I\'ve been checking out various TLS certificates lately and noticed that most of

Question

I've been checking out various TLS certificates lately and noticed that most of the banks seem to have the following two issues:

1) They do not offer perfect forward secrecy

2) They are still using RC4

So far, all the ones I've checked (TD, JPMorgan, CIBC, Wells Fargo, Bank of America, ING/Tangerine, RBC) use

TLS_RSA_WITH_RC4_128_SHA

Though actually CitiGroup and Goldman Sachs are using AES in CBC mode with 256 bit keys, instead of RC4, but still, no forward secrecy, and I would think GCM+SHA256 is better than CBC+SHA, even with 128 bit keys vs 256.

On the other hand, google, facebook, linkedin, and bitcoin exchanges/sites do offer perfect forward secrecy (typically with ECDHE), and unanimously use AES in GCM mode with SHA256 and 128 bit keys.

So my question: why have our banks not upgraded their security, especially given recent attacks on RC4 (though they are mostly theoretical, they do point to possible issues, and RC4 is generally considered less secure than AES)? Also, why would they not offer perfect forward secrecy? Is that an oversight on their part, or possibly for regulatory reasons?

I nearly emailed my bank about this today, but figured I'd throw the question up here first. Of course, cyber attacks on banks are all the rage these days - they ought to use the best encryption they can.

Explanation / Answer

Banks are usually not known to work in an agile way and quickly follow the latest developments. Like with lots of other large companies there is lots of paper work involved if somebody tries to change something, which costs efforts, man power, time and thus money. I don't think that a system administrator just can decide to change the ciphers. Instead it must justify the change against upper management, it must be approved, then tested and then they need to find a maintenance window to apply the change.

Also, the technical side might not be as simple as just changing a cipher in the servers config. There might be load balancers involved which have only (hardware accelerated) support for a limited set of ciphers (mostly RC4 and DES3). Also they might deploy deep inspection IDS up front which can deal with RSA based key exchange provided they have the private key of the servers certificate. But this will not work any longer if the server uses (EC)DH key exchanges to provide forward security.

Together you have lots of management and technical challenges. And unless there are some requirements by law to use better ciphers, only few (if any) resources will be allocated for such a project, which means a change will take a long long time.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.