19
votes
Accepted
Is RC4 secure with a single-use 32-byte random key prefix and 3072 prefix bytes discarded?
Yes, there are reasons to avoid RC4 and to consider it hopelessly insecure.
The single-byte biases—the biases that were so obvious that Bob Jenkins found them empirically on his 1994-era laptop ...
- 47.9k
17
votes
Accepted
Difference between RC2, RC4, RC5 and RC6
RC2
RC2 is a 64-bit source-heavy unbalanced Feistel cipher with an 8 to 1024-bit key size, in steps of 8. The default key size is 64 bits. It was designed in 1987. It has a heterogenous round ...
- 15.1k
8
votes
What are the steps for decryption of RC4?
Your guess is correct. RC4 basically generates a very long key to fit your message. Encryption and decryption is simply xoring with the output of RC4 for that particular position in the key stream.
...
- 1,583
7
votes
Accepted
Using a PRNG for a stream cipher instead of a dedicated algorithm
I use HMAC-DRBG in my python modules as a backup for when no "real" crypto package is installed. The python 2 standard library offers cryptographic hashes and HMAC, but no encryption primitives.
The ...
- 19.5k
7
votes
Using a PRNG for a stream cipher instead of a dedicated algorithm
Rather than giving the advantages of purpose build stream cipher I'll give the disadvantages of using a PRNG / DRBG (you are using a PRNG for the use case of a stream cipher after all):
...
- 91.7k
7
votes
Accepted
Are there any long term RC4 bias based exploits?
I'm happy to have a crack at this one, providing I've understood your question correctly.
Firstly I wouldn't say the cipher possibly exhibits low level bias at any point. It experiences plenty of ...
- 540
7
votes
Is RC4 secure with a single-use 32-byte random key prefix and 3072 prefix bytes discarded?
Unfortunately, most of them. The issue here is the notion of "single use". You have to consider that a single encryption session might be longer than your random 3072 prepended bytes. So RC4 output ...
- 15.1k
6
votes
Accepted
Do we have anyway of knowing if avoiding self-permutation in RC4 makes it any stronger?
Wanted to expand on my comment as an answer.
The KSA in RC4 permutes the bytes [0,1,...,255] using a key, say $k_u$. For any permutation of these bytes, there exists a key that will get you that ...
- 38.5k
6
votes
Accepted
How much stronger is RC4 if it is keyed with an RSA private key?
RC4 has several known weaknesses, including:
Rather strong biases in the initial parts of its keystream
Weaker biases in the rest of the keystream.
Now, RC4 does take a variable length key, ...
- 145k
6
votes
Security analysis of Spritz?
Unfortunately, there’s bad news.
According to Wikipedia, it’s alledgedly been broken; this paper appears to have details, but I prefer being a programmer, not an academic.
The summary of it boils ...
- 293
5
votes
Using a PRNG for a stream cipher instead of a dedicated algorithm
I think this question's answer becomes much clearer if we refine our terminology/classification of algorithms, to focus on the requirements instead of the mechanics. In particular, cryptographic uses ...
- 14.4k
5
votes
Is it possible for an element to be swapped with itself in RC4?
$i=j$ is possible.
Here's an example: When initialized with key iB (i.e., the two-byte string 69 42), the state after key ...
- 12k
5
votes
Accepted
Does "double RC4" exhibit the same weaknesses as standard RC4?
It can be attacked in the same way, but not as efficiently.
The RC4 "NOMORE" attack (pdf), for example, uses both Fluhrer-McGrew biases, which are biases towards certain pairs of values in certain ...
- 32k
5
votes
Accepted
Arbitrary key size in RC4
This is about a misunderstanding. RC4 is a stream cipher. That means that it takes an (input) key and generates a key stream. The bits of this key stream are then XOR'ed with the plaintext. The size ...
- 91.7k
5
votes
Accepted
Use large key size for RC4 to avoid RC4 bias
Will such a large key size possibly solve any of the bias of the initial bits of the key stream produced by RC4?
