Killing RC4 (softly)
Jan 29, 2014Piotr Sikora
Summary
This post addresses the evolution of TLS security by detailing the deprecation of RC4 cipher suites for TLS v1.1 and above. It explains the historical context of preferring RC4 to mitigate BEAST attacks, the subsequent discovery of RC4 vulnerabilities, and the challenge of selectively disabling RC4 due to limitations in open-source web servers. Cloudflare's contribution is a patch for OpenSSL that allows RC4 to be used only for TLS v1.0 connections, while disabling it for newer, more secure protocols, thereby improving overall website security and SSL Labs ratings.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack