Re: [TLS] I-D Action: draft-ietf-tls-prohibiting-rc4-01.txt

[Ryan Carboni <[e-mail]>]

>
> Well, never is a long time, and it is already somewhat broken, in that
> the bias in at least firt 256 bytes of output makes fixed plaintexts
> transmitted repeatedly under varying keys vulnerable to recovery.


Yes, there's obvious issues with RC4's key-schedule. I visit some websites
as much as 2^15 times a year, or 2^(6.5) times a day, mostly forums of
interest. The bias attack at best can break 2^30. Or to put it in better
perspective:

http://googleonlinesecurity.blogspot.com/2013/11/a-roster-of-tls-cipher-suites-weaknesses.html

"The best, known attack against using RC4 with HTTPS involves causing a
browser to transmit many HTTP requests -- each with the same cookie -- and
exploiting known biases in RC4 to build an increasingly precise probability
distribution for each byte in a cookie. However, the attack needs to see on
the order of 10 billion copies of the cookie in order to make a good guess.
This involves the browser sending ~7TB of data. In ideal situations, this
requires nearly three months to complete."

RC4 should be fully deprecated... in 2020.