Re: [TLS] I-D Action: draft-ietf-tls-prohibiting-rc4-01.txt

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 2 October 2014 15:44:37 BST, Bodo Moeller <[e-mail]> wrote:
> It seems to me that having a bit of a gray area then is
> unavoidable ... and often you *do* need some latitude in
> backwards-compatible cases, assuming you support these to achieve
> backwards-compatibility.

As I've pointed out, if you're forced into backwards compatibility
with rusty legacy, 3DES is, though crappy, a less crappy choice than RC4.

As Rich points out, just because legacy devices are indeed out there
doesn't mean that they do TLS safely, and doesn't mean we shouldn't
prohibit unsafe practice like using weak ciphers.

> (www.microsoft.com, for example, does allow RC4 cipher suites when 
> using TLS 1.0, which would be incompatible with that MUST NOT,
> since it expressly applies to TLS 1.0 too.)

This draft is a warning to implementers and deployers of TLS that they
MUST change their allowed ciphersuites to completely exclude RC4,
because RC4 isn't safe enough to use in TLS (or really for any purpose
anymore).

Pointing to examples of RC4 still being allowed in the wild only
further demonstrates the need for this draft as-is.

> If the spec isn't aligned with reality, that's a bit of a problem. 
> You shouldn't have to interpret a MUST NOT as a SHOULD NOT.

Reality is, unfortunately, that RC4 should have obsoleted years ago.
That is indeed a bit of a problem - one we now need to fix rapidly.

> Maybe the spec should have strict MUST NOT requirements for TLS
> 1.2, but make mere recommendations for the legacy protocols?

No, not sure I follow your reasoning here: RC4 is no less weak when
used with SSLv3 or TLS 1.0 than with TLS 1.2. Might even be weaker, if
there's a way to trick a server into selecting it (hence the fallback
SCSV draft). I see no reason the prohibition ought not be absolute.

Regarding obsolete ciphers such as RC2 and DES, I don't think the need
to prohibit them is quite as urgent, because people aren't actually
using them in the wild. (Well, not _many_ people, anyway.)

I would indeed support their deprecation - but perhaps in a separate
document, as I'm concerned that any unnecessary delay with this one is
another day that RC4's still actively being used by many, even when
better alternatives are available - which is another day of traffic
Eve can record - and, I fear, break, now or any time later at their
leisure.

The sooner we can proceed, the sooner we can start working to fix that.

- -- 
/akr
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJULYUNAAoJEOyEjtkWi2t6cZYQAK/LJRHi9BjIDkyQgTGiSRrl
D7tawBqIyR/0IErV+bz1UrIvCifx4Lrn99qscMEfuklRjEmJ0QJa2qAYYB51LPOi
+zxphHrXwSA3iofgTqawPLq3A+N6mHM38TBKhhxRW8oF8Y7zcNtvIAFRAWZ3f5zM
vAN9GW4MJLbDYpbu4mxsJ1qLhZ8+Ojo3IIcJnhhhZYJ6pdlwoQzWlUOzd9itdbbo
Nn1DnZUvJBIHS8uGclFamZDlg+f4b4Djy6msQH1C2VdQkgaZxAHr/E+gaU/whpTY
Qfc9FooyaEH5tpAiKDfcTjyhhgWatsJQhx39I+Mt/t9Ht+H7FR3kxHB4XRCgiSyg
ASvobV/ATo3aSflqeUrO7myS7cJWXH2gHCVKCXIw0JxIT40j5q08VtUsd9b1Db9Z
HaXWibvBYcngkGvpHC5CW+P7vNDP0x4wUPNaa/w8KBO7dZcqwFKC7BHpcekIKt4A
yQjiPAG2tXDmqd5Y9GykcJU0kFZucPbulcGnNW1KeAoZhgBmUzsDVq0gw6U+VQ/J
1vFcwG2DlCl1ICBxHEjCcNAiJ3K0MX5Dz6wMD2NaQ1CvlqU3g7HWHJha0VbMsQns
P1SLllT8Kjmm/KpJyqiYE0hbuYfWnUPv5BeKW5eVuBzZA2D8maHSBilIZIvPbv8K
a1qiinNciHhRIs14X8kV
=GfyS
-----END PGP SIGNATURE-----