22.2 FREAK
FREAK stands for Factoring RSA Export Keys. The attack was discovered in 2017 ([27]) and can be seen as a variant of the cipher suite downgrade attack shown in Figure 20.1 with respect to RSA as a key establishment mechanism. It works if server Alice supports weak, export-grade RSA cipher suites. Interestingly, client Bob may even support only strong RSA cipher suites for the attack to work.
More specifically, in the FREAK attack, Mallory modifies the cipher suite list sent by the client to be
and forwards it to the server.
If the server accepts this cipher suite and sends a corresponding ServerHello back, Mallory modifies it to a stronger, non-export RSA cipher suite, as follows:
The client now ought to use the strong RSA public key contained in the server’s certificate for securely transporting PreMasterSecret to the server. However, along with its certificate, the server also sends a ServerKeyExchange message containing an ephemeral export-grade RSA public...
