20.1 Downgrade attacks
As we have seen in Chapter 18, TLS Cipher Suites, the TLS protocol allows Alice and Bob to negotiate cryptographic settings for the TLS connection they want to establish.
The ability to negotiate cryptographic parameters has a twofold benefit. First, it ensures maximum possible compatibility in the heterogeneous landscape of TLS endpoints. As long as Alice and Bob share a single TLS cipher suite, they both support and a single security setting they are willing to accept – for instance, that server Alice authenticates herself using a certificate and client Bob does not need to authenticate himself – they will be able to establish a TLS connection.
Second, it enables cryptographic agility. Without negotiation, all TLS clients on the internet would have to transition to the new cryptographic algorithm at once, or else parts of the TLS ecosystem would stop working. With negotiation, this transition can happen gradually, allowing a grace period during...