This paper has been discussed on this list before. So I will assume
possible interest and will post a link to my comments:
Legacy Encryption Downgrade Attacks against LibrePGP and CMS: Some Comments
https://articles.59.ca/doku.php?id=pgpfan:ledowngrade
Bruce