What replaced RC4?

What does RC4 encryption stand for?

The RC4 encryption algorithm is an open source, symmetric-key stream cipher.

Like other ciphers, RC4 can be used to encrypt a block of data or to scramble a message. RC4 was originally developed by Ronald Rivest in 1991 as an open-source replacement for DES.

RC4 was designed to be fast and to resist known attacks. It can encrypt and decrypt blocks of up to 512 bytes, which can be processed quickly on CPUs, and the algorithm is easy to implement in software.

RC4 was first published by David Wagner and Joseph N. Streib in 1993 as RFC-2612 and was later adopted by the IETF for standardization as RFC-2617. In 2023, the U. Government approved the use of RC4 for national security applications.

What does RC4 look like? In a basic RC4 implementation, there is a global variable RC4Context used to hold an initialization vector (IV), used to prevent side-channel attacks. The initialization vector is used to ensure that every time the algorithm is run, the same initial state is used. If the IV is not set, RC4 will not encrypt anything. It will just create a stream of random bits.

The IV is the only secret in RC4; the key is not kept secret, but it is used for multiple encryption rounds. RC4 uses 16-byte blocks of data for encryption. To encrypt a block of data, you calculate the key and pass that into the RC4Context object as a parameter. The value for the key parameter is a 128-bit block of data.

The key parameter value is XORed with the IV. The result of this operation is the 64-bit result to be fed into the RC4 function. The result of the function is a 64-bit output value.

The encryption and decryption of data is then repeated until the 128-bit result is fed back into the function and the final 64-bit value is produced. RC4 has a simple specification: it takes a key parameter as input and produces a 64-bit result as output. This output is the encrypted form of the data given the key.

RC4 is very fast to run, but it's vulnerable to brute force attacks. For best performance, it is recommended to increase the key size to at least 32-bytes.

What replaced RC4?

So the RC4 algorithm has been replaced by something else. What is it and how does it work? Here's my understanding, which is probably wrong. The idea is that it's a more efficient cipher, using much less memory and CPU time.

There's no secret key. It's a stream cipher, meaning you give it a message and it returns an encrypted message, as long as the same message doesn't appear more than once in the stream. In the RSA case, the same message is called a keystream.

You start by encrypting a message with the public key of your intended recipient. Then you give the encrypted message to the intended recipient, who decrypts it using their private key.

What's the difference between this and the RSA case? In the RSA case, you get a different encrypted message for each message you send, even if you're sending the same message to the same recipient. So the message is a sort of key. In the RC4 case, you get a different keystream for each message you send. You start by encrypting a message with the public key of your intended recipient, and that's all that you send them. That message becomes a keystream for any message you send later. So the message becomes the keystream, and the message-to-keystream mapping is the key.

The only difference is that in the RSA case, the message is treated as a key, and RC4 treats the message as a key. The RC4 keystream is a kind of message that is encrypted with the recipient's public key. The RSA keystream is a message encrypted with the recipient's private key.