Also known as: RC4, ARC4, Rivest Cipher 4
RC4 (also ARC4, from “Rivest Cipher 4”) is a fast, byte-oriented stream cipher that generates a pseudo-random keystream from a secret key and XORs it with the data.1 Designed by Ron Rivest in 1987, it was for two decades the most widely deployed stream cipher — in WEP, WPA/TKIP, SSL/TLS, and RDP — before accumulated biases made it insecure. On the radio it survives as the “Enhanced Privacy” encryption option on some DMR systems.
How it works
RC4’s entire state is a 256-byte array S holding a permutation of the values 0–255, plus two byte indices i and j. It runs in two phases:
- KSA (Key-Scheduling Algorithm) — initialize S to the identity (S[k] = k), then make 256 passes that swap bytes of S under the control of the key, scrambling the permutation into a key-dependent starting state.
- PRGA (Pseudo-Random Generation Algorithm) — for each output byte, advance
i = i + 1, thenj = j + S[i], swap S[i] and S[j], and outputS[(S[i] + S[j]) mod 256]. All arithmetic is mod 256.
Each output byte is XORed with a plaintext byte to encrypt (and the identical keystream XORs back to decrypt). RC4 is prized for being tiny and fast in software — no lookup tables beyond its own state, no wide arithmetic — which is exactly why it spread so far. Only holders of the correct key can reproduce the keystream, so unlike scrambling (a public, keyless sequence) the voice cannot be recovered without the secret key.
Variants — where it appeared
RC4 was a trade secret until source code was anonymously posted in 1994; the unlicensed clone was named ARC4 (“alleged RC4”) to sidestep the trademark, and the two names are used interchangeably. It anchored a generation of protocols: WEP and WPA/TKIP Wi-Fi encryption, SSL/TLS, Microsoft’s RDP and Office password protection, and various proprietary radio “privacy” features. DMR “Enhanced Privacy” uses a 40-bit-keyed RC4 variant, short enough that its main protection is obscurity rather than real key strength.
In practice — biases and breaks
RC4 is comprehensively broken, and by more than one route:
- Weak key schedule (Fluhrer–Mantin–Shamir, 2001). When a per-message IV is prepended to a fixed key — exactly WEP’s design — the first keystream bytes leak key information. FMS and its successors recover a WEP key from enough captured frames in minutes; this is what killed WEP.
- Keystream biases. The second output byte is biased toward zero, and many further position-dependent biases exist. Given the same plaintext (a fixed header, say) encrypted under many keys, these biases let an attacker reconstruct it — the basis for practical TLS attacks that led browsers to prohibit RC4 in 2015 (RFC 7465).
- Mitigations like discarding the first N keystream bytes (RC4-drop[n]) patch the KSA weakness but not the later biases, so no configuration is considered safe today.
These are textbook cryptanalysis: the cipher is not attacked by brute force but by exploiting statistical structure the keystream should not have.
Relevance to SDR
RC4 illustrates the line between reversible whitening and true encryption: GopherTrunk can descramble a public whitening sequence but cannot decode encrypted voice without the key. DMR Enhanced Privacy’s short 40-bit RC4 key is weak by modern standards, but recovering it still requires an attack GopherTrunk does not attempt — the project decodes clear and scrambled traffic and honestly stops at keyed encryption, logging the call’s metadata while the audio stays opaque. See DMR encryption.