I spoke to Jeff Schiller (area director for security), and we think that the reference to Schneier is sufficient for the TLS spec. Having the RC4 ciphersuite is important, I think, because of its widespread use in SSL today. Without a similar description of RC2, it isn't appropriate to include the ciphersuite. - Win Treese