Re: [TLS] RC4+3DES rekeying - long-lived TLS connections

[David-Sarah Hopwood <[e-mail]>]

Martin Rex wrote:
> Peter Saint-Andre wrote:
>>                                            ...  For example in XMPP
>> we use long-lived TCP connections and, on top of those, long-lived XML
>> streams that can be TLS-protected. In practice, for server-to-server
>> federation (and even for client-to-server communication) those
>> connections might be up for days, weeks, even months. At this point the
>> handling of long-lived XML streams is unspecified, but I would expect
>> most XMPP servers to terminate the connection and force the other party
>> to reconnect.
> 
> There was a discussion around long-lived SSL connections and
> reasons for rekeying, e.g. using TLS renegotiation on mogul-open.
> 
> If you're using ciphersuites with RC4 or 3DES encryption algorithms,
> you probably should not use such connections for prolonged times
> or huge amounts of data without rekeying (see below).

As far as I know, RC4 as used in TLS does not have a significant
problem with encrypting large amounts of data. There are small
statistical biases in the RC4 keystream but they're not a serious
threat in most situations.

If you're worried about the information leakage in using 3DES for
long-lived connections, then it's probably a better option to disable
3DES ciphersuites, than to use renegotiation to rekey. I think that
disabling 3DES should not cause significant interoperability problems
provided you continue to offer both RC4 and AES ciphersuites.

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com