Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

A system fell into my neck, where lots of files are splitted into several segments and encoded via RC4. RC4, because client side - slow computer, slow flash arithmetic ops - can only decode big blobs with this simple algo in a reasonable amount of time. I have some reservations regarding the RC4 security, so I'd like to hear your opinions about it.

Files can vary in size (1-16 MB), the segment size varies. Each file segment is encoded with a different, random 256 bit key, also a ciphertext based HMAC-SHA256 is appended to each segment.

Client (flash) and Server (php, mcrypt) communicates via DH keyexchange. A 3072 bit PRIME (http://tools.ietf.org/html/rfc3526) is used for generating the secret key. The secret key then hashed with SHA256. With the hashed secret key, the server sends the file segment decode keys - encoded with RC4. Finally, the client checks, then decodes (and checks) the segments.

What are the possible attack scenarios, pitfalls? Since every file segment is encoded with a totally different key. Is the FMS attack an issue here?

share|improve this question
This answer (and some of the others) to a nearly related question could be interesting for you. –  e-sushi Aug 27 '13 at 11:14
Your description seems to be missing some possibly relevant details. For instance, what key is used for the HMAC? Is the HMAC output also encrypted, and if so, how? And how are the segment lengths transmitted? –  Ilmari Karonen Aug 27 '13 at 12:59
HMAC key: the same key used for the segment. HMAC is not encrypted. Client fetches the segments as separate files, so length info not necessary. –  MollyRazor Aug 27 '13 at 13:36
You're still missing a lot of details. Can you provide the exact algorithms? e.g., what is the HMAC computed on? (on the ciphertext/on the plaintext?) How is the HMAC key for each segment chosen: is it the same for all files and all segments, or does it vary? How is the RC4 key for each segment generated? is it a function of some master key, and if so, what's the function? Can you specify the exact DH key exchange more precisely? How is the DH exchange authenticated? There are many possible problems; your question doesn't specify enough detail to analyze the scheme at a technical level. –  D.W. Aug 29 '13 at 23:56
add comment

1 Answer

Using the same key for encryption and MAC is generally bad style, but may be secure in your implementation.

FMS isn't relevant for file segment decode because you don't reuse the same key. FMS isn't the only attack, though.

I have to ask though - is there some reason why you don't use SSL?

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.