You are here

RC4

Stout nails in RC4's coffin

Cipher disk

Two important announcements this week about RC4:

First, Cisco has downgraded the RC4 encryption cipher and marked it as a cipher to "avoid." In other words, web sites should NOT use it to protect things like passwords. This is a revision of their published recommendations for cryptographic algorithms.

Wordpress tag: 
Post category: 

RC4, SSL, and deck chairs on the Titanic

ChromeChrome has sensibly increased the key sizes it expects in public-key transactions (see here and here). However, Chrome still silently accepts RC4 encryption, even though RC4 has been vulnerable to attack for over a decade. 

This is like putting a heavy padlock on a cardboard box.

Even so, 7 out of the top 10 US web sites still use RC4. This includes sites with a lot to lose like Amazon and eBay as well as Google itself. The other weaklings in the Top 10 are LinkedIn, Wikipedia, Twitter, and Google's Youtube (as weak as their owner).

Wordpress tag: 
Post category: 

Internet crypto cracking is no real surprise

Old Lock LogoThe Guardian has recently published a report on how the NSA and the UK's GCHQ have been routinely cracking cryptography used on the Internet. Seriously, this is no surprise. Lots and lots of sites routinely use "RC4" encryption, whose vulnerablility has been well known for over a decade

I also hadn't realized the extent to which American citizens in general are considered "the enemy" by the NSA. Their duplicitous role in Internet standards is breathtaking. It may be the grandest example of social engineering. Ever.

Post category: 

More Matlab and RC4

A reader asked for more details on the RC4 and block cipher mode functions I wrote in Matlab.

To recap, I needed a 'block cipher' to produce a complete example of how a straight block cipher fails to hide large patterns in the output, and how an appropriate block cipher mode yields something akin to white noise.

Wikipedia has a "penguin" example with a block encrypted version (penguin still visible) and a block of white noise. The white noise represents what the block mode output is supposed to look like as opposed to being the genuine output of a block cipher mode. So I built this 'real' example, more or less.

I didn't have a block cipher that worked with small blocks. But I knew it wasn't hard to implement RC4. So I created a function to map 8 bytes of data into 8 bytes of 'ciphertext' to simulate the block cipher.

Post category: 

Matlab, RC4, and Crypto-Graphics

A while back I used graphical images to illustrate why you never, ever want to reuse the keystream of a stream cipher. Recently I've constructed similar examples to show the role of modes in using block ciphers. There's a nice set of block mode examples in Wikipedia, but I wanted to include the real result of applying the mode.

 

smileycolorsmileyecbsmileycbc

 

While cryptographic neophytes may want to know why the second encryption clearly failed (if you can read the message, the encryption failed), cryptographic experts may find it interesting to see other examples of cryptographic failures appearing graphically.

 

[There is a later post with more info on RC4 in Matlab

]

 

A while back I used graphical images to illustrate why you never, ever want to reuse the keystream of a stream cipher. Recently I've constructed similar examples to show the role of modes in using block ciphers. There's a nice set of block mode examples in Wikipedia, but I wanted to include the real result of applying the mode.

 

smileycolorsmileyecbsmileycbc

 

While cryptographic neophytes may want to know why the second encryption clearly failed (if you can read the message, the encryption failed), cryptographic experts may find it interesting to see other examples of cryptographic failures appearing graphically.

 

[There is a later post with more info on RC4 in Matlab]

 

Post category: 

Stream Ciphers

Whenever your browser establishes a “secure” connection to a web site, it encrypts the data. Traditionally, the browser and site use a stream cipher called Rivest Cipher #4 (RC4), although some sites use newer techniques.

Stream ciphers use a deceptively simple mechanism: you combine the plaintext data, bit by bit, with “key” bits, using the exclusive or operation. This is often abbreviated xor, and denoted by ⊕ - a circle with a cross.

Post category: 

Theme by Danetsoft and Danang Probo Sayekti inspired by Maksimer