RC4 Encryption (New, Proper)

[Valik]

Since the original posting of RC4 by bcording found here was broken and I also wanted to learn the algorithm for myself (The main reason), I wrote my own version. In doing so, I discovered the problem with bcording's version as explained in that thread. My version is based off information found here and implemented using the C code found here.

Of notable interest in this function is it kind-of handles NULL characters (Chr(0) or \0 In C/C++). When performing the algorithm, my function detects when \0 is to be part of the encrypted string. Instead of inserting it, it instead leaves that character unchanged. This has the unfortunate side effect of making the string no longer decryptable by any RC4 implementation not supporting this. However, it can be decrypted by this function. In all other cases where \0 does not appear, then encrypted string is completely RC4 compliant*. When \0 is detect, @error will be set (Even though the function still returns an encrypted/decrypted string).

The code can be found http://www.autoitscript.com/fileman/users/Valik/Library/encryption.au3.

Example usage:

#include "Encryption.au3"

Main()

Func Main()
    Local $sText = "This script performs 'RC4' Stream Encryption"
    Local $sKey = "password"
    
    Local $sEncrypted = _RC4Encrypt($sText, $sKey); My Function
    If @error Then MsgBox(4096+48, "Warning", "Non RC4 string produced")
    MsgBox(4096, "Encrypted", $sEncrypted)
    Local $sDecrypted = _RC4Decrypt($sEncrypted, $sKey)
    MsgBox(4096, "Decrypted", $sDecrypted)
    
    $sText = "This shouldn't generate a warning."
    $sKey = "Another Key"
    
    $sEncrypted = _RC4Encrypt($sText, $sKey); My Function
    If @error Then MsgBox(4096+48, "Warning", "Non RC4 string produced")
    MsgBox(4096, "Encrypted", $sEncrypted)
    $sDecrypted = _RC4Decrypt($sEncrypted, $sKey)
    MsgBox(4096, "Decrypted", $sDecrypted)
EndFunc; Main()

* "RC4 compliant" in this case means, anything which implements the original RC4 algorithm can decrypt the string (or encrypt it, so long as the result doesn't contain \0, which AutoIt can't handle).

Edit: Changed file suffix.

Edited January 29, 2005 by Valik

[DirtyBanditos]

Since the original posting of RC4 by bcording found here was broken and I also wanted to learn the algorithm for myself (The main reason), I wrote my own version.  In doing so, I discovered the problem with bcording's version as explained in that thread.  My version is based off information found here and implemented using the C code found here. 

Of notable interest in this function is it kind-of handles NULL characters (Chr(0) or \0 In C/C++).  When performing the algorithm, my function detects when \0 is to be part of the encrypted string.  Instead of inserting it, it instead leaves that character unchanged.  This has the unfortunate side effect of making the string no longer decryptable by any RC4 implementation not supporting this.  However, it can be decrypted by this function.  In all other cases where \0 does not appear, then encrypted string is completely RC4 compliant*.  When \0 is detect, @error will be set (Even though the function still returns an encrypted/decrypted string).

The code can be found http://www.autoitscript.com/fileman/users/Valik/Library/encryption.au3.

Example usage:

#include "Encryption.au3"

Main()

Func Main()
    Local $sText = "This script performs 'RC4' Stream Encryption"
    Local $sKey = "password"
    
    Local $sEncrypted = _RC4Encrypt($sText, $sKey); My Function
    If @error Then MsgBox(4096+48, "Warning", "Non RC4 string produced")
    MsgBox(4096, "Encrypted", $sEncrypted)
    Local $sDecrypted = _RC4Decrypt($sEncrypted, $sKey)
    MsgBox(4096, "Decrypted", $sDecrypted)
    
    $sText = "This shouldn't generate a warning."
    $sKey = "Another Key"
    
    $sEncrypted = _RC4Encrypt($sText, $sKey); My Function
    If @error Then MsgBox(4096+48, "Warning", "Non RC4 string produced")
    MsgBox(4096, "Encrypted", $sEncrypted)
    $sDecrypted = _RC4Decrypt($sEncrypted, $sKey)
    MsgBox(4096, "Decrypted", $sDecrypted)
EndFunc; Main()

* "RC4 compliant" in this case means, anything which implements the original RC4 algorithm can decrypt the string (or encrypt it, so long as the result doesn't contain \0, which AutoIt can't handle).

Edit: Changed file suffix.

<{POST_SNAPBACK}>

Hi valik thx you i like the Rc4 Stream Encryption "

good job

[kapowdude]

umm is this suppose to do anything... if it is i dont get it

[Insolence]

...encrypt things.

Let's say you wanted to encrypt a password that is to be used in one of your AutoIT scripts, this would be a good way to save it.

Instead of someone just dissasembling your script and finding the password it'd be a bunch of jumbled characters.

[kapowdude]

i know

but can i use this exact code to encrypt something or is it somthing Valic just wanted to show us that he knows how to make things rs4 encrypt

[Insolence]

You can use this if you use his functions...

[Chris_1013]

Is this intended to be an update for _StringEncrypt that's included with AutoIt? If so, is it going to be included in an update?

