Re: [TLS] I-D Action: draft-ietf-tls-prohibiting-rc4-01.txt

[Viktor Dukhovni <[e-mail]>]

On Fri, Oct 24, 2014 at 01:07:04PM -0700, Geoffrey Keating wrote:

> Suppose 20% of hosts will use RC4 if it is offered, and 0.1% will
> refuse a connection if RC4 is not offered.  Then by not offering RC4,
> you are downgrading 0.1% to plaintext (assuming that's what happens)
> and upgrading 20% to a secure cipher---in the short term.  I believe
> that in itself is likely to be a win overall.

Well, the 20% "upgrade" is invisible and offers no immediate benefit,
while the 0.1% breakage causes people operational headaches, and
with sites they never specifically wanted encryption for.  They'll
then disable encryption for the site and forget they did that, so
the site is stuck at cleartext "forever".

Anyway, I think I've accepted the probability that RC4 will be a
MUST NOT, but that I'll simply have to ignore this for a few years.

-- 
	Viktor.