Re: [TLS] RC4 Considered Harmful (Was: RC4 deprecation path)

[[e-mail] (Martin Rex)]

Paterson, Kenny wrote:
>
> "Watson Ladd" <[e-mail]> wrote:
>>
>> Martin Rex <[e-mail]> wrote:
>>> 
>>> RC4 is a stream cipher, and operates by xoring plaintext with
>>> a pseudo-random keystream.  In order to "completely break" RC4,
>>> it would be necessary to precompute future RC4 outputs from
>>> some amount of *known* RC4 keystream, essentially re-creating
>>> the internal state of the RC4 algorithm.
>>
>>Yes, that would be terribly bad of a break. We don't have one like
>>that now. 5 years from now I would not be surprised. We need to start
>>moving now to be ready for the inevitable. I would prefer not to have
>>my banking secrets spread across the Internet before we decide we have
>>a problem.
>>
>>However, even before you predict keystream from a handful of bytes you
>>can do the following:
>>-Use multiple connections sharing similar data together with hidden
>>markov models to recover text
> 
> 
> Indeed, the use of language models is mentioned as an enhancement in our
> paper. Based on my experience of using such models in a different context,
> I think they would make a big difference in reducing the attacks'
> ciphertext requirements when the plaintext being targeted is "natural
> language", and possibly even passwords. But this is less likely to be
> effective for session cookies. It would be a great student project to
> investigate this angle.

Quantify "multiple connections sharing similar data" /
the attacks' ciphertext requirements.

I'm doing like 300 web-based purchases with OTP-authentication tokens
(TAN) year and maybe 4 Credit Card purchases per year online from various
different shops and would repeat a single failing purchase at most 5 times
before I would give up.

The numbers I've seen so far do not scare me for a significant number
of usage scenarios.  That doesn't mean that there would be no usage
scenarios where the weaknesses could be sufficient to make an attack
practical.  But I'm not using any of those.


Problems like the recent shortcut in the certificate validation
for (EC)DHE cipher suites in Apple's TLS stack and GnuTLS, or the
recent Heartbleed (Heartbloat) attack is stuff that worries me much more.


-Martin