2021년 2월 17일 (수) 08:03에 Pythagoras0님의 편집

2021-02-17T08:03:40Z

Pythagoras0: /* 메타데이터 */ 새 문단

2020-12-26T12:15:18Z

메타데이터: 새 문단

Pythagoras0: /* 노트 */ 새 문단

2020-12-21T11:11:56Z

노트: 새 문단

새 문서

== 노트 ==

===위키데이터===
* ID : [https://www.wikidata.org/wiki/Q846955 Q846955]
===말뭉치===
# In cryptography, RC4 (Rivest Cipher 4 ) is the most widely used software stream cipher and is used in popular Internet protocols such as Transport Layer Security (TLS).<ref name="ref_9dcb5040">[https://support.venafi.com/hc/en-us/articles/215914607-How-To-How-do-I-disable-my-server-from-using-RC4 How To: How do I disable my server from using RC4]</ref>
# While remarkable for its simplicity and speed in software, RC4 has weaknesses that argue against its use in new systems.<ref name="ref_9dcb5040" />
# As of 2015, there is speculation that some state cryptologic agencies may possess the capability to break RC4 even when used in the TLS protocol.<ref name="ref_9dcb5040" />
# Mozilla and Microsoft recommend disabling RC4 where possible.<ref name="ref_9dcb5040" />
# Important: Multiple vulnerabilities have been discovered in the RC4 cipher, rendering it insecure.<ref name="ref_8705cdf7">[https://www.microfocus.com/documentation/visual-cobol/vc50pu6/CSWin/BKCJCJALGOS004.html RC4]</ref>
# RC4 was designed by Ron Rivest of RSA Security in 1987.<ref name="ref_8705cdf7" />
# It stands for "Rivest Cipher 4", or alternatively for "Ron's Code".<ref name="ref_8705cdf7" />
# RC4 was a widely-used cipher which has the following related algorithms, RC2, RC5, and RC6.<ref name="ref_8705cdf7" />
# The remote host supports the use of RC4 in one or more cipher suites.<ref name="ref_a6e91c73">[https://www.tenable.com/plugins/nnm/7282 SSL RC4 Cipher Suites Supported (Bar Mitzvah)]</ref>
# The RC4 cipher is flawed in its generation of a pseudo-random stream of bytes so that a wide variety of small biases are introduced into the stream, decreasing its randomness.<ref name="ref_a6e91c73" />
# Overview ▾ Package rc4 implements RC4 encryption, as defined in Bruce Schneier's Applied Cryptography.<ref name="ref_8aee4a01">[https://golang.org/pkg/crypto/rc4/ The Go Programming Language]</ref>
# RC4 uses symmetric key encryption algorithm.<ref name="ref_57176abb">[https://support.citrix.com/article/CTX205269 How do I Remove RC4 Ciphers in NetScaler?]</ref>
# RC4 generates a key stream from the secret key and XORs it with plain text to produce the encrypted text.<ref name="ref_57176abb" />
# Even though implementation looks simple, RC4 is an encryption algorithm having some vulnerability at initial stages.<ref name="ref_57176abb" />
# NetScaler supports RC4 symmetric key encryption algorithm.<ref name="ref_57176abb" />
# RC4 is one of the most used software-based stream ciphers in the world.<ref name="ref_c1ca9d93">[https://www.tech-faq.com/rc4.html RC4 (Rivest Cipher 4)]</ref>
# There are a number of weaknesses with the baseline RC4 algorithm that require additional analysis before including in new systems requiring cryptologic features.<ref name="ref_c1ca9d93" />
# Ron Rivest originally designed RC4 in 1987 when he was working for RSA Security.<ref name="ref_c1ca9d93" />
# RC4 creates a pseudorandom stream of bits that is also referred to as a keystream.<ref name="ref_c1ca9d93" />
# As part of our commitment to protect the privacy of our users, Mozilla will disable the insecure RC4 cipher in Firefox in late January 2016, beginning with Firefox 44.<ref name="ref_cbd51a29">[https://blog.mozilla.org/security/2015/09/11/deprecating-the-rc4-cipher/ Deprecating the RC4 Cipher]</ref>
# If you’re a web site operator and still rely on RC4, you need to enable some other ciphers, or Firefox users will be unable to reach you.<ref name="ref_cbd51a29" />
# Over the years, however, cryptanalysis of RC4 has resulted in better and better attacks against it.<ref name="ref_cbd51a29" />
# It has been known since 1995 that RC4 has certain biases that make it easier to attack.<ref name="ref_cbd51a29" />
# Since the RC4 Cipher is a stream cipher, it always operates in the same mode, which may be specified by the transformations “RC4” or “RC4/ECB/NoPadding”.