Re: [Uta] On prohibiting RC4

[Andrei Popov <[e-mail]>]

Hi Yaron,

You are right in saying that browser re-connects are insecure, and that an active attacker can cause the browser to re-connect with RC4 enabled. While in our experiments at the time, this re-connect behavior drastically reduced the use of RC4 with IE, the ultimate solution is to never negotiate RC4 with TLS, which is the purpose of the Internet-Draft we're discussing.

The entire world certainly won't eliminate RC4 overnight, but I believe that it makes sense to do regular housekeeping and remove known broken crypto from current RFCs.

Cheers,

Andrei

-----Original Message-----
From: Yaron Sheffer [mailto:[e-mail]] 
Sent: Friday, March 7, 2014 9:47 PM
To: Andrei Popov; Salz, Rich; Alyssa Rowan; [e-mail]
Subject: Re: [Uta] On prohibiting RC4

Hi Andrei,

I'm not sure I understand your response. The way I parse it, in
*today's* Internet, assuming we never want to resort to cleartext, what would work is:

- Client initiates handshake #1 without RC4.
- Server (sometimes, if it's old) fails the handshake. This failure is unauthenticated, which means it can be forced by an attacker.
- client fallbacks to handshake #2 with RC4 (which by the way, is disallowed by the draft).
- Server's happy.

IMHO this would only complicate fallback logic (which in an ideal world we should have gotten rid of) without improving security.

If we're saying MUST NOT we must be able to stand behind it. If we can't, let's try to craft more nuanced language.

The current draft would fail the connection and thereby fallback to cleartext if the client only offers RC4. Even if such clients are rare, this is still a grave mistake IMO.

Thanks,
	Yaron

On 03/07/2014 09:22 PM, Andrei Popov wrote:
>> It depends on what you're concerned about.  From a global view, I'm concerned about perpass. From a commercial view, I'm perhaps more worried about my customers getting through to me.
>
> Are you dealing with a significant number of RC4-only TLS clients? When we tried to disable RC4 altogether here at MS, the issues we ran into were mostly with the TLS servers that would not speak anything but RC4 (not just web servers, but other applications such as e-mail). We were nevertheless able to have IE not offer RC4 on the initial connection attempt.
>
> If adopted, the RC4 deprecation draft would hopefully send a strong message to the industry and help us phase out RC4 sooner.
>
> Cheers,
>
> Andrei
>