Re: [TLS] I-D Action: draft-ietf-tls-prohibiting-rc4-01.txt

[Peter Gutmann <[e-mail]>]

Alyssa Rowan <[e-mail]> writes:

>As I've pointed out, if you're forced into backwards compatibility with rusty
>legacy, 3DES is, though crappy, a less crappy choice than RC4.
>
>As Rich points out, just because legacy devices are indeed out there doesn't
>mean that they do TLS safely, and doesn't mean we shouldn't prohibit unsafe
>practice like using weak ciphers.

It's not just TLS implementations, you also need to look at the surrounding
infrastructure.  For example Microsoft's NDES (Network Device Enrolment
Service) hardcodes in MD5 to authenticate certs (via cert fingerprints) and
single DES (not 3DES, single DES) for "protection" of messages (even if you
send in a request using AES, the response comes back using single DES).  In
other words the most modern algorithm in there is more than twenty years old,
and it's broken.  So it doesn't matter how secure the TLS implementation is if
the certs used to control it are being "protected" with broken crypto.

Peter.