Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I read about PODDLE attack which downgrades the TLS version to SSL 3.0 to exploit CBC padding oracle attack. I looked at the specs for TLS 1.1
And found CBC is still used in its ciphersuites. Why is POODLE needs to downgrade to SSL 3? Can't the POODLE attack works by downgrading to TLS 1 or TLS 1.1? Is the CBC implementation in SSL 3 different than that in TLS 1 and TLS 1.1?
Essentially the reason is that in SSL3 the padding was not specified which was corrected in the specification of TLS. Here is a detailed and readable explanation of the attack.
However, there is a variant of the poodle attack that also works on TLS because the same procedure as for SSL3 could be used on TLS packets. While this was not standard-compliant it would work and some implementations are vulnerable.
