Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [rc4]

RC4 (Rivest Cipher 4) is a type of stream cipher.

1
vote
0answers
66 views

How does fake authentication work with no other clients connected to the AP? (aireplay-ng)

I was reading a tutorial about how to hack a WEP network that has no other clients connected to the AP. It says that fake authentication must be used and it appears to work, but I don't understand how ...
2
votes
1answer
340 views

SSL - Enabling Forward Secrecy with or without RC4

I'm running an Apache 2 server with Ubuntu 16. Here's my current configuration: SSLProtocol All -SSLv2 -SSLv3 SSLHonorCipherOrder on SSLCipherSuite I'm a bit confused as to what I should use for ...
1
vote
2answers
760 views

Why does tls_version “TLS 1.2” from howsmyssl rate “Probably Okay” in Chrome on Windows 10 but “Bad” in IE11 on Windows 7?

I'm implementing an API endpoint based on howsmyssl to check the TLS version of clients then notify those clients about whether or not they passed the test. However, several clients have reported ...
1
vote
1answer
99 views

Is an RC4 encrytion enough for my personal documents?

In the last few weeks I wrote several proposals to the government, to my professor, etc. I want to make a copy of this filled proposals and save them. Instead of scanning it with my printer, making ...
3
votes
2answers
119 views

Using old ciphers in email security

My email provider still supports old SSL_RSA_WITH_RC4_128_SHA ciphers. What does that mean for me? If I use an updated system (Ubuntu 16.04) and an updated client (Thunderbird 52), shouldn't it use ...
0
votes
3answers
322 views

Why is it necessary to minimize redundancy in the ciphertext of a stream cipher?

I am utterly confused about this. I understand why you would want to minimize redundancy if you're using a substitution cipher, but why is this necessary when using a stream cipher such as RC4? ...
1
vote
1answer
220 views

Network scan for vulnerabilities free tool [closed]

I have a huge distributed network with over 1000 servers and network devices. It is mix of operating systems. I'm looking for some free tool to scan network for SSL v2, SSL v3, RC4,TLS v1.0 and older. ...
1
vote
1answer
641 views

difference between rc4-40 and rc4 in OpenSSL

I was testing rc4-40 out with a 200-bit key (25 bytes) and, to my surprise, the results were the same as they were with rc4: <?php $key_size = 25; $key = ''; for ($i = 0; $i < $key_size; $i++) {...
2
votes
1answer
123 views

Is RC4 banned from TLS for good?

According to RFC7465 RC4 is banned from TLS and my question is : Is it banned for good, does any site can use it now and if it does, will I get any notification from Chrome?
6
votes
1answer
9k views

Disable RC4 ciphers best practice

To be compliant with security best practices, we have a requirement to disable RC4 ciphers. I have investigated a way to achieve this and, found that I can disable it by editing the registry keys. [...
0
votes
2answers
203 views

Which of AES modes are safer and faster for transferring data over the network?

I have using Crypto++ in Qt and use of AES Algorithm for encrypting files. I know about AES modes and their applications. I have use of StreamTransformation method for encrypting files in CBC and EAX ...
2
votes
2answers
556 views

Can we restrict cipher suites using server certificate?

Can we restrict cipher suites (such as RC4) using server certificate?
0
votes
2answers
46 views

Reconcile IMAP4 RFC with No RC4 RFC

RFC 3501 states: IMAP client and server implementations MUST implement the TLS_RSA_WITH_RC4_128_MD5. RFC 7465 states: o TLS clients MUST NOT include RC4 cipher suites in the ClientHello ...
3
votes
1answer
215 views

Why are weak Cipher Suites still in use by clients, particularly mobile apps?

I am examining the collection of cipher suites that some mobile apps use (Client Hello) and I noticed that the majority of them include the TLS_RC4_128_MD5 and TLS_RC4_128_SHA. According to the OWASP ...
3
votes
1answer
123 views

How much of an impact will the RC4 cut off make?

