Skip to main content
19 votes
Accepted

Is RC4 secure with a single-use 32-byte random key prefix and 3072 prefix bytes discarded?

Yes, there are reasons to avoid RC4 and to consider it hopelessly insecure. The single-byte biases—the biases that were so obvious that Bob Jenkins found them empirically on his 1994-era laptop ...
Squeamish Ossifrage's user avatar
17 votes
Accepted

Difference between RC2, RC4, RC5 and RC6

RC2 RC2 is a 64-bit source-heavy unbalanced Feistel cipher with an 8 to 1024-bit key size, in steps of 8. The default key size is 64 bits. It was designed in 1987. It has a heterogenous round ...
forest's user avatar
  • 15.3k
8 votes

What are the steps for decryption of RC4?

Your guess is correct. RC4 basically generates a very long key to fit your message. Encryption and decryption is simply xoring with the output of RC4 for that particular position in the key stream. ...
Marc's user avatar
  • 1,583
7 votes

Is RC4 secure with a single-use 32-byte random key prefix and 3072 prefix bytes discarded?

Unfortunately, most of them. The issue here is the notion of "single use". You have to consider that a single encryption session might be longer than your random 3072 prepended bytes. So RC4 output ...
Paul Uszak's user avatar
  • 15.5k
7 votes
Accepted

Using a PRNG for a stream cipher instead of a dedicated algorithm

I use HMAC-DRBG in my python modules as a backup for when no "real" crypto package is installed. The python 2 standard library offers cryptographic hashes and HMAC, but no encryption primitives. The ...
Ella Rose's user avatar
  • 19.7k
7 votes

Using a PRNG for a stream cipher instead of a dedicated algorithm

Rather than giving the advantages of purpose build stream cipher I'll give the disadvantages of using a PRNG / DRBG (you are using a PRNG for the use case of a stream cipher after all): ...
Maarten Bodewes's user avatar
  • 93.2k
6 votes

Security analysis of Spritz?

Unfortunately, there’s bad news. According to Wikipedia, it’s alledgedly been broken; this paper appears to have details, but I prefer being a programmer, not an academic. The summary of it boils ...
mirabilos's user avatar
  • 293
5 votes

Using a PRNG for a stream cipher instead of a dedicated algorithm

I think this question's answer becomes much clearer if we refine our terminology/classification of algorithms, to focus on the requirements instead of the mechanics. In particular, cryptographic uses ...
Luis Casillas's user avatar
5 votes
Accepted

Arbitrary key size in RC4

This is about a misunderstanding. RC4 is a stream cipher. That means that it takes an (input) key and generates a key stream. The bits of this key stream are then XOR'ed with the plaintext. The size ...
Maarten Bodewes's user avatar
  • 93.2k
5 votes

Is it possible for an element to be swapped with itself in RC4?

$i=j$ is possible. Here's an example: When initialized with key iB (i.e., the two-byte string 69 42), the state after key ...
yyyyyyy's user avatar
  • 12.1k
5 votes
Accepted

Does "double RC4" exhibit the same weaknesses as standard RC4?

It can be attacked in the same way, but not as efficiently. The RC4 "NOMORE" attack (pdf), for example, uses both Fluhrer-McGrew biases, which are biases towards certain pairs of values in certain ...
otus's user avatar
  • 32.2k
5 votes
Accepted

Use large key size for RC4 to avoid RC4 bias

Will such a large key size possibly solve any of the bias of the initial bits of the key stream produced by RC4? There is a bias in the RC4 output at small multiples of the key size; hence a 16 byte ...
poncho's user avatar
  • 148k
5 votes
Accepted

MS CryptoAPI RC4-1024 vs AES-128?

MD5 based key derivation and RC4 encryption. Really? Example created in 2018? Microsoft should be ashamed of itself. I don't see that 1024 bit key, I see a 128 bit key created from the aforementioned ...
Maarten Bodewes's user avatar
  • 93.2k
4 votes

How do attacks on WEP work?

Part of the problem you're having is that there are multiple distinct vulnerabilities in WEP, and you're getting confused by the sheer number. For example: I still don't have an understanding of ...
poncho's user avatar
  • 148k
4 votes

Arbitrary key size in RC4

Yes, RC4 can give 17-bit ciphertext for 17-bit plaintext. Nothing special is necessary beyond supporting bit-sized plaintext and ciphertext. In RC4: The ciphertext has precisely the size of the ...
fgrieu's user avatar
  • 142k
4 votes
Accepted

Are there ready-to-use software that can try many decryption techniques on a ciphertext, with no information?

