Re: [TLS] RC4 Considered Harmful (Was: RC4 deprecation path)

[Jacob Appelbaum <[e-mail]>]

On 4/19/14, Alyssa Rowan <[e-mail]> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> On 19/04/2014 20:28, Yoav Nir wrote:
>
>> As long as the client is required to support such servers, I guess
>> we have to live with it.
>
> I think the only correct deprecation path to recommend is the one
> that's on the table right now: the off switch.
>
> Warn your users if you have to. But don't negotiate RC4 without a
> click-through warning.
>
> RC4 is either on the brink of being cracked, given the serious known
> weaknesses pointed out in Section 1 of the draft, or it is already
> over the brink (if that's the 'cryptanalytic breakthrough' GCHQ were
> talking about that they got from NSA, and that seems plausible to me,
> and to several others, including Schneier).
>

I think that RC4 is completely broken for certain adversaries. It
should be totally abandoned.

> If it's on the brink, then when it's cracked, captured traffic can
> (and will) be retroactively decrypted. If it's over the brink, that's
> already happening.
>

Yes, I agree. I believe that this is already happening.

> That window of opportunity was widened by advice given to use RC4-SHA
> to avoid BEAST, which is why some servers prefer RC4 to AES-128. (That
> was very bad advice, with 20:20 hindsight.)
>
> We need to close that window now. As you've seen in this discussion,
> there is only one safe way to close that window: disable RC4
> completely. Any delay in disabling RC4 leaves that window open for
> longer, and leaves users subject to a false sense of security about
> their connections that should be protected by that little 'lock icon'.
>
> I don't think we can in good conscience recommend any delay. That's
> why the draft we have strong consensus on is crystal-clear:
>
>    o  TLS clients MUST NOT include RC4 cipher suites in the ClientHello
>       message.
>
>    o  TLS servers MUST NOT select an RC4 cipher suite when a TLS client
>       sends such a cipher suite in the ClientHello message.
>
>    o  If the TLS client only offers RC4 cipher suites, the TLS server
>       MUST terminate the handshake.  The TLS server MAY send the
>       insufficient_security fatal alert in this case.
>
> In short: RC4 is Considered Harmful. Kill it with fire.
>

I agree entirely. RC4 needs to die in a fire. A celebratory TLS 1.3 fire.

All the best,
Jacob