On Reconstruction of RC4 Keys from Internal States

Khazaei, Shahram; Meier, Willi

doi:10.1007/978-3-540-89994-5_14

Cited by 6 publications

(4 citation statements)

References 7 publications

(26 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the similar direction, a bit-by-bit key recovery approach is discussed in [7]. We have also added to our initial work of [20] in Sections 2.5, 3.4 of the current paper.…”

Section: Outline Of the Contributionmentioning

confidence: 92%

On biases of permutation and keystream bytes of RC4 towards the secret key

Paul

Maitra

2009

Cryptogr. Commun.

View full text Add to dashboard Cite

A theoretical analysis of the RC4 Key Scheduling Algorithm (KSA) is presented in this paper, where the nonlinear operation is swapping among the permutation bytes. Explicit formulae are provided for the probabilities with which the permutation bytes at any stage of the KSA are biased to the secret key. Theoretical proofs of these formulae have been left open since Roos' work (1995). Next, a generalization of the RC4 KSA is analyzed corresponding to a class of update functions of the indices involved in the swaps. This reveals an inherent weakness of shuffle-exchange kind of key scheduling. Moreover, we show that biases towards the secret key also exist in S [S[y]], S[S[S[y]]], and so on, for initial values of y.We additionally show that each byte of S N actually reveals secret key information. Looking at all the elements of the final permutation S N and its inverse S −1 N , the value of the hidden index j in each round of the KSA can be estimated from a "pair of values" in 0, . . . , N − 1 with a constant probability of success π = N−2 N · ( N−1 N ) N−1 + 2 N (we get π ≈ 0.37, for N = 256), which is significantly higher than the random association. Using the values of two consecutive j's, we estimate the y-th key byte from at most a "quadruple of values" in 0, . . . , N − 1 with a probability > 0.12. As a secret key of l bytes is repeated at least N l times in RC4, these many quadruples can be accumulated to get each byte of the secret key with very high probability (e.g., 0.8 to close to 1) from a small set of values. Based on our analysis of the key scheduling, we show that the secret key of RC4 can be recovered from the state information in a time much less than the exhaustive search with good probability. Finally, based This is a revised and substantially extended version of the conference papers [20] and [11]. on the above biases of the permutation after the KSA and other related results, a complete framework is presented to show that many keystream output bytes of RC4 are significantly biased towards several linear combinations of the secret key bytes. The results do not assume any condition on the secret key. We find new biases in the initial as well as in the 256-th and 257-th keystream output bytes.

show abstract

“…In the similar direction, a bit-by-bit key recovery approach is discussed in [7]. We have also added to our initial work of [20] in Sections 2.5, 3.4 of the current paper.…”

Section: Outline Of the Contributionmentioning

confidence: 92%

On biases of permutation and keystream bytes of RC4 towards the secret key

Paul

Maitra

2009

Cryptogr. Commun.

View full text Add to dashboard Cite

show abstract

“…Later, Matsui [22] reported colliding key pairs for RC4 for the first time and then stronger key collisions were found by Chen and Miyaji [5]. A direct approach for key recovery from the internal permutation of RC4 was first proposed by Paul and Maitra [28], and was later studied by Biham and Carmeli [4], Khazaei and Meier [13], Akgün, Kavak and Demirci [1], and Basu, Maitra, Paul and Talukdar [3].…”

Section: An Overview Of Rc4 Cryptanalysismentioning

confidence: 98%

(Non-)Random Sequences from (Non-)Random Permutations—Analysis of RC4 Stream Cipher

et al. 2012

View full text Add to dashboard Cite

Abstract. RC4 has been the most popular stream cipher in the history of symmetric key cryptography. Its internal state contains a permutation over all possible bytes from 0 to 255, and it attempts to generate a pseudorandom sequence of bytes (called keystream) by extracting elements of this permutation. Over the last twenty years, numerous cryptanalytic results on RC4 stream cipher have been published, many of which are based on non-random (biased) events involving the secret key, the state variables, and the keystream of the cipher.Though biases based on the secret key is common in RC4 literature, none of the existing ones depends on the length of the secret key. In the first part of this paper, we investigate the effect of RC4 keylength on its keystream, and report significant biases involving the length of the secret key. In the process, we prove the two known empirical biases that were experimentally reported and used in recent attacks against WEP and WPA by Sepehrdad, Vaudenay and Vuagnoux in EUROCRYPT 2011. After our current work, there remains no bias in the literature of WEP and WPA attacks without a proof.In the second part of the paper, we present theoretical proofs of some significant initial-round empirical biases observed by Sepehrdad, Vaudenay and Vuagnoux in SAC 2010.In the third part, we present the derivation of the complete probability distribution of the first byte of RC4 keystream, a problem left open for a decade since the observation by Mironov in CRYPTO 2002. Further, the existence of positive biases towards zero for all the initial bytes 3 to 255 is proved and exploited towards a generalized broadcast attack on RC4. We also investigate for long-term non-randomness in the keystream, and prove a new long-term bias of RC4.

show abstract

“…The technique discussed by authors in [20] is known to be the more efficient and faster approach form key recovery from state. Another key recovery approach was discussed in [21] which is again an improvement over the technique given by [19]. Authors have used the same differential equation as in [19], but key was recovered using bit by bit approach.…”

Section: Key Recovery From Statementioning

confidence: 99%

“…It is revealed that the proposed proposed RC4 has two internal states and has removed some of the byte biases which are the foundation of many security attacks on RC4 and is also faster than the existing conventional RC4. -short related keys attack [14] -TWP WEP attack [28] -VV WEP attack [29] Hill climb search attack [39] 2008 -Difference equations [19] -bit by bit approach attack [21] --generative pattern [40] -iterative probabilistic attack [41] Maitra and Paul conditional Bias [56] In [64] authors have proposed a new variant of RC4 called Quad-RC4 without changing the basic structure of conventional RC4. The proposed RC4 structure promises the reasonable security and a high throughput.…”

Section: Enhancements In Rc4 Stream Ciphermentioning

confidence: 99%

A Survey on RC4 Stream Cipher

Jindal

Singh²

2015

IJCNIS

View full text Add to dashboard Cite

Abstract-RC4 is one of the most widely used stream cipher due to its simplicity, speed and efficiency. In this paper we have presented a chronological survey of RC4 stream cipher demonstrating its weaknesses followed by the various RC4 enhancements from the literature. From the recently observed cryptanalytic attempts on RC4 it is established that innovative research efforts are required to develop secure RC4 algorithm, which can remove the weaknesses of RC4, such as biased bytes, key collisions, and key recovery attacks specifically on WEP and WPA. These flaws in RC4 are offering open challenge for developers. Hence our chronological survey corroborates the fact that even though researchers are working on RC4 stream cipher since last two decades, it still offers a plethora of research issues related to statistical weaknesses in either state or keystream.

show abstract

On Reconstruction of RC4 Keys from Internal States

Abstract: Abstract. In this work key recovery algorithms from the known internal states of RC4 are investigated. In particular, we propose a bit-by-bit approach to recover the key by starting from LSB's of the key bytes and ending with their MSB's.

Cited by 6 publications

References 7 publications

On biases of permutation and keystream bytes of RC4 towards the secret key

On biases of permutation and keystream bytes of RC4 towards the secret key

(Non-)Random Sequences from (Non-)Random Permutations—Analysis of RC4 Stream Cipher

A Survey on RC4 Stream Cipher

Contact Info

Product

Resources

About