[TLS] RC4 depreciation path (Re: Deprecating more (DSA?))

[Watson Ladd <[e-mail]>]

On Thu, Apr 17, 2014 at 9:15 AM, Brian Sniffen <[e-mail]> wrote:
> Alyssa Rowan <[e-mail]> writes:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA512
>>
>> It looks like RC4 is rapidly heading for the chopping block, with
>> basically unanimous consensus. Good.
>
> Agreed, mod Martin's proposal that I understand to ask for a reasonable
> path by which we strongly deprecate RC4 on clients, then after a client
> generation ban RC4 on clients and deprecate for servers.

I don't think this is the correct path. I think what we should do is
have clients and servers both prefer other options (in all TLS
versions), then once that change is made, ban it entirely. Deprecation
on one side won't affect the other side if there isn't an alternative
mandated. (Right now RC4 only servers are keeping RC4 alive).

This first step has already happened in the web context on modern
browsers. What we need is to make the server side step happen, and
then think about removal in the second step.

Sadly, our ability to force upgrades is very limited.

How long a client generation were you thinking? Because I could see
cryptanalysis speeding up: RC4 has been neglected for about 12 years
after WEP, but the new techniques of massive brute force coupled with
some good idea might bear fruit sooner than expected.

Sincerely,
Watson Ladd



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin