Re:On the Security of RC4 in TLS and WPA – Full Paper Released
by tptacek on Monday July 08, 2013 @04:33PM
(#6009099)
I dispute the first graf for three reasons. First, the attack (you can play with it yourself; it's one of our upcoming crypto challenges) is relative to the start of the art in cryptography devastatingly easy to carry out; it takes a large amount of time, and may not be suitable for mass attacks, but one can imagine circumstances today in which this attack could be workable for targeted high-value secrets. Second, the kinds of advances in this attack that will make it more viable are less likely to be cryptographic and more likely to be systems programming related; as people play with the attack and explore more of the interactions between browsers and (say) specific RC4 bias positions, I think we're likely to find "non-cryptographic" (to coin a term) refinements of the attack that will make it scarier. The tempo of these kinds of advances is much, much faster than the tempo of fundamental advances in crypto. Finally, I think that graf doesn't adequately capture the other circumstances in which RC4 is used --- it's not a hair-on-fire operational issue for the web today, but it might be hair-on-fire for less well-understood cryptosystems.
Re:On the Security of RC4 in TLS and WPA – Full Paper Released
by trebor on Monday July 08, 2013 @04:30PM
(#6009082)
So, given that virtually every HTTP request has a uniform header, you'd need an adequate number of requests to the same page. That sounds impractical, but it won't stay that way for long. 2^24 is only 16.77 million requests, something not-so-difficult to achieve by a botnet, especially on sites that scale well (slower sites would be safer, actually).
Re:On the Security of RC4 in TLS and WPA – Full Paper Released
by jnbiche on Monday July 08, 2013 @08:41PM
(#6010400)
Is it possible that at least some of the high-profile "DDOS" attacks on Mt.Gox that took place earlier this year[0] were actually attempted RC4 attacks? There would have been a payoff worth the effort. I checked, and indeed Mt. Gox was using (and still uses) RC4[1]:
0. https://mtgox.com/press_release_20130404.html
1. http://security.stackexchange.com/questions/18863/how-secure...
Re:On the Security of RC4 in TLS and WPA – Full Paper Released
by JshWright on Monday July 08, 2013 @09:47PM
(#6010601)
The goal with this attack is to listen in on (and have some degree of control of the plaintext contained in) requests between the server and a specific client. A botnet wouldn't help you do that.
"This said, it would be incorrect to describe the attacks as being a practical threat to TLS and WPA today. However, our attacks are open to further enhancement, using, for example, the ability of our algorithms to output likelihoods for candidate plaintext bytes coupled with more sophisticated plaintext models."
"We recognise that, with around 50% of TLS traffic currently using RC4, recommending that it be avoided completely in TLS is not a suggestion to be made lightly. Nevertheless, given the rather small security margin provided by RC4 against our attacks, our recommendation is that RC4 should henceforth be avoided in TLS, and deprecated as soon as possible."