3

According to RFC7465 RC4 is banned from TLS and my question is : Is it banned for good, does any site can use it now and if it does, will I get any notification from Chrome?

7

RC4 has been deprecated, and is unlikely to ever be used again. There's no reason to go back and improve an old cipher when we have newer alternatives like AES, and in RC4's current state it should not be used. Some sites do continue to have it as a supported cipher suite. However, if you are using an updated version of Chrome, Firefox, or IE 11, then you will be unable to connect to the server via RC4 because they have all removed support for the cipher.

Sources:
https://blog.mozilla.org/security/2015/09/11/deprecating-the-rc4-cipher/
https://blogs.windows.com/msedgedev/2016/08/09/rc4-now-deprecated/#5weuUm0EqMr6WIE8.97
https://codereview.chromium.org/2030263002

2

RC4 is gone for good, it will not come back. Good TLS libraries don't support it.

Its role as a cipher that works well enough when implemented in software on generic hardware without any hardware acceleration (e.g. AESNI CLMUL) is now handled by ChaCha20-Poly1305.

Your server can support RC4 ciphesuites for TLS versions below 1.3 and Chrome will not know about it and thus will not ding your site for this misconfiguration.

In order for Chrome to know that your server supports RC4 ciphesuites it would need to open a connection to your server and send a ClientHello that lists only RC4 ciphersuites in the cipher_suites list and receive a ServerHello back instead of the expected alert about no cipher suites in common. Chrome won't do this.

What would be the warning message that a modern browser would show for such a site? "Had you been using a bad or old browser, this site would have allowed an insecure connection"? The browser wants to tell the user whether it's secure to give a site personal information, assuming the site is trustworthy but the WiFi connection is not trustworthy. That's it. If the browser doesn't support RC4 but the server does - this doesn't affect the security of the established connection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.