-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 19/04/2014 20:28, Yoav Nir wrote:

> As long as the client is required to support such servers, I guess 
> we have to live with it.

I think the only correct deprecation path to recommend is the one
that's on the table right now: the off switch.

Warn your users if you have to. But don't negotiate RC4 without a
click-through warning.

RC4 is either on the brink of being cracked, given the serious known
weaknesses pointed out in Section 1 of the draft, or it is already
over the brink (if that's the 'cryptanalytic breakthrough' GCHQ were
talking about that they got from NSA, and that seems plausible to me,
and to several others, including Schneier).

If it's on the brink, then when it's cracked, captured traffic can
(and will) be retroactively decrypted. If it's over the brink, that's
already happening.

That window of opportunity was widened by advice given to use RC4-SHA
to avoid BEAST, which is why some servers prefer RC4 to AES-128. (That
was very bad advice, with 20:20 hindsight.)

We need to close that window now. As you've seen in this discussion,
there is only one safe way to close that window: disable RC4
completely. Any delay in disabling RC4 leaves that window open for
longer, and leaves users subject to a false sense of security about
their connections that should be protected by that little 'lock icon'.

I don't think we can in good conscience recommend any delay. That's
why the draft we have strong consensus on is crystal-clear:

   o  TLS clients MUST NOT include RC4 cipher suites in the ClientHello
      message.

   o  TLS servers MUST NOT select an RC4 cipher suite when a TLS client
      sends such a cipher suite in the ClientHello message.

   o  If the TLS client only offers RC4 cipher suites, the TLS server
      MUST terminate the handshake.  The TLS server MAY send the
      insufficient_security fatal alert in this case.

In short: RC4 is Considered Harmful. Kill it with fire.


On 19/04/2014 20:54, Kurt Roeckx wrote:

> IE on XP is known to only support 3DES, RC4, and some export 
> ciphers.

Firstly, of those options, they're all bad. 3DES is the less awful
option in my opinion (because BEAST is an active attack, but RC4 is or
will be vulnerable to a passive attack applicable in retrospect), but
none of them are recommended.

But, reminder: support for Windows XP ended 11 days ago. It's now off
life-support... it's got bigger problems than even 3DES.

- -- 
/akr
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJTUtgsAAoJEOyEjtkWi2t6vUMP/jPu/pPVELPORfPfhyN7sxCV
+6WrH6T933A/2RgkvvIHGXovMWceu95Kf9yT8qQSsbG3kIJIoFYSr+cMSa0+2F7r
+cELTer21kavBgHlxJuS2plAZbgU72J1AYhkC5CxyHG6cUW5vAXmBDTSqOJikdks
j5/NiClm9hh0EiKgkTBvcAsmt9I/md6RIP9kEgwlgwCXTakjWG2xY3PCTJoLC3ta
ryb6HGyBD4dUlOAexh8ttBc5pei1hjTvrM3fDxXHLtLB/WGEuE24Ljf5UzBeLGli
WFgMTmy8nGXSDgQgLTzkhX4IQSDI8vRd9H7NP3aKVyxPyjILShEuR08OEYgW21Vf
G74tkB3LwToKRvvrZlv99/W7R0sIFRkqA8Zwq/9/TwqSWMwrbkn3x75GG35jEa98
LpX9OXvr1Q6nVEwL9S3vR8kFMggRMG0WZ6ypbF13AcrCzxDckC/gp3kFPstRlf1T
k+C4b88FTexBNk6L00s2crrvLs8mcjBCWbPlT9ylYTA1Y9bZjdW3jU4JQ20haplb
Qto5NIKPI0StmYaQ5ApKfN7UDAFqLZwD6SUxDFgfANbssvPKsEi/6zhiNLXEhydp
QB6o7PAtHsZvVkdBpvjPB0DOEPbTsb7sSagK41rGReZDcX8WoKL2l4/i4noFmmYJ
QRik78o7c2X5zdKam8Rm
=0nHD
-----END PGP SIGNATURE-----