0

I have a client-server system. The client and the server application are programmed in windows. I use Windows Crypto API for encrypting communication between client and server. My selected details for encrypting data are:

Provider : Microsoft Enhanced Cryptographic Provider v1.0

Provider Type : PROV_RSA_FULL - Exchange Key: RSA

Algorithm : RC4 stream encryption - 128 bit

I ask are my selections for encrypting secure? How much are they secure? Can you compare my specifications with AES 128 bit?

1

2 Answers 2

2

AES-128 is considered more secure than RC4. RC4 is an old stream cipher which is considered broken. That is: it is possible to obtain information about the key stream and therefore plaintext.

That said: neither RSA and AES encryption are in themselves enough to create a secure transport protocol. You'd also need to establish keys securely, authenticate at least one of the participants (a subject all on it's own), authenticate your messages, avoid replay and reversal attacks, avoid timing attacks, make sure you don't leak too much information with ciphertext length...

This is why you're normally informed that you should use (well configured) TLS instead of inventing your own. Transport security is not something you can create off of the back of a coaster.

1

In cryptography, the security of a cipher is highly depends on the length of encryption-decryption key you are using.Encrypting 16 bit data with AES-256 (256 bit key) is much more secure than Encrypting 16 bit data with AES-128 (128 bit key).

First of all, note that AES and RC4 are two different ciphers. AES is a block cipher while RC4 is a stream cipher. You can use the block ciphers for creating a stream cipher. both two ciphers are two different things with different usage. You must compare them separately and decide which one is better for you.

The popularity of RC4 is related to it's simplicity and its speed. AES in not as fast as RC4 at all, but hardware implementation of AES along side AES_NI, new instruction for performing one round of AES, makes it very fast!!

AES security is clear for everybody but RC4 has some weaknesses. In 2005, Andreas Klein presented an analysis of the RC4. Erik Tews, [Ralf-Philipp Weinmann][2], and Andrei Pychkine create a tool that cracks 104-bit RC4 under a minute.

I recommend you to use AES encryption if:

  1. you Need strong security!!!

  2. your Processor has AES_NI instruction.

    [2]: Erik Tews, Ralf-Philipp Weinmann, Andrei Pyshkin. Breaking 104-bit WEP in under a minute.

3
  • I disagree about "Encrypting 16 bit data with AES-256 (256 bit key) is much more secure than Encrypting 16 bit data with AES-128 (128 bit key)", see security.stackexchange.com/questions/14068/…
    – John29
    Jul 3, 2019 at 22:39
  • @John29 this is essentially true,for example if the exhaustive key search is the only method, which one takes much time to guess the key?
    – Rezaeimh7
    Jul 8, 2019 at 2:52
  • I don't want to argue here. Please read the link that I provided to understand why I disagree. I agree with your general statement "In cryptography, the security of a cipher is highly depends on the length of encryption-decryption key you are using", but I disagree about AES-256 being much more secure than AES-128. I think that an example where the key length makes a real world difference, making a brute force attack feasible, would be more appropriate.
    – John29
    Jul 8, 2019 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.