RC4

(cryptography)A cipher designed by RSA Data Security, Inc. which can accept keys of arbitrary length, and isessentially a pseudo random number generator with the outputof the generator being XORed with the data stream to producethe encrypted data. For this reason, it is very importantthat the same RC4 key never be used to encrypt two differentdata streams. The encryption mechanism used to be a tradesecret, until someone posted source code for an algorithmonto Usenet News, claiming it to be equivalent to RC4. Thealgorithm is very fast, its security is unknown, but breakingit does not seem trivial either. There is very strongevidence that the posted algorithm is indeed equivalent toRC4.

The United States government routinely approves RC4 with40-bit keys for export. Keys this small can be easily brokenby governments, criminals, and amateurs. The exportableversion of Netscape's Secure Socket Layer, which usesRC4-40, was broken by at least two independent groups.Breaking it took about eight days; in many universities orcompanies the same computing power is available to anycomputer science student.

See also Damien Doligez's SSL cracking page, RC4 Source and Information, SSLeay, Crypto++, Ssh, A collection of articles.