Which statement about RC4's key lengths is accurate?

• A. RC4 can use a broad range of key lengths
• B. RC4 uses a fixed 40-bit key
• C. RC4 requires 128-bit keys
• D. RC4 keys must be 256 bits

Answer: (A)

RC4 uses a variable-length key. There is no single fixed size defined by the algorithm. The key can be as short as 1 byte or as long as 256 bytes (8 to 2048 bits), with many practical deployments using common lengths like 40 to 2048 bits. This flexibility means RC4 can be configured for different security and performance needs, rather than being locked to a specific bit length. That’s why the statement that RC4 can use a broad range of key lengths is the best choice. The other options imply fixed sizes, which RC4 does not require.