Microsoft Ends 26-Year Reign of Vulnerable RC4 Encryption Cipher

Microsoft has announced that it will finally be phasing out the obsolete and vulnerable encryption cipher, RC4, which has been a default component of Windows for 26 years. The decision comes after more than a decade of devastating hacks that exploited the cipher, as well as recent criticism from a prominent US senator. RC4, short for Rivest Cipher 4, was a stream cipher developed by Ron Rivest of RSA Security in 1987. Despite its known susceptibility to attacks, RC4 remained a staple in encryption protocols, including SSL and its successor TLS, until about a decade ago. According to Microsoft, RC4 was made the sole means of securing Windows Active Directory in 2000, which administrators use to configure and provision user accounts inside large organizations. The company has stated that it will be removing support for RC4 in a future update, although no specific date has been announced. "We have been working to remove RC4 from our products for some time now, and we are pleased to finally be able to take this step," said a Microsoft spokesperson. The decision to phase out RC4 has been welcomed by security experts, who have long criticized the cipher's use in modern encryption protocols. "RC4 is a relic of the past, and it's about time that Microsoft finally acknowledged its limitations," said cryptography expert, Bruce Schneier. "We've known for years that RC4 is vulnerable to attacks, and it's only a matter of time before it's used to compromise sensitive information." RC4's history dates back to 1987, when it was developed by Ron Rivest of RSA Security. However, within days of the trade-secret-protected algorithm being leaked in 1994, a researcher demonstrated a cryptographic attack that significantly weakened the security it had been believed to provide. Despite this, RC4 remained a staple in encryption protocols until about a decade ago, when its use began to decline. Microsoft's decision to phase out RC4 is part of a broader effort to improve the security of its products. The company has been working to remove support for other outdated encryption protocols, including SSL, in favor of more secure alternatives. "We are committed to providing our customers with the most secure products possible, and that means removing outdated and vulnerable technologies like RC4," said the Microsoft spokesperson. The phase-out of RC4 is expected to have a significant impact on the security landscape, particularly for large organizations that have relied on the cipher to secure their user accounts. While Microsoft has not announced a specific date for the removal of RC4, security experts expect the process to be completed within the next year. In the meantime, organizations are advised to begin planning for the transition to more secure encryption protocols.