Re: [Uta] On prohibiting RC4

[Franck Martin <[e-mail]>]

----- Original Message -----
> From: "Andrei Popov" <[e-mail]>
> To: "Rich Salz" <[e-mail]>, "Alyssa Rowan" <[e-mail]>, [e-mail]
> Sent: Friday, March 7, 2014 7:22:46 PM
> Subject: Re: [Uta] On prohibiting RC4
> 
> > It depends on what you're concerned about.  From a global view, I'm
> > concerned about perpass. From a commercial view, I'm perhaps more worried
> > about my customers getting through to me.
> 
> Are you dealing with a significant number of RC4-only TLS clients? When we
> tried to disable RC4 altogether here at MS, the issues we ran into were
> mostly with the TLS servers that would not speak anything but RC4 (not just
> web servers, but other applications such as e-mail). We were nevertheless
> able to have IE not offer RC4 on the initial connection attempt.
> 
> If adopted, the RC4 deprecation draft would hopefully send a strong message
> to the industry and help us phase out RC4 sooner.
> 
I have not dived into this selection process yet, but I see RC4 a lot in SMTP.

I think the problem is in ciphersuite selection, it is the client that propose a list of ciphers and the server that picks the one it likes. The whole selection process seems not standardized or with little control settings.

Is someone making (or has already done) a standard to select ciphersuites, and can they rank the ciphersuites across 2 dimensions: speed, strength?

It seems openssl allows you to select the cipher list in an ordered fashion:
https://www.openssl.org/docs/apps/ciphers.html#CIPHER_LIST_FORMAT
"Include only 3DES ciphers and then place RSA ciphers last: openssl ciphers -v '3DES:+RSA'"

What the string should be? How hard is it to manage this string and keep it up to date? Can this work group (or the TLS one) provide some regular advice?

"the cipher string @STRENGTH can be used at any point to sort the current cipher list in order of encryption algorithm key length."
Seems to me we need the sort to be in the opposite direction from strong to weak...

That's openssl, what about gnuTLS?

There is a great deal of configuration in postfix on this subject, but basically it relies on openssl point of view:
http://www.postfix.org/TLS_README.html#server_cipher

This should not be rocket science for most postmasters.

Then, we can place RC4 last for opportunistic TLS and eventually deprecate it.