4

I'm reading about the cryptographic function called RC4.

Apparently, its method was kept secret from 1987 until 1994 despite being available to the public for licensing and use.

How did it stay secret for so long? It's not a very complicated algorithm. Couldn't someone just reverse-engineer the code and get the source?

Is there some reason they couldn't that I don't know about?

0

1 Answer 1

7

Couldn't someone just reverse-engineer the code and get the source?

Yes. That's exactly what happened in 1994:

From the Wikipedia entry:

RC4 was initially a trade secret, but in September 1994 a description of it was anonymously posted to the Cypherpunks mailing list. It was soon posted on the sci.crypt newsgroup, and from there to many sites on the Internet. The leaked code was confirmed to be genuine as its output was found to match that of proprietary software using licensed RC4. Because the algorithm is known, it is no longer a trade secret. The name RC4 is trademarked, so RC4 is often referred to as ARCFOUR or ARC4 (meaning alleged RC4) to avoid trademark problems. RSA Security has never officially released the algorithm; Rivest has, however, linked to the English Wikipedia article on RC4 in his own course notes in 2008 and confirmed the history of RC4 and its code in a 2014 paper by him.

You can, with varying degrees of success, make it more difficult by, for example, obfuscating the code, encrypting the code, storing the code in an HSM that self-destructs when tampered with, requiring restrictive contracts, threatening legal actions, etc... But in the end, there is no security without physical security. Once you let the code out of your physical control, it is potentially exposed.

As to why nobody did it before, I suspect that it was lack of interest and legal concerns.

3
  • So as I suspected, it's impossible to keep an algorithm secret unless you don't let anyone else run it. (i.e. I can run it for you on my server, but I won't give you an exe to run). Is that correct? Oct 25, 2015 at 16:28
  • 2
    You can, with varying degrees of success, make it more difficult by, for example, obfuscating the code, encrypting the code, storing the code in an HSM that self-destructs when tampered with, etc... But in the end, there is no security without physical security. So if you let the code out of your physical control, it is potentially exposed. Oct 25, 2015 at 16:32
  • 1
    "As to why nobody did it before, I suspect that it was lack of interest and legal concerns." Of course, it's entirely possible that someone did, but didn't tell anyone that they did.
    – JonnyWizz
    Oct 30, 2015 at 12:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .