Re: [TLS] I-D Action: draft-ietf-tls-prohibiting-rc4-01.txt

[Viktor Dukhovni <[e-mail]>]

On Fri, Oct 24, 2014 at 10:01:23AM -0400, Daniel Kahn Gillmor wrote:

> arguably, there are many such "grossly-misconfigured peers" right now
> with respect to RC4 (usually because of misguided attempts to protect
> against BEAST, aiui).  These are servers that support something other
> than RC4, but select RC4 if a client offers it (even if it was the
> client's lowest priority).

[ Note I was responding to Stephen's side note about opportunistic
  security, we're no longer discussing the language of the draft. ]

Indeed if RC4 were always selected for spurious reasons, then one
might be wise to disable it.  We're not there yet, so in practice
opportunistic applications will not immediately change to adhere
to the draft.

> So the safest OS approach in the context of a strongly-deprecated cipher
> $WEAK_CIPHER, for a client that is willing to ultimately fall back to
> cleartext would be, for any given peer P:
> 
>  * connect to P and offer TLS without $WEAK_CIPHER
>  * if that fails with "no cipher overlap", then:
>     * reconnect to P and offer TLS with $WEAK_CIPHER
>     * if that fails for any reason, then:
>         * reconnect to P with cleartext.

That's too much code.  MTAs are not browsers, there are no complex
multi-pass attempts to establish TLS.  TLS either happens or does
not.  If the handshake fails, some will retry in cleartext, others
will skip to the next MX host or defer the mail.

With MTAs the remote end often has connection rate limits, and may
lower the "reputation" of clients that frequently disconnect without
completing a delivery.

> This could probably be further improved by remembering which level of
> fallback succeeded on previous attempts, and refusing to fallback further.

Sorry, MTAs don't maintain SQLite databases with peer history.
There is no interactive user to override stale pinned information.

Browser analogies and strategies work poorly or not at all when
misapplied to SMTP.

-- 
	Viktor.