Re: [TLS] I-D Action: draft-ietf-tls-prohibiting-rc4-01.txt

[Viktor Dukhovni <[e-mail]>]

On Fri, Oct 03, 2014 at 07:28:53AM -0700, Watson Ladd wrote:

> > Before RC4 becomes MUST NOT, it needs to first become a low priority
> > algorithm that is used when nothing better is available.
> 
> <snip>
> What advice do you want to give them, and how will it end the use of
> RC4?

Use RC4 at a lower priority than any other non-deprecated 128-bit
or better cipher suite or triple DES (which is rated at 168 bits
by some libraries and 112 bits by others).

There is no reason to prefer single-DES or any 40-bit export cipher
suite over RC4.

> The advice given is to not offer RC4 cipher suites on the client
> side, and not to pick them on the server side: are we only debating
> the third point? Or are you saying that clients should feel free to
> offer RC4, and servers should be configured to pick it last?

I am saying that initially (first step on the road to elimination)
both clients and servers SHOULD choose RC4 last when it is not
disabled.  Clients and servers that implement mandatory security
and prioritize security over interoperability SHOULD disable RC4
entirely.  Clients and servers employing opportunistic unauthenticated
encrypted communication SHOULD not disable RC4.  Even RC4 is better
than cleartext or communications failure, as it will only be chosen
when no stronger options are available.

-- 
	Viktor.