Hopely Cyanogenmod devs, if not Google itself, will fix it, now that they are aware. In 2010 it may not be seen as a priority, but since last June it is for everyone.
Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
21–30 of 91 posts
Re: Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
#22Why do you have to fix it in the apps? Iirc you just could specify a different order on the server side and enable "honor cipher order", so the servers preference is used? http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslhon... Not sure there, though.
Afaik, as long as a weak cipher is enabled on both client and server, a MITM attacker can force it to be used. It involves manipulating the handshake to tell both parties the other one doesn't support any better cipher.
Re: Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
#23There's interesting technical content here, but it suffers from its alarmist tone. The MD5 hash function is broken, that is true. However, TLS doesn't use MD5 in its raw form; it uses variants of HMAC-MD5, which applies the hash function twice, with two different padding constants with high Hamming distances (put differently, it tries to synthesize two distinct hash functions, MD5-IPAD and MD5-OPAD, and apply them bo…
Thank you for the insight. It is good to get some more details on how broken it is. I will add a clarification regarding MD5 to the article. Sorry about my alarmist tone - from time to time I need to get rid of my conspiracy theories.
You should append tptacek's comment to your post.
Re: Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
#24I asked my local SSL expert, and he mentioned: the list the client sends is just a preference list; the server can choose what it wants.
For example, nginx by default[1] specifies an OpenSSL cipher list of HIGH:!aNULL:!MD5, which you can examine by running
$ openssl ciphers 'HIGH:!aNULL:!MD5'
You'll see neither RC4 nor MD5 in that list. (You will if you run a plain "openssl ciphers", so you can see openssl knows about them but the config turns them off.)
(I'm an SSL newbie, please correct any mistakes I've made in the above.)
Re: Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
#25Why do you have to fix it in the apps? Iirc you just could specify a different order on the server side and enable "honor cipher order", so the servers preference is used? http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslhon... Not sure there, though.
Weak cyphers should be disabled on the server entirely, not just re-ordered.
Re: Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
#26Why do you have to fix it in the apps? Iirc you just could specify a different order on the server side and enable "honor cipher order", so the servers preference is used? http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslhon... Not sure there, though.
Afaik, as long as a weak cipher is enabled on both client and server, a MITM attacker can force it to be used. It involves manipulating the handshake to tell both parties the other one doesn't support any better cipher.
Eh, no. Maybe in SSLv2, but the first thing TLS encrypts is a hash of the entire handshake. Modifying the cipher list would change those hashes into something different.
Unless you have a client which will happily disable a cipher and try again when encountering an error. But if you do that, you don't deserve any security.
Re: Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
#27This beautifully illustrates the power of open source. One guy was worried enough about security to start checking the crypto source, and was able to alert the community. I hope this leads to a more secure platform.
Re: Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
#28I asked my local SSL expert, and he mentioned: the list the client sends is just a preference list; the server can choose what it wants. For example, nginx by default[1] specifies an OpenSSL cipher list of HIGH:!aNULL:!MD5, which you can examine by running $ openssl ciphers 'HIGH:!aNULL:!MD5' You'll see neither RC4 nor MD5 in that list. (You will if you run a plain "openssl ciphers", so you can see openssl knows abou…
You are right, the final choice of the algorithm is with the server. I am not sure though if it is possible to give other ciphers a higher priority on the server without completely disabling RC4 (which is still better than no encryption / no connection).
Edit: effhaa mentioned http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslhon... for apache in another post.
Re: Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
#29There's interesting technical content here, but it suffers from its alarmist tone. The MD5 hash function is broken, that is true. However, TLS doesn't use MD5 in its raw form; it uses variants of HMAC-MD5, which applies the hash function twice, with two different padding constants with high Hamming distances (put differently, it tries to synthesize two distinct hash functions, MD5-IPAD and MD5-OPAD, and apply them bo…
There is another technical angle; RC4 is usually quite a lot less CPU intensive than the alternatives available. Not using RC4 can easily mean stuttering video playback, greatly diminished battery life, and even lock ups. Very few users are open to accepting that issues like that are "better" for them.
Many RC4 deprecation efforts have faced rollback in the face of issues like this; especially on hard to fix embedded devices (think TVs, Cars and phones) with comparatively weak CPUs.
Re: Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010
#30Why do you have to fix it in the apps? Iirc you just could specify a different order on the server side and enable "honor cipher order", so the servers preference is used? http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslhon... Not sure there, though.
Weak cyphers should be disabled on the server entirely, not just re-ordered.
Knee-jerk disabling of RC4 because it's "weak" would almost certainly reduce the security of the Internet, because you can't simply evaluate TLS ciphersuites based on the strength of their core cipher; there are lots of deployed TLS clients that can't do block cipher crypto securely right now.