Which cipher's weak implementation contributed to WEP insecurity?

• A. RC4
• B. AES
• C. DES
• D. RSA

Answer: (A)

WEP’s insecurity comes from how RC4 was used rather than the cipher itself. In WEP, RC4 is applied with a 24-bit initialization vector that is attached to the shared key for every packet. That small IV space means that in a busy network, the same keystream is reused across multiple frames. When two packets are encrypted with the same keystream, the ciphertexts relate as C1 XOR C2 = P1 XOR P2, which lets an attacker uncover patterns and, with enough data and some known plaintext, recover the key or plaintext. Additionally, RC4 exhibits biases in its early keystream bytes that depend on the IV, enabling practical attacks that exploit those biases to crack the WEP key. AES is a different, more modern cipher and is used in later standards like WPA2, while DES and RSA serve other cryptographic roles and aren’t the mechanism behind WEP’s encryption. The combination of RC4 with a short, reused IV and weak IV handling is what made WEP vulnerable.