# What Is RC4 (Rivest Cipher 4, ARC4)? Definition and Examples

> RC4 is a stream cipher designed by Ron Rivest in 1987, once widely used in SSL/TLS, whose keystream biases led RFC 7465 to prohibit it in TLS in 2015.

Source: https://ssl.sh/glossary/rc4/
Last updated: 2026-11-10

RC4 is a stream cipher that generates a pseudo-random keystream from a key and XORs it with the plaintext. It was simple and fast, which made it common in SSL, TLS and early Wi-Fi security. In TLS it appeared in suites such as RC4-SHA, RC4-MD5 and ECDHE-RSA-RC4-SHA (OpenSSL names).

## Why it matters
RC4's keystream is statistically biased, especially in its first bytes. When the same secret, such as an HTTP cookie, is encrypted many times under different keys, those biases let an attacker recover it, and published attacks in 2013 and 2015 made this increasingly practical. The timing was awkward: around 2011 to 2013 many sites had moved to RC4 deliberately, because as a stream cipher it was immune to [BEAST](https://ssl.sh/glossary/beast/) and other CBC attacks. [RFC 7465](https://www.rfc-editor.org/rfc/rfc7465) prohibited RC4 cipher suites in TLS in February 2015, major browsers removed support by 2016, and [TLS 1.3](https://ssl.sh/glossary/tls-1-3/) does not include it.

## Example
Check that a server no longer offers any RC4 suite:

```bash
nmap --script ssl-enum-ciphers -p 443 example.com | grep -i rc4
```

No output is the expected result. Current OpenSSL versions do not enable RC4 suites by default, so a modern nginx build will not negotiate them even if an old cipher string lists them.

## Common misconceptions
- **"RC4 is safe because it avoids CBC attacks."** That was the BEAST-era advice. RC4's own biases turned out to be exploitable, and the protocol standard now forbids it.
- **"128-bit RC4 is as strong as 128-bit AES."** Key length does not help when the keystream itself leaks information.
- **"All stream ciphers share RC4's weaknesses."** Modern designs such as ChaCha20 have no comparable biases and are used in AEAD constructions.

## Related terms

- [密码套件](https://ssl.sh/zh/glossary/cipher-suite/): 密码套件是 TLS 客户端和服务器协商使用的一组命名的加密算法组合，例如 TLS_AES_128_GCM_SHA256，决定连接用什么算法保护数据。
- [SSL 3.0](https://ssl.sh/zh/glossary/ssl-3-0/): SSL 3.0 是 Netscape 设计的安全套接层协议的最后一个版本，1996 年发布，2014 年被 POODLE 攻破，2015 年被 RFC 7568 废弃。
- [BEAST](https://ssl.sh/zh/glossary/beast/): BEAST 是 2011 年公布的攻击（CVE-2011-3389），利用 SSL 3.0 和 TLS 1.0 中 CBC 模式可预测的 IV，逐字节解密 Cookie 等秘密。
- [TLS 1.0](https://ssl.sh/zh/glossary/tls-1-0/): TLS 1.0 是传输层安全协议的第一个版本，1999 年以 RFC 2246 发布，2021 年被 RFC 8996 正式废弃，主流浏览器已不再支持。
- [AEAD](https://ssl.sh/zh/glossary/aead/): AEAD 是带关联数据的认证加密算法，一次运算同时完成数据加密和完整性认证，并能保护不加密的附加数据不被篡改。
- [ChaCha20-Poly1305](https://ssl.sh/zh/glossary/chacha20-poly1305/): ChaCha20-Poly1305 是把 ChaCha20 流密码与 Poly1305 认证算法组合而成的 AEAD 算法，专为纯软件实现时的高速和恒定时间而设计。