My idea is to generate a RSA 2048 bit key and use RC4 with the private RSA key to encrypt a stream of data. RC4 is weak because RC4 keys are small, 256-bit. But when we use RC4 with private RSA 2048 key, how much stronger will it be?
$\begingroup$
$\endgroup$
6
-
4$\begingroup$ "RC4 is weak because its key is small, 256bits"; actually, no. RC4 isn't weak because of the key size (128 bits would be sufficient if RC4 were a strong cipher, and in any case, it can take a variable length up to 2048 bits); it's because RC4 has known biases in its output, and these biases can possibly cause information to be leaked. These biases occur independent of the RC4 key size. $\endgroup$– ponchoCommented Dec 12, 2015 at 4:56
-
$\begingroup$ @poncho Wouldn't a sufficiently large key eliminate the bias in the beginning of the RC4 stream caused by its weak key setup, leaving only the mostly harmless n-gram biases inherent to RC4? (of course one could just drop the beginning of the output instead) $\endgroup$– CodesInChaosCommented Dec 12, 2015 at 12:33
-
1$\begingroup$ @CodesInChaos: no, the initial biases occur even with a completely random 2048 bit RC4 key. $\endgroup$– ponchoCommented Dec 12, 2015 at 13:07
-
1$\begingroup$ @poncho, sounds like you have a good answer there. Care to write it up? $\endgroup$– mikeazoCommented Dec 12, 2015 at 13:26
-
1$\begingroup$ Note that using fully random 2048 bit key would be more secure than using a 2048 bit RSA private key. You would also have to encode the RSA private key somehow, and if you use a standardized encoding scheme, the resulting byte array will be even less random and over the maximum of 2048 bits. You'd have to use the encoded private exponent instead. $\endgroup$– Maarten Bodewes ♦Commented Dec 13, 2015 at 17:44
|
Show 1 more comment
1 Answer
$\begingroup$
$\endgroup$
RC4 has several known weaknesses, including:
Rather strong biases in the initial parts of its keystream
Weaker biases in the rest of the keystream.
Now, RC4 does take a variable length key, potentially up to 2048 bits (256 bytes). So, if you wanted, you could take a 2048 bit RSA modulus, and use that as the RC4 key. However, doing so would not affect most of the known biases; these occur independent of the key size. What RC4 does internally is effectively take the key it is given, and repeat it until it has something 256 bytes long (and uses that to stir the initial permutation). Most of the biases do not occur because of repeats in this expanded key, and so are unaffected by a larger key.
Now, I say "most of the biases" because there is one bias in the initial keystream that would be cleared up by a larger key; a 32 byte key would cause a bias at locations 32, 64, 96 (and gradually dying out until you hit location 256); a larger key would eliminate that bias. However, there are plenty of other biases in the initial keystream; just eliminating this one doesn't solve the problem.
