TLS versions 1.0 and 1.1 are affected by a large number of protocol and implementation vulnerabilities that have been published by security researchers in the last two decades. Attacks like u003cstrongu003eROBOTu003c/strongu003e affected the RSA key exchange algorithm, while u003cstrongu003eLogJamu003c/strongu003e and u003cstrongu003eWeakDHu003c/strongu003e showed that many TLS servers could be tricked into using incorrect parameters for other key exchange methods. Compromising a key exchange allows attackers to completely compromise network security and decrypt conversations.u003cbr/u003eu003cbr/u003eAttacks on symmetric ciphers, such as u003cstrongu003eBEASTu003c/strongu003e or u003cstrongu003eLucky13u003c/strongu003e, have demonstrated that various ciphers supported in TLS 1.2 and earlier, with examples including u003cstrongu003eRC4u003c/strongu003e or u003cstrongu003eCBC-modeu003c/strongu003e ciphers, are not secure.u003cbr/u003eu003cbr/u003eEven signatures were affected, with u003cstrongu003eBleichenbacher’s RSA signature forgeryu003c/strongu003e attack and other similar padding attacks.u003cbr/u003eu003cbr/u003eMost of these attacks have been mitigated in TLS 1.2 (provided that TLS instances are configured correctly), even though TLS 1.2 is still vulnerable to u003ca rel=u0022noreferrer noopeneru0022 href=u0022https://www.ssl.com/faqs/what-are-downgrade-attacks/u0022 target=u0022_blanku0022u003edowngrade attacksu003c/au003e, such as u003cstrongu003ePOODLEu003c/strongu003e, u003cstrongu003eFREAKu003c/strongu003e, or u003cstrongu003eCurveSwapu003c/strongu003e. This is due to the fact that all versions of the TLS protocol prior to 1.3 don’t protect the handshake negotiation (which decides the protocol version that will be used throughout the exchange).