One of the joys of continuing my education is having getting to write a mini-article once a week for my fellow students and instructors. I’ve decided to share some of the better ones here. B.
In the beginning, there was the Internet, and it was good.
Then, in 1990, Tim Berners-Lee invented the World Wide Web (World Wide Web Foundation, n.d.). And that was awesome!
But then bad people began doing bad things to nice people who just wanted to send emails and shop online and do other things that involved sensitive information. And so, SSL was born (Blitz, 2019).
The key to SSL was that it encrypted communications between the user (client) and the remote website (server). Encryption garbles the data transmitted so that bad people who might be listening in on data being sent between the client and server would not gain access to the particulars of the conversation. Over time, the exact method used to encrypt these communications evolved, and eventually a ciphersuite known as RC4 became the dominant one used to encrypt SSL web communications (Green, 2013).
Then someone figured out how to break it.
RC4 is a stream cipher and variable length key algorithm. The algorithm encrypts one byte at a time using a pseudorandom bit generator that produces a stream 8-bit number that is unpredictable without knowledge of input key. The output is called key-stream and is combined one byte at a time with the plaintext stream cipher using an X-OR operation (Rai, 2019). The problem is that, with sufficient data samples to reference, the encryption is reversible. In short, it is possible for an unauthorized third-party to listen in on an encrypted conversation as if it was being sent on plain text (Vanhoef & Piessens, 2015).
The initial discovery that RC4 was reversible was made public in 2013 (Ristic, 2013), but at that point the logistics of cracking RC4 were considered impractical as it was thought to require a huge amount of data to be sampled first. Then, in 2015, a pair of researchers figured out a way to decrypt web browser cookies and other data encrypted using RC4 in minutes (Vanhoef & Piessens, 2015). That was the death knell for RC4, which was then cast out of TLS implementations as of TLS 1.3 (Wikipedia, n.d.).
References
Blitz, M. (2019, April 4). How Netscape Navigator Won and Then Lost the World Wide Web. Popular Mechanics. https://www.popularmechanics.com/culture/web/a27033147/netscape-navigator-history/
Green, M. (2013, March 12). Attack of the week: RC4 is kind of broken in TLS. A Few Thoughts on Cryptographic Engineering. https://blog.cryptographyengineering.com/2013/03/12/attack-of-week-rc4-is-kind-of-broken-in/
Rai, A. (2019, August 9). RC4 Encryption Algorithm. GeeksforGeeks. https://www.geeksforgeeks.org/rc4-encryption-algorithm/
Ristic, I. (2016, September 30). RC4 in TLS is Broken: Now What? Qualys Blog. https://blog.qualys.com/ssllabs/2013/03/19/rc4-in-tls-is-broken-now-what
Vanhoef, M., & Piessens, F. (2015). Numerous Occurrence MOnitoring & Recovery Exploit. RC4 NOMORE. https://www.rc4nomore.com/
Wikipedia. (2001, December 7). Transport Layer Security. Retrieved March 18, 2020, from https://en.wikipedia.org/wiki/Transport_Layer_Security
World Wide Web Foundation. (n.d.). History of the Web. https://webfoundation.org/about/vision/history-of-the-web/