I read about PODDLE attack which downgrades the TLS version to SSL 3.0 to exploit CBC padding oracle attack. I looked at the specs for TLS 1.1

And found CBC is still used in its ciphersuites. Why is POODLE needs to downgrade to SSL 3? Can't the POODLE attack works by downgrading to TLS 1 or TLS 1.1? Is the CBC implementation in SSL 3 different than that in TLS 1 and TLS 1.1?

up vote 3 down vote accepted

Essentially the reason is that in SSL3 the padding was not specified which was corrected in the specification of TLS. Here is a detailed and readable explanation of the attack.

However, there is a variant of the poodle attack that also works on TLS because the same procedure as for SSL3 could be used on TLS packets. While this was not standard-compliant it would work and some implementations are vulnerable.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.