Exploring weaknesses of RC4 in different usage modes

 A dissertation Submitted in Partial Fulfillment 
         for the Award of the Degree of

       Master of Engineering
      	         in
Computer Technology and Applications

      			     By
          		      S. P. Mishra
                        University Roll No. 8516
              Under the guidance of
                        Ms. Rajni Jindal, Lecturer
                    Delhi College of Engineering, Delhi

DEPARTMENT OF COMPUTER ENGINEERING
       			DELHI COLLEGE OF ENGINEERING 
           	DELHI -110042

          		  (2004-06)

CERTIFICATE

This is to certify that the dissertation entitled “Exploring weaknesses of RC4 in different usage modes” submitted by S. P.Mishra, class Roll No. 20/CTA/04, University Roll No. 8516 in the partial fulfillment of the requirement for award of the Degree of Master of Engineering in Computer Technology and Applications, Delhi College of Engineering, Delhi is an account of his work carried out under my guidance and supervision.

Project Guide                                                                                                 Head of Department

				

		
]

					Abstract

    Cryptography is an important building block used i n communication systems to provide confidentiality and authenticity. Stream ciphers, which encrypt data one bit or byte at a time have been used in applications sherec low delay and hiogh speed are essential requirements.RC4, a stream cipher designed by Rivest for Data Security Inc. has been used in several commercial applications.

In this thesis RC4 is described and its various weaknesses have been exploited. It is shown that second binary derivative of the least significant bit of sequence is correlated to 1 with correlation coefficient close to 152 -3n. The result can be used to distinguish RC4 from other key-stream generators. Digraph probabilities gives another method of distinguishing RC4 from random sequence requiring lesser amount of output key-stream bits.

40-bit RC4 was recommended for WEP, the link-layer security protocol for 802.11 networks. An attack was proposed by Fluhrer, Shamir and Mantin based upon non-random behaviour of first output byte. Attack has been implemented, showing successfully recovery of keys using cipher-text only attack.

Properties of RC4 in particular it's cycle structure has been analysed. Several variasnts of basic tracking attacks are analysed, providing experimental results on scaled-down version of RC4. Experimental results offers insight into RC4 algorithm and its security.  A probabilistic model of attack is also proposed which reduces the computation time by distributing computation over network of workstations.

The software is written in C over Linux platform, which can easily be portred to other environments.

   Contents

Chapter No                                                                                                         Page No.

CHAPTER 1: Introduction                                                                                       1

                        1.1   RC4: A Popular Stream Cipher                                                    1          
           		1.2   Contribution of this Dissertion                                                     1
           1.3   Organisation of Dissertion                                                             2

CHAPTER 2: Introduction to Cryptography                                                          3

          		2.1 Cryptography from stream cipher point of view                             4
          		2.2  Structure of strream cipher                                                             5
           		2.3 Secret Key vs. Public Key Cipher                                                   6
           		2.4 Stream Cipher vs. Block Cipher                                                    11
            		2.4.1 Desirable Characteristics of stream and Block Ciphers  13
           		2.5 Analysis of Stream Cipher                                                              13

CHAPTER 3 : Stream Cipher                                                                                    15

           		3.1 Introduction                                                                                      15
              	     3.1.1 Classification of Stream Ciphers                                              15
           		3.2 Basic Building-Blocks of Stream Ciphers                                        16
           		3.3 Linear feedback shift registers                                                          16
           		3.4 Stream cipher based on LFSRs                                                         19
                        3.5 Linear Complexity                                                                            21
                        3.6 Golomb's randomness postulates                                                      24
                        3.7 Attacks on Stream Ciphers                                                                25
                    3.7.1 Correlation Attacks                                                                26
                                3.7.2 Other Attacks                                                                         26
            3.8  Practical Considerations                                                                  26

CHAPTER 4:   Linear Statistical weakness of RC4                                                  28
           		 4.1 The RC4 Stream Cipher                                                                  28
           		 4.2 Statistical properties iand it's significance                                      29
           		 4.3 Correlation properties of random Boolean functions                     30
           		 4.4 Linear Models                                                                                31

