Re: [TLS] I-D Action: draft-ietf-tls-prohibiting-rc4-01.txt

[[e-mail] (Martin Rex)]

Hubert Kario wrote:
> 
> Only about 1% of servers support only RC4 cipher, 1.5% if you're
> using Firefox[1].
> 
> On the other hand, over 21% of servers will negotiate a RC4 cipher
> in case you're using Firefox (and nearly 18% if you're using
> OpenSSL-like supported cipher list).
> 
> So by dropping RC4 from your first ClientHello (in case you do use
> fallback) may as well cut your RC4 usage by over 20%!

We're talking past each other here.

I'm perfectly OK with the MUST NOT for the __client__ (!!), and
I will not mind the slightest if (Browser or other) TLS clients that
implement the awkward application-level reconnect fallback logic
for TLS handshake failures start "punishing" the remaining RC4-only
servers with reconnect fallbacks.

My issue is with the IMHO bogus "MUST NOT" for servers.
Servers have no control over the client behaviour, and the current
proposal calls for an unconditional hard failure (equals to
"come back in clear text") rather than interoperating with an
RC4-based TLS cipher suites with installed base clients.

Based on what we currently know about the weaknesses of RC4,
unconditionally turning down clients will be ridiculously stupid
in most situations, because for the vast number of scenarios,
the weakness of the TLS RC4 cipher suites is not a threat.


-Martin