3 ms·
Yes, but RC4 should still not be used.
by lucian1900 14y ago
Yes, but RC4 should still not be used.
- eyeareque 14y agoWhich attack is easier to carry out: "Lucky 13" or breaking RC4?
- aidenn0 14y agoProbably breaking rc4
- xyzzy123 14y agoSince prioritising RC4 is the mitigation for the BEAST attack as well (IMHO a rather impractical attack on SSL, but that's another story) it's going to be the default on a lot of servers already. You'll find that Google, Facebook and Microsoft servers all prefer RC4 during SSL negotiation. See: https://www.ssllabs.com/ https://www.ssllabs.com/ TLS_RSA_WITH_RC4_128_MD5 - www.microsoft.com TLS_RSA_WITH_RC4_128_SHA - www.facebook.com TLS_ECDHE_RSA_WITH_RC4_128_SHA - www.google.com In most circumstances I would consider AES a "better" cipher than RC4, but it's interesting there are now multiple attacks where block boundaries matter.
- moxie 14y agoMost organizations were already prioritizing RC4 before that, simply because it's fast (23 in order instructions per byte!).