[Valik]

Its nothing like _StringEncrypt(). _StringEncrypt() looks like its maybe based on RC4 but it is most definitely not an implementation of RC4.

[Chris_1013]

True, it does say it's RC4 based in the description at the top. If this is a truer implementation of an RC4 encryption maybe it makes sense to replace it then?

[bcording]

Back in November I found out it was breaking due to nulls and fixed it. http://www.autoitscript.com/forum/index.ph...wtopic=6039&hl=

[Valik]

Back in November I found out it was breaking due to nulls and fixed it. http://www.autoitscript.com/forum/index.ph...wtopic=6039&hl=

<{POST_SNAPBACK}>

I didn't remember that post, only the original. The algorithm is still broken, though because no swapping occurs in the 3rd loop.

[Wolvereness]

If you want to replace the current _StringEncrypt() feel free to use the existing example.

[a6m1n0]

I know that this is an ancient post, but can anyone provide the missing au3 source for Valik's script? I am having problems interfacing with 'true RC4' algorithm in both ASP and PHP+mcrypt with _StringEncrypt and _StringEncryptRC4.

Thanks

[Valik]

Be aware that this code requires 3.2.0.1 or later. It can produce strings with embedded Chr(0)'s as part of the RC4 encryption.

expandcollapse popup

#Region Public Members

#Region _RC4Encrypt()
; ===================================================================
; _RC4Encrypt($sData, $sKey)
;
; Encrypts a string using the RC4 algorithm.
; Parameters:
;    $sData - IN - The data to encrypt.
;    $sKey - IN - The key to use for encryption.
; Returns:
;    The encrypted string.
; ===================================================================
Func _RC4Encrypt($sData, $sKey)
    Local $sResult = __RC4Impl($sData, $sKey)
    SetError(@error, @extended)    ; Propagate up
    Return $sResult
EndFunc    ; _RC4Encrypt()
#EndRegion _RC4Encrypt()

#Region _RC4Decrypt()
; ===================================================================
; _RC4Decrypt($sData, $sKey)
;
; Decrypts an RC4 encrypted string.
; Parameters:
;    $sData - IN - The data to decrypt.
;    $sKey - IN - The key to used during encryption.
; Returns:
;    The decrypted string.
; ===================================================================
Func _RC4Decrypt($sData, $sKey)
    Local $sResult = __RC4Impl($sData, $sKey)
    SetError(@error, @extended)    ; Propagate up
    Return $sResult
EndFunc    ; _RC4Decrypt()
#EndRegion _RC4Decrypt()

#EndRegion Public Members

#Region Private Members

#Region __RC4Impl()
; ===================================================================
; __RC4Impl($sData, $sKey)
;
; Implementation of the RC4 encryption algorithm.
; Parameters:
;    $sData - IN - Either plain text or an encrypted string.
;    $sKey - IN - The key to encrypt with or used during a previous encryption.
; Returns:
;    The string after being processed by the RC4 algorithm.
; ===================================================================
Func __RC4Impl($sData, $sKey)
    Local $aState[256]
    Local $nKeyLength = StringLen($sKey), $nDataLength = StringLen($sData)
    Local $c, $index, $x = 0, $y = 0, $sResult = ""

    For $counter = 0 To 255
        $aState[$counter] = $counter
    Next

    For $counter = 0 To 255
        $c = StringMid($sKey, Mod($counter, $nKeyLength)+1, 1)
        $index = Mod(Asc($c) + $aState[$counter] + $index, 256)
        __RC4Swap($aState[$counter], $aState[$index])
    Next

    For $counter = 1 To $nDataLength
        $x = Mod($x+1, 256)
        $y = Mod($aState[$x]+$y, 256)
        __RC4Swap($aState[$x], $aState[$y])
        $index = Mod($aState[$x]+$aState[$y], 256)
        $c = BitXOR(Asc(StringMid($sData, $counter, 1)), $aState[$index])
        $sResult &= Chr($c)
    Next
    Return $sResult
EndFunc    ; __RC4Impl()
#EndRegion __RC4Impl()

#Region __RC4Swap()
; ===================================================================
; __RC4Swap(ByRef $a, ByRef $B)
;
; Swap function provided only for convience.
; Parameters:
;    $a - IN/OUT - First argument to swap.
;    $b - IN/OUT - Second argument to swap.
; Returns:
;    None.
; ===================================================================
Func __RC4Swap(ByRef $a, ByRef $B)
    Local $t = $a
    $a = $b
    $b = $t
EndFunc    ; __RC4Swap()
#EndRegion __RC4Swap()

#EndRegion Private Members

[CoePSX]

... Am I just completely wrong or the _RC4Encrypt and _RC4Decrypt functions are totally the same?

[RazerM]

RC4 uses the same algorithm to encrypt and decrypt.

Edit:

@Valik

If you take out the StringToHex and HexToString functions from my UDF, my function produces the same result as yours (without Chr(0) support)

^^That doesn't have a point

Edited September 21, 2006 by RazerM

[solistic]

Thanks very much.

This is just what I need.

[Inyu]

The link you posted for the code in the topic seems to be dead. . [ http://www.autoitscript.com/fileman/users/Valik/Library/encryption.au3 ]

Edited April 8, 2009 by Inyu