2
$\begingroup$

I am planning to develop a more secure version of the RC4 algorithm. Since I´m not an encryption expert, I´ld like you to help me find answers to the following questions:

  1. Does the value of the key array(T) have to be in this range [0-255]? If the answer is “yes”, could you please explain why?

  2. Why did they use s[t] to generate the key and not the key array which is defined as t array in RC4?

    Output = S[(S[i] + S[j]) mod N];
Improve this question
$\endgroup$
6
  • 7
    $\begingroup$ "i want to develop the RC4 algorithm to be more secure and i am not an expert in encryption" Then don't, and use AES. $\endgroup$
    – fkraiem
    Commented Jul 22, 2015 at 8:28
  • $\begingroup$ @fkraiem i am using RC4 for a reason which is very fast and i need that i my application $\endgroup$
    – lena
    Commented Jul 22, 2015 at 8:49
  • 4
    $\begingroup$ @lena, there are other fast ciphers you should prefer, e.g. Salsa20. Any modification to RC4 to actually make it secure will likely slow it down anyway. (That doesn't make this a bad question, though.) $\endgroup$
    – otus
    Commented Jul 22, 2015 at 11:45
  • $\begingroup$ @otus i would be glad if you suggest a list of stream or block cipher that is really fast and secure $\endgroup$
    – lena
    Commented Jul 22, 2015 at 13:10
  • 1
    $\begingroup$ @lena What's your target hardware? The relative performance of ciphers varies a lot between different CPUs. $\endgroup$
    – CodesInChaos
    Commented Jul 22, 2015 at 20:26

2 Answers 2

Reset to default
5
$\begingroup$

Does the value of the key array(T) have to be in this range [0-255] if yes could you please specify why?

Yes. RC4 operates on bytes. There are 256 possible values for an 8 bit (1 byte) number, that range from 0 to 255. RC4 treats the key as an array of bytes, so every entry in the key array is by definition in the range 0 to 255.

Why did they use s[t] to generate the key and not the key array which is defined as t array in RC4?

Without seeing the RC4 code you are referring to, it is hard to tell what you mean. $S$ is a keyed permutation (where the key is $T$) of the bytes in the range 0-255. The T array may not contain all bytes since it is generated by the user. So, in order to make it so that the values output as the keystream can be the entire range of byte values, they have to use $S$ instead of $T$.

I want to develop the RC4 algorithm to be more secure

Bruce Schneier once noted: "Again, I repeat the saying I've heard came from inside the NSA: 'Attacks always get better; they never get worse.'"

The most recent news on an RC4 attack had this to say: "The researchers said the only reliable countermeasure is to stop using RC4 altogether." (emphasis added)

A number of attacks on RC4 have been published in recent years, and, they are only getting better. A lot of folks are removing RC4 completely from older systems.

Important
I want to point something out that I hope you don't skip over. Any sort of system designed these days should be designed in such a way that it is not cipher specific. In other words, if you really want your system to be "more secure", you should design it in such a way that it can theoretically support any cipher. That way, if one cipher gets broken, your system can easily adapt to a new one that isn't broken. If you are willing to share more details about your system, I think we can help you design it in such a way that this is possible. Likely that will mean using existing standards, or only slightly modifying a standard to fit your needs.

Improve this answer
$\endgroup$
9
  • $\begingroup$ first thanks for replay this was really helpful regarding my system i want to create secure voice transmission system that will encrypt voice and send it so i need the system to be fast but at the same time very secure i will be grateful for any help or ideas $\endgroup$
    – lena
    Commented Jul 22, 2015 at 12:58
  • $\begingroup$ @lena, the best thing to do in security is to not reinvent the wheel and copy what others are doing. Open Whisper Systems has built the RedPhone app for Android and the Signal app for iOS that does secure voice transmission. Check out their source code and their documentation. $\endgroup$
    – mikeazo
    Commented Jul 22, 2015 at 13:20
  • $\begingroup$ i am using udp protocol to transmit voice i guess they are using SIP and RTP so i do not guess there code will be applied in my system $\endgroup$
    – lena
    Commented Jul 22, 2015 at 13:29
  • $\begingroup$ @lena, maybe not, but you can learn from what they are doing and try to apply some of the general ideas. For example, how are symmetric keys established? Etc. The fact that they are using AES w/o issue, says you probably can too. $\endgroup$
    – mikeazo
    Commented Jul 22, 2015 at 13:31
  • $\begingroup$ so do you think that the best algorithm that i can use to encrypt voice is AES $\endgroup$
    – lena
    Commented Jul 22, 2015 at 13:33
0
$\begingroup$

I am planning to develop a more secure version of the RC4 algorithm. Since I´m not an encryption expert...

Never roll your own crypto, especially not if you are no expert in that topic. There are so many traps, starting from implementation bugs to side channel attacks. Simply use existing crypto libraries of secure algorithms like AES.

Improve this answer
$\endgroup$
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.