Re: [TLS] RC4 Considered Harmful (Was: RC4 deprecation path)

On Tue, Apr 22, 2014 at 5:14 PM, Martin Rex <mrex@sap.com> wrote:
> Alyssa Rowan wrote:
>>
>> > 1.56% or TLS servers support only RC4.
>>
>> Partly because of PCI compliance testers making noise about BEAST, I'm
>> thinking.
>
> BEAST was and still is a pretty stupid hype.
>
> Even the ssl test at qualys is still making bogus claims about
> servers not being BEAST-patched.  Unless your server is a SSL-VPN server
> or will boldly execute client-supplied active content, there can not
> possibly be a BEAST vulnerability in the TLS server.

It's not about the server: if I only offer TLS 1.0, then clients who
connect to me who aren't 1/(n-1) patched are vulnerable to BEAST,
which leads to theft of credentials. Force RC4, and it isn't
exploitable, no matter how bad the client is. (BEAST was demonstrated
against PayPal on a fully patched browser, with cookies stolen live on
stage. I don't see how it is "stupid hype")

With modern clients this isn't a concern: TLS 1.1 or higher fixes the
problem, as does 1/(n-1). However, there are enough old clients out
there to apparently make this an issue, and the fix usually forces all
of them to RC4. The one saving grace is BEAST requires a plugin. So
far.

At some point RC4 needs to be removed. The question is now, or after
someone demonstrates the sort of attack that we have nightmares about.
Actually, given the talk about a removal path, 5 years from now or 3
years after someone demonstrates an attack.

>
>
> The larger problem with the use of RC4 is that a number of dense
> TLS clients (e.g. Java) send RC4 cipher suites at the very beginning
> of the list of cipher suites, and a number of dense TLS server
> choose the first shared cipher from the list proposed by the client
> rather then the first shared cipher from the list configured by the
> server admin.

One side or the other needs patching, preferably both. End of the day
we can't do anything without some actual work getting done on deployed
stuff. But yes, this is a good reminder that not everything is a web
browser that calls home every week for an update.

Sincerely,
Watson Ladd

>
>
> -Martin
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin