How did I miss this. Today, I noticed SSLLabs was doing a new experimental vulnerability test called DROWN. I went looking for more info and found it on Matthew Green’s blog:
“To every thing there is a season. And in the world of cryptography, today we have the first signs of the season of TLS vulnerabilities.
This year’s season is off to a roaring start with not one, but two serious bugs announcements by the OpenSSL project, each of which guarantees that your TLS connections are much less than private than you’d like them to be.”
http://blog.cryptographyengineering.com/2016/03/attack-of-week-drown.html
When SSL was going down via POODLE, we started fretting about what would happen if unpatchable vulnerabilities started to show up in TLS when BEAST attacks were occurring at the same time. Unlike SSL there is nothing to replace TLS.
