5
$\begingroup$

I saw a question on StackOverflow where RC4 was initialized by a 1024 bit key (with 2048 the maximum key size, if I'm not mistaken).

Will such a large key size possibly solve any of the bias of the initial bits of the key stream produced by RC4? Does it increase security any other way - other than brute force?

Is there any reason for keys larger than 256 bits for a combined key + IV?

$\endgroup$
5
$\begingroup$

Will such a large key size possibly solve any of the bias of the initial bits of the key stream produced by RC4?

There is a bias in the RC4 output at small multiples of the key size; hence a 16 byte key will have biases at offsets 16, 32, 48, etc (with the bias rapidly growing smaller as the offset grows). This bias happens less often with larger key sizes.

Other than that specific bias, no, increasing the key size doesn't help.

Is there any reason for keys larger than 256 bits

Actually, I'm not sure if there's any reason to use RC4 at all...

| improve this answer | |
$\endgroup$
  • 3
    $\begingroup$ Yeah, RC4 should be avoided (and Spritz can also be distinguished from random and doesn't bring any benefit other than drop-in RC4 compatibility). I was just being curious. $\endgroup$ – Maarten Bodewes Feb 25 at 13:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.