I was under the impression that RC4-MD5 was no longer recommended but RC4-SHA wa... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

newman314 on July 14, 2011 | parent | context | favorite | on: Nginx doesn't suck at SSL after all

I was under the impression that RC4-MD5 was no longer recommended but RC4-SHA was okay (comparatively). Is this incorrect?

yuhong on July 15, 2011 [–]

The hash algorithm in TLS is HMAC-hash. Some uses of MD5 like secret suffix are now insecure (which is why usage of MD5 for certificate signing ended long ago), but HMAC is not one of them.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact