Though biases based on the secret key is common in RC4 literature, none of the existing ones depends on the length of the secret key. In the first part of this paper, we investigate the effect of RC4 keylength on its keystream, and report significant biases involving the length of the secret key. In the process, we prove the two known empirical biases that were experimentally reported and used in recent attacks against WEP and WPA by Sepehrdad, Vaudenay and Vuagnoux in EUROCRYPT 2011. After our current work, there remains no bias in the literature of WEP and WPA attacks without a proof.
In the second part of the paper, we present theoretical proofs of some significant initial-round empirical biases observed by Sepehrdad, Vaudenay and Vuagnoux in SAC 2010.
In the third part, we present the derivation of the complete probability distribution of the first byte of RC4 keystream, a problem left open for a decade since the observation by Mironov in CRYPTO 2002. Further, the existence of positive biases towards zero for all the initial bytes 3 to 255 is proved and exploited towards a generalized broadcast attack on RC4. We also investigate for long-term non-randomness in the keystream, and prove a new long-term bias of RC4.Category / Keywords: Bias, Distinguisher, Keylength Recovery, Probability Distribution, Pseudo-Random Sequences, RC4, Stream Ciphers. Publication Info: Accepted in Journal of Cryptology Date: received 16 Aug 2011, last revised 7 Nov 2012 Contact author: subho at isical ac in Available formats: PDF | BibTeX Citation Note: This is the final revised version that has been accepted in Journal of Cryptology on Nov 3, 2012. Version: 20121107:171935 (All versions of this report) Discussion forum: Show discussion | Start new discussion