3

Quick disclaimer - Student, cryptography is a weak point.

So, can someone explain exactly how this will work?

The way I see is is that if a user is attempting to connect to a server using RC4 only and the server does not support RC4, the connection will be denied. Currently however, if the server supports RC4 in their cipher suite, the connection will be established. From what I can understand, browser releases in 2016 will no longer support RC4 only connections, right?

As a base example to build from, if a server is using TLS_RSA_WITH_RC4_128_MD5 in 2016 when the RC4 cutoff passes, who will be affected/what browsers will be affected?

Thanks.

  • 1
    what exactly is your question? Are you asking what browsers support RC4? You already know the connection will be denied if both sides cannot agree on a cipher. – Rory Alsop Dec 21 '15 at 10:07
5

From what I can understand, browser releases in 2016 will no longer support RC4 only connections, right?

Yes. Chrome, Firefox, MS-Edge, MS-IE plan to deprecate

who will be affected/what browsers will be affected?

About 1000 servers in the Alexa top 500,000 are currently marked RC4 Only. You won't be able to access these over HTTPS with any modern browser anymore.

|improve this answer|||||
  • POODLE killed RC4 – JOW Dec 21 '15 at 11:48
  • 2
    @JOW Exactly not. POODLE's "bite" is based on CBC, and RC4 is the only pre-1.2 data-cipher that is NOT CBC. Several years ago when RC4's weaknesses were less explored, it was widely promoted as a fix to BEAST, another CBC attack. RC4 was killed by the accumulation of exploitable biases, partly (mostly?) by the Paterson group at RHUL. What POODLE did kill is SSLv3. – dave_thompson_085 Dec 21 '15 at 17:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.