Knowledge Base

Finding

F

Encryption Algorithm: Rivest Cipher 4 (RC4)

Summary

Security

Encryption algorithm Rivest Cipher 4[370][371][372][373] is a stream cipher[182][183] that is more malleable[134] than a block cipher[78][79][80][81]. It has multiple vulnerabilities[375][376][377][378][379] (eg: related-key attack[68], distinguishing attack[60], ...), so attacker can apply statistical analysis against it to recover the encrypted text.

Suggestion

Remove the cipher suite from the list of cipher suites supported by your server.

Evaluate your host!

Type a URL to analyze a service

Get a prompt and clear overview of your security configuration. Right now!

Config Snippets

You can fix your security setting with the following config snippets in various services. You simply copy-paste (or delete) them to get a better secirity and grade. Do not forget to re-check your modified settings above.

If you want to reveal your security weaknesses and monitor your services or supply chain sign up for our beta test.

i
NGINX
OpenSSL version: 0.9.8+
ssl_ciphers …:!RC4
i
Apache
OpenSSL version: 0.9.8+
SSLCipherSuite …:!RC4

Affected Cipher Suites