net: don't do TLS False Start with RC4.

net/third_party/nss/ssl/ssl3con.c

 /* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
 /*
  * SSL3 Protocol
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /* $Id: ssl3con.c,v 1.192 2012/09/28 05:10:25 wtc%google.com Exp $ */
 
 /* TODO(ekr): Implement HelloVerifyRequest on server side. OK for now. */
@@ skipping 6393 matching lines @@
     ssl_GetSpecReadLock(ss);
     rv = ss->opt.enableFalseStart &&
          !ss->sec.isServer &&
          !ss->ssl3.hs.isResuming &&
          ss->ssl3.cwSpec &&
 
          /* An attacker can control the selected ciphersuite so we only wish to
           * do False Start in the case that the selected ciphersuite is
           * sufficiently strong that the attack can gain no advantage.
           * Therefore we require an 80-bit cipher and a forward-secret key
-          * exchange. */
+          * exchange.
+          *
+          * Although RC4 has more than 80 bits of key, biases in the RC4
+          * keystream make it unsuitable for False Start because an attacker
+          * can cause the same plaintext to be transmitted under many different
+          * keys. */
          ss->ssl3.cwSpec->cipher_def->secret_key_size >= 10 &&
         (ss->ssl3.hs.kea_def->kea == kea_dhe_dss ||
          ss->ssl3.hs.kea_def->kea == kea_dhe_rsa ||
          ss->ssl3.hs.kea_def->kea == kea_ecdhe_ecdsa ||
-         ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa);
+         ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa) &&
+         ss->ssl3.cwSpec->cipher_def->cipher != cipher_rc4;
     ssl_ReleaseSpecReadLock(ss);
     return rv;
 }
 
 static SECStatus ssl3_SendClientSecondRound(sslSocket *ss);
 
 /* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
  * ssl3 Server Hello Done message.
  * Caller must hold Handshake and RecvBuf locks.
  */
@@ skipping 4836 matching lines @@
             PORT_Free(ss->ssl3.hs.recvdFragments.buf);
         }
     }
 
     ss->ssl3.initialized = PR_FALSE;
 
     SECITEM_FreeItem(&ss->ssl3.nextProto, PR_FALSE);
 }
 
 /* End of ssl3con.c */