4 ms·

This is pretty interesting. The attacks can only be carried out by a determined attacker who can generate sufficient sessions for the attacks. 2^3

This is pretty interesting. The attacks can only be carried out by a determined attacker who can generate sufficient sessions for the attacks. 2^30 connections seems pretty insane to me. Who the hell can generate that many without having a client-side bot running, and if a client-side bot is running who the hell cares about RC4?... Also, is it really such a big deal to use AES-256 or AES-GCM now? I mean, (a) we're not running web-servers on 1998 hardware and (b) we're not designing sites for IE6 and under any more.

tptacek 13y ago
Because here "client-side bot" includes bots written in Javascript served up from arbitrary pages on the web. I don't understand your second question, like, at all.
- mikegioia 13y ago
  I'm asking why configure your web server to use RC4 at all if there are better algorithms to use. I'm under the assumption that people use RC4 because it's either less taxing on the web server, or more browsers support it.
  - tptacek 13y ago
    Oh, sorry. A few years ago, people might have selected RC4 for its speed. These days, people who deliberately enable RC4 are doing it because they're concerned about the Lucky13 attack on TLS CBC. It's a rock/hard-place situation with a pair of TLS vulnerabilities that both require adoption of TLS 1.2 to decisively mitigate.
JshWright 13y ago
I'm not sure what you mean by 'AES-256 _or_ AES-GCM' (since you can use 128 or 256 bit key sizes in either CBC or GCM mode), but the problem with GCM mode in general is that no clients support it... I'm the web guy for Silent Circle. We run in-house analytics on our 'marketing' sites (we don't run any analytics (or even log remote IP addresses or user agents) on any site that a user can authenticate (and therefore identify themselves) to)(I'm not a Lisper... honest...). We recently upgraded the server that hosts the analytics to a sufficiently recent version of OpenSSL that it now supports TLS 1.1+ and GCM mode ciphers. I was curious how many connections actually used GCM ciphers, so I started logging the TLS version and cipher suite for each connection. I only did this a couple days ago, so I don't have a ton of data yet, but the short answer is... Almost no one supports GCM. GCM ciphers are highest priority in our cipher list (and server ciphers are preferred), and yet I've seen almost no GCM connections. Far and away the most common cipher suite is ECDHE-RSA-AES256-SHA (~75% of connections). Note: This is for our marketing sites, not the site our customers actually authenticate to, so the results might differ a bit when it comes to our actual customers...
- StavrosK 13y ago
  > I'm the web guy for Silent Circle. cough
  - JshWright 13y ago
    ...and StavrosK is the web lackey ;) (Who gets to do most of the fun stuff lately...)
    - StavrosK 13y ago
      I'm going to commit a piece of code that doesn't conform to PEP8 and make it look like you did it.

tptacek 13y ago

Because here "client-side bot" includes bots written in Javascript served up from arbitrary pages on the web. I don't understand your second question, like, at all.

mikegioia 13y ago
I'm asking why configure your web server to use RC4 at all if there are better algorithms to use. I'm under the assumption that people use RC4 because it's either less taxing on the web server, or more browsers support it.
- tptacek 13y ago
  Oh, sorry. A few years ago, people might have selected RC4 for its speed. These days, people who deliberately enable RC4 are doing it because they're concerned about the Lucky13 attack on TLS CBC. It's a rock/hard-place situation with a pair of TLS vulnerabilities that both require adoption of TLS 1.2 to decisively mitigate.

JshWright 13y ago

I'm not sure what you mean by 'AES-256 _or_ AES-GCM' (since you can use 128 or 256 bit key sizes in either CBC or GCM mode), but the problem with GCM mode in general is that no clients support it... I'm the web guy for Silent Circle. We run in-house analytics on our 'marketing' sites (we don't run any analytics (or even log remote IP addresses or user agents) on any site that a user can authenticate (and therefore identify themselves) to)(I'm not a Lisper... honest...). We recently upgraded the server that hosts the analytics to a sufficiently recent version of OpenSSL that it now supports TLS 1.1+ and GCM mode ciphers. I was curious how many connections actually used GCM ciphers, so I started logging the TLS version and cipher suite for each connection. I only did this a couple days ago, so I don't have a ton of data yet, but the short answer is... Almost no one supports GCM. GCM ciphers are highest priority in our cipher list (and server ciphers are preferred), and yet I've seen almost no GCM connections. Far and away the most common cipher suite is ECDHE-RSA-AES256-SHA (~75% of connections). Note: This is for our marketing sites, not the site our customers actually authenticate to, so the results might differ a bit when it comes to our actual customers...

StavrosK 13y ago
> I'm the web guy for Silent Circle. cough
- JshWright 13y ago
  ...and StavrosK is the web lackey ;) (Who gets to do most of the fun stuff lately...)
  - StavrosK 13y ago
    I'm going to commit a piece of code that doesn't conform to PEP8 and make it look like you did it.