Why Distance-128 relation in Plain texts is reflected in Cipher texts

Question

The two text having relation as "\x10\x11" → "\x90\x91" (80+10) will have relation after encryption/decryption also in RC4. Following code clearly describes the problem I am mentioning.

 from Crypto.Cipher import ARC4
 key = '12345678'
 obj1 = ARC4.new(key)
 obj2 = ARC4.new(key)
 d1= obj1.decrypt('\x01\x02\x03\x04\x05\x06')
 d2= obj2.decrypt('\x81\x82\x83\x84\x85\x86')

 p1='';p2=''
 for i in d1:
     if ord(i)>=128: p1+=chr(ord(i)-128)    
     else: p1+=chr(ord(i))

 for i in d2:
     if ord(i)>=128: p2+= chr(ord(i)-128)    
     else: p2+=chr(ord(i))
 print p1==p2

output: True

I mean if i have two ciphers that are related with (0x80) 128-distance, I get some relation in decrypted outputs. I tried it many times and got the same replation with respect to the ciphers’ characters related as +-7F. What is the reason behind it?

Answer 1

The short answer to your question is because RC4 is a stream cipher.

Try comparing the xors of the two plaintexts and the two ciphertexts... Better still, replace the second ciphertext with \x00...\x00 and then look what happens.

A stream cipher works by taking a secret input (the key) and turning it into a long stream of pseudo-random data (the stream). This output stream is the xor'd with the plaintext to produce the ciphertext. To decrypt, we again generate the stream, but this time by xoring it with the ciphertext we retrieve the plaintext.

One of the biggest issues with using xor is that bit's flipped in the plaintext translate into bit's flipped in it's ciphertext.