StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>As a high level view the following comments on both should be useful.</p> <ul> <li><p>It is extremely easy to create a protocol based on RC4 (such as WEP) that is of extremely low strength (breakable with commodity hardware in minutes counts as extremely weak).</p></li> <li><p>Triple DES is not great in that its strength comes though excessive cpu effort but it is of considerably greater strength (both theoretically in real world attacks) than RC4 so should be the default choice.</p></li> </ul> <p>Going somewhat deeper: </p> <p>In the field of encryption with no well defined target application then the definition of 'best' is inherently hard since the 'fitness' of an algorithm is multi variant. </p> <ul> <li>Ease of implementation <ul> <li>Can you run it on commodity hardware?</li> <li>Are implementations subject to accidental flaws that significantly reduce security while still allowing 'correctness' of behaviour.</li> </ul></li> <li>Cost of implementation <ul> <li>Power/silicon/time to encode/decode.</li> </ul></li> <li>Effort to break <ul> <li>Brute Force resilience. Pretty quantifiable</li> <li>Resistance to cryptanalysis, less quantifiable, you might think so but perhaps the right person hasn't had a try yet:)</li> </ul></li> <li>Flexibility <ul> <li>Can you trade off one of the above for another</li> <li>What's the maximum key size (thus upper limits of the Brute Force)</li> <li>What sort of input size is required to get decent encryption, does it require salting.</li> </ul></li> </ul> <p>Actually working out the effort to break itself requires a lot of time and effort, which is why you (as a non cryptographer) go with something already done rather than roll your own. It is also subject to change over time, hopefully solely as a result of improvements in the hardware available rather than fundamental flaws in the algorithm being discovered.</p> <p>The core overriding concern is of course just that, is it secure? It should be noted that many older algorithms previously considered secure are no longer in that category. Some are so effectively broken that their use is simply pointless, you have no security whatsoever simply <em>obscurity</em> (useful but in no way comparable to real security).</p> <p>Currently neither of the core algorithms of RC4 and TDES is in that category but the naive implementation of RC4 is considered extremely flawed in protocols where the message data can be forced to repeat. RC4 has several more significant theoretical flaws than TDES.</p> <p>That said TDES is NOT better than RC4 in all the areas listed above. It is significantly more expensive to compute (and that expensiveness is not justified, other less costly crypto systems exist with comparable security to TDES)</p> <p>Once you have a real world application you normally get one or both of the following:</p> <ul> <li>Constrains on your hardware to do the task</li> <li>Constraints imposed be the data you are encrypting (this is used to transmit data which needs to be kept secret only for X days... for example)</li> </ul> <p>Then you can state, with tolerances and assumptions, what can achieve this (or if you simply can't) and go with that.</p> <p>In the absence of any such constraints we can only give you the following:</p> <h3>Ease of implementation</h3> <p>Both have publicly available secure free implementations for almost any architecture and platform available. RC4 implementations may not be as secure as you think if the message can be forced to repeat (see the WEP issues). Judicious use of salting may reduce this risk but this will NOT have been subject to the rigorous analysis that the raw implementations have been and as such should be viewed with suspision.</p> <h3>Cost of implementation</h3> <p>I have no useful benchmarks for RC4 (it is OLD) <a href="http://www.cryptopp.com/benchmarks.html" rel="noreferrer">http://www.cryptopp.com/benchmarks.html</a> has some useful guides to put TDES in context with RC5 which is slower than RC4 (TDES is at least an order of magnitude slower than RC4) RC4 can encrypt a stream at approximately 7 cycles per byte in a fast implementation on modern x86 processors for comparison.</p> <h3>Effort to break</h3> <p>Brute Force resilience of TDES is currently believed to be high, even in the presence of many encryption outputs. RC4 brute force resilience is orders of magnitude lower than TDES and further is <em>extremely</em> low in certain modes of operation (failure to discard initial bits of stream)</p> <p>Resistance to cryptanalysis, There are publicly known flaws for Triple DES but they do not reduce the effectiveness of it to realistic attack in the next decade or two, the same is not true for RC4 where several flaws are known and combined they have produced reliable attacks on several protocols based on it.</p> <h3>Flexibility</h3> <p>TDES has very little flexibility (and your library may not expose them anyway) RC4 has a lot more flexibility (the key used to initialize it can be arbitrarily long in theory, though the library may limit this.</p> <p>Based on this and your statement that you must use one or the other you should consider the RC4 implementation only if the CPU cost of TripleDES makes it unrealistic to implement in your environment or the low level of security provided by RC4 is still considerably higher than your requirements specify.</p> <p>I should also point out that systems exist which are empirically better in all areas than RC4 and TDES. The <a href="http://www.ecrypt.eu.org/stream/" rel="noreferrer">eSTREAM</a> project is evaluating various stream cyphers in the order of 5 or less cycles per byte though the cryptanalysis work on them is not really complete. Many faster, stronger block cyphers exist to compete with TDES. <a href="http://en.wikipedia.org/wiki/Advanced_Encryption_Standard" rel="noreferrer">AES</a> is probably the best known, and would be a candidate since it is of comparable (if not better) security but is much faster.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload