Saint DROWN, Who Drowned TLS in the Past

Patron of protocols that should have been switched off, keys reused in two places, and SSLv2.

Life

On 1 March 2016 an international group of cryptographers revealed DROWN, CVE-2016-0800. If any server anywhere still accepted the old SSLv2 with the same RSA key used elsewhere, an attacker could decrypt the modern TLS traffic of a different server. According to the researchers, about a third of all HTTPS servers were vulnerable at the time of the announcement.

Prayer

O Saint DROWN, who brings buried protocols back to the surface, keep SSLv2 switched off and our keys from travelling server to server. Amen.

How to celebrate

Celebrated by disabling SSLv2 everywhere, updating OpenSSL to 1.0.2g or 1.0.1s, and never reusing the same key.

A protocol you thought was dead drowns the living.