21.2 POODLE
POODLE stands for Padding Oracle On Downgraded Legacy Encryption and was discovered in 2014 by Möller, Duong, and Kotowicz [122]. The name shows that the attack combines two other attacks described in Chapter 19, Attacks on Cryptography, and in Chapter 20, Attacks on the TLS Handshake Protocol, namely the padding oracle attack and the protocol downgrade attack. By exploiting some characteristics of SSL 3.0, Möller et al. could turn these two into one of the most severe attacks on TLS.
Basically, POODLE is an attack on SSL3.0. Although at the time the attack was published, the underlying weakness was already fixed in TLS 1.2 by introducing authenticated encryption into the TLS Record protocol, the attack remained relevant because of the downgrade dance explained in the previous chapter.
21.2.1 Attacker model
At the heart of the problem lies the MAC-then-encrypt construction deployed by SSL 3.0 described in Chapter 15, Authenticated Encryption...
