ietf-corpus

rfc-7465

Prohibiting RC4 Cipher Suites

A. Popov
date2015-02 streamIETF areasec wgtls statusPROPOSED STANDARD pages6 canonicalhttps://www.rfc-editor.org/rfc/rfc7465 doi10.17487/RFC7465
This document requires that Transport Layer Security (TLS) clients and servers never negotiate the use of RC4 cipher suites when they establish connections. This applies to all TLS versions. This document updates RFCs 5246, 4346, and 2246.

updated by

updates

Extracted elements (6)

design-rationale §1

RC4 is prohibited across all TLS versions rather than just newer ones because the cryptographic weaknesses (keystream biases enabling plaintext recovery) apply regardless of the TLS version negotiated. The prohibition is a blanket ban, not a version-specific deprecation.

tls, crypto, security

normative-requirement §2 MUST

If the TLS client only offers RC4 cipher suites, the TLS server MUST terminate the handshake. The server MAY send the insufficient_security fatal alert in this case.

tls, crypto, security

normative-requirement §2 MUST NOT

TLS clients MUST NOT include RC4 cipher suites in the ClientHello message. This applies to all TLS versions (1.0, 1.1, 1.2).

tls, crypto, security

normative-requirement §2 MUST NOT

TLS servers MUST NOT select an RC4 cipher suite even when a TLS client includes one in the ClientHello message.

tls, crypto, security

protocol-element §A

Appendix A enumerates 19 RC4-based TLS cipher suites that are prohibited, including TLS_RSA_WITH_RC4_128_MD5, TLS_RSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, and their KRB5, PSK, DH_anon, and ECDH variants.

tls, crypto, security

security-consideration §3

RC4 has long-known cryptographic weaknesses. Recent cryptanalysis (AlFardan et al., USENIX Security 2013) exploits biases in the RC4 keystream to recover repeatedly encrypted plaintexts, requiring approximately 2^26 sessions or 13×2^30 encryptions — on the verge of practical exploitability.

tls, crypto, security