Subject: [TLS] Prohibiting RC4 Cipher Suites

From: Andrei Popov <[email-masked]>
Date: Wed, 21 Aug 2013 20:59:02 +0000

Hello All,

RC4 is a widely deployed cipher, which is commonly preferred by TLS servers: our tests show ~40% of the high-traffic HTTPS sites pick RC4 if IE offers this cipher. A significant percentage of web sites and e-mail servers have only RC4 enabled, so a client cannot altogether disable RC4 without breaking interoperability. At the same time, attacks on RC4 are improving (e.g. http://www.isg.rhul.ac.uk/tls/), to the point that practical exploits are possible.

I have posted a new Internet-Draft "Prohibiting RC4 Cipher Suites" (draft-popov-tls-prohibiting-rc4-00<http://datatracker.ietf.org/doc/draft-popov-tls-prohibiting-rc4/>) to deprecate the use of RC4 cipher suites in TLS.

Looking forward to comments and feedback on the draft,

Andrei Popov

---

From: "Paterson, Kenny" <[email-masked]>
Date: Wed, 21 Aug 2013 21:13:07 +0000

Andrei,

Your intro says:

"Recent cryptanalysis results [ALF] exploit biases in the RC4 keystream to
recover early portions of plaintexts."

The attacks can recover repeated plaintext from ANYWHERE in the plaintext
stream, so they are more flexible in application than your text suggests.

Another (better?) link for the attacks by AlFardan et al. is
www.isg.rhul.ac.uk/tls. The "official" USENIX link, which should be
long-lasting, is:

https://www.usenix.org/conference/usenixsecurity13/security-rc4-tls

Best wishes

Kenny

On 21/08/2013 13:59, "Andrei Popov" <[email-masked]> wrote:

>Hello All,
> 
>RC4 is a widely deployed cipher, which is commonly preferred by TLS
>servers: our tests show ~40% of the high-traffic HTTPS sites pick RC4 if
>IE offers this cipher. A significant percentage of web sites and e-mail
>servers have only RC4 enabled,
> so a client cannot altogether disable RC4 without breaking
>interoperability. At the same time, attacks on RC4 are improving (e.g.
>http://www.isg.rhul.ac.uk/tls/), to the point that practical exploits are
>possible.
> 
>I have posted a new Internet-Draft ³Prohibiting RC4 Cipher Suites²
>(draft-popov-tls-prohibiting-rc4-00
><http://datatracker.ietf.org/doc/draft-popov-tls-prohibiting-rc4/>) to
>deprecate the use of RC4 cipher suites in TLS.
>

---

From: Andrei Popov <[email-masked]>
Date: Thu, 22 Aug 2013 22:15:57 +0000

Hi Kenny,

Thanks for your comments; I will update the attack description and the link in the next revision of the draft.

Cheers,

Andrei

-----Original Message-----
From: Paterson, Kenny [mailto:[email-masked]] 
Sent: Wednesday, August 21, 2013 2:13 PM
To: Andrei Popov; [email-masked]
Subject: Re: [TLS] Prohibiting RC4 Cipher Suites

Andrei,

Your intro says:

"Recent cryptanalysis results [ALF] exploit biases in the RC4 keystream to recover early portions of plaintexts."

The attacks can recover repeated plaintext from ANYWHERE in the plaintext stream, so they are more flexible in application than your text suggests.

Another (better?) link for the attacks by AlFardan et al. is www.isg.rhul.ac.uk/tls. The "official" USENIX link, which should be long-lasting, is:

Best wishes

Kenny

On 21/08/2013 13:59, "Andrei Popov" <[email-masked]> wrote:

>servers: our tests show ~40% of the high-traffic HTTPS sites pick RC4 
>if IE offers this cipher. A significant percentage of web sites and 
>e-mail servers have only RC4 enabled,  so a client cannot altogether 
>disable RC4 without breaking interoperability. At the same time, 
>attacks on RC4 are improving (e.g.
>http://www.isg.rhul.ac.uk/tls/), to the point that practical exploits 
>are possible.
>