Re: [TLS] RC4 depreciation path (Re: Deprecating more (DSA?))

[Kurt Roeckx <[e-mail]>]

On Fri, Apr 18, 2014 at 11:03:44PM -0700, Watson Ladd wrote:
> On Thu, Apr 17, 2014 at 9:15 AM, Brian Sniffen <[e-mail]> wrote:
> > Alyssa Rowan <[e-mail]> writes:
> >
> >> -----BEGIN PGP SIGNED MESSAGE-----
> >> Hash: SHA512
> >>
> >> It looks like RC4 is rapidly heading for the chopping block, with
> >> basically unanimous consensus. Good.
> >
> > Agreed, mod Martin's proposal that I understand to ask for a reasonable
> > path by which we strongly deprecate RC4 on clients, then after a client
> > generation ban RC4 on clients and deprecate for servers.
> 
> I don't think this is the correct path. I think what we should do is
> have clients and servers both prefer other options (in all TLS
> versions), then once that change is made, ban it entirely. Deprecation
> on one side won't affect the other side if there isn't an alternative
> mandated. (Right now RC4 only servers are keeping RC4 alive).
> 
> This first step has already happened in the web context on modern
> browsers. What we need is to make the server side step happen, and
> then think about removal in the second step.
> 
> Sadly, our ability to force upgrades is very limited.

And I think publishing an RFC isn't actually really going to help
much.  Yes, people could use it tell others that it's deprecated,
but I think there are already more than enough places that say so
that having this RFC isn't really going to make a difference.

I do agree that we need to try to get both sides to stop using it,
and I wish we could just tell people to stop using it and that
they would do so.  But I don't see either the server or the client
side wanting to break things.  It would clearly help if they could
say at which point they wouldn't mind breaking things.

So I think that for now the best we can do is:
- Servers should either stop accepting RC4 or make sure that 
  if the clients supports something better (TLS >= 1.1?) it should
  not pick RC4.
  It's my understanding that the client preferences of ciphers
  should be used but that servers can override that, and that
  there might be good reasons to do so. For instance to get PFS
  when talking to Internet Explorer.  If they override it, they
  should make sure not to put RC4 first.  Basically, a mondern
  client should never get RC4.
- Clients should not announce support for RC4 in their initial
  connection attempt, and only fall back to support it when the
  server says that there are no common ciphers.  (I'm not sure
  if a MITM can fake that response or not.)

At some point in time when the clients or servers think that they
don't need to support RC4 anymore they should disable it.


Kurt