It seems like the main idea is the same for both the vulnerabilities then what is the difference?

  • $\begingroup$ SO what are the main ideas, what are the conclusions? $\endgroup$
    – kelalaka
    Apr 19 '20 at 4:57

This attacks are quite similar since they both target TLS handshake and exploit a padding oracle on RSA decryption. However, the way the attacker access this oracle is quite different.

DROWN attack

In this attack, the authors assume that the server uses the same RSA key for both TLS and SSLv2. We can have this situation, for instance, if the server still supports SSLv2 (which is bad but quite common according to the paper), or if the key is shared with another server supporting SSLv2 (sharing keys is never a good idea...). Since SSLv2 is badly flawed, an attacker can use it to access the oracle and perform an improved Bleichenbacher attack on a message coming from the TLS handshake.

Bottom line: the attacker does not attack TLS per se, but the fact that the same key is used in a weaker protocol. This can be qualified as a cross-protocol attack, induced by poor key management and/or server misconfigurations.


Here, there is no need to assume key sharing or support of weaker protocols. The authors developed a systematic tool to scan TLS implementations in the wild and see if they can obtain a padding oracle by various means (error codes, no response in case of error, ...). They found out that a lot of widespread implementations provide a padding oracle during the TLS handshake, meaning the Bleichenbacher vulnerability is still present, even in up to date implementations.

All implementations did not provide a "good enough" oracle to exploit the attack in a reasonable time, but still, this vulnerability should have been long gone.

TL;DR: The core attack is quite similar, but DROWN is a cross-protocol attack between TLS and SSLv2, whereas ROBOT point out that TLS by it self is still vulnerable.

  • $\begingroup$ I think you mean SSLv2, not SSHv2. $\endgroup$ Apr 19 '20 at 16:21
  • $\begingroup$ Obviously ;-) Thanks, I edited it ! $\endgroup$
    – Faulst
    Apr 19 '20 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.