enough in TLS and SSH all the time”

Not quite. Downgrade attacks has been a huge problem for TLS.

Reply on news.ycombinator.com