Crypt::RC4 (3pm)

# Functional Style

  use Crypt::RC4;
  $encrypted = \s-1RC4\s0( $passphrase, $plaintext );
  $decrypt = \s-1RC4\s0( $passphrase, $encrypted );

# \s-1OO\s0 Style

  use Crypt::RC4;
  $ref = Crypt::RC4->new( $passphrase );
  $encrypted = $ref->\s-1RC4\s0( $plaintext );

  $ref2 = Crypt::RC4->new( $passphrase );
  $decrypted = $ref2->RC4( $encrypted );

# process an entire file, one line at a time # (Warning: Encrypted file leaks line lengths.)

  $ref3 = Crypt::RC4->new( $passphrase );
  while (<\s-1FILE\s0>) {
      chomp;
      print $ref3->\s-1RC4\s0($_), \*(L"\n\*(R";
  }

A simple implementation of the \s-1RC4\s0 algorithm, developed by \s-1RSA\s0 Security, Inc. Here is the description from \s-1RSA\s0's website:

\s-1RC4\s0 is a stream cipher designed by Rivest for \s-1RSA\s0 Data Security (now \s-1RSA\s0 Security). It is a variable key-size stream cipher with byte-oriented operations. The algorithm is based on the use of a random permutation. Analysis shows that the period of the cipher is overwhelmingly likely to be greater than 10100. Eight to sixteen machine operations are required per output byte, and the cipher can be expected to run very quickly in software. Independent analysts have scrutinized the algorithm and it is considered secure.

Based substantially on the \*(L"\s-1RC4\s0 in 3 lines of perl\*(R" found at http://www.cypherspace.org

A major bug in v1.0 was fixed by David Hook ([email protected]). Thanks, David.

Kurt Kincaid ([email protected]) Ronald Rivest for \s-1RSA\s0 Security, Inc.

Disclaimer: Strictly speaking, this module uses the \*(L"alleged\*(R" \s-1RC4\s0 algorithm. The Algorithm known as \*(L"\s-1RC4\s0\*(R" is a trademark of \s-1RSA\s0 Security Inc., and this document makes no claims one way or another that this is the correct algorithm, and further, make no claims about the quality of the source code nor any licensing requirements for commercial use.

There's nothing preventing you from using this module in an insecure way which leaks information. For example, encrypting multilple messages with the same passphrase may allow an attacker to decode all of them with little effort, even though they'll appear to be secured. If serious crypto is your goal, be careful. Be very careful.

It's a pure-Perl implementation, so that rating of \*(L"Eight to sixteen machine operations\*(R" is good for nothing but a good laugh. If encryption and decryption are a bottleneck for you, please re-write this module to use native code wherever practical.

This is free software and may be modified and/or redistributed under the same terms as Perl itself.

perl, <http://www.cypherspace.org>, <http://www.rsasecurity.com>, <http://www.achtung.com/crypto/rc4.html>, <http://www.columbia.edu/~ariel/ssleay/rrc4.html>