<ref name="ref_d20c68ab">[https://thalesdocs.com/gphsm/ptk/5.5/docs/Content/PTK-J/Ciphers/RC4.htm RC4]</ref>
# The RC4 Cipher requires either a SecretKeySpec or SafeNet ProtectToolkit-J provider RC4 Key during initialization.<ref name="ref_d20c68ab" />
# To create an appropriate SecretKeySpec, pass an array of up to 256 bytes and the algorithm name “RC4” to the SecretKeySpec constructor.<ref name="ref_d20c68ab" />
# The SafeNet ProtectToolkit-J RC4 key will return the string “RC4” as its algorithm name, “RAW” as its encoding.<ref name="ref_d20c68ab" />
# HTTPS supports several encryption techniques, one of them being the famous RC4 algorithm.<ref name="ref_ab699551">[https://www.rc4nomore.com/ RC4 NOMORE]</ref>
# At one point RC4 was used 50% of the time, with the estime around Februari 2015 being 30%.<ref name="ref_ab699551" />
# Our RC4 NOMORE attack exposes weaknesses in this RC4 encryption algorithm.<ref name="ref_ab699551" />
# Update October 2017: We are pleased to say that, together with other work on RC4, our work influenced major browsers to disable RC4.<ref name="ref_ab699551" />
# RC4 uses a variable key and stream cipher method.<ref name="ref_02bfdcb1">[https://encyclopedia2.thefreedictionary.com/RC4+Cipher RC4 Cipher]</ref>
# The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information.<ref name="ref_ad7d96fe">[https://www.ibm.com/support/pages/security-bulletin-vulnerability-rc4-stream-cipher-affects-ibm-i-cve-2015-2808 Security Bulletin: Vulnerability in RC4 stream cipher affects IBM i (CVE-2015-2808)]</ref>
# Not disabling the RC4 stream cipher will expose yourself to the attack described above.<ref name="ref_ad7d96fe" />
# IBM recommends that you review your entire environment to identify other areas where you have enabled the RC4 stream cipher and take appropriate mitigation and remediation actions.<ref name="ref_ad7d96fe" />
# After loading the System SSL fixes listed in this bulletin, applications coded to use the default values will no longer negotiate the use of RC4 cipher suites with peers.<ref name="ref_ad7d96fe" />
# We recently removed support for RC4 for browsers using TLS 1.1+.<ref name="ref_c043cf0e">[https://blog.cloudflare.com/killing-rc4-the-long-goodbye/ Killing RC4: The Long Goodbye]</ref>
# Now we are removing RC4 as the preferred cipher.<ref name="ref_c043cf0e" />
# Servers behind CloudFlare will prefer AES-based cipher suites for all HTTPS connections and only use RC4 as a cipher as a last resort.<ref name="ref_c043cf0e" />
# The immediate workaround was to get servers to prefer a non-CBC cipher and the only good widely-supported candidate was RC4.<ref name="ref_c043cf0e" />
# RC4 Stream Cipher and Its Variants is the first book to fully cover the popular software stream cipher RC4.<ref name="ref_2fcbd85b">[https://www.routledge.com/RC4-Stream-Cipher-and-Its-Variants/Paul-Maitra/p/book/9780367382162 RC4 Stream Cipher and Its Variants]</ref>
# With extensive expertise in stream cipher cryptanalysis and RC4 research, the authors focus on the analysis and design issues of RC4.<ref name="ref_2fcbd85b" />
# After an introduction to the vast field of cryptology, the book reviews hardware and software stream ciphers and describes RC4.<ref name="ref_2fcbd85b" />
# It presents a theoretical analysis of RC4 KSA, discussing biases of the permutation bytes toward secret key bytes and absolute values.<ref name="ref_2fcbd85b" />
# A chronological survey demonstrating the cryptanalysis of RC4 stream cipher is presented in this paper.<ref name="ref_ebe87045">[https://www.sciencedirect.com/science/article/pii/S1877050915001933 RC4 Encryption-A Literature Survey ☆]</ref>
# We have summarized the various weaknesses of RC4 algorithm followed by the recently proposed enhancements available in the literature.<ref name="ref_ebe87045" />
# These flaws in RC4 are still offering an open challenge for developers.<ref name="ref_ebe87045" />
# Hence our chronological survey corroborates the fact that even though researchers are working on RC4 stream cipher since last two decades, it still offers a plethora of research issues.