Subject: Re: [TLS] I-D Action: draft-ietf-tls-prohibiting-rc4-01.txt

From: Ryan Carboni <[email-masked]>
Date: Wed, 22 Oct 2014 11:36:36 -0700

>
> Well, never is a long time, and it is already somewhat broken, in that
> the bias in at least firt 256 bytes of output makes fixed plaintexts
> transmitted repeatedly under varying keys vulnerable to recovery.

Yes, there's obvious issues with RC4's key-schedule. I visit some websites
as much as 2^15 times a year, or 2^(6.5) times a day, mostly forums of
interest. The bias attack at best can break 2^30. Or to put it in better
perspective:

http://googleonlinesecurity.blogspot.com/2013/11/a-roster-of-tls-cipher-suites-weaknesses.html

"The best, known attack against using RC4 with HTTPS involves causing a
browser to transmit many HTTP requests -- each with the same cookie -- and
exploiting known biases in RC4 to build an increasingly precise probability
distribution for each byte in a cookie. However, the attack needs to see on
the order of 10 billion copies of the cookie in order to make a good guess.
This involves the browser sending ~7TB of data. In ideal situations, this
requires nearly three months to complete."

RC4 should be fully deprecated... in 2020.

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 22 Oct 2014 18:15:36 -0400

> RC4 should be fully deprecated... in 2020.

With all due respect, most cryptographers who work with the IETF disagree with you.

--  
Principal Security Engineer, Akamai Technologies
IM: [email-masked] Twitter: RichSalz

---

From: "Paterson, Kenny" <[email-masked]>
Date: Thu, 23 Oct 2014 05:06:17 +0000

> With all due respect, most cryptographers who work with the IETF disagree with you.

Like me, for instance.