CHAPTER 5:     Digraph Probabilities                                                                    37
           		5.1 Anomalous RC4 outputs                                                                38
           		5.2 Extrapolating for Higher values on n                                        39
5.3 Reason behind Statistical Anomalies                                        39
5.4 Analysis of Fortituous States                                                     41

CHAPTER 6     Weaknesses in key scheduling                                                  43
          		6.1 Definitions                                                                                 43
	            6.2 The Weakness                                                                           44
           		6.3 Adjustments to KSA                                                                 45
           		6.4 Key -Output Correlation                                                           46 
           		6.5 Cryptanalytic Appliocations of the Invariance Weakness        46

CHAPTER 7      Analysis of WEP                                                                        48
                		 7.1 The WEP Attack                                                            48
             7.2 Basic Idea                                                                       49
                                     7.3 Detailed description                                                        49

CHAPTER 8      Systematic Cryptanalysis                                                            52
             8.1 Brute-Force Attack                                                          52
                                     8.2 Obtaining key from the RC4 State                                  52
                                     8.3 Forward tracking Attack                                                 53
                                     8.4 Backward Tracking Attack                                             58
                                     8.5 Probabilistic Model                                                         59
                                         8.5.1 Laddered backtracking Attack                                 60
                                         8.5.2 RC4 State Probability Matrix Calculation               61
                                         8.5.3 Most Probable Path Backtracking Attack                62

CHAPTER 9:   Conclusion and Future Work                                                       64

References										65	

Appendix-1            Results of Forward Tracking                                                  66

Appendix-2            Results of Backward Tracking                                                70

Appendix-3            Results of WEP attack                                                             72

					Chapter 1
                                         Introduction

Secret writing for transmission of message has been, according to David Kahn, the great historian of cryptography, practiced since forty centuries, the first example being an altered message on a tomb in Egypt in 1900 B.C. From that time onwards, secret messages have been used by people of different walks-of-life i.e. diplomats, military officers, bankers, scholars and citizens all over the world. The art and science of producing systems for secret writing (keeping the message secure) is cryptography. During the last twenty years, public and academic research in cryptography has explored various new dimensions. While classical cryptography could be used by ordinary citizens, computer cryptography has been the exclusive domain of the world’s militaries since World War II. Today state of the art computer cryptography is being practiced outside the secured walls of the military agencies also.

Modern cryptographic algorithms cannot really be executed by humans. Strong cryptographic algorithms are designed to be executed by computers or specialized hardware devices. In most applications, cryptography is done in computer software.

1. 1 RC4 : A Popular Stream Cipher
RC4 was designed by Ron Rivest in 1987 in an attempt to make a stream cipher, which is more suitable for software implementations.  The design was a trade secret of RSA Inc. but leaked 1994 when someone anonymously posted the source code to the Cypherpunks mailing list. The security of RC4 was of course not affected as it is solely based on the used key. Even though this alleged version was never officially confirmed to be equivalent to the original version by RSA Inc., there is strong evidence to assume this. Subsequently, the notation RC4 refers to the alleged version of the algorithm. RC4 is one of the most popular stream ciphers, it is heavily used in SSL/TLS or IEEE 802.11 and is integrated into many widely used open-source libraries or applications of Microsoft or Oracle. Hardware implementations have been considered as well.

1.2 Contribution of this Dissertation
RC4 came under intensive scrutiny after it was made public in 1994. Finney [8] showed  a class of internal states that RC4 never enters. The class contains all the states for which j=i+1 and S[j]=1. A fraction of N -2 of all possible states fall under Finney’s forbidden states. Jenkins [13] detected a probabilistic correlation between the Secret information (S , j) and the public information (i, output). Grosul and Wallah[9] demonstrated a related key attack that works better on very long keys. Andrew Roos[11] also discovered  a class of weak keys. Knudsen et al.[15] have attacked versions of RC4 with n<8 using guesses of internal states and checks if contradiction occurs at later stage. Pudovkina[14] has attempted to detect a bias, only analytically in the distribution of first, second  output values of RC4 and digraph under certain uniformity assumptions. Mironov modeled RC4 as a Markov chain and recommended to dump the initial 12*N bytes of the output stream (at least 3.N) in order to obtain  uniform distribution of the initial permutation of elements[10]. Given RC4’s popularity and simplicity of design it is very valuable to study attacks available in the literature and see whether they can be improved further. Aim of the work done in present thesis is to know whether non-random behavior of the key-sequence generated by RC4 can be exploited for cryptanalysis or not. Another aim of the present dissertation is  to improve the performance of  Brute-Force Attack by exploiting  it’s way of changing the permutation during the process  of generating the key-sequence.

