1. A symmetric stream cipher developed by RSA Data Security, Inc.. Whereas most ciphers have been optimized for hardware (e.g. DES), RC4 was optimized for software. Applications: SSL, which means RC4 is built into your Netscape and Microsoft web browser. CDPD (Cellular) connections for your Palm modem using OmniSky. Lotus Notes, MS Access, Adobe Acrobat, PPTP, Oracle Secure SQL. IEEE 802.11 WEP Key point: RC4 supports variable length keys (up to 2048-bits), but most uses are 40-bits due to historic export controls. History: The algorithm was a trade-secret until 1994 when somebody reverse engineered it and anonymously posted it to the cypherpunks list and USENET. This reverse engineered version is known as "Arcfour" or "ARC4", which stands for "Alleged RC4". It isn't patented. Therefore, RSA Inc. is trying to move all its customers to RC5, which is both patented and copyrighted. The source code is essentially: while (length--) { x++; sx = state[x]; y += sx; sy = state[y]; state[y] = sx; state[x] = sy; *data++ ^= state[(sx+sy)&0xFF];} RSA Inc. still claims that it is a trade secret; however, due to its simplicity, its description is in virtually all crypto textbooks -- it is the most widely known secret on the net. Key point: RC4 works by XORing the plain-text against a stream of random numbers. Unless a whitening seed is provided at the begining, the plain-text may be recovered. This is a common bug in products. From Hacking-Lexicon