# possible MITM attack against servers that used to support weak DH?

from reading the TLS 1.1 RFC, it looks like it would be possible to break a previously recorded TLS <1.2, 512-bit DHE ServerKeyExchange and then send it (unmodified, with the original, valid signature) to a client that still accepts TLS <1.2 and 512-bit DHE to impersonate a server that has since been fixed (disabling DHE and/or TLS <1.2 entirely) or "fixed" (using a larger DH group). TLS 1.2 seems like it would be immune to this attack, since its ServerKeyExchange signature includes the ClientRandom value. is there something i'm missing, or would this actually work?

-
why is there this link pointing to a flag!? –  SOJPM May 23 at 19:15
what link pointing to a flag? –  lily wilson May 23 at 19:16
https://hotaru.thinkindifferent.net/flags/x, inserted in your last edit. –  SOJPM May 23 at 19:17
oops. apparently i somehow hit 'paste' when i was fixing the fact that my phone put "it's" instead of "its". –  lily wilson May 23 at 19:24
short version of the answer: Read the next page of the RFC. –  SOJPM May 23 at 19:31

On page 44 you'll find that ServerKeyExchange consists of ServerXXXParams params and Signature signed_params. Now on page 44 you'll actually find a definition of Signature. This definition signs sha_hash with or without md5_hash. Now look at the definition of sha_hash and md5_hash. It states that MD5(ClientHello.random + ServerHello.random + ServerParams) is the definition for md5_hash and that SHA(ClientHello.random + ServerHello.random + ServerParams) is the definition of sha_hash.