38 ms·
It looks like one AES-GCM and one RC4 ciphersuite, but with RC4 preferred? "Support" for AES-GCM doesn't mean much if an RC4 ciphers is enabled and preferred b
by harshreality 12y ago
It looks like one AES-GCM and one RC4 ciphersuite, but with RC4 preferred?
"Support" for AES-GCM doesn't mean much if an RC4 ciphers is enabled and preferred by the server.
1. There are production servers that are still using RC4 only.
2. Consequently, clients can't disable RC4
3. Consequently, servers that prefer RC4 but offer better ciphersuites are insecure because they will negotiate RC4 even with better ciphers available. Client workarounds might be possible (involving multiple handshakes for rc4-only servers) but aren't implemented?