<ref name="ref_ebe87045" />
# RC4 (also known as ARC4) is a stream cipher used in popular protocols such as SSL and WEP.<ref name="ref_e7b46c15">[https://cryptii.com/pipes/rc4-encryption RC4 / ARC4 encryption and decryption online]</ref>
# This strike simulates a TLS handshake using an RC4 cipher suite.<ref name="ref_cf571ebc">[https://support.ixiacom.com/strikes/analysis/tls/rfc7465_rc4_cipher_deprecation.xml TLS RC4 Cipher Deprecation]</ref>
# As of RFC7465, the RC4 cipher suite has been deprecated due to a number of exploits capable of decrypting portions of RC4 encrypted messages.<ref name="ref_cf571ebc" />
# In the first scenario, the client will send a mix of supported cipher suites, including RC4 cipher suites.<ref name="ref_cf571ebc" />
# The server will select an RC4 suite.<ref name="ref_cf571ebc" />
# So SSLCipherSuite ALL:!RC4 will enable every openssl cipher except for RC4.<ref name="ref_bc7ab2b7">[https://serverfault.com/questions/792096/disable-rc4-cipher-for-apache-2-2 Disable RC4 cipher for Apache 2.2]</ref>
# It’s been more than 25 years since Ron Rivest invented his RC4 stream cipher, and after all that time it’s still being used widely, which is something of an achievement in the crypto world.<ref name="ref_ab8604e8">[https://threatpost.com/attack-exploits-weakness-rc4-cipher-decrypt-user-sessions-031413/77628/ Attack Exploits Weakness in RC4 Cipher to Decrypt User Sessions]</ref>
# However, for more than 15 years researchers have known about a weakness in RC4 that could enable an attacker to decrypt the keystream.<ref name="ref_ab8604e8" />
# RC4 is a stream cipher, so it encrypts plaintext by mixing it with a series of random bytes, making it impossible for anyone to decrypt it without having the same key used to encrypt it.<ref name="ref_ab8604e8" />
# But as far as we knew, there was no way to attack this in RC4 in the way it’s used in SSL.<ref name="ref_ab8604e8" />
# RC4 means Rivest Cipher 4 invented by Ron Rivest in 1987 for RSA Security.<ref name="ref_12267f10">[https://www.geeksforgeeks.org/what-is-rc4-encryption/ What is RC4 Encryption?]</ref>
# RC4 stream cipher is one of the most widely used stream ciphers because of its simplicity and speed of operation.<ref name="ref_12267f10" />
# RC4 was designed by Ron Rivest in 1987.<ref name="ref_12267f10" />
# Rivest Cipher 4 is an official name while it is also known as Ron’s Code.<ref name="ref_12267f10" />
# This document requires that Transport Layer Security (TLS) clients and servers never negotiate the use of RC4 cipher suites when they establish connections.<ref name="ref_4e26b431">[https://tools.ietf.org/html/rfc7465 Prohibiting RC4 Cipher Suites]</ref>
# As a result, RC4 can no longer be seen as providing a sufficient level of security for TLS sessions.<ref name="ref_4e26b431" />
# TLS clients MUST NOT include RC4 cipher suites in the ClientHello message.<ref name="ref_4e26b431" />
# o TLS servers MUST NOT select an RC4 cipher suite when a TLS client sends such a cipher suite in the ClientHello message.<ref name="ref_4e26b431" />
# Vulnerabilities in SSL RC4 Cipher Suites is a Medium risk vulnerability that is one of the most frequently found on networks around the world.<ref name="ref_374c9049">[https://beyondsecurity.com/scan-pentest-network-vulnerabilities-ssl-rc4-cipher-suites-supported.html Finding and Fixing SSL RC4 Cipher Suites Supported Vulnerability]</ref>
# Reconfigure the affected application, if possible, to avoid use of RC4 ciphers.<ref name="ref_374c9049" />
# Vulnerabilities in SSL RC4 Cipher Suites Supported is a Medium risk vulnerability that is also high frequency and high visibility.<ref name="ref_374c9049" />
# A recently published paper described an attack that can break the RC4 cipher and decrypt user cookies.<ref name="ref_82a49849">[https://searchsecurity.techtarget.com/answer/Should-the-RC4-cipher-still-be-used-in-enterprises Should the RC4 cipher still be used in enterprises?]</ref>
# While RC4 has long been known to be flawed, attacks against it have not been practical in real-world scenarios.