Re: [TLS] I-D Action: draft-ietf-tls-prohibiting-rc4-01.txt

[Viktor Dukhovni <[e-mail]>]

On Fri, Oct 24, 2014 at 10:31:23AM -0400, Salz, Rich wrote:

> > Leaving a cipher suite out is only practical once it is no longer the best shared
> > cipher with any peers.  
> 
> I don't agree with this blanket statement.  Sometimes nothing trumps "something is better than nothing."
> 
> When the IETF's leading cryptographers say not to use something,
> then you're better off with plaintext than a false sense of security
> for your users.

There is no false sense of security with non-interactive with
unauthenticated opportunistic TLS.  You expect no security, and
none is claimed.  If passive attacks happened to be avoided, that's
gravy, if not, at least cleartext would not have been stronger.

The MTA logs (if they record the use of TLS at all) will record
the ciphersuite used.  The administrator can make appropriate
conclusions:

    Oct 18 11:42:40 amnesiac postfix/smtp[29005]: Untrusted TLS connection established to gmail-smtp-in.l.google.com[173.194.68.26]:25: TLSv1.1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)
    Oct 20 19:55:07 amnesiac postfix/smtp[21141]: Untrusted TLS connection established to gmail-smtp-in.l.google.com[173.194.68.27]:25: TLSv1.1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)
    Oct 22 02:55:59 amnesiac postfix/smtp[8024]: Untrusted TLS connection established to gmail-smtp-in.l.google.com[173.194.68.26]:25: TLSv1.1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)
    Oct 22 23:51:08 amnesiac postfix/smtp[26570]: Untrusted TLS connection established to gmail-smtp-in.l.google.com[173.194.68.26]:25: TLSv1.1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)
    Oct 23 01:25:18 amnesiac postfix/smtp[18228]: Untrusted TLS connection established to gmail-smtp-in.l.google.com[64.233.171.26]:25: TLSv1.1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)
    Oct 23 04:53:38 amnesiac postfix/smtp[20459]: Untrusted TLS connection established to gmail-smtp-in.l.google.com[64.233.171.27]:25: TLSv1.1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)
    Oct 23 21:05:20 amnesiac postfix/smtp[29828]: Untrusted TLS connection established to gmail-smtp-in.l.google.com[64.233.171.26]:25: TLSv1.1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)
    Oct 24 03:23:26 amnesiac postfix/smtp[1541]: Untrusted TLS connection established to gmail-smtp-in.l.google.com[64.233.171.27]:25: TLSv1.1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)

After all the fuss about RC4, I've taken a minute to  add a
destination-specific TLS policy for gmail.com:

    tls-policy:
	gmail.com encrypt exclude=RC4

# postmap tls-policy

    main.cf:
	indexed = ${default_database_type}:${config_directory}/
	smtp_tls_policy_maps = ${indexed}tls-policy

Now I have:

    Oct 24 14:51:57 amnesiac postfix/smtp[10528]: Untrusted TLS connection established to gmail-smtp-in.l.google.com[173.194.76.26]:25: TLSv1.1 with cipher ECDHE-RSA-AES128-SHA (128/128 bits)

No publically known RC4 attacks apply to MTA to MTA delivery without
SASL AUTH, but there we have it, after enabling server cipher order
preempt on my end, and disabling RC4 for Gmail, who can do better,
I am no longer seeing RC4 in my logs (still enabled for all other
destinations, no idea which ones are still running Exchange 2003).

-- 
	Viktor.