# Is it secure to use ciphertext feedback with RC4?

Consider the following modification of RC4 to give some "ciphertext feedback"

i ← 0
j ← 0
C ← 0  -- We will remember the previous output ciphertext byte.
repeat
i ← (i + 1) mod 256
j ← (j + S[i] + C) mod 256  -- Use the previous ciphertext byte
-- for "ciphertext feedback".
S[i] ↔ S[j]
input P                     -- Read the next byte of plaintext
C ← S[(S[i] + S[j]) mod 256] xor P
output C                    -- Output the next byte of ciphertext


It would be nice to be able to use RC4 in some sort of plaintext-dependent mode like this, to avoid various stream cipher weaknesses while still having a cheap cipher that is easy to implement.

Is there something obvious (or non-obvious) that goes wrong here? [Edit: Other than my ability to write appropriate pseudocode on the first try.]

• please. do. not. use. RC4. for. anything. and more importantly: do. not. roll. your. own. crypto. – SEJPM Nov 17 '15 at 20:27
• That is not like ciphertext feedback. It's more like output feedback. – otus Nov 17 '15 at 21:56
• I dorked the pseudocode. Thanks for noticing my stupidity. I'll edit the question and try again. – PO8 Nov 18 '15 at 1:49
• I. will. not. use. RC4. for. anything. important. and more importantly: I. asked. for. review. because. I. was. interested. in. the. analysis. I can well believe that something goes wrong here. I would love to learn something by seeing what problems this has. Dot-texting at me is not helping. – PO8 Nov 18 '15 at 1:58
• In general, I don't think you'll find that people are overly willing to spend time and/or effort analyzing bespoke novel constructions around broken ciphers. – Stephen Touset Nov 18 '15 at 2:04

At least one thing goes very wrong: if an adversary can obtain the ciphertext for a few short chosen plaintexts and the same reused key/initial state, that allows reconstructing the state because the indexes vary in a controlled way. That certainly works if we obtain the ciphertext for the $2^{24}$ plaintexts consisting of the 3 bytes $u$ $v$ $w$ $0$ (basically, we can make some hyptohesis on a few state bytes, and confirm or rule it out based on the ciphertext for that chosen plaintext); or something on that tune. Likely, it is possible to mount an attack requiring much less chosen plaintext.