1.3 Organization of the thesis
     Chapter  2 deals with Introduction to Cryptography.
     Chapter 3  deals with Stream Ciphers.
     Chapter  4 deals RC4 and it’s linear statistical weakness.
     Chapter 5  deals with weaknesses of  RC4 in terms of diagraph distributions
     Chapter 6  deals with  weaknesses in key scheduling of RC4
     Chapter 7 deals with cryptanalysis of WEP Protocol.
     Chapter 8  deals with systematic cryptanalysis of RC4.
     Chapter 9 consists of conclusion and Future work.
      Finally Appendix-1, Appendix-2, Appendix-3 consists of various experimental results obtained.

       					Chapter 2
			       Introduction to Cryptography 

Cryptography is the mathematics of making a system secure. The algorithm must be so strong that there is no better way to break it than with a Brute-Force attack. This is not as easy as it might seem. Strong cryptosystems with a couple of minor changes can become weak. Good cryptosystems has nice property of making life harder for the attacker than the legitimate user. The designer of cryptosystem has to think of every possible means of attack and protect against all of them.

	The need for information security in today's digital systems is growing. For this reason cryptography has become a critical component for most of these digital equipments. Cryptographic services are now required across a variety of electronic platforms such as secure access to private networks, data banks, electronic commerce, cellular and PCS phones, all kinds of data communications and smart card technology. 

Cryptographic goals A well-defined and implemented cryptographic system should provide the following services:

1) Confidentiality: Keeps the data involved in an electronic transaction private. Meaning that the transmitted information is accessible only for reading by authorized parties. Encryption provides confidentiality.

2) Authentication: Ensures that the origin of a message or electronic document is correctly identified. In mutual authentication both the server and user or both parties in general case authenticate each other. It is typically provided by verifying other parties digitally signed certificates.

3) Data Integrity: It basically means that the information exchanged in an electronic data transfer is not alterable without detection. Modification types include writing, changing, deleting, etc.

4) Nonrepudiation: This simply tells that the actions performed by the service user in an electronic transaction are not revocable so that they are legally binding. Therefore, neither the sender nor the receiver of a message should be able to deny the transaction.
	A fundamental goal of cryptography is to adequately address these four areas in both theory and practice. Cryptography is about the prevention and detection of cheating and other malicious activities.
	A good cryptosystem is one in which all the security is inherent in the knowledge of the key and none is inherent in knowledge of algorithm. If a cryptographically weak process has been used to generate keys then the whole system is weak. This is why Key management is so important in cryptography. The art and science of breaking cipher-text is cryptanalysis. The range of science encompassing both cryptography and cryptanalysis is cryptology.

2.1 A Short History of Cryptology from a Stream Ciphers Point of View
Modern cryptology deals with confidentiality, integrity, authenticity, random-number generation, zero-knowledge proofs and various other topics in a mathematical way. However, most of these issues arose in the last decades. The propelling force in the centuries before was the human desire to transfer information secretly. Ancient approaches to transport information in a confidential way considered single letters and changed them according to various rules. Examples thereof are the Caesar cipher or simple substitution ciphers. The first approach which has much in common with today's stream ciphers is the cipher of Vignere . It can be formalized as:
               
     Ci = Pi +Ki mod 26                                                                                                 (1.1)
	Equation 1.1 can be interpreted as follows: each letter in the alphabet is understood as a number ranging from 0 to 25. The keyletter K is added to the plaintext letter P in order to get the ciphertext letter C. The mod 26 operation makes sure that the resulting ciphertext is always inside the proper range. Keep in mind: in this scheme, the key is reused if the plaintext is longer than the key. The first cryptanalysis of this scheme was published by Kasiski, which is based upon this fact. He came up with the following observation when encrypting two plaintexts Pa and Pb with the same secret key:

