3 ms·

Any comment on this? Is RC4 secure? For this use-case, yes. For TLS, most certainly not. Even today there are many plausible attacks against RC4 in the TLS con

Any comment on this? Is RC4 secure? For this use-case, yes. For TLS, most certainly not. Even today there are many plausible attacks against RC4 in the TLS context, but none of them apply to this static-data world.

aidenn0 11y ago
RC4 is no longer considered secure for most any purpose. There is known bias in the first few bytes of the cipher that can allow for key-recovery with enough messages sent with the same key. In general you want "head room" in your ciphers such that the best attacks today are not just impractical, but wildly impractical, because attacks tend to get better over time. RC4 was known to not have this "head room" for a while, and now is largely broken.
- kybernetikos 11y ago
  "This use-case" indicates to me a single message encrypted with a single passphrase.
- tptacek 11y ago
  There are biases throughout the whole RC4 keystream, not just in the first few bytes. RC4 is totally broken.
  - ultramancool 11y ago
    If you cannot have something continue to produce output though those periodic biases cannot be obtained, To my knowledge you need a quite large amount of output to exploit them. So for encrypting a single short message, where an attacker is unable to obtain more output, this should be sufficient for such a purpose. Still, I wouldn't use it at all, there are other micro alternatives like TweetNaCl which offer a far higher degree of security.
    - aidenn0 11y ago
      > So for encrypting a single short message, where an attacker is unable to obtain more output, this should be sufficient for such a purpose. This is fairly vacuous as there are tons of really broken cryptosystems for which this is true; futhermore if you are going to only send a single short message with a given key, an OTP could probably be described in 140 characters of English prose and requires no machine to implement.
      - tptacek 11y ago
        It's not vacuous, but there is a history of cryptosystems that have tried and failed to sidestep that RC4 weakness by burning off keystream, so it's worth being careful about it.

aidenn0 11y ago

RC4 is no longer considered secure for most any purpose. There is known bias in the first few bytes of the cipher that can allow for key-recovery with enough messages sent with the same key. In general you want "head room" in your ciphers such that the best attacks today are not just impractical, but wildly impractical, because attacks tend to get better over time. RC4 was known to not have this "head room" for a while, and now is largely broken.

kybernetikos 11y ago
"This use-case" indicates to me a single message encrypted with a single passphrase.
tptacek 11y ago
There are biases throughout the whole RC4 keystream, not just in the first few bytes. RC4 is totally broken.
- ultramancool 11y ago
  If you cannot have something continue to produce output though those periodic biases cannot be obtained, To my knowledge you need a quite large amount of output to exploit them. So for encrypting a single short message, where an attacker is unable to obtain more output, this should be sufficient for such a purpose. Still, I wouldn't use it at all, there are other micro alternatives like TweetNaCl which offer a far higher degree of security.
  - aidenn0 11y ago
    > So for encrypting a single short message, where an attacker is unable to obtain more output, this should be sufficient for such a purpose. This is fairly vacuous as there are tons of really broken cryptosystems for which this is true; futhermore if you are going to only send a single short message with a given key, an OTP could probably be described in 140 characters of English prose and requires no machine to implement.
    - tptacek 11y ago
      It's not vacuous, but there is a history of cryptosystems that have tried and failed to sidestep that RC4 weakness by burning off keystream, so it's worth being careful about it.