All operations

RC4

The broken stream cipher that used to be everywhere. Kept for reading old traffic.

The loaded example

The hex above is a widely reproduced RC4 test vector. The chain decodes it to bytes and runs RC4 over them with the key Secret, giving Attack at dawn. Encrypting and decrypting are the same operation, so that plaintext sent back through with the same key returns the hex. RFC 6229’s keystream vectors are checked against this implementation.

How it works

The cipher keeps a 256-byte array holding every value from 0 to 255, and a key schedule shuffles it. Each output byte then comes from advancing two indices, swapping the entries they point at, and reading the entry at the sum of those two values, which is XORed against one byte of input. Keys run from 1 to 256 bytes, typed as text or hex; anything longer never reaches the schedule, so this operation refuses it rather than truncating quietly. Small state, no precomputed tables, a couple of dozen lines of code. RC4 spread because it cost almost nothing to run.

Where it broke

Mantin and Shamir showed in 2001 that the second keystream byte is zero about twice as often as chance allows. Fluhrer, Mantin and Shamir published the key-schedule weakness the same year, and it took WEP apart: a 24-bit IV prepended to the shared key went out in the clear, so enough captured packets yield the key itself. PTW had that down to under a minute by 2007.

TLS held out longer. In 2013 AlFardan, Bernstein, Paterson, Poettering and Schuldt turned the single-byte biases into plaintext recovery against anything sent repeatedly, a session cookie being the obvious target. RFC 7465 prohibited RC4 in TLS in February 2015. Vanhoef and Piessens published RC4 NOMORE that July, decrypting a cookie in about 75 hours, and 52 in a practical run. The major browsers dropped RC4 early in 2016. Keep it for old captures and puzzles.

Key reuse

One key field, no nonce. Two messages under the same key share a keystream, so XORing the ciphertexts cancels it and leaves the plaintexts XORed together. Anything using RC4 seriously mixed per-message material into the key, the seam WEP tore along.

Where it came from

Ron Rivest designed RC4 at RSA Data Security in 1987 and kept it a trade secret. Source code appeared anonymously on the Cypherpunks mailing list in September 1994. Implementations avoiding the trademark called it ARCFOUR, the name RFC 4253 still lists as an optional SSH cipher.

AES replaced it, with authentication attached. Bitwise is the XOR underneath, with no key schedule in front of it. Hexadecimal runs backwards above, turning those digits into bytes.