Quick disclaimer - Student, cryptography is a weak point. So, can someone explain exactly how this will work? The way I see is is that if a user is attempting to connect to a server using RC4 only ...
0
votes
0answers
522 views

xls RC4 encryption password from key

I asked this question on stackoverflow, but thought it may be more appropriate here. I have a key from a RC4 encrypted excel sheet (xls), along with the salt, and hash, etc. and I have decrypted the ...
3
votes
1answer
527 views

Use of RC4 on real time application

I need to use a stream cipher in my application. I know using the same key for many messages is not a good practice for stream ciphers (RC4). But I also dont want to make a new key all the time so I ...
3
votes
2answers
98 views

RC4 encrypt many messages with same password

I would like to ask if it's insecure to encrypt many different messages sent over the Internet encrypted by RC4 with the same password. If it is insecure, then if I encrypt the first message with the ...
4
votes
1answer
365 views

How could a publicly available stream cipher (RC4) be kept secret so long?

I'm reading about the cryptographic function called RC4. Apparently, its method was kept secret from 1987 until 1994 despite being available to the public for licensing and use. How did it stay ...
1
vote
2answers
177 views

Dovecot TLS connection handshake ChangeCipherSpec

I added a virtual domain to our mail server today then did a check of the Dovecot TLS connection security. The test was done from a remote host using Thunderbird. I captured the connection with ...
8
votes
1answer
600 views

What to do when Google disables SSLv3 and RC4?

I've read this article from Google's Online Security Blog, and it says that Google will disable support for SSLv3 and RC4. Here's the reason: SSLv3 has been obsolete for over 16 years and is so ...
3
votes
1answer
574 views

Writing your own John the Ripper module

I have a script in C, which is able to determine the password of certain data. It uses HMAC and RC4 algorithms to encrypt the given password and then compares that later to the given data. If they ...
2
votes
0answers
144 views

Should Mozilla SSL3/RC4 whitelisted sites be blacklisted by admins/users? [closed]

As of Firefox 39, Mozilla has dropped support for SSL3 and RC4... and whitelisted 519 (!) non-compliant sites: (https://mxr.mozilla.org/mozilla-release/source/security/manager/ssl/src/...
3
votes
1answer
914 views

CryptoAPI to CommonCrypto with RC4

I have cryptographic code used in the Windows platform, which uses the Crypto API functions and need to convert this to using Common Crypto on OS X. Essentially the original code is this, with error ...
5
votes
1answer
874 views

Is CVE-2013-2566 a practical attack against RC4 or still conceptual?

Is CVE-2013-2566 a practical attack against RC4 or still conceptual and does it only apply to WPA/TKIP?
3
votes
1answer
567 views

RC4 encryption of torrents safely

Torrent clients offer encryption of traffic using RC4, and people consider this very safe to hide traffic information from ISP. Now since I have a website with SSL encryption, I know that RC4 has a ...
5
votes
3answers
11k views

Disadvantages of disabling RC4 in SSL/TLS [closed]

Other than requiring more server resources, are there any disadvantages of disabling RC4 from being using by an Apache webserver? My primary concern is preventing access from older browsers.
5
votes
3answers
9k views

What is the impact of removing TLS_RSA_WITH_RC4_128_SHA from my server's cipher suite?

I run a website that supports many clients via webservices. I'm setting up some new certificates and load balancers and when doing ssllabs's server test, it's flagging all my ciphers as OK except ...
14
votes
3answers
2k views

Should I worry if my credit card payment processor's server allows only weak SSL cipher suites?

I tested their server using https://www.ssllabs.com/ssltest/ and, apart from the disappointing "B" rating (it handles financial transactions, after all), the server only allows the following two RC4 ...
2
votes
1answer
155 views

For use with RC4 how do I combine a reused key and an initialization vector

I am an a-level student writing an encryption program using an rc4 implementation I have written myself. I have the basic algorithm coded correctly (and I have checked that some ciphertext for a given ...
28
votes
1answer
3k views

How to describe RC4 'bias' to non-tech people

I'm looking for the 'plain English' version of 'bias' as used in the context of the RC4 weakness. I know that RC4 generates a string of psuedorandom bits over, for instance, http(s) traffic. If you ...
0
votes
2answers
374 views

RC4 support in SSL configuration

GitHub recently improved its SSL setup by removing RC4 support: To keep GitHub as secure as possible for every user, we will remove RC4 support in our SSL configuration on github.com and in the ...
4
votes
1answer
9k views

