Re: [TLS] RC4 deprecation path (Re: Deprecating more (DSA?))

[Kurt Roeckx <[e-mail]>]

On Sat, Apr 19, 2014 at 10:32:24AM -0700, Michael D'Errico wrote:
> Kurt Roeckx wrote:
> >
> >- Clients should not announce support for RC4 in their initial
> >  connection attempt, and only fall back to support it when the
> >  server says that there are no common ciphers.  (I'm not sure
> >  if a MITM can fake that response or not.)
> 
> Continue the handshake all the way through to the Finished messages
> to determine if a MITM has tampered with it.  This will only not
> work if the server is of the type that chooses RC4 no matter where
> it is in the client's cipher suite list.
> 
> Here's the message flow I'm thinking about:
> 
>     ClientHello (w/o RC4)      ----->
>                                <-----    Alert (handshake_failure)
> 
> close and reconnect:
> 
>     ClientHello (with RC4)     ----->
>                                <-----    ServerHello (RC4 chosen)
>                                          ..... continues
> 
> Place the RC4 suites at the end of the list so that the server will
> not choose them if it respects the client's preference.

Right, so an MITM could downgrade to RC4 in case the server
prefers RC4 over the rest in that case.


Kurt