<ref name="ref_82a49849" />
# Back in 2013, it seemed that RC4 was coming to the end of its useful life due to the increasing number of cryptographic weaknesses being discovered.<ref name="ref_82a49849" />
# The attack uses biases in the RC4 keystream to recover plaintext.<ref name="ref_82a49849" />
# Could you explain the recent flaw that was discovered in the RC4 encryption algorithm?<ref name="ref_9b85d12a">[https://searchsecurity.techtarget.com/answer/RC4-attack-details-Can-the-RC4-encryption-algorithm-protect-SSL-TLS RC4 attack details: Can the RC4 encryption algorithm protect SSL/TLS?]</ref>
# RC4 (Rivest Cipher 4) was designed by Ron Rivest of RSA Security back in 1987 and has become the most widely used stream cipher because of its speed and simplicity.<ref name="ref_9b85d12a" />
# A flaw disclosed recently by Dan Bernstein, a professor at the University of Illinois, allows an attacker to recover a limited amount of plaintext from a TLS connection when RC4 encryption is used.<ref name="ref_9b85d12a" />
# The RC4 attack applies to all versions of SSL and TLS that support the algorithm.<ref name="ref_9b85d12a" />
# "This server uses the RC4 cipher algorithm which is not secure.<ref name="ref_f0587d60">[https://docs.digicert.com/certificate-tools/discovery-user-guide/tlsssl-endpoint-vulnerabilities/rc4-cipher-enabled/ RC4 cipher enabled]</ref>
# RC4 is a stream cipher designed by Ron Rivest in 1987.<ref name="ref_f0587d60" />
# However, if you were unable to enable TLS 1.1 and TLS 1.2, a workaround is provided: Configure SSL to prioritize RC4 ciphers over block-based ciphers.<ref name="ref_f0587d60" />
# This library implements the Alleged RC4 cipher, which is described for example in Applied Cryptography.<ref name="ref_f1015625">[https://www.openssl.org/docs/man1.1.0/man3/RC4.html man1.1.0]</ref>
# RC4() encrypts or decrypts the len bytes of data at indata using key and places the result at outdata.<ref name="ref_f1015625" />
# Q: What can we do to limit or exclude the use of the RC4 stream cipher on our Windows platforms?<ref name="ref_889c932d">[https://www.itprotoday.com/compute-engines/disabling-rc4-cipher Disabling the RC4 Cipher]</ref>
# A: Microsoft recommends that customers use Transport Layer Security 1.2 (TLS) 1.2 and the more secure Advanced Encryption Standard - Galois/Counter Mode (AES-GCM) cipher as the RC4 alternative.<ref name="ref_889c932d" />
# Internet Explorer 11 (IE 11), which is bundled with Windows 8.1, enables TLS 1.2 by default and no longer uses RC4 during the SSL/TLS handshake.<ref name="ref_889c932d" />
# Windows clients that have these registry entries set won't be able to connect to sites that require RC4.<ref name="ref_889c932d" />
# In cryptography, RC4 (Rivest Cipher 4 also known as ARC4 or ARCFOUR meaning Alleged RC4, see below) is a stream cipher.<ref name="ref_a9491e0f">[https://en.wikipedia.org/wiki/RC4 Wikipedia]</ref>
# The leaked code was confirmed to be genuine as its output was found to match that of proprietary software using licensed RC4.<ref name="ref_a9491e0f" />
# RC4 generates a pseudorandom stream of bits (a keystream).<ref name="ref_a9491e0f" />
# Several operating systems include arc4random , an API originating in OpenBSD providing access to a random number generator originally based on RC4.<ref name="ref_a9491e0f" />
# RC4 generates a pseudo-random stream of bits (a key-stream).<ref name="ref_13854fdf">[https://paginas.fe.up.pt/~ei10109/ca/rc4.html How does RC4 works]</ref>
# Figure taken from http://www.networklife.net/2009/07/etude-de-wep-et-rivest-cipher-4/ The lookup stage of RC4.<ref name="ref_13854fdf" />
===소스===
<references />

@@ 99번째 줄: / 99번째 줄: @@
   <references />
-== 메타데이터 ==
+==메타데이터==
 ===위키데이터===
 * ID :  [https://www.wikidata.org/wiki/Q846955 Q846955]

← 이전 판		2020년 12월 26일 (토) 12:15 판
98번째 줄:		98번째 줄:
	===소스===		===소스===
	<references />		<references />
		+
		+	== 메타데이터 ==
		+
		+	===위키데이터===
		+	* ID : [https://www.wikidata.org/wiki/Q846955 Q846955]

RC4 - 편집 역사

2021년 2월 17일 (수) 08:03에 Pythagoras0님의 편집

Pythagoras0: /* 메타데이터 */ 새 문단

Pythagoras0: /* 노트 */ 새 문단