Is RC4 +XOR secure for small data?

I need to encrypt transmission between my device (with AVR processor) and base. I create packet data - it will be encrypted into string:

PacketData {
int packetN;
string data;
CRC16 checksum;
string nextKey;
}


As you can see, key will be changing after each packet.

First, I tried to use XOR encryption, but I forgot that if attacker know plaintext, all encryption will be without sense.

Now, I have an idea - first, use RC4 on data with key, and XOR result with same key. I see bad side of this solution - key will be same for both operations, and I want key length ~64 bits. Handshake will be written on device (8 characters), and connection will be made when base sends encrypted packet with handshake. Also, data size will be usually between 4 and 32 bytes, sometimes more.

Is this encryption give me sufficient safety? After reading about RC4 in WPA, I see that is problem in WPA implementation. Maybe I should use (when connected) two keys, for RC4 and XOR, both sended in encrypted packet?

Please, tell me what do you think about it. It must be light solution (because tiny processor) so I can't use AES. My solution is right?

• First, AES is really not very demanding on hardware, so unless you verified that it doesn't work on your exact hardware I'd take another look at it. Second, why not just use RC4? Why add in an XOR with the key? – cpast Jan 21 '15 at 15:37
• Incidentally, you probably won't want 64 bit keys; those are a bit too short for comfort. – cpast Jan 21 '15 at 15:56
• If you haven't tried AES, I'd highly recommend trying it; the limit on code size is actually the only possible issue I see, but there are small implementations of AES available (embedded system performance was a requirement of AES candidates). Otherwise, I'd still strongly caution against combining a Vigenere cipher and RC4 - combining two insecure systems normally doesn't result in a secure system. – cpast Jan 21 '15 at 16:10
• This isn't authenticated (a CRC16 is nowhere near strong enough to prevent someone from even just trying all possible values for a packet), so an attacker can almost assuredly flip arbitrary bits at will. – Stephen Touset Jan 21 '15 at 16:42
• For AVR specifically, this page seems to have an AES implementation with code size of 1570 bytes and encryption at ~93.5 kB/sec (decryption is only 71.5 kB/sec, but you'd be decrypting on the base station). Would that be too big for your needs? – cpast Jan 21 '15 at 17:36