Ca  Cb = Pa  Pb								 (1.2)
	A ciphertext only attack reveals very much of the used plaintext, if the key K is reused. Even if the used plaintexts are not directly revealed, Pa  Pb contains much information about the plaintexts Pa and Pb.
	Later, in the early 20th century, Vernam introduced a scheme, which made the key as long as the plaintext. This was a big difference to the polyalphabetic substitution ciphers used at this time. Later on, this system has been used with a random key - hence the one-time pad was born. In 1949 Shannon proved in his landmark paper that this approach is indeed unconditionally secure; that is, even an attacker with unbounded computing resources cannot break such a system, and no future advance in mathematics can provide a shortcut attack because of its entropy conditions.
All of these approaches have two things in common: first, their security is based on a shared secret - they are all symmetrical ciphers. But even more important is that their working principle is based on simple symbols, which is an important characteristic of stream ciphers.

2.2 The Structure of Stream Ciphers
Since it is very inconvenient and in many circumstances impractical to share and use keys which are of the same size as the transmitted information (this effort is only made in exceptional circumstances) the goal was to reduce the key-size but maintain a reasonable level of security. The general approach to achieve this is to replace the key in the Vernam scheme by a pseudo-random sequence of bits or symbols which is the output of a generator that is initialized with a (shorter) key. Of course, this scheme can no longer be unconditionally secure anymore because the entropy of the key is now smaller than the entropy of the message. In the context of generating random bits, several identifiers are used to refer to random number generators (RNG).
Informally, they can be structured as follows.

	When talking about true random number generators (TRNG), some sort of physical activity is used as a source for randomness. Examples thereof are thermal noise, flipping a coin or radioactive decay. On the other hand, pseudo random number generators (PRNG) are based on algorithms and are thus deterministic. Usually, they are seeded by a TRNG. The randomness of a PRNG is verified by means of statistical tests. If used for cryptographic purposes, PRNG need to have additional properties: it should be difficult to predict the future output from previous outputs and it should be difficult to determine the internal state of the generator by examining the output. If those properties are fulfilled, the PRNG is cryptographically secure (CSPRNG).

                    Ki	   Z i                   Pi	             Ci 
Key Stream generator

                                        Fig. 2.1
	Figure 2.1 shows the general structure of a stream cipher. The short key denoted as K is used to seed the key-stream generator. The key-stream symbols Zi are combined with the plaintext symbols Pi to produce a sequence of ciphertext symbols Ci. The generated key-stream is combined with the plaintext on a bit-per-bit basis. This combining step is most of the time an XOR function.

2.3 Secret Key vs. Public Key Cryptography
A major problem arises when a big number of devices/people want to exchange messages using a cipher and a secret key. Since nobody else than the two involved parties should be able to decrypt the exchanged message, pair wise secret keys need to be distributed among the participants. There are two straightforward solutions to this problem. One is the generation and pre-distribution of   n*(n-1)/2 keys for n parties. Another approach is to introduce a trusted party, which generates needed keys on demand. In this case, the number of pre-distributed keys is in the order of n, but the trusted party is also a single point of failure.

Message         Secret Key						    Decrypted Msg.

Decryption

Encryption

				       Secure Channel						
                                   
				      Unsecure Channel

Adversary

            Alice			                		      Eve			Bob

Fig 2.2:Two parties engaged in symmetric cipher conversation with an adversary listening in on  unsecured channel
					        
	In the late 70s public key cryptography was introduced among others by Diffe and Hellman and by Rivest, Shamir and Adleman in the open literature. Their methods are based on hard number-theoretic problems and can be used to solve the key distribution problem. Instead of sharing a secret key, each party has a pair of keys, which consist of a private key only known to the owner and a public key. Despite this big structural advantage, public key cryptography did not replace secret key cryptography. Performance is one of the reasons, since public key cryptography is much slower than secret key cryptography. In practice, a two-stage approach is used. In a first step public key cryptography is used to derive a secret key. Subsequently, this key is used to encrypt the actual message. 

	Asymmetric ciphers (also called public-key algorithms or generally public-key cryptography) permit the encryption key to be public (it can even be published in a newspaper), allowing anyone to encrypt with the key, whereas only the proper recipient (who knows the decryption key) can decrypt the message. The encryption key is also called  public key and the decryption key is called private key or secret key.