The project Cryptool does some if not all of what you want. I have not used it extensively, but it seems quite well documented. Below from the webpage: CrypTool 1 (CT1) was the first version of ...
kodlu's user avatar
  • 22.7k
3 votes
Accepted

Attacks against RC4 when index $i$ is unknown

The most efficient way I can think of (not that it's all that practical) is to take a very long section of the keystream (think a Gigabyte+), and check it against the known RC4 digraph statistics; ...
poncho's user avatar
  • 148k
3 votes
Accepted

Is RC4 cipher just xoring plaintext with a random sequence seeded by key?

Is there something else in the algorithm? No, that's it: just a pseudorandom generator (which in RC4's case turned out not to be that random) whose output is XORed with the message. Is there a ...
yyyyyyy's user avatar
  • 12.1k
3 votes
Accepted

Is the RC4 KSA the same as an extractor?

It would not work as a randomness extractor as there is a detectable correlation between the key, the internal state, and the output. http://saluc.engr.uconn.edu/refs/stream_cipher/...
user3201068's user avatar
3 votes

Does RC4 continue to be used anywhere?

RC4 seems to be an option in the SSH1 and SSH2 protocols, so yes, it is still in use as cipher. AES seems to be preferred in most configurations, but "arcfour" is still often used as fallback. WPA ...
Maarten Bodewes's user avatar
  • 93.2k
3 votes

RC4-40 with IV (32-bit) setup

RC4 does not take an IV. This is relatively uncommon in stream ciphers, but it is the case in RC4. It seems tempting to just concatenate the key with the IV, and this is the approach taken in WEP. ...
bk2204's user avatar
  • 3,476
2 votes
Accepted

When is AES chosen instead of a stream Cipher (e.g., RC4) during an SSL connection?

I understand that AES would be a better choice for applications where all the data is available at once, permitting the use of large blocks. RC4 on the other hand is more suited for applications where ...
otus's user avatar
  • 32.2k
2 votes
Accepted

RC4, finding key if we know plain text and ciphertext

The correct answer depends on whether you want to recover the key or the keystream. Let's first review how RC4 works: RC4 Recap RC4 takes a key as input and generates a cryptographically secure stream ...
derbenoo's user avatar
  • 221
2 votes

Stream Ciphers -- Need clarification on their benefits in practice

Stream ciphers not necessarily encrypt one byte at a time; they encrypt/decrypt by generating keystream and xorring it with plaintext/ciphertext. Old stream ciphers like RC4 generate keystream byte by ...
kludg's user avatar
  • 736
2 votes
Accepted

How should k2 be produced in the RC4A stream cipher (A modification of RC4)?

Do the two differing implementations in practice undermine RC4A's security claims by not using a PRBG/PRGA to produce k2? I wouldn't think so. I get the impression that the authors just intend k2 to ...
Paul Uszak's user avatar
  • 15.5k
2 votes

Why does Blowfish and RC4 (Arc4) make same encrypted strings

Did I implement the algorithms correctly? given that one of my GUI buttons invoked a wrong method which lead to Blowfish encrypt method to be called, instead of RC4 we don't know. But ARC4 ...
SEJPM's user avatar
  • 46.1k
2 votes
Accepted

RC4 - Key scheduling Algorithm

Yes, the seed to the KSA in RC4 is essentially the secret key for the stream cipher. With the secret key (the only input to the KSA) an adversary can recreate the keystream, and thereby recover any ...
puzzlepalace's user avatar
  • 4,042
2 votes

Books about stream ciphers

Probably all you need to know about RC4 (at your level) is on the Wikipedia page. There's even code. And then there are all the links to follow for more detail. And two books in Further Reading:- ...
Paul Uszak's user avatar
  • 15.5k
2 votes

I need a simple cryptographic code to put on a t-shirt

The problem is that dcode.fr expects the key to be ASCII ("SECRET"), while Cryptii.com expect hexadecimal (53 45 43 52 45 54). So in effect when you put the hex to both sites, dcode.fr ...
Eugene Styer's user avatar
  • 1,676
2 votes
Accepted

What authenticated encryption do kerberos use in windows?

It depends on the algorithm. The Kerberos specification states that the encryption and decryption functions must handle integrity checking, but the algorithm specified must define this behavior. The ...
bk2204's user avatar
  • 3,476

Only top scored, non community-wiki answers of a minimum length are eligible