Discovery and Exploitation of New Biases in RC4

Abstract

Abstract. In this paper, we present several weaknesses in the stream cipher RC4. First, we present a technique to automatically reveal linear correlations in the PRGA of RC4. With this method, 48 new exploitable correlations have been discovered. Then we bind these new biases in the PRGA with known KSA weaknesses to provide practical key recovery attacks. Henceforth, we apply a similar technique on RC4 as a black box, i.e. the secret key words as input and the keystream words as output. Our objective is to exhaustively find linear correlations between these elements. Thanks to this technique, 9 new exploitable correlations have been revealed. Finally, we exploit these weaknesses on RC4 to some practical examples, such as the WEP protocol. We show that these correlations lead to a key recovery attack on WEP with only 9 800 encrypted packets (less than 20 seconds), instead of 24 200 for the best previous attack.

Synthetic Linear Analysis: Improved Attacks on CubeHash and Rabbit

“…Obviously, we can easily justify that Approximations (5), (6) are independent, because the involved states x 10100 , x 00100 in (5) are independent of the involved states x 10110 , x 00110 in (6); similarly, Approximations (8), (9), (10), (11) are independent pairwise. Our main focus here is to show below that these two groups of approximations are, however, not independent.…”

“…The internal states are invertible with the CubeHash round function T , as each step operation is invertible. Thus, we can rewrite Approximations (8), (9), (10), (11) in terms of states right after step one as follows respectively,…”

“…Nevertheless, when the bias is large, we can always compute it empirically, as successfully showed with recent results on RC4 biases (eg. [9]). The direct bias computation when the bias is small is beyond the scope of this paper.…”

“…We get q ′ = 0xaf ed/0x10000, p ′ + = 0xd4698c87/(0xaf ed * 2 21 ), p ′ − = 0x4ea00ceb/(0x5013 * 2 21 ). They correspond to the percentage of positive bias 68.7%, the average of positive bias +2 −4.73 , the average of negative bias −2 −5.03 , and the average bias +2 −5.94 of all 9 . By (31), we estimate the bias 2 −17.5 for A ⊕ B ⊕ C. This result agrees with our first estimation (38).…”

A Survey on RC4 Stream Cipher

“…As reported in the literature the adversary attack the WEP protocol by recovering the secret key K from the known values of IV (initialization vector) and known values of the RC4 keystream bytes found from the plaintext and ciphertext pairs. [31][32][33], and Shepehrdad, Susil, Vaudenay and Vuagnoux (SSVV) attack [34], WEP was declared as an insecure protocol. Later it is replaced by WPA (Wi-Fi protected access) which also make use of RC4 as its core element.…”