IT lexicon › Security › Bodo Möller

Bodo Möller

Security På svenska → Updated: 2026-10-17

German cryptographer and early OpenSSL developer who co-discovered POODLE in 2014 and then wrote the fix for downgrade attacks.

Möller spent years on the OpenSSL development team and wrote much of the library's elliptic-curve support. At Google he published POODLE in October 2014 with Thai Duong and Krzysztof Kotowicz. The attack exploited the fact that SSL 3.0 doesn't check CBC padding, and that browsers cheerfully fell back to SSL 3.0 whenever a connection hiccupped — something a man in the middle could easily arrange.

The remedy he wrote with Adam Langley: the TLS_FALLBACK_SCSV signalling value, standardised in RFC 7507, which lets a server refuse a downgrade it never asked for. SSL 3.0 itself was effectively dead within months. It had been obsolete for fifteen years; it took an attack with a cute name.

← Back to the lexicon