RC4

Updated 13 Aug 2026

•
Definition
- •
  a stream cipher (1987) that expands a variable-length seed (commonly 128 bits) into a large internal state (2048 bits), then generates output one byte per iteration of a simple loop
•
Usage
- •
  historically widespread — used in HTTPS (e.g. by Google) and in WEP (where it's applied insecurely, compounding WEP's other flaws)
•
Known weaknesses
- •
  biased output bytes — e.g. the 2nd output byte equals 0 with probability $2/256$ instead of the expected $1/256$ (the 1st and 3rd bytes are also biased); mitigation: discard the first 256 output bytes before using the stream
- •
  biased digram — the two-byte sequence "00" appears with probability $1/256^3$ instead of the expected $1/256^2$ , showing up after several gigabytes of output — enough to distinguish RC4 output from random
- •
  related-key weakness — related, non-independent keys (as WEP uses) enable full key recovery; see Two-Time Pad Attack
•
Status
- •
  no longer recommended for new systems; superseded by modern PRGs
•
Related

Linked references 3