Does the DROWN attack enable breaking strong RSA keys (e.g. the 2048-bit key itself) or enable breaking the plaintext (i.e. pre-master key) that is encrypted with a 2048-bit (or any strong) RSA, if the key is shared with SSLv2 server?


It breaks the secret key (master secret) that is encrypted using RSA; this secret key is the plaintext message; it is not the RSA private key.

Padding oracle attacks (DROWN uses a special form of the Bleichenbacher padding oracle attack) generally only attack the plaintext message, not the secret or private key used to create the ciphertext.

  • $\begingroup$ But if you have been vulnerable to this attack then I'd still recommend to switch out your private key, especially if it was stored in software. It is clear that the private key was used in an incorrectly configured system. $\endgroup$
    – Maarten Bodewes
    Sep 18 '18 at 0:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.