ALT-21 · Paper · 23 Oct 2026
DROWN: how a dead protocol broke a live one
Servers that still accepted SSLv2 — even on another port, even on another machine sharing the key — let attackers decrypt modern TLS. A third of HTTPS servers were exposed in 2016.
- 1996SSLv3 replaces SSLv2, which is known to be weak.
- 2011RFC 6176 prohibits SSLv2.
- Mar 2016DROWN disclosed as CVE-2016-0800.
- Of all HTTPS servers vulnerable at disclosure
- 33%drownattack.com
- Of the top one million domains
- 25%drownattack.com
How it worked
SSLv2's handshake leaks information about RSA decryptions. An attacker who records a modern TLS session and can talk SSLv2 to any server holding the same private key can use thousands of crafted SSLv2 probes to recover the TLS session key.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- A key is only as strong as the weakest protocol it is used with — anywhere.
- Reusing one certificate across services joins their fates.
- “Nobody uses that anymore” is not the same as “it is turned off”.
What it means for you
- Disable SSLv2 and SSLv3 everywhere, including mail and legacy services.
- Do not share private keys between unrelated services.
- Inventory every endpoint that presents your certificates.
Sources
Altumptic was not involved in this research. Figures are as published by the sources above.
Cite this entry
Altumptic Lab (2026). ALT-21 — DROWN: how a dead protocol broke a live one. 23 Oct 2026. altumptic.com/research/drown-2016