PayPal encrypted with obsolete cryptography

Question

My Chrome just complained from PayPal's security, similarly to this issue:

Google Chrome "Your connection to website is encrypted with obsolete cryptography"

The identity is verified, but it complains the cryptography is obsolete.

Says it uses RC4_128 with SHA1.

Should I be worried? Should PayPal be ashamed? Should Chrome stop scaring me?

UPDATE: Chrome was v 42 and after the update to v 43 the message stopped and now the certificate shows AES_256_CBC -- which, according to some of the comments, makes me believe that choice of using "RC4_128 with SHA1" was made by Chrome 42, not PayPal.

Bad Google: making people think the server is in the wrong, while it was your browser making the decision...

Answer 1

This message is Google trying to push people nilly-willy into the 21st century of cryptography. So they point and mock when they see "RC4" or "SHA-1". This does not mean that such algorithms can be broken immediately. Only that Google would find the world a better place (or possibly a googler place) if everybody were using algorithms more to their liking, i.e. TLS 1.2 with AES/GCM.

In practice, there are a few "worries" about RC4 and SHA-1, though neither should prove fatal to your communications:

• RC4 has known biases. These biases could theoretically be exploited to recover secret data, provided that the attacker can observe lots of connections (millions), all containing the same secret data at the same predictable place in the stream, provided that the secret appears early enough in that stream (because these biases get lower the further you go down the stream). The last condition is the one which is the biggest problem for an attacker trying to break through HTTPS; the interesting secret (HTTP cookie) appears relatively far in the HTTP header. To my knowledge, there has been no application of such attacks spotted in the wild so far.

• SHA-1 has theoretical weaknesses with regards to resistance to collisions. No actual collision was produced yet; the theory (which is considered rather solid) is that building a collision would imply a computing cost of 2⁶¹ function evaluations or so, i.e. substantially less than the expected 2⁸⁰ (for a function with a 160-bit output), but still too much to be casually contemplated even by academics with a lot of budget. Moreover, use of SHA-1 within TLS is through HMAC, which would not be impacted by collisions. There is no known weakness, theoretical or otherwise, in SHA-1 as it is used in SSL/TLS.

Paypal enforces RC4 because they want to avoid the perceived weakness induced by AES in CBC mode (so-called "BEAST attack" that no longer works in practice). They sure would prefer if Chrome was not claiming that they are "obsolete" because that may scare away customers; for a bank, security is important, but projecting an image of security even more. Customers must feel safe, or they will bring their money elsewhere (this is why most 19th-century banks were opening offices with very massive architecture, with granite columns and steel doors: to instill an inconscious feeling of solidity).