GeezerVison

RC2

The MIX transformation of RC2; four of these comprise a MIXING round
General
Designers	Ron Rivest
First published	Leaked in 1996, designed in 1987, officially published in 1998
Cipher detail
Key sizes	1–128 bytes
Block sizes	64 bits
Structure	Source-heavy unbalanced Feistel network
Rounds	16 of type MIXING, 2 of type MASHING
Best public cryptanalysis
A related-key attack is possible requiring 234 chosen plaintexts (Kelsey et al., 1997).

In cryptography, RC2 (also known as ARC2) is a symmetric-key block cipher designed by Ron Rivest in 1987. "RC" stands for "Ron's Code"^[1] (see also RC2, RC5 and RC6), but generally called simply RC2. Other ciphers designed by Ron Rivest include RC4, RC5, and RC6.

The development of RC2 was sponsored by Lotus, who were seeking a custom cipher that, after evaluation by the NSA, could be exported as part of their Lotus Notes software. The NSA suggested a few changes, which Rivest incorporated. After further negotiations, the cipher was approved for export in 1989. Along with RC4, RC2 with a 40-bit key size was treated favourably under US export regulations for cryptography.

Initially, the details of the algorithm were kept secret — proprietary to RSA Security — but on 29 January 1996, source code for RC2 was anonymously posted to the Internet on the Usenet forum sci.crypt. Mentions of CodeView and SoftICE (popular debuggers) suggest that it had been reverse engineered. A similar disclosure had occurred earlier with RC4.

In March 1998, Ron Rivest authored an RFC publicly describing RC2 himself.^[2]

RC2 is a 64-bit block cipher with a variable size key. Its 18 rounds are arranged as a source-heavy unbalanced Feistel network, with 16 rounds of one type (MIXING) punctuated by two rounds of another type (MASHING). A MIXING round consists of four applications of the MIX transformation, as shown in the diagram, which modifies one 16-bit words based on the three other data words and one subjey word. A MASHING round likewise consists of four MASH transformations, each of which modifies one word.

The subkeys come from a 64-word key schedule. Each of the 64 MIX transformations in the 16 MIXING rounds uses one of the 64 words. Each of 8 MASH transformations in the 2 MASHING rounds uses one subkey word, selected in a data-dependent way from the full schedule of 64.

The 128-byte key schedule is computed from the supplied key using a 256-entry permutation table. The table was constructed as a "Nothing-up-my-sleeve number" by a Fisher–Yates shuffle where the random positions were selected using consecutive three-digit groups from the decimal expansion of pi.^[3]

RC2 is vulnerable to a related-key attack using 2³⁴ chosen plaintexts.^[4]

• RFC 2268 - A Description of the RC2(r) Encryption Algorithm
• RSA FAQ: What is RC2? Archived 2016-03-03 at the Wayback Machine
• sci.crypt posting revealing the RC2 algorithm