3 ms·

Why not use RC4? How resource constrained are you? Doesn’t most of your networking gear have crypto built into it already?

by _3u10 5y ago

JoachimS 5y ago
Apart from being broken RC4 requires 256 bytes of state, have a very slow key change operation. And is actually quite slow. Most modern lightweight ciphers requires much less state (can be stored in registers even), has good key agility. And are faster. So there are numerous technical reasons to not use RC4. As long as you don't have legacy requirements, don't use RC4.
tptacek 5y ago
Because RC4 is probably the most egregiously broken cipher that has ever been in common use.
- tialaramex 5y ago
  And this is actually an interesting line in the sand here. SPECK is probably fine. It's a pretty ordinary-looking design, if some 25 year old up-and-coming crypto academic proposed this for an application, nobody would freak out about how maybe it's a cunning trick to steal all our data. But because the NSA was involved and wasn't willing to share whatever methods they're currently using to check this was OK that's apparently reason to shoot it down. And even though RC4 is very broken (unlike SPECK) it'd still actually be a lot of work to attack many practical applications of RC4. One of the strange things the Web gave us is a real application that looks like the outrageously convenient models in a cryptography class. Want one of the participants to repeatedly send a known plaintext using millions of different keys so you can see what that looks like? Javascript! Need to ensure your payload data is right next to the mystery data you need to decrypt? Cookies! Need to convince a participant to connect to your hostile system and decrypt large volumes of data? Embedded images and HTML email! So on the web, you can build a toy demo that breaks RC4, not really in a real time (I guess at a multi-day conference you could do an afternoon session "Preparing to break RC4" and then a morning session the next day "See, it worked") but for most protocols the attack is not practical. Attacks of course, only get better, so, this is not telling anybody to use RC4 but only underscoring how high the bar is here. Should you use RC4? No. Definitely not. But is the RC4-encryption for the IoT data feed the weakest link in your system today? Almost certainly also no.
  - _3u10 5y ago
    Exactly. Is it broken? Yes. Am I going to buy a GPU or a wrench to crack a password? Most definitely a wrench. I honestly do think if the data only has to be protected for a day, just use RC4 (or something similar). It’s pretty obvious the data is worth nothing if it’s not even worth an extra battery to properly encrypt.
    - tptacek 5y ago
      At this point you might as well use Speck; at least there’s a chance it works.

Why not use RC4? How resource constrained are you? Doesn’t most of your networking gear have crypto built into it already?

by _3u10 5y ago

Why not use RC4? How resource constrained are you? Doesn’t most of your networking gear have crypto built into it already?

JoachimS 5y ago

Apart from being broken RC4 requires 256 bytes of state, have a very slow key change operation. And is actually quite slow. Most modern lightweight ciphers requires much less state (can be stored in registers even), has good key agility. And are faster. So there are numerous technical reasons to not use RC4. As long as you don't have legacy requirements, don't use RC4.

tptacek 5y ago

Because RC4 is probably the most egregiously broken cipher that has ever been in common use.

tialaramex 5y ago
And this is actually an interesting line in the sand here. SPECK is probably fine. It's a pretty ordinary-looking design, if some 25 year old up-and-coming crypto academic proposed this for an application, nobody would freak out about how maybe it's a cunning trick to steal all our data. But because the NSA was involved and wasn't willing to share whatever methods they're currently using to check this was OK that's apparently reason to shoot it down. And even though RC4 is very broken (unlike SPECK) it'd still actually be a lot of work to attack many practical applications of RC4. One of the strange things the Web gave us is a real application that looks like the outrageously convenient models in a cryptography class. Want one of the participants to repeatedly send a known plaintext using millions of different keys so you can see what that looks like? Javascript! Need to ensure your payload data is right next to the mystery data you need to decrypt? Cookies! Need to convince a participant to connect to your hostile system and decrypt large volumes of data? Embedded images and HTML email! So on the web, you can build a toy demo that breaks RC4, not really in a real time (I guess at a multi-day conference you could do an afternoon session "Preparing to break RC4" and then a morning session the next day "See, it worked") but for most protocols the attack is not practical. Attacks of course, only get better, so, this is not telling anybody to use RC4 but only underscoring how high the bar is here. Should you use RC4? No. Definitely not. But is the RC4-encryption for the IoT data feed the weakest link in your system today? Almost certainly also no.
- _3u10 5y ago
  Exactly. Is it broken? Yes. Am I going to buy a GPU or a wrench to crack a password? Most definitely a wrench. I honestly do think if the data only has to be protected for a day, just use RC4 (or something similar). It’s pretty obvious the data is worth nothing if it’s not even worth an extra battery to properly encrypt.
  - tptacek 5y ago
    At this point you might as well use Speck; at least there’s a chance it works.