Rivest Cipher 4 (RC4) | Infosec (2024)

Cryptography

RC4 stands for Rivest Cipher 4. RC4 is a stream cipher and was invented by Ron Rivest in 1987. Since RC4 is a stream cipher, it encrypts the stream of data byte by byte.

Of all the stream ciphers, RC4 is the widely used stream cipher due to its speed of operations and simplicity.

RC4 variants

RC4 has 4 variants to it. They are:

• SPRITZ: Spritz is used to build:
• a) Cryptographic hash function
• b) Deterministic random bit generator (DRBG)
• c) Encryption algorithm which supports Authenticated Encryption with Associated Data (AEAD)
• RC4A:This is a stronger variant than RC4.
• VMPC: It stands for Variably Modified Permutation Composition.RC4A+:RC4A+ as the name suggests is a modified version of RC4 with a more complex three-phase key schedule and takes 1.7 times as long as basic RC4.

Working of RC4

RC4 makes use of KSA and PRGA Algorithms. Explanation and working of these algorithms is out of scope. Let’s understand how encryption and decryption takes place in RC4.

Encryption

1. User inputs plain text and a secret key.
2. The encryption engine generates the keystream by using KSA and PRGA Algorithms for the secret key entered.
3. The generated keystream is XORed with plain text. Since RC4 is a stream cipher, XORing is done byte by byte and encrypted text is produced.
4. This encrypted text is now sent to the intended receiver in encrypted form.

Example

Plain Text: 10011001

Keystream: 11000011

--------------------------------

Cipher Text: 01011010

Decryption

Steps

1. For decryption, ciphertext and the same keystream is required which was used for encryption.
2. The ciphertext and the keystream produce plain text using XOR Operation.
3. The ciphertext is XOR’ed with keystream bit by bit to produce PlainText.

Example

Cipher Text: 01011010

Keystream: 11000011

----------------------

Plain Text: 10011001

Advantages of RC4

1. RC4 is simple to use.
2. Speed of operation is fast as compared to other cipher suites.
3. RC4 cipher is easy to implement.
4. RC4 does not consume more memory.
5. For large streams of data, RC4 is the preferred choice.

Disadvantages of RC4

1. If a strong MAC is not used, RC4 is vulnerable to a bit-flipping attack.
2. RC4 does not support authentication.
3. RC4 is not feasible to be implemented on small streams of data.

Attacks on RC4

RC4 is vulnerable to following attacks -

1. Fluhrer, Mantin and Shamir attack
2. Klein’s attack
3. Combinatorial Problem
4. Royal Holloway Attack
5. Bar-mitzvah Attack
6. NOMORE Attack

RC4 applications

RC4 application has been found in -

• WPA
• BitTorrent protocol encryption
• WEP
• Microsoft Office XP
• Microsoft Point-to-Point Encryption
• Transport Layer Security / Secure Sockets Layer
• Secure Shell (optionally)
• Remote Desktop Protocol
• Kerberos
• SASL Mechanism Digest-MD5
• PDF
• Skype

Sources

1. https://www.geeksforgeeks.org/rc4-encryption-algorithm/
2. https://paginas.fe.up.pt/~ei10109/ca/rc4.html
3. https://tutorialspoint.dev/computer-science/computer-network-tutorials/computer-network-rc4-encryption-algorithm

Posted: January 11, 2021

In this Series

Related Bootcamps