The tag has no wiki summary.

learn more… | top users | synonyms

21
votes
1answer
4k views

TLS: RC4 or not RC4?

I was reading another interesting article by Matthew Green today, saying that if you're using RC4 as your primary ciphersuite in SSL/TLS, now would be a great time to stop As far as I'm aware ...
12
votes
4answers
9k views

Remove RC4 from SSL/TLS ciphers in Chromium

Recently I started to live without RC4 within my Firefox session. Discussion about it can be found here. While it is quite easy in Firefox (Enter about:config and then rc4), I found no possibility to ...
7
votes
3answers
3k views

Can someone explain a little better what exactly is accomplished by generation of DH parameters?

I'm setting up a node.js server: https.createServer({ ... ciphers: 'ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH', honorCipherOrder: true }, app).listen(443); ...
6
votes
2answers
348 views

Implications of having a service account in AD use RC4 rather than AES for Kerberos?

Bear with me, I know this is sloppy, but here is the back story: We have a partner that uses Jira and is using spnego with a custom auth back-end that expects certain group membership in the token. ...
5
votes
2answers
481 views

RC4 bias protection with padding in TLS

On the answer to my previous question about RC4 vulnerabilities in TLS, Thomas Pornin gave a great answer, in which he said: One way to "fix" RC4, which has been suggested many times, is to drop ...
4
votes
1answer
431 views

PFS on nginx: only RC4 gets used (TLS_ECDHE_RSA_WITH_RC4_128_SHA)

I'm trying to configure my webserver for perfect forward secrecy. I'm using ssl_ciphers ...
3
votes
1answer
154 views

Are all cipher suites with rc4 in them intrinsically flawed?

I've been wondering lately if RC4 is so flawed in all its forms, why is it that it is still being supported by all major browsers per default? Why does the typical chrome browser prefer ...
3
votes
1answer
7k views

How does DHE-RSA-AES256-SHA compare to RC4 as the Cipher for SSL?

I read a lot of issue [1] currently stating that RC4 is broken and is at risk. I just checked my web server (nginx) and it is using the default settings, which is DHE-RSA-AES256-SHA How does this ...
2
votes
3answers
240 views

Does it make sense to keep RC4?

I know that the RC4 cipher when used with SSL is vulnerable to certain attacks, which in the worst case scenario could result in authentication tokens being stolen. But RC4 is also recommended as a ...
1
vote
2answers
523 views

Clients breaking after avoiding RC4-MD5

As per http://projects.webappsec.org/w/page/13246945/Insufficient%20Transport%20Layer%20Protection , we have been recommended to stop using RC4-MD5. The clients supported by our Application are IE ...
0
votes
2answers
328 views

Google's usage of RC4

I was reading about Google's usage of RC4 and an answer on stackexchange website stated the following: I know Google uses RC4 for most of its services, and this is the reason one shouldn't keep ...
0
votes
1answer
2k views

Are there any known vulnerabilities in PPTP VPNs when configured properly?

PPTP is the only VPN protocol supported by some devices (for example, the Asus RT-AC66U WiFi router). If PPTP is configured to only use the most secure options, does its use present any security ...