20.6 Improvements of Bleichenbacher’s attack
After its publication in 1998, it quickly became clear that Bleichenbacher’s attack could be extended on various levels to yield even more practical attacks on TLS.
20.6.1 Bad version oracles
In 2003, Klima, Pokorny, and Rosa published a practical attack on RSA-based TLS sessions that extracts the TLS pre-master secret from a TLS 1.0 handshake [101]. Their attack extends Bleichenbacher’s attack by exploiting the TLS version number check over PKCS #1 plaintexts as an oracle.
As shown in Figure 20.3, a TLS message with the correct PKCS #1 padding contains two bytes that denote the TLS version. These bytes were originally introduced to thwart so-called version rollback attacks where Mallory tries to trick Alice into switching to an older TLS version, preferrably – from Mallory’s perspective – with weaker cryptographic algorithms or shorter and, therefore, fewer secure keys.
Klima, Pokorny, and...