RC4_SET_KEY(3ossl)

💖 RC4_SET_KEY(3ossl) — the OpenSSL tea 💖

okay bestie, sit down, grab a boba, because today we're talking about RC4_set_key and RC4, straight out of the OpenSSL manual. this one's a legacy icon, and by iconic i mean deprecated. buckle up. 🎀

---

✨ NAME ✨

RC4_set_key, RC4 — RC4 encryption, the OG stream cipher that we all have complicated feelings about 💀

---

🌸 SYNOPSIS 🌸

#include <openssl/rc4.h>

so here's the vibe check: the following functions have been deprecated since OpenSSL 3.0, and you can hide them entirely by defining OPENSSL_API_COMPAT with a suitable version value — peek at openssl_user_macros(7) for the deets 👀

void RC4_set_key(RC4_KEY *key, int len, const unsigned char *data);

void RC4(RC4_KEY *key, unsigned long len, const unsigned char *indata,
         unsigned char *outdata);

---

🦋 DESCRIPTION 🦋

okay so, first thing first, and i need you to hear me on this: all of the functions described on this page are deprecated. every single one. no cap. if you're writing an app, you should be using EVP_EncryptInit_ex(3), EVP_EncryptUpdate(3) and EVP_EncryptFinal_ex(3) instead — or the equivalently named decrypt functions. the EVP girlies ate and left no crumbs. 💅

now, the lore ✨: this library implements the Alleged RC4 cipher, which is described for example in Applied Cryptography. it is believed to be compatible with RC4[TM], a proprietary cipher of RSA Security Inc. (the "alleged" is doing a lot of heavy lifting there and honestly? iconic.)

RC4 is a stream cipher with variable key length. typically, 128 bit (16 byte) keys are used for strong encryption, but shorter insecure key sizes have been widely used due to export restrictions. yes, shorter keys = insecure, that's not a vibe, that's just facts. 😭

RC4 consists of a key setup phase and the actual encryption or decryption phase. two eras, one cipher.

• RC4_set_key() — sets up the RC4_KEY key using the len bytes long key at data. this is the setup era. the getting-ready-with-me. 🎀
• RC4() — encrypts or decrypts the len bytes of data at indata using key and places the result at outdata. repeated RC4() calls with the same key yield a continuous key stream. it's giving "one long conversation" energy fr fr.

and since RC4 is a stream cipher (the input is XORed with a pseudo-random key stream to produce the output), decryption uses the same function calls as encryption. symmetric queen behavior 👑

---

💜 RETURN VALUES 💜

RC4_set_key() and RC4() do not return values. they simply do the thing and leave. no receipts, no follow-up text, just vibes. 🫶

---

⭐ NOTE ⭐

bestie, listen to me carefully 🚨

• applications should use the higher level functions EVP_EncryptInit(3) etc. instead of calling these functions directly. like, please. for me.
• it is difficult to securely use stream ciphers. for example, do not perform multiple encryptions using the same key stream. that's a real footgun, not a cute one. 🙈

---

🌈 SEE ALSO 🌈

• EVP_EncryptInit(3)

---

🕰️ HISTORY 🕰️

all of these functions were deprecated in OpenSSL 3.0. that's it, that's the chapter of the story. 💀

---

👑 COPYRIGHT 👑

Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie!! 💖 this was OpenSSL 3.5.9, dated 2026-09-29, and the manual is literally called RC4_SET_KEY(3ossl) — so now you know exactly where to find it again. go forth, use EVP, and don't reuse your key streams. mwah 🎀✨🦋