3 ms·
Why do you have both "RC4" and "!RC4" in the second string?
by oleganza 13y ago
Why do you have both "RC4" and "!RC4" in the second string?
- aroch 13y agoAs far as I understand it, the server will respond RC4 ciphered negotiations by saying "sorry , what?" instead of "fuck off" if you include it in both the accepted and refused lists. In doing so, it'll force a renegotiation over an accepted cipher combo
- ivanr 13y agoIt makes sense in the context of (my) blog post. I start by showing one configuration for those who wish to use RC4 to mitigate the BEAST attack (better suites are used for the clients that support TLS 1.2). In the subsequent section, for those who do not care about BEAST and don't like RC4, I show how they can simply add !RC4 to the end. The advantage is that the configuration string remains the same.