Re: [TLS] I-D Action: draft-ietf-tls-prohibiting-rc4-01.txt

[Viktor Dukhovni <[e-mail]>]

On Wed, Oct 22, 2014 at 10:28:54AM -0700, Ryan Carboni wrote:

> This is why SHA-256 will never have a malicious collision, and why RC4 will
> never be broken.

Well, never is a long time, and it is already somewhat broken, in that
the bias in at least firt 256 bytes of output makes fixed plaintexts
transmitted repeatedly under varying keys vulnerable to recovery.

While I would prefer to see RC4 phased out more gradually, I do
not think we can claim that it has not been broken.

So I think that it would be nice if there was some wiggle-room for
opportunistic TLS.  As weak as RC4 might be, it is stronger than
cleartext.  And the published bias attacks don't apply to MTA to
MTA SMTP.  There is no (pairwise) fixed sensitive plaintext at a
fixed offset in every MTA to MTA email transaction.

I have no objections to banning RC4 for "strict" TLS use-cases.

-- 
	Viktor.