My bank's website uses HTTPS with the cipher suite ssl_rsa_with_rc4_128_md5
.
What are the known weaknesses of this suite? Do they have a practical impact for banking-related communications?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this communityIn a purist cryptographic sense, there are many vulnerabilities in this cipher suite that can be (theoretically and practically) exploited. There are much stronger versions of SSL/TLS, and much stronger cipher suites that could be used.
In a practical sense, it's not the end of the world - there are far worse cipher suites (e.g. those using intentionally weaked 'export' encryption, or weak ciphers such as DES), and you probably have more to fear from malware/phishing attacks etc. wrt interacting with your bank than from someone targeting your SSL connection.
Bear in mind that the cipher suite being used is what the bank web server chose to use based on the cipher suites your web browser told it could be used - if your browser is configured to disable TLS 1.0/1.1 for example, this may be the best the server could manage (although from the use of MD5, this appears unlikely).
If you're interested in the detail, then looking at each of the parts of ssl_rsa_with_rc4_128_md5 individually:
Most of these issues are in the walk, don't run, to the exit category (the use of MD5 being probably the most concerning issue) - it would be prudent for your bank (and you) to start using more modern cipher suites to protect traffic.
ssl_
in the ciphersuite name gives a pretty clear indication that the asker is wanting to know if RSA_WITH_RC4_MD5 is a strong/non-broken SSL ciphersuite. Now, the answer may be nuanced instead of a blind "yes"/"no", but I just don't see this question as unclear at all. Could it be phrased better? Absolutely. But that doesn't make it unclear, in my opinion. $\endgroup$