IETF Logo Mail Archive

Re: [TLS] Deprecating RC4 (was: draft-ietf-tls-encrypt-then-mac)

Martin Thomson <martin.thomson@gmail.com> Mon, 14 April 2014 23:35 UTC

Return-Path: <martin.thomson@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F9691A03F0 for <tls@ietfa.amsl.com>; Mon, 14 Apr 2014 16:35:15 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id St8MEYkw5a7l for <tls@ietfa.amsl.com>; Mon, 14 Apr 2014 16:35:10 -0700 (PDT)
Received: from mail-wg0-x22c.google.com (mail-wg0-x22c.google.com [IPv6:2a00:1450:400c:c00::22c]) by ietfa.amsl.com (Postfix) with ESMTP id 921581A029E for <tls@ietf.org>; Mon, 14 Apr 2014 16:35:10 -0700 (PDT)
Received: by mail-wg0-f44.google.com with SMTP id m15so8721199wgh.15 for <tls@ietf.org>; Mon, 14 Apr 2014 16:35:07 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=mgNnpVt0x7INDb1KmKqkzC7ZJqt8lwi/9Z8wQFkVtdM=; b=tpR6Wez91UwDzT1fVAZ2UKmhpQEPGTyip2x5HAXSdlA+c6AEKxKK1AiUGNpWoSka9w O8EM8dSrCdU7Y6kZbWiTT7g05/fv8IpT/DMTtiuyT1eJISsFFuPI1/JqYF7DiLSRoKm2 vi2x4YknG33CXntLa/vfDmCSBoXbcVEgCsYSnUBffNftW32IHlOl2yxVWTWH4uQCBCrb Fq3b7cRjRib9cW9bg8yrsqek7ZevWTwpZzNV1pWUwLFPrMhprHveWYY2MD9UfDyUInUh ArdvocYvC+1oQS0AppbcM0iSF0G3jV60887QVMf7B1oz7EfkDg/TWLMQX4kDq1tleyT6 VgBw==
MIME-Version: 1.0
X-Received: by 10.180.188.134 with SMTP id ga6mr11466627wic.58.1397518507324; Mon, 14 Apr 2014 16:35:07 -0700 (PDT)
Received: by 10.227.144.132 with HTTP; Mon, 14 Apr 2014 16:35:07 -0700 (PDT)
In-Reply-To: <20140414213309.0F4821ACBF@ld9781.wdf.sap.corp>
References: <CABcZeBOvxL7Zws0UNowViBWGaVBgfm3zXt8=dNPKffGfN3q2gA@mail.gmail.com> <20140414213309.0F4821ACBF@ld9781.wdf.sap.corp>
Date: Mon, 14 Apr 2014 16:35:07 -0700
Message-ID: <CABkgnnWppZ4C7AvTOvfyRtRmTHTfq-i5BiUFxBMZx9gAYL_+5g@mail.gmail.com>
From: Martin Thomson <martin.thomson@gmail.com>
To: mrex@sap.com
Content-Type: text/plain; charset="UTF-8"
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/THO576rn4JzlEEAlkFR1yCOTa0w
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Deprecating RC4 (was: draft-ietf-tls-encrypt-then-mac)
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 14 Apr 2014 23:35:15 -0000

On 14 April 2014 14:33, Martin Rex <mrex@sap.com> wrote:
> There might be (higher layer) protocols that do this all by themselves
> (resend the very same data over and over again) potentially including
> credentials of a disclosing authentication, and there might be
> communication peers that can be enticed to do this (such as web browsers).


I'm pretty sure that both instances of "might be" can be replaced by
"are".  Web browsers use HTTP in this way.  Hence the desire to end
RC4 use, at least in that context.

v2.23.0 | Report a Bug | By Email