of the government. Technical description In the original version of CipherSaber (now called CipherSaber-1 or CS1), each encrypted message begins with a random ten-byte initialization vector (IV). This IV is appended to the CipherSaber key to form the input to the RC4 key setup algorithm. The message, XORed with the RC4 keystream, immediately follows. The Fluhrer, Mantin and Shamir attack on RC4 has rendered CipherSaber-1 vulnerable if a large number (>1000) messages are sent with the same CipherSaber key. To address this, the CipherSaber designer has made a modified protocol (called CipherSaber-2) in which the RC4 key setup loop is repeated multiple times (20 is recommended). In addition to agreeing on a secret key, parties communicating with CipherSaber-2 must agree on how many times to repeat this loop. The ciphertext output is a binary byte stream that is designed to be "indistinguishable from random noise". For use with communications systems that can accept only ASCII data, the author recommends encoding the byte stream as hexadecimal digits. This is less efficient than, for example, base64 MIME encoding, but it is much simpler to program, keeping with CipherSaber's goal of maximal ease of implementation. Security and usability CipherSaber is strong enough and usable enough to make its political point effectively. However, it falls markedly short of the security and convenience one would normally ask of such a cryptosystem. While CipherKnights can use CipherSaber to exchange occasional messages with each other reasonably securely, either for fun or in times of great distress, CipherSaber strips cryptography to its bare essentials and it does not offer enough features to be suitable for wide deployment and routine daily use. CipherSaber's author in fact asks users to download and install PGP as one of the steps of becoming a CipherKnight. CipherSaber can be seen as a last-resort fallback system to use if programs like PGP are banned. Some, but not all of CipherSaber's sacrifices and shortcomings are unique to RC4. CipherSaber provides no message authentication. This vulnerability, shared by all pure stream ciphers, is straightforward to exploit. For example, an attacker who knows that the message contains "Meet Jane and me tomorrow at 3:30 pm" at a particular point can recover the keystream at that point from the ciphertext and plaintext. Then the attacker can replace the original content with any other content of exactly the same length, such as "3:30 meeting is cancelled, stay home" by