RC4 State Information at Any Stage Reveals the Secret Key

A theoretical analysis of the RC4 Key Scheduling Algorithm (KSA) is presented in this paper, where the nonlinear operation is swapping among the permutation bytes. Explicit formulae are provided for the probabilities with which the permutation bytes at any stage of the KSA are biased to the secret key. Theoretical proofs of these formulae have been left open since Roos’ work (1995). Next, a generalization of the RC4 KSA is analyzed corresponding to a class of update functions of the indices involved in the swaps. This reveals an inherent weakness of shuffle-exchange kind of key scheduling. We additionally show that each byte of SN actually reveals secret key information. Looking at all the elements of the final permutation SN and its inverse S−1 N , the value of the hidden index j in each round of the KSA can be estimated from a “pair of values” in 0, . . . , N−1 with a constant probability of success π = N−2 N ·( N−1 N ) N−1+ 2 N (we get π ≈ 0.37, for N = 256), which is significantly higher than the random association. Using the values of two consecutive j’s, we estimate the y-th key byte from at most a “quadruple of values” in 0, . . . , N −1 with a probability > 0.12. As a secret key of l bytes is repeated at least bNl c times in RC4, these many quadruples can be accumulated to get each byte of the secret key with very high probability (e.g., 0.8 to close to 1) from a small set of values. Based on our ∗This is a revised and substantially extended version of the paper [20] “Permutation after RC4 Key Scheduling Reveals the Secret Key”, presented in the 14th Annual Workshop on Selected Areas in Cryptography, SAC 2007, August 16-17, Ottawa, Canada, LNCS (Springer) vol. 4876, pages 360-377. Sections 2.1, 2.2, 3.3 are similar to [20] with revision in Section 3.3.1. Rest of the technical contents in this version are new.

[1]  A. M. Abdullah,et al.  Wireless lan medium access control (mac) and physical layer (phy) specifications , 1997 .

[2]  Bart Preneel,et al.  Analysis of Non-fortuitous Predictive States of the RC4 Keystream Generator , 2003, INDOCRYPT.

[3]  Goutam Paul,et al.  New Form of Permutation Bias and Secret Key Leakage in Keystream Bytes of RC4 , 2008, FSE.

[4]  Adi Shamir,et al.  A Practical Attack on Broadcast RC4 , 2001, FSE.

[5]  Goutam Paul,et al.  On Non-randomness of the Permutation After RC4 Key Scheduling , 2007, AAECC.

[6]  Mete Akgün,et al.  New Results on the Key Scheduling Algorithm of RC4 , 2008, INDOCRYPT.

[7]  Itsik Mantin,et al.  A Practical Attack on the Fixed RC4 in the WEP Mode , 2005, ASIACRYPT.

[8]  Adi Shamir,et al.  Weaknesses in the Key Scheduling Algorithm of RC4 , 2001, Selected Areas in Cryptography.

[9]  Vincent Rijmen,et al.  Analysis Methods for (Alleged) RC4 , 1998, ASIACRYPT.

[10]  Andreas Klein,et al.  Attacks on the RC4 stream cipher , 2008, Des. Codes Cryptogr..

[11]  Goutam Paul,et al.  On non-negligible bias of the first output byte of RC4 towards the first three bytes of the secret key , 2008, Des. Codes Cryptogr..

[12]  Scott R. Fluhrer,et al.  Statistical Analysis of the Alleged RC4 Keystream Generator , 2000, FSE.

[13]  Shahram Khazaei,et al.  On Reconstruction of RC4 Keys from Internal States , 2008, MMICS.

[14]  Joseph H. Silverman,et al.  A Friendly Introduction to Number Theory , 1996 .

[15]  Erik Tews,et al.  Breaking 104 Bit WEP in Less Than 60 Seconds , 2007, WISA.

[16]  Serge Vaudenay,et al.  Passive-Only Key Recovery Attacks on RC4 , 2007, Selected Areas in Cryptography.

[17]  Bart Preneel,et al.  A New Weakness in the RC4 Keystream Generator and an Approach to Improve the Security of the Cipher , 2004, FSE.

[18]  Eli Biham,et al.  Efficient Reconstruction of RC4 Keys from Internal States , 2008, FSE.

[19]  Matthew McKague,et al.  Design and Analysis of RC4-like Stream Ciphers , 2005 .

[20]  Goutam Paul,et al.  Permutation After RC4 Key Scheduling Reveals the Secret Key , 2007, Selected Areas in Cryptography.

[21]  Itsik Mantin,et al.  Predicting and Distinguishing Attacks on RC4 Keystream Generator , 2005, EUROCRYPT.

[22]  Jovan Dj. Golic,et al.  Linear Statistical Weakness of Alleged RC4 Keystream Generator , 1997, EUROCRYPT.

[23]  Ilya Mironov,et al.  (Not So) Random Shuffles of RC4 , 2002, IACR Cryptol. ePrint Arch..

[24]  Octavio Nieto-Taladriz,et al.  Finding an internal state of RC4 stream cipher , 2007, Inf. Sci..