A system fell into my neck, where lots of files are splitted into several segments and encoded via RC4. RC4, because client side - slow computer, slow flash arithmetic ops - can only decode big blobs with this simple algo in a reasonable amount of time. I have some reservations regarding the RC4 security, so I'd like to hear your opinions about it.
Files can vary in size (1-16 MB), the segment size varies. Each file segment is encoded with a different, random 256 bit key, also a ciphertext based HMAC-SHA256 is appended to each segment.
Client (flash) and Server (php, mcrypt) communicates via DH keyexchange. A 3072 bit PRIME (http://tools.ietf.org/html/rfc3526) is used for generating the secret key. The secret key then hashed with SHA256. With the hashed secret key, the server sends the file segment decode keys - encoded with RC4. Finally, the client checks, then decodes (and checks) the segments.
What are the possible attack scenarios, pitfalls? Since every file segment is encoded with a totally different key. Is the FMS attack an issue here?