RC4 is insecure primarily due to vulnerabilities in which aspect?

• A. Block cipher mode of operation
• B. The symmetric key length is too short
• C. KEYSTREAM biases and vulnerabilities
• D. It uses ECB mode

Answer: (C)

Keystream biases in RC4 make it insecure. RC4 encrypts by XORing plaintext with a generated keystream, so the secrecy relies on the keystream behaving like random data. But RC4’s keystream is not perfectly random—the early bytes and certain patterns are biased, and these weaknesses can be exploited by attackers to distinguish RC4-encrypted data from random and, with enough ciphertext, recover information about the plaintext or even the key in some cases. That non-randomness in the keystream is the core vulnerability, which is why RC4 is considered insecure.

Other options don’t hit the fundamental issue. RC4 is a stream cipher, not a block cipher that uses modes like ECB; key length itself isn’t the primary fault—RC4 can use a range of key sizes, yet the keystream biases still undermine security.