EXERCISE 2 — Match each attack to its TLS defence
==================================================

(a) SSL STRIPPING
    The attacker intercepts the victim's initial PLAINTEXT request and keeps
    them on HTTP, silently proxying to the real HTTPS site, so the victim
    never sees a cert or a warning.
    DEFENCE: HSTS (Strict-Transport-Security). After the first secure visit
    the browser auto-upgrades all requests to HTTPS and refuses plain HTTP
    for the domain -- so there is no plaintext request to strip. HSTS
    PRELOAD closes even the first-visit gap.
    CHAPTER: 10 (HSTS).

(b) PROTOCOL / CIPHER DOWNGRADE
    The attacker tampers with the cleartext ClientHello to force a weak
    protocol version or cipher suite the attacker can break.
    DEFENCE: The Finished message hashes the ENTIRE handshake transcript, so
    any tampering makes the two sides' Finished values disagree and the
    connection aborts. Additionally, TLS 1.3 simply REMOVED the weak options
    there's nothing weak left to downgrade to.
    CHAPTER: 6 (Finished / transcript integrity) + 7 (1.3 removed legacy).

(c) PASSIVE EAVESDROPPING
    The attacker reads traffic on the wire (e.g. open Wi-Fi) but doesn't
    modify or impersonate anything.
    DEFENCE: Symmetric encryption of all application data with an AEAD cipher
    (the negotiated session key). The eavesdropper sees only ciphertext.
    -> the CONFIDENTIALITY guarantee.
    CHAPTER: 2 (symmetric/AEAD encryption), guarantee from Chapter 1.

(d) STOLEN SERVER KEY USED TO DECRYPT OLD RECORDED TRAFFIC
    The attacker recorded encrypted sessions earlier and later steals the
    server's long-term private key ("harvest now, decrypt later").
    DEFENCE: Forward secrecy via EPHEMERAL Diffie-Hellman (ECDHE). Each
    session's secret comes from one-time DH values that are discarded; the
    long-term key only SIGNS, it never decrypts the session. So a later key
    theft can't unlock past recorded sessions. TLS 1.3 makes this mandatory.
    CHAPTER: 3 (ephemeral DH / forward secrecy), enforced in Chapter 7.

THE PATTERN:
  stripping     -> HSTS                       (Ch.10)
  downgrade     -> Finished hash + 1.3 purge  (Ch.6/7)
  eavesdropping -> AEAD encryption            (Ch.2)
  key-harvest   -> ephemeral DH / fwd secrecy (Ch.3)
  (plus: tampering -> AEAD/MAC integrity Ch.2; impersonation -> certs +
   chain Ch.4/5). Every attack class has a specific, already-learned
   counter -- TLS is a layered defence.