I've seen a lot of algorithms posted everywhere about how to encrypt using RC4. For example, this wiki article https://en.wikipedia.org/wiki/RC4 explains the KSA and PRGA steps.

After it generates bytes, they are XOR'd with a message to encrypt the message. What are the steps for decrypting the message when it is received by the intended entity?

It's probably the inverse of KSA / PGRA, but can someone write out the steps for it? I've tried looking online and can't find an article on it, and I'm trying to fully understand the decryption part of it.

What I'm guessing is, the entity receiving the message generates the same bytes using the key as well (with the KSA / PRGA algorithm), then XORs the encrypted message with the bytes?


1 Answer 1


Your guess is correct. RC4 basically generates a very long key to fit your message. Encryption and decryption is simply xoring with the output of RC4 for that particular position in the key stream.

In general, most stream ciphers work that way. The complex part is that the algorithm should generate a very long key that is not susceptible to attack (the ideal being a one-time pad of the same length as the message).

So once you understand encryption using RC4, switch "plaintext" and "ciphertext" in the explanation to give you decryption.

edit: you probably know this already but it doesn't hurt to reiterate: don't use RC4. It is not secure and can be broken.

  • $\begingroup$ It is possible to use other methods than XOR as well, for instance addition (over bytes or words) is also reversible, commutative and associative. XOR is mainly used of course, as it operates on bits and is it's own reverse. The stream ciphers that do not work this way are the ones that are "plaintext aware". $\endgroup$
    – Maarten Bodewes
    Dec 14, 2017 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.