RFC 7465 / PROTOCOL MECHANISMS

Remove RC4 before ClientHello

ClientHello is the TLS client’s initial offer. A conforming client MUST NOT include any RC4 cipher suite in it. This is not merely a low preference.

RFC 7465 · § 2EXAMPLE

4 / 4

Transmit that filtered offer; no RC4 suite crosses to the server.

Transmit that filtered offer; no RC4 suite crosses to the server.

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references

New to this? Start hereA quick picture + helpful background

A message needs an address.

Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.

Helpful first, if these ideas are unfamiliar

These pictures are analogies to help you learn. The linked RFC explains the actual rules.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

KEY POINT

The example starts with a local historical configuration, not a transmitted conforming offer. Filter RC4 before constructing ClientHello.
Both shown RC4 names are forbidden: TLS_RSA_WITH_RC4_128_SHA and TLS_ECDHE_RSA_WITH_RC4_128_SHA. Changing the key-exchange family does not remove RC4.
The remaining worked example is TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (RFC5289§3.2). Passing this RC4 check alone is not a complete current TLS recommendation.
AppendixA lists18 RC4 suites, including export, anonymous, Kerberos, PSK and elliptic-curve families. The prohibition is on RC4, not just the two shown names.

DETAILS

The drawing is a simplified worked example. Follow the linked RFC and its updates for implementation requirements.