Downgrade Attack on TLS 1.3 and Vulnerabilities in Major TLS Libraries

As the new version of TLS (1.3) does not offer an RSA key exchange, the exploitation of our attack must first begin with a downgrade to an older version of TLS. Besides protocol downgrades, other techniques exist to force browser clients to fallback onto older TLS versions: network glitches, a spoofed TCP RST packet, a lack of response, etc. (see POODLE)

Continuing with a spoofed TLS 1.2 handshake, we can simply present the server’s RSA certificate in a message and then end the handshake with a message. At this point, if the server does not have a trusted certificate allowing for RSA key exchanges, or if the client refuse to support RSA key exchanges or older versions than TLS 1.2, the attack is stopped.

Source: www.nccgroup.trust