Re: [TLS] I-D Action: draft-ietf-tls-prohibiting-rc4-01.txt

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 21 October 2014 06:58:23 BST, "Salz, Rich" <[e-mail]> wrote:

>+1
>
>Kill RC4 or put our face on it and face the public embarrassment.

Strong +1. I couldn't be stronger here.

I think we have rough consensus to publish this draft as-is right now, despite a couple of vocal but wrong-headed objections. I don't think further discussion makes RC4 any more, or less, weak, but delay keeps people using it for longer and that is bad.

If this WG cannot even achieve rough consensus about turning off a weak 20-year-old piece-of-crap cipher everyone knows is bad and which many fear will soon be (according to some sources has already been) broken catastrophically and irretrievably, then we have a much deeper problem and this WG is going to look utterly ineffectual and useless - which would mean taking our security, and pushing it somewhere else which can deal with it.

If you're waiting for a catastrophic break to be published to disable a cipher when it's already a decade overdue and you've been warned it's weak, then sorry but you're a complete idiot, attackers have saved all your juicy ciphertexts for the promised day, and will just sit there looking back at your (and your customers') precious data.

Anyone is free to ignore an RFC: just remember Chris, we warned you RC4 was weak; we told you that you MUST NOT use it in the clearest possible language. If you want to ignore that, you're facing the music when a break is published. Keeping RC4 enabled is the kind of thing you should, and will, fail audits for.

Don't make me get the whips out! ;-)

- --
/akr
-----BEGIN PGP SIGNATURE-----
Version: APG v1.1.1

iQI3BAEBCgAhBQJURhUGGhxBbHlzc2EgUm93YW4gPGFrckBha3IuaW8+AAoJEOyE
jtkWi2t6088P/imVPNrVpDrcyG0Gsl/5sMCqasrzSfDEG8ZJZNUNGQ3msCA1SzYr
XEx4FVHVX2/0fwrDftIU/N+1ECiV+l6PQf7Xoeh6XBr0P8gxMocb49J2rlZGhV9c
aZPfz40wktglMJYNlXoKu2GsoUTOaBY+DUiOygpB0nerix9k06FXcuu26y3eGyB+
bMlL2oxNvrpYJtbBNrPaRAKr1xee8AwaQzWkWoqeqjBJjwCKGp98SUS96jpXddp3
P55CDs15LsMP2dHJtkM6xS1OZWAHEZwG+3BSGJOgrkMD1hMstwNAFtJxTmOc/BRs
uFbUpYISxp1s+6ZZYH94e8Nzcr0mF6AYS3AjAXTZDGzl62LQajafxLVA13Bokoia
KHvvxylIvDNqSYu4nysJrjOX8rnrDk1m7dPZBG1Yj++4zJZ5KbxBUhzjYooX0yzp
IWIeveDOswD4n8oTKeRN3CnwYc25GLHhyg+jGrs5ullFNKwTh12G726XTd8FeGOO
AdMO0T23qhj2JpzOT2v8fd2+03FEWhkc24w/2BrdtfwZWOwN1CG9kaIMnkUzOefd
50Myy1Iws33P6tOm4X/v7vvtDLQo+aZbfHebkU4289j4D1e+e50QfWR+AYqhOOI7
dKkVMIiZALHTnlLFn9dMO2UIjlYffaugjQNBvppcqWviarYW4zi5cVNi
=t57m
-----END PGP SIGNATURE-----