Re: [Uta] On prohibiting RC4

["Salz, Rich" <[e-mail]>]

> With respect, I think he's simply wrong, because (and we've been over this ground previously on this list, in December/January) passive
> breaks are a much greater threat than active BEAST attacks.

It depends on what you're concerned about.  From a global view, I'm concerned about perpass. From a commercial view, I'm perhaps more worried about my customers getting through to me.

> I have heard from sources I trust that NSA can passively crack RC4 in SSL/TLS in or about real-time: they are apparently doing so
> en-masse, and (importantly!) to historically-captured traffic. ...  If so, they must have really liked people switching to it to avoid the BEAST
> active attack - a mistake we should not make.

You're not seriously expecting me to take this undocumented assertion without skepticism, are you?

> BEAST attacks are active, and perpass normally has no means to perform them.

> That is not to say that those active attacks do not pose a risk, but that they pose a lower risk

Not everyone feels this way.

> so I assume you're simply playing Devil's Advocate here?

No.

> If you have any specific points or counterpoints, I'm sure we'd all love to hear them.

I'll wait until the minutes are published which will hopefully contain ekr's view which (rightfully) carries more weight than mine.

	/r$

--  
Principal Security Engineer
Akamai Technology
Cambridge, MA