Re: [TLS] RC4 deprecation path (Re: Deprecating more (DSA?))

[Yoav Nir <[e-mail]>]

On Apr 19, 2014, at 8:53 PM, Kurt Roeckx <[e-mail]> wrote:

> On Sat, Apr 19, 2014 at 10:32:24AM -0700, Michael D'Errico wrote:
>> Kurt Roeckx wrote:
>>> 
>>> - Clients should not announce support for RC4 in their initial
>>> connection attempt, and only fall back to support it when the
>>> server says that there are no common ciphers.  (I'm not sure
>>> if a MITM can fake that response or not.)
>> 
>> Continue the handshake all the way through to the Finished messages
>> to determine if a MITM has tampered with it.  This will only not
>> work if the server is of the type that chooses RC4 no matter where
>> it is in the client's cipher suite list.
>> 
>> Here's the message flow I'm thinking about:
>> 
>>    ClientHello (w/o RC4)      ----->
>>                               <-----    Alert (handshake_failure)
>> 
>> close and reconnect:
>> 
>>    ClientHello (with RC4)     ----->
>>                               <-----    ServerHello (RC4 chosen)
>>                                         ..... continues
>> 
>> Place the RC4 suites at the end of the list so that the server will
>> not choose them if it respects the client's preference.
> 
> Right, so an MITM could downgrade to RC4 in case the server
> prefers RC4 over the rest in that case.

Yes. As long as the client is required to support such servers, I guess we have to live with it.

It’s possible to make some kind of extension to help discover this activity by a MitM, but I don’t expect servers that continue to support RC4 to be the kind of servers that upgrade to the latest version of the software, the one that supports the new extension.

Yoav