Subject: TLS considering an rc4-die-die-die draft

From: Stephen Farrell <[email-masked]>
Date: Fri, 11 Apr 2014 22:10:20 +0100

FYI. The TLS working group are thinking of adopting an
rc4-die-die-die draft, that is to deprecate TLS ciphersuites
that use RC4. Thread starts at [1], if you care about RC4
please comment on that list, not here.

Someone however asked if SSH's used of RC4 ought also be
deprecated at the same time, or not. Which could be done in
the same document as the TLS one, or not.

What do folks here think about that?

Thanks,
S.

[1] https://www.ietf.org/mail-archive/web/tls/current/msg11932.html

---

From: [email-masked] (Niels Möller)
Date: Sat, 12 Apr 2014 09:27:19 +0200

> What do folks here think about that?

I think there's some use for a cipher in ssh which is significantly
faster than aes. I'm not following developments as closely as I'd like
to, but I think it would be nice with some recommended replacement for
such uses, most likely salsa20 or chacha. And I think it would be good to
have a spec for using a fast cipher as a traditional cipher in ssh,
independent of developments to adopt aead constructions like
chacha-poly1305.

I don't have a strong opinion on whether or not this is the right time
for an explicit deprecation.

> [1] https://www.ietf.org/mail-archive/web/tls/current/msg11932.html

Is the intention that a conforming implementation must delete all
support for rc4? Or is it viewed as acceptable to keep supporting it (if
configured by user/administrator) but ensure that the *default*
configuration never enables it in the algorithm negotiation?

Regards,
/Niels

-- 
Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26.
Internet email is subject to wholesale government surveillance.

---

From: Tatu Ylonen <[email-masked]>
Date: Sun, 13 Apr 2014 10:45:38 +0300

My understanding is that AES128-SHA1 is about as fast or faster than 
RC4-MD5 on modern processors due to AES-NI extensions (see 
http://www.intel.com/content/dam/www/public/us/en/documents/white-papers/open-ssl-performance-paper.pdf).

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 13 Apr 2014 13:14:34 +0100

Hiya,

On 04/13/2014 12:18 PM, Damien Miller wrote:
> OpenSSH will turn RC4 off soon - we're just trying to figure out how
> to do it gently enough that working configurations don't suddenly break
> yet firmly enough that people actually move to a better cipher.

Given the above, I'm guessing that processing this for
SSH and TLS might best be done separately, agreed?

If so, and if/when someone writes up an SSH rc4-die-die-die
draft I'll be happy to sponsor that if doing so seems to be
the consensus on this list.

Cheers,
S.

---

From: Damien Miller <[email-masked]>
Date: Sun, 13 Apr 2014 21:18:53 +1000 (EST)

We'll be recommending [email-masked] as a replacment
where both ends upport it.

https://anongit.mindrot.org/openssh.git/tree/PROTOCOL.chacha20poly1305

-d

---

From: [email-masked] (Niels Möller)
Date: Sun, 13 Apr 2014 19:10:56 +0200

> yet firmly enough that people actually move to a better cipher.

What breakage do you expect? Servers configured to support no other
cipher than arcfour, probably from some (possibly misguided) performance
argument?

> where both ends upport it.

If I have understood correctly, openssh uses the original definition of
chacha with 64-bits each for nonce and counter, while recent ietf drafts
specify a 96-bit nonce and only 32 bits for the counter. Is that right?
I think support for chacha-poly1305 is highly desirable, but it seems a
bit messy with specifications still in flux.

Best regards,
/Niels

---

From: Damien Miller <[email-masked]>
Date: Mon, 14 Apr 2014 11:12:34 +1000 (EST)

> cipher than arcfour, probably from some (possibly misguided) performance

People who have "ssh -c arcfour" in their scripts or configurations used
non-interactively.

-d

---

From: Mouse <[email-masked]>
Date: Thu, 17 Apr 2014 11:40:55 -0400 (EDT)

>> Someone however asked if SSH's used of RC4 ought also be deprecated
> faster than aes.

There are also code-design reasons to want to keep a stream cipher
around, though admittedly those can mostly be satisfied by having one
for testing but not routine production use.

In the immediate future, I will leave arcfour in moussh; I really ned
to find the time to read up on the results and figure out what I want
to do in the longer term.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B