Why RC4 used 24-bits constant value + 40 bits random values to generate key?
$\begingroup$
$\endgroup$
2
asked Sep 5, 2012 at 2:06
-
2$\begingroup$ We must not be looking at the same stream cipher, to my knowledge RC4 uses no constant value other than the identity permutation (0, 1, 2, ..., 255), and has a key up to 2048 bits long. If this is a custom implementation which uses an IV, we need to have references. You might be talking about the WEP protocol, which uses a 24-bit IV, if so, mention it. $\endgroup$– ThomasCommented Sep 5, 2012 at 2:55
-
1$\begingroup$ Also note 40-bit keys are way too short to be secure nowadays, I could break one in a couple hours on the computer I'm on right now. You want 80 bits at the very least and 128-bit to be comfortable. $\endgroup$– ThomasCommented Sep 5, 2012 at 2:55
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
I believe you are mistaken; RC4 takes a variable length key (between 1 byte and 256 bytes), and uses that to generate an initial internal state, and from that, generates a continuous length of keystream. There are no assumption that 24 bits are fixed and 40 bits are random.
What you might be talking about is that there might be some protocol or file encryption method that creates the RC4 key by concatenating a 24 bit constant value to a 40 bit random value. I have not heard of such a thing; however, I cannot claim that I know of everything that uses RC4. In addition, it's possible that you are making a garbled reference to WEP; for the standard WEP protocol, that uses 24 bits of IV (which vary for each packet), and 40 bits of secret keying data. If you are talking about WEP, well, don't do it; the protocol is known to be broken.
However, even if you are not talking about WEP, but instead something that really does form the key from a 24 bit constant and a 40 bit random value, it still doesn't sound like a good idea. For one, RC4 is known to be weak when using keys that are formed by concatenating public and private information (which is exactly the problem that WEP ran into); while I don't immediately see a specific way generating keys this way could be exploited, it's not a good sign.
What is apparent is that, even if the 24 bit constant value is not public information, if that attacker can get his hands on $2^N$ ciphertexts were the plaintexts has known linear relationships (for example, the MSBits are known to be all clear), then he can recover one of the keys with $2^{64-N}$ effort (by trying random 64 bit keys, generating the keystream, and seeing if the linear relationships work out); once he has that, he has the 24 bit constant value; he can recover the rest of the keys with $2^{40}$ work.