Prevent BEAST attack without RC4 cipher suites

It is common practice to prevent the BEAST attack using the following ciphers in Apache SSL configuration: SSLCipherSuite RC4-SHA:HIGH:!ADH Unfortunately, RC4 has been found to be flawed and it is ...
2
votes
1answer
188 views

SSL Mixed Scripting Vulnerabilities and XOR Attacks

Given that RC4 is a stream cipher (I'm pretty sure the details of its inner workings don't matter for the sake of this argument) and the existence of Mixed Scripting / Mixed Display (web applications ...
3
votes
1answer
1k views

How strong is PDF security/encryption?

I want to securely convey a PDF document containing sensitive information from my system to another system. The latter is operated by a different person, whom I trust. However, this person does not ...
5
votes
2answers
925 views

Why do the banks all use weaker TLS suites? [closed]

I've been checking out various TLS certificates lately and noticed that most of the banks seem to have the following two issues: 1) They do not offer perfect forward secrecy 2) They are still using ...
1
vote
2answers
825 views

Google's usage of RC4

I was reading about Google's usage of RC4 and an answer on stackexchange website stated the following: I know Google uses RC4 for most of its services, and this is the reason one shouldn't keep ...
4
votes
1answer
362 views

Are all cipher suites with rc4 in them intrinsically flawed?

I've been wondering lately if RC4 is so flawed in all its forms, why is it that it is still being supported by all major browsers per default? Why does the typical chrome browser prefer ECDHE-ECDSA-...
2
votes
3answers
658 views

Does it make sense to keep RC4?

I know that the RC4 cipher when used with SSL is vulnerable to certain attacks, which in the worst case scenario could result in authentication tokens being stolen. But RC4 is also recommended as a ...
28
votes
2answers
30k views

Are there any known vulnerabilities in PPTP VPNs when configured properly?

PPTP is the only VPN protocol supported by some devices (for example, the Asus RT-AC66U WiFi router). If PPTP is configured to only use the most secure options, does its use present any security ...
5
votes
1answer
1k views

PFS on nginx: only RC4 gets used (TLS_ECDHE_RSA_WITH_RC4_128_SHA)

I'm trying to configure my webserver for perfect forward secrecy. I'm using ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+ECDSA+AESCBC:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA256:EECDH+aRSA+AESCBC:EECDH+aRSA+RC4:...
1
vote
2answers
2k views

Clients breaking after avoiding RC4-MD5

As per http://projects.webappsec.org/w/page/13246945/Insufficient%20Transport%20Layer%20Protection , we have been recommended to stop using RC4-MD5. The clients supported by our Application are IE ...
18
votes
4answers
27k views

Remove RC4 from SSL/TLS ciphers in Chromium

Recently I started to live without RC4 within my Firefox session. Discussion about it can be found here. While it is quite easy in Firefox (Enter about:config and then rc4), I found no possibility to ...
34
votes
4answers
26k views

Can someone explain what exactly is accomplished by generation of DH parameters?

I'm setting up a node.js server: https.createServer({ ... ciphers: 'ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH', honorCipherOrder: true }, app).listen(443); ...
6
votes
1answer
22k views

How does DHE-RSA-AES256-SHA compare to RC4 as the Cipher for SSL?

I read a lot of issue [1] currently stating that RC4 is broken and is at risk. I just checked my web server (nginx) and it is using the default settings, which is DHE-RSA-AES256-SHA How does this ...
10
votes
2answers
689 views

RC4 bias protection with padding in TLS

On the answer to my previous question about RC4 vulnerabilities in TLS, Thomas Pornin gave a great answer, in which he said: One way to "fix" RC4, which has been suggested many times, is to drop ...
39
votes
1answer
10k views

TLS: RC4 or not RC4?

I was reading another interesting article by Matthew Green today, saying that if you're using RC4 as your primary ciphersuite in SSL/TLS, now would be a great time to stop As far as I'm aware RC4 ...
7
votes
2answers
1k views

Implications of having a service account in AD use RC4 rather than AES for Kerberos?

Bear with me, I know this is sloppy, but here is the back story: We have a partner that uses Jira and is using spnego with a custom auth back-end that expects certain group membership in the token. ...