关于RC4解密PHP（mcrypt）

Question

I'm looking for anything about RC4 Decryption with decode the input using: Hexa

Lucky for me, I found PHP's mcrypt_encrypt.

I want to decrypt many cipher files with the same key. But, I had a problem with:

$iv_size = mcrypt_get_iv_size(MCRYPT_ARCFOUR, MCRYPT_MODE_STREAM); 
$iv = mcrypt_create_iv($iv_size, MCRYPT_RAND); 
print (mcrypt_decrypt(MCRYPT_ARCFOUR, $key, $text, MCRYPT_MODE_STREAM, $iv));

(And UTF-8 Vietnamese)

The result of echo $iv_size is 0.

Please help me, I don't know how I can fix it?

Key : Lyr1cjust4nct (key file .txt)

Mode: STREAM

Decode the input using: Hexa

Ciphertext: cipher.txt (Hexa)

http://pastebin.com/bmYcmU0J

Answer 1

RC4 doesn't support IVs. You instead need to use a unique key for each message.

RC4 has two big weaknesses that apply to your situation:

• Using related keys is not secure. So you can't just concatenate a fixed key with a variable/unique IV. You'd need to use some kind of hashing scheme.
• The beginning of the output is very biased, which leaks information about the ciphertext. So you need to throw away the beginning of the key-stream. I think throwing away 1024 bytes should take care of the biggest biases.

RC4 doesn't include any integrity protection (MAC). So if an attacker manipulates the ciphertext, you'll run into problems.

=> Don't use RC4. Use AES in an authenticated mode such as GCM or by combining AES with a MAC using the encrypt-then-MAC principle.

I strongly recommend using a high level library written by experts, since people get encryption wrong very often, even when using standard primitives like AES.