A Practical Attack on Broadcast RC4

Mantin, Itsik; Shamir, Adi

doi:10.1007/3-540-45473-x_13

Cited by 188 publications

(203 citation statements)

References 4 publications

Supporting

Mentioning

194

Contrasting

Unclassified

Order By: Relevance

“…Mantin and Shamir [13] also show that the second word of the output is slightly more probable to be 0 than any other value. Using this bias they are able to build a prefix distinguisher for RC4, based on only about N short streams.…”

Section: Previous Attacksmentioning

confidence: 94%

Efficient Reconstruction of RC4 Keys from Internal States

Biham

Carmeli

Fast Software Encryption

View full text Add to dashboard Cite

Abstract. In this paper we present an efficient algorithm for the retrieval of the RC4 secret key, given an internal state. This algorithm is several orders of magnitude faster than previously published algorithms. In the case of a 40-bit key, it takes only about 0.02 seconds to retrieve the key, with success probability of 86.4%. Even if the algorithm cannot retrieve the entire key, it can retrieve partial information about the key.

show abstract

Section: Previous Attacksmentioning

confidence: 94%

Efficient Reconstruction of RC4 Keys from Internal States

Biham

Carmeli

Fast Software Encryption

View full text Add to dashboard Cite

show abstract

“…The multi-key setting can be seen as a generalization of the multi-user setting of Chatterjee et al [19], where encryption queries of only one plaintext P are allowed under keys K i . 4 This multi-user setting is then again a further generalization of the broadcast setting of Mantin and Shamir [45], where the plaintext P is unknown to the attacker.…”

Section: Three Attack Settingsmentioning

confidence: 99%

Multi-key Security: The Even-Mansour Construction Revisited

Mouha

Luykx

2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. At ASIACRYPT 1991, Even and Mansour introduced a block cipher construction based on a single permutation. Their construction has since been lauded for its simplicity, yet also criticized for not providing the same security as other block ciphers against generic attacks. In this paper, we prove that if a small number of plaintexts are encrypted under multiple independent keys, the Even-Mansour construction surprisingly offers similar security as an ideal block cipher with the same block and key size. Note that this multi-key setting is of high practical relevance, as real-world implementations often allow frequent rekeying. We hope that the results in this paper will further encourage the use of the Even-Mansour construction, especially when a secure and efficient implementation of a key schedule would result in significant overhead.Keywords: Even-Mansour, multi-key setting, broadcast attack, relatedkey setting. IntroductionModern block cipher design is based on the concept of iterating a round function [44]. This round function typically consists of a subkey addition followed by an unkeyed invertible function. All commonly-used block ciphers, including the DES [46] and AES [23] standards, follow this design strategy.As such, the design of an iterated block cipher consists of two parts: the design of a round function, and a key schedule to generate the subkeys for every round. Although round function design seems to be a relatively well-understood problem, this is much less the case for the key schedule. For example, Rijmen and Daemen already stated in the AES design book that: "There is no consensus on the criteria that a key schedule must satisfy [23, p. 77]. This fact has been repeated many times since, for example in the SHA-3 finalist Grøstl design document [32, p. 5]. In particular, there seems to be no consensus on whether ⋆ © IACR 2015. This article is the final version submitted by the authors to the IACR and to Springer-Verlag in June 2015. It will appear in the proceedings of CRYPTO 2015.a "strong" or a "simple" key schedule is required, a choice which appears to depend on the application. An argument for a "simple" key schedule is that keys should be chosen uniformly at random from the entire key space anyway, in order to avoid a speed-up of brute-force attacks due to low key entropy. As a result, attacks based on weak keys [25] and known keys [42] are no longer applicable. Similarly, when multiple keys are used, they should be chosen independently to prevent a compromise of one key helping the recovery of other keys. This avoids attacks based on related keys [9][10][11].Proponents of a "strong" key schedule point out that in practice, keys may not always be chosen independently from a uniformly random distribution. The cause of this could be a weak protocol, a programming error or an insecure implementation.Complexity, however, always comes at a cost. It makes cryptosystems more difficult to design, to implement and to analyze. Hence, we argue for a block cipher with a simple key schedule, ...

show abstract

“…The main directions of cryptanalysis in this area are 1. finding correlations between the keystream output bytes and the secret key [31,39,24,15] and key recovery in the IV mode [6,17,11,34,38] (these exploit the weaknesses of both the KSA and the PRGA), 2. recovering the RC4 permutation from the keystream output bytes [12,35,21] and 3. identifying distinguishers [16,29,18].…”

Section: Prga + : Modifications To Rcprgamentioning

confidence: 99%

“…In [16], it was proved that P (z 2 = 0) = 2 N instead of the uniformly random case of 1 N . This originates from the fact that when S N [2] = 0 and S N [1] = 2 after the KSA, the second keystream output byte z 2 takes the value 0.…”

Section: Resisting Distinguishing Attacksmentioning

confidence: 99%

Analysis of RC4 and Proposal of Additional Layers for Better Security Margin

Maitra

Paul

2008

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. In this paper, the RC4 Key Scheduling Algorithm (KSA) is theoretically studied to reveal non-uniformity in the expected number of times each value of the permutation is touched by the indices i, j. Based on our analysis and the results available in literature regarding the existing weaknesses of RC4, few additional layers over the RC4 KSA and RC4 Pseudo-Random Generation Algorithm (PRGA) are proposed. Analysis of the modified cipher (we call it RC4 + ) shows that this new strategy avoids existing weaknesses of RC4.

show abstract

A Practical Attack on Broadcast RC4

Cited by 188 publications

References 4 publications

Efficient Reconstruction of RC4 Keys from Internal States

Efficient Reconstruction of RC4 Keys from Internal States

Multi-key Security: The Even-Mansour Construction Revisited

Analysis of RC4 and Proposal of Additional Layers for Better Security Margin

Contact Info

Product

Resources

About