Re: [TLS] I-D Action: draft-ietf-tls-prohibiting-rc4-01.txt

[Ronald del Rosario <[e-mail]>]

"I'm not sure how representative that cloudflare statistic is.

But if this is anywhere near the real numbers, that the current
"MUST NOT" for server would be clear fear-mongering rather than
providing the target audience a sensible information about the
trade-off and realistic perspective on the insignificance of
the perceived threat.

-Martin”

+1

I live in a browser-integration world (CRM, Softphone clients, etc.) and disabling support for RC4 will be a burden since we still have a big percentage of customers using WindowsXP/IE6 (Obsolete clients) due to legacy custom integrations they are running.

I feel that making RC4 a "MUST NOT” and ending up as an IETF Standard is too much fear-mongering.

Best,

Ron F. del Rosario
Information Security Officer

[cid:D8C7FEEC-B79B-4830-9898-1599B9F2269E]

Five9, Inc.
Cloud Contact Center Software
4000 Executive Pkwy, Ste 400 San Ramon, CA 94583
www.Five9.com<http://www.five9.com/>

From: Martin Rex <[e-mail]<mailto:[e-mail]>>
Reply-To: "[e-mail]<mailto:[e-mail]>" <[e-mail]<mailto:[e-mail]>>
Date: Monday, October 6, 2014 at 1:24 PM
To: Hubert Kario <[e-mail]<mailto:[e-mail]>>
Cc: "[e-mail]<mailto:[e-mail]>" <[e-mail]<mailto:[e-mail]>>
Subject: Re: [TLS] I-D Action: draft-ietf-tls-prohibiting-rc4-01.txt

Hubert Kario wrote:

My issue is with the IMHO bogus "MUST NOT" for servers.
Servers have no control over the client behaviour, and the current
proposal calls for an unconditional hard failure (equals to
"come back in clear text") rather than interoperating with an
RC4-based TLS cipher suites with installed base clients.

thing is that only very specific clients do advertise only RC4,
far less than there are RC4 only servers. Cloudflare saw on the
order of 0.000002% of connections end up with RC4:
http://blog.cloudflare.com/the-web-is-world-wide-or-who-still-needs-rc4/
All from long obsolete clients.
Previously they saw on the order of 0.0009%:
http://blog.cloudflare.com/killing-rc4-the-long-goodbye/


I'm not sure how representative that cloudflare statistic is.

But if this is anywhere near the real numbers, that the current
"MUST NOT" for server would be clear fear-mongering rather than
providing the target audience a sensible information about the
trade-off and realistic perspective on the insignificance of
the perceived threat.

-Martin

_______________________________________________
TLS mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/tls


________________________________

CONFIDENTIALITY NOTICE: This e-mail and any files attached may contain confidential information of Five9 and/or its affiliated entities. Access by the intended recipient only is authorized. Any liability arising from any party acting, or refraining from acting, on any information contained in this e-mail is hereby excluded. If you are not the intended recipient, please notify the sender immediately, destroy the original transmission and its attachments and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Copyright in this e-mail and any attachments belongs to Five9 and/or its affiliated entities.