RC4 (Rivest Cipher 4, ARC4)

RC4 is a stream cipher that generates a pseudo-random keystream from a key and XORs it with the plaintext. It was simple and fast, which made it common in SSL, TLS and early Wi-Fi security. In TLS it appeared in suites such as RC4-SHA, RC4-MD5 and ECDHE-RSA-RC4-SHA (OpenSSL names).

Why it matters

RC4's keystream is statistically biased, especially in its first bytes. When the same secret, such as an HTTP cookie, is encrypted many times under different keys, those biases let an attacker recover it, and published attacks in 2013 and 2015 made this increasingly practical. The timing was awkward: around 2011 to 2013 many sites had moved to RC4 deliberately, because as a stream cipher it was immune to BEAST and other CBC attacks. RFC 7465 prohibited RC4 cipher suites in TLS in February 2015, major browsers removed support by 2016, and TLS 1.3 does not include it.

Example

Check that a server no longer offers any RC4 suite:

nmap --script ssl-enum-ciphers -p 443 example.com | grep -i rc4

No output is the expected result. Current OpenSSL versions do not enable RC4 suites by default, so a modern nginx build will not negotiate them even if an old cipher string lists them.

Common misconceptions

• "RC4 is safe because it avoids CBC attacks." That was the BEAST-era advice. RC4's own biases turned out to be exploitable, and the protocol standard now forbids it.
• "128-bit RC4 is as strong as 128-bit AES." Key length does not help when the keystream itself leaks information.
• "All stream ciphers share RC4's weaknesses." Modern designs such as ChaCha20 have no comparable biases and are used in AEAD constructions.