(Non-)Random Sequences from (Non-)Random Permutations - Analysis of RC4 stream cipher

Sourav Sen Gupta; Subhamoy Maitra; Goutam Paul; Santanu Sarkar

Paper 2011/448

(Non-)Random Sequences from (Non-)Random Permutations - Analysis of RC4 stream cipher

Sourav Sen Gupta, Subhamoy Maitra, Goutam Paul, and Santanu Sarkar

Abstract

RC4 has been the most popular stream cipher in the history of symmetric key cryptography. Its internal state contains a permutation over all possible bytes from 0 to 255, and it attempts to generate a pseudo-random sequence of bytes (called keystream) by extracting elements of this permutation. Over the last twenty years, numerous cryptanalytic results on RC4 stream cipher have been published, many of which are based on non-random (biased) events involving the secret key, the state variables, and the keystream of the cipher. Though biases based on the secret key is common in RC4 literature, none of the existing ones depends on the length of the secret key. In the first part of this paper, we investigate the effect of RC4 keylength on its keystream, and report significant biases involving the length of the secret key. In the process, we prove the two known empirical biases that were experimentally reported and used in recent attacks against WEP and WPA by Sepehrdad, Vaudenay and Vuagnoux in EUROCRYPT 2011. After our current work, there remains no bias in the literature of WEP and WPA attacks without a proof. In the second part of the paper, we present theoretical proofs of some significant initial-round empirical biases observed by Sepehrdad, Vaudenay and Vuagnoux in SAC 2010. In the third part, we present the derivation of the complete probability distribution of the first byte of RC4 keystream, a problem left open for a decade since the observation by Mironov in CRYPTO 2002. Further, the existence of positive biases towards zero for all the initial bytes 3 to 255 is proved and exploited towards a generalized broadcast attack on RC4. We also investigate for long-term non-randomness in the keystream, and prove a new long-term bias of RC4.

Note: This is the final revised version that has been accepted in Journal of Cryptology on Nov 3, 2012.

Metadata

Available format(s): PDF
Publication info: Published elsewhere. Accepted in Journal of Cryptology
Keywords: Bias Distinguisher Keylength Recovery Probability Distribution Pseudo-Random Sequences RC4 Stream Ciphers.
Contact author(s): subho @ isical ac in
History: 2012-11-07: last of 8 revisions; 2011-08-17: received; See all versions
Short URL: https://ia.cr/2011/448
License: CC BY

BibTeX

@misc{cryptoeprint:2011/448,
      author = {Sourav Sen Gupta and Subhamoy Maitra and Goutam Paul and Santanu Sarkar},
      title = {(Non-)Random Sequences from (Non-)Random Permutations - Analysis of {RC4} stream cipher},
      howpublished = {Cryptology {ePrint} Archive, Paper 2011/448},
      year = {2011},
      url = {https://eprint.iacr.org/2011/448}
}