Windows 10: Ending support for RC4 cipher in Microsoft Edge and Internet Explorer

Brink · Aug 31, 2015

Today, Microsoft is announcing the end-of-support of the RC4 cipher in Microsoft Edge and Internet Explorer 11. Starting in early 2016, the RC4 cipher will be disabled by-default and will not be used during TLS fallback negotiations.

There is consensus across the industry that RC4 is no longer cryptographically secure. Our announcement aligns with today’s announcements from Google and Mozilla, who are ending support for RC4 in Chrome and Firefox.

What is RC4?

RC4 is a stream cipher that was first described in 1987, and has been widely supported across web browsers and online services. Modern attacks have demonstrated that RC4 can be broken within hours or days. The typical attacks on RC4 exploit biases in the RC4 keystream to recover repeatedly encrypted plaintexts. In February 2015, these new attacks prompted the Internet Engineering Task Force to prohibit the use of RC4 with TLS.

Microsoft Edge and Internet Explorer 11 only utilize RC4 during a fallback from TLS 1.2 or 1.1 to TLS 1.0. A fallback to TLS 1.0 with RC4 is most often the result of an innocent error, but this is indistinguishable from a man-in-the-middle attack. For this reason, RC4 will be entirely disabled by default for all Microsoft Edge and Internet Explorer users on Windows 7, Windows 8.1 and Windows 10 starting in early 2016.

How can I prepare?

We expect that most users will not notice this change. The percentage of insecure web services that support only RC4 is known to be small and shrinking.

If your web service relies on RC4, you will need to take action. Since 2013, Microsoft has recommended that customers enable TLS 1.2 in their services and remove support for RC4. For additional details, please see Security Advisory 2868725.

– David Walp, Senior Program Manager, Microsoft Edge
Click to expand...

Source: Ending support for the RC4 cipher in Microsoft Edge and Internet Explorer 11 | Microsoft Edge Dev Blog

:)

Abi99 (2) · Aug 31, 2015

aa.com - cant log in

I am able to reproduce your issue on a Nokia Lumia 1520 with Windows Phone 8.1 (OS version 8.10.12397.895).
www.aa.com:443 supports a single cipher-suite only (RC4-SHA; 0x0005). Furthermore, Windows Phone does not support RC4 at all. You face a

cipher-suite mismatch. Therefore, American Airlines returns a TLS alert (handshake failure) on the very first TLS-Client-Hello. . see below

You are able to reproduce this yourself via a UNIX terminal (command line) with

openssl s_client -connect www.aa.com:443 -cipher AES128-SHA

Or stated differently:

Because RC4 is consider deprecated by Microsoft, you have to convince American Airlines to add further TLS cipher-suites to their server installation. Another alternative would be to go for another mobile-phone operating system which still supports RC4.
However, that is no wise decision because the root cause is AA and they are going to run into many troubles soon and already.

andyswa · Aug 31, 2015

e65 - WLAN 802.1x + TKIP + PEAPv0

forgot to mention that you have to enable the Ciphers RSA,RC4,MD5 and RSA,RC4,SHA when you configure EAP-PEAP (settings for Ciphers are under the tab after the EAP tab). these ciphers are required for WPA/TKIP. for WPA2 you require the cipher RSA,AES,SHA.

cheers

andy

Windows 10: Ending support for RC4 cipher in Microsoft Edge and Internet Explorer

Ending support for RC4 cipher in Microsoft Edge and Internet Explorer

Ending support for RC4 cipher in Microsoft Edge and Internet Explorer

Ending support for RC4 cipher in Microsoft Edge and Internet Explorer - Similar Threads - Ending support RC4

Internet Explorer to Microsoft Edge

Internet Explorer to Microsoft Edge

WhatsApp ends support for legacy Microsoft Edge browser

internet explorer , not microsoft edge

Internet Explorer 11 End of Support

Microsoft to end support for TLS protocol for Edge and Internet Explorer in first half of 2020

Microsoft Edge and Internet Explorer 11

RC4 no longer supported in Microsoft Edge and IE11 in April

RC4 is now deprecated in Microsoft Edge and Internet Explorer 11

Users found this page by searching for:

internet explorer RC4 cipher support