Encryption process for any outgoing packet to the specified "remote IP":

-original payload P is encrypted (the bytes after the IP header) using RC4 with the
given "key" to obtain encrypted payload C=RC4(P, key)

-The encrypted payload P is concatenated with 16 bytes of md5(C|key), and the
IP header is adjusted accordingly (increasing the packet total length, re-calculate the checksum) so that the outgoing packet will have payload C|md5(C|key) to "remote IP"

Decryption process for any incoming packet from specified "remote IP":

-Check the packet payload for the MD5 authentication with the same given "key"
Specifically, divide the received packet payload (those bytes after the IP header) as two parts C, A where A is the last 16 bytes of the packet payload and C is the rest.

-If (md5(C|key) == A), decrypt C using RC4 with the given "key" to obtain
P=RC4(C, key), change the payload of the incoming packet from C|A to P, and
adjust the IP header accordingly (decrease the packet total length, re-calculate the checksum) so that the incoming packet will be restored to its original form without keyed md5 authentication before sent to the receiving process