Abstract. In this report, we point out a serious security flaw in Mi-crosoft Word and Excel. The stream cipher RC4 [9] with key length upto 128 bits is used in Microsoft Word and Excel to protect the documents.But when an encrypted document gets modified and saved, the initial-ization vector remains the same and thus the same keystream generatedfrom RC4 is applied to encrypt the different versions of that document. The consequence is disastrous since a lot of information of the documentcould be recovered easily.

For the implementation of stream ciphers, the basic principle is that if the same key is used for more than once, different initialization vectors should beused to prevent the same keystream from being used to encrypt more than onemessage. When the stream cipher is used in the data transmission, normallypeople would follow this principle strictly. However, in the environment wherethe document needs to be edited and modified, such principle may be forgot-ten. This kind of mistake takes place in the Microsoft Office (Word and Excel)encryption – the same key and the same initialization vector are allowed to en-crypt different versions of a document. This happens as follows. We encrypt aMicrosoft Office (Word or Excel) document with a password and save that file.Later that document is modified and being saved again. In this process, thekey and initialization vector remain unchanged, so the same keystream is usedto protect two different versions (the original and the modified versions) of thedocuments. By XORing those two versions, we could obtain a lot of informationabout the document.