{{ message }}

Instantly share code, notes, and snippets.

Created Mar 24, 2012
RC4 encryption in javascript and php
 /* * RC4 symmetric cipher encryption/decryption * * @license Public Domain * @param string key - secret key for encryption/decryption * @param string str - string to be encrypted/decrypted * @return string */ function rc4(key, str) { var s = [], j = 0, x, res = ''; for (var i = 0; i < 256; i++) { s[i] = i; } for (i = 0; i < 256; i++) { j = (j + s[i] + key.charCodeAt(i % key.length)) % 256; x = s[i]; s[i] = s[j]; s[j] = x; } i = 0; j = 0; for (var y = 0; y < str.length; y++) { i = (i + 1) % 256; j = (j + s[i]) % 256; x = s[i]; s[i] = s[j]; s[j] = x; res += String.fromCharCode(str.charCodeAt(y) ^ s[(s[i] + s[j]) % 256]); } return res; }


WebReflection commented Sep 12, 2012

 just wonder if this, or its source ... was actually inspired by this one: http://code.google.com/p/sessionstorage/source/browse/trunk/src/RC4.js

 Well, different implementations of the same algorithm couldn't be much different. Actually I wrote this code about 7 years ago based on some pseudocode in an article about RC4 (which I don't remember where I found) and published it in my personal website: http://web.archive.org/web/20060810225251/http://farhadi.ir/rc4.html

 Is it possible to get java compatible algorithm for the same?

 I'm not a Java developer but the code is simple and I think an average Java programmer can port it to Java.

basgroot commented Jun 15, 2013

 Javascript works, but PHP code doesn't work with unicode strings, like '€'.

basgroot commented Jun 15, 2013

 It looks like there is a difference in the last line of the PHP version, compared to JS: JS: res += String.fromCharCode(str.charCodeAt(y) ^ s[(s[i] + s[j]) % 256]); PHP: \$res .= \$str[\$y] ^ chr(\$s[(\$s[\$i] + \$s[\$j]) % 256]); This is my PHP version, which works with unicode, at least on my server: function mb_chr(\$char) { return mb_convert_encoding('&#'.intval(\$char).';', 'UTF-8', 'HTML-ENTITIES'); } function mb_ord(\$char) { \$result = unpack('N', mb_convert_encoding(\$char, 'UCS-4BE', 'UTF-8')); if (is_array(\$result) === true) { return \$result[1]; } return ord(\$char); } function rc4(\$key, \$str) { if (extension_loaded('mbstring') === true) { mb_language('Neutral'); mb_internal_encoding('UTF-8'); mb_detect_order(array('UTF-8', 'ISO-8859-15', 'ISO-8859-1', 'ASCII')); } \$s = array(); for (\$i = 0; \$i < 256; \$i++) { \$s[\$i] = \$i; } \$j = 0; for (\$i = 0; \$i < 256; \$i++) { \$j = (\$j + \$s[\$i] + mb_ord(mb_substr(\$key, \$i % mb_strlen(\$key), 1))) % 256; \$x = \$s[\$i]; \$s[\$i] = \$s[\$j]; \$s[\$j] = \$x; } \$i = 0; \$j = 0; \$res = ''; for (\$y = 0; \$y < mb_strlen(\$str); \$y++) { \$i = (\$i + 1) % 256; \$j = (\$j + \$s[\$i]) % 256; \$x = \$s[\$i]; \$s[\$i] = \$s[\$j]; \$s[\$j] = \$x; ``````\$res .= mb_chr(mb_ord(mb_substr(\$str, \$y, 1)) ^ \$s[(\$s[\$i] + \$s[\$j]) % 256]); `````` } return \$res; }

reyneke-vosz commented Jul 23, 2013

 Thats exactly what i need! PHP-Decryption and JS-Encryption. In my case I had to utf8_encode the decrypted string. Works fine, thanks!

eduardoalcantara commented Jul 24, 2013

 I need encryption and decryption for at least PHP.

r3wt commented May 14, 2014

 i need php encryption and js decryption for websocket messages

DamiJegede commented Jul 16, 2014

 But this is one-way. How about the snippet for decryption?

burn0050 commented Nov 11, 2014

 Actually, @DamilolaJegede, this function is symmetrical. If you pass the resulting (encoded) string back into the function, you get the original string back.

 how to combine this rc4 with Message Authentication code?

aldoemilio commented May 2, 2016

 Hi Basgroot, I need to encript a series of _GET values before including them in the URL, and decript them in the target page in order to populate it, with the various _GET values. But the function does not decript the string as pairs of GET keys and values. How can I achieve this?

weeco commented Aug 20, 2017

 Why is there no support for streaming? Or at least keeping the internal state? Can you add that please? RC4 is a stream cipher so there has to be support for transforming data while keeping the internal state of the encryption/decryption SBox (https://en.wikipedia.org/wiki/RC4 see: Key scheduling)

weeco commented Aug 20, 2017

 nevermind, this one does the trick https://www.npmjs.com/package/simple-rc4 ;-)

jesobreira commented Nov 10, 2017

 Here's my port to AutoIt3: ``````Func rc4(\$sKey, \$sStr) Local \$s[256], \$j = 0, \$x, \$res, \$y, \$i Local \$uBound For \$i = 0 To 255 \$s[\$i] = \$i Next For \$i = 0 To 255 \$j = Mod((\$j + \$s[\$i] + Asc(StringMid(\$sKey, Mod(\$i, StringLen(\$sKey))+1, 1))), 256) \$x = \$s[\$i] \$s[\$i] = \$s[\$j] \$s[\$j] = \$x Next \$i = 0 \$j = 0 For \$y = 0 To StringLen(\$sStr)-1 \$i = Mod((\$i + 1), 256) \$j = Mod((\$j + \$s[\$i]), 256) \$x = \$s[\$i] \$s[\$i] = \$s[\$j] \$s[\$j] = \$x \$res &= Chr(BitXOR(Asc(StringMid(\$sStr, \$y+1, 1)), (\$s[Mod((\$s[\$i] + \$s[\$j]), 256)]))) Next Return \$res EndFunc ``````