# TLS弱密码套件协商：服务器允许导出级密码导致降级攻击

- **ID:** `security/tls-weak-cipher-downgrade`
- **领域:** security
- **类别:** protocol_error
- **错误码:** `SSL_WEAK_CIPHER`
- **验证级别:** ai_generated
- **修复率:** 88%

## 根因

TLS服务器支持已弃用的密码套件（如EXPORT、DES、RC4）或允许协议降级至TLS 1.0/1.1，使中间人攻击者可以强制使用弱加密。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| OpenSSL 1.1.1 | active | — | — |
| nginx 1.20.0 | active | — | — |
| Apache httpd 2.4.48 | active | — | — |

## 解决方案

1. ```
   Disable all weak cipher suites and enforce TLS 1.2+ only. Example nginx config: ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:...'; ssl_prefer_server_ciphers on;
   ```
2. ```
   Use a tool like Mozilla SSL Configuration Generator to produce a hardened configuration, then test with sslyze or testssl.sh
   ```
3. ```
   Enable TLS 1.3 support which mandates strong ciphers and provides downgrade protection via the ServerHello random value
   ```

## 无效尝试

- **** — Weak ciphers like RC4 and DES are still supported in TLS 1.1 and 1.2, allowing downgrade. (70% 失败率)
- **** — Does not fix the server configuration; attackers can use different IPs or proxies. (90% 失败率)
- **** — HSTS only protects against SSL stripping, not cipher suite downgrade within the same protocol. (60% 失败率)