I am working on RC4 encryption/ decryption algorithm based on the following:

A wants to send M to B, for that A did:

H = Hash (K||M)
C = Ek (M||H)

A sent ciphertext C to B. (I have completed until this part)

Upon receiving of ciphertext B calculate:

M||H = Dk (C)

Now, how do we obtain M as I need to verify if H' = Hash (K||M) holds.

  • $\begingroup$ Why new code based on RC4 in 2014? There is a lot of work on getting rid of RC4 because it's potentially weak. $\endgroup$ – CodesInChaos Nov 4 '14 at 8:48

Since you already know $K$, you just need to know the length of $H$ based on the hash algorithm you are using, which should be constant, then simply split the output of $D_k$ into the 2 parts of appropriate length.

You can then perform the keyed hash on the first part and match it against the last part, which will match if the decryption was successful.

It should be noted that your method is not aligned with best practices, such as NOT hashing using key prefixing (unless you are using Keccak or other sponge based hash), and NOT hashing the plaintext, but rather the ciphertext, as attacks are possible, especially with RC4. Also it is not recommended to use the same key for both encryption and authentication as per your example.

A better option is:

$C'$ = $E_k (M)$

$C$ = $C'$ $||$ $HMAC_{k'} (C')$

Where $C$ is the final transmitted message, and the hash is checked prior to decryption of the message, and $k'$ is a separate or derived key just for authentication.

  • $\begingroup$ not aligned with best practices is an understatement! H is apparently here in an attempt to authenticate the message; but it does not if M is predictable by the attacker (known plaintext): it is trivial to forge a cryptogram deciphering to any apparently authentic message M' an attacker may wish, with the restriction that M' is no longer than M. $\endgroup$ – fgrieu Nov 4 '14 at 18:25
  • $\begingroup$ as long as it is smaller, you can pad it with carriage return/line feeds, and the message will still appear unmodified. In cases where it is longer, you could make it appear to be compressed data of some kind (zlib)? $\endgroup$ – Richie Frame Nov 4 '14 at 21:25
  • $\begingroup$ the attack rebuilds RC4's keystream generator output over the length of M+H, then process M'+H' where H' is the hash of M'. Truly truncating M'is thus feasible. Your idea of building a compressed M' with uncompressed meaning bigger than that of M is the best option in the other direction. $\endgroup$ – fgrieu Nov 5 '14 at 6:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.