There is a bias in the RC4 output at small multiples of the key size; hence a 16 byte ...
- 145k
5
votes
Accepted
MS CryptoAPI RC4-1024 vs AES-128?
MD5 based key derivation and RC4 encryption. Really? Example created in 2018? Microsoft should be ashamed of itself. I don't see that 1024 bit key, I see a 128 bit key created from the aforementioned ...
- 91.7k
4
votes
Accepted
Can somebody help me understand RC4 Spritz? (Three Questions)
The reference definition of Spritz seems to be: Ronald L. Rivest and Jacob C. N. Schuldt, Spritz - a spongy RC4-like stream cipher and hash function, presented at Charles River Crypto Day (2014).
The ...
- 138k
4
votes
Do we have anyway of knowing if avoiding self-permutation in RC4 makes it any stronger?
To build on mikeazo's answer (since it's not really practical to post code in comments), here's a quick Python program that takes any two permutations of $\{0, \dots, 255\}$ and generates a key that ...
- 45.9k
4
votes
How do attacks on WEP work?
Part of the problem you're having is that there are multiple distinct vulnerabilities in WEP, and you're getting confused by the sheer number. For example:
I still don't have an understanding of ...
- 145k
4
votes
Accepted
Is the RC4 keystream random or not?
Like fkraiem's answer points out, passing a statistical test does not prove a PRNG is cryptographically random, or even statistically random with regard to other tests.
In the case of RC4 the biases ...
- 32k
4
votes
Is the RC4 keystream random or not?
Statistical tests have no value to evaluate randomness in a cryptographic sense, because an attacker is not required to use any specific test. The fact that a stream passes some set of predetermined ...
- 8,082
4
votes
Arbitrary key size in RC4
Yes, RC4 can give 17-bit ciphertext for 17-bit plaintext. Nothing special is necessary beyond supporting bit-sized plaintext and ciphertext.
In RC4:
The ciphertext has precisely the size of the ...
- 138k
4
votes
Accepted
Are there ready-to-use software that can try many decryption techniques on a ciphertext, with no information?
The project Cryptool does some if not all of what you want. I have not used it extensively, but it seems quite well documented. Below from the webpage:
CrypTool 1 (CT1) was the first version of ...
- 21.2k
3
votes
Accepted
Is the RC4 KSA the same as an extractor?
It would not work as a randomness extractor as there is a detectable correlation between the key, the internal state, and the output.
http://saluc.engr.uconn.edu/refs/stream_cipher/...
- 701
3
votes
Accepted
Is RC4 cipher just xoring plaintext with a random sequence seeded by key?
Is there something else in the algorithm?
No, that's it: just a pseudorandom generator (which in RC4's case turned out not to be that random) whose output is XORed with the message.
Is there a ...
- 12k
3
votes
Accepted
Is it secure to use ciphertext feedback with RC4?
At least one thing goes very wrong: if an adversary can obtain the ciphertext for a few short chosen plaintexts and the same reused key/initial state, that allows reconstructing the state because the ...
- 138k
3
votes
Encryption Algorithms in Verilog code
Verilog is Turing complete, so you can implement any algorithm in Verilog, if you really want to.
- 32k
3
votes
Does RC4 continue to be used anywhere?
RC4 seems to be an option in the SSH1 and SSH2 protocols, so yes, it is still in use as cipher. AES seems to be preferred in most configurations, but "arcfour" is still often used as fallback.
WPA ...
- 91.7k
3
votes
Accepted
Attacks against RC4 when index $i$ is unknown
The most efficient way I can think of (not that it's all that practical) is to take a very long section of the keystream (think a Gigabyte+), and check it against the known RC4 digraph statistics; ...
- 145k
3
votes
RC4-40 with IV (32-bit) setup
RC4 does not take an IV. This is relatively uncommon in stream ciphers, but it is the case in RC4.
It seems tempting to just concatenate the key with the IV, and this is the approach taken in WEP. ...
- 2,971
Only top scored, non community-wiki answers of a minimum length are eligible