Re: [TLS] I-D Action: draft-ietf-tls-prohibiting-rc4-01.txt

["Carl S. Gutekunst" <[e-mail]>]

On 10/03/2014 04:15 AM, Hubert Kario wrote:
> This is not the case.
>
> Only about 1% of servers support only RC4 cipher, 1.5% if you're
> using Firefox[1].
>
> On the other hand, over 21% of servers will negotiate a RC4 cipher
> in case you're using Firefox (and nearly 18% if you're using
> OpenSSL-like supported cipher list).

Note that in the SMTP world, use of RC4 (and a bias towards RC4) is more 
prevalent than on web servers. This is in large measure because 
Microsoft Exchange Server 2003 shipped with only RC4 and 3DES, and the 
3DES implementation crashed somewhere around the MAIL FROM dialog. I 
still regularly run into these old, unpatched servers. I tell them to 
install AES support, but they usually ignore me, abandon my product, and 
switch to one that "works" -- that is, it uses TLS v1 and RC4.

<csg>