Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
1–10 of 91 posts
Re: Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
#2There are some good advice on how to improve the situation in the appendix section.
Re: Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
#3There are some good advice on how to improve the situation in the appendix section.
I will be adding advices from the discussion here, so feel free to comment! :)
Re: Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
#4There's interesting technical content here, but it suffers from its alarmist tone.
The MD5 hash function is broken, that is true. However, TLS doesn't use MD5 in its raw form; it uses variants of HMAC-MD5, which applies the hash function twice, with two different padding constants with high Hamming distances (put differently, it tries to synthesize two distinct hash functions, MD5-IPAD and MD5-OPAD, and apply them both). Nobody would recommend HMAC-MD5 for use in a new system, but it has not been broken.
RC4 is horribly broken, and is horribly broken in ways that are meaningful to TLS. But the magnitude of RC4's brokenness wasn't appreciated until last year, and up until then, RC4 was a common recommendation for resolving both the SSL3/TLS1.0 BEAST attack and the TLS "Lucky 13" M-t-E attack. That's because RC4 is the only widely-supported stream cipher in TLS. Moreover, RC4 was considered the most computationally efficient way to get TLS deployed, which 5-6 years ago might have been make-or-break for some TLS deployments.
You should worry about RC4 in TLS --- but not that much: the attack is noisy and extremely time consuming. You should not be alarmed by MD5 in TLS, although getting rid of it is one of many good reasons to drive adoption of TLS 1.2.
Re: Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
#5Close to this subject there was a good invited talk entitled "Why does the web still run on RC4?" by Adam Langley at CRYPTO this year. I can't find a video online however someone from the Bristol crypto group wrote a small report of his talk here: http://bristolcrypto.blogspot.fr/2013/08/why-does-web-still-....
Re: Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
#6Would this flaw be "patchable" using Cydia Substrate for Android? Might be good as a quick fix.
Re: Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
#7There's interesting technical content here, but it suffers from its alarmist tone. The MD5 hash function is broken, that is true. However, TLS doesn't use MD5 in its raw form; it uses variants of HMAC-MD5, which applies the hash function twice, with two different padding constants with high Hamming distances (put differently, it tries to synthesize two distinct hash functions, MD5-IPAD and MD5-OPAD, and apply them bo…
Thank you for the insight. It is good to get some more details on how broken it is. I will add a clarification regarding MD5 to the article.
Sorry about my alarmist tone - from time to time I need to get rid of my conspiracy theories.
Re: Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
#8Why do you have to fix it in the apps? Iirc you just could specify a different order on the server side and enable "honor cipher order", so the servers preference is used? http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslhon...
Not sure there, though.
Re: Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
#9There's interesting technical content here, but it suffers from its alarmist tone. The MD5 hash function is broken, that is true. However, TLS doesn't use MD5 in its raw form; it uses variants of HMAC-MD5, which applies the hash function twice, with two different padding constants with high Hamming distances (put differently, it tries to synthesize two distinct hash functions, MD5-IPAD and MD5-OPAD, and apply them bo…
Thanks for your insightful comments and representing the paradox of the internet: Alarmist tones are required to generate interest in a story, but taking the time to explain the cognitively challenging details is instantly off-putting in an article. The average internet users is becoming so stupid, even the simplified versions are TL;DR. I've come to rely on Hacker News comments in ways I used to rely on Slashdot stories. The SNR at Reddit is overwhelming.
Re: Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
#10There's interesting technical content here, but it suffers from its alarmist tone. The MD5 hash function is broken, that is true. However, TLS doesn't use MD5 in its raw form; it uses variants of HMAC-MD5, which applies the hash function twice, with two different padding constants with high Hamming distances (put differently, it tries to synthesize two distinct hash functions, MD5-IPAD and MD5-OPAD, and apply them bo…
I'm sort of confused, because TLS 1.1/1.2 support across browsers looks to be quite poor at the moment. Especially when given a large number of IE visitors that will likely upgrade to IE11 (first version that will have TLS 1.1/1.2 enabled by default) sometime around the year 2016.
With that said, I was under the impression that sites will need to support TLS 1.0 for a good long while, and if that is indeed the case, would they not be better off using RC4? From my understanding, the RC4 attacks seemed less practical than attacks against the implementation of CBC mode in SSL 3.0 / TLS 1.0?