Adversary

  
 Message                                                                                       Eve

Encryption

Decryption

     							              Decrypted    Message	
    
					       Unsecured Channel                       
                       Bob								  Alice
									Private Key
                                          	          Unsecured Channel	Public Key

Fig 2.3:Two parties engaged in public key cipher conversation. The adversary can see the both cipher text and the public key

	Encryption using public key k is denoted by

                                                    Ek (P) = C
	Even though the public key and private key are different, decryption with the corresponding private key is denoted by

                                                    Dk  (C) =  P
	Sometimes message will be encrypted with the private key and decrypted with the public key , this is used in digital signatures. These operations are also denoted  by,

                                          Ek (P) =   C
                                                    Dk  (C) =  P

1	RSA (Rivest-Shamir-Adelman) is the most commonly used public key algorithm. It has been used both for encryption and for digital signature. It is generally considered to be secure when sufficiently long keys are used (512 bits is insecure, 768 bits is moderately secure, and 1024 bits is good and 2048 bit keys are likely to remain secure for decades. ). The security of RSA relies on the difficulty of factoring large integers. Dramatic advances in factoring large integers would make RSA vulnerable. RSA is currently the most important public key algorithm.
	Let  P and Q be the two large primes , each roughly of same size ( approx .10100). Compute N = P*Q  and f(N) = (P-1)(Q-1) . Select an integer E, 1 < E <  f(N) , such that   (E, f(N)) = 1 . The integer E is called the encryption key, used as public key, and the integer N is called the modulus of the system. Let M, 1<M<N , be a numerical plane message , then the cryptogram C is obtained in the following way:-
                                      C º ME mod N
	Let D be a  +ve integer such that E.D º 1 mod f(N)  then the plane message M is obtained back from the cryptogram C in the following way :
                                            M º CD mod N
	The integer D is called the decryption key of the system and used as the private key. These encryption and decryption keys E and D can be generated easily using the inverse generating algorithm (IGA) .
2	Diffie-Hellman, DSS (Digital Signature Standard), LUC are others public key algorithms.
	Modern cryptographic algorithms cannot really be executed by humans. Strong cryptographic algorithms are designed to be executed by computers or specialized hardware devices. In most applications, cryptography is done in computer software, and numerous cryptographic software packages are available.
	Generally, symmetric algorithms are much faster to execute on a computer than asymmetric ones. In practice they are often used together, so that a public-key algorithm is used to encrypt a randomly generated encryption key, and the random key is used to encrypt the actual message using a symmetric algorithm.
Advantages and disadvantages Symmetric-key vs. public-key cryptography
Symmetric-key and public-key encryption schemes have various advantages and disadvantages, some of which are common to both. This section highlights a number of these and summarizes features pointed out in previous sections.

	(i) Advantages of symmetric-key cryptography
	1. Symmetric-key ciphers can be designed to have high rates of data throughput. Some hardware implementations achieve encryption rates of hundreds of megabytes per second, while software implementations may attain throughput rates in the megabytes per second range.
2. Keys for symmetric-key ciphers are relatively short.
3 Symmetric-key ciphers can be employed as primitives to construct various cryptographic mechanisms including pseudorandom number generators hash functions and computationally efficient digital signature schemes, to name just a few.
4. Symmetric-key ciphers can be composed to produce stronger ciphers. Simple transformations which are easy to analyze, but on their own weak, can be used to construct strong product ciphers.
5. Symmetric-key encryption is perceived to have an extensive history, although it must be acknowledged that, notwithstanding the invention of rotor machines earlier, much of the knowledge in this area has been acquired subsequent to the invention of the digital computer, and, in particular, the design of the Data Encryption Standard in the early 1970s.

	(ii) Disadvantages of symmetric-key cryptography
	1. In a two-party communication, the key must remain secret at both ends.
2. In a large network, there are many key pairs to be managed. Consequently, effective key management requires the use of an unconditionally trusted TTP .
3. In a two-party communication between entities A and B, sound cryptographic practice dictates that the key be changed frequently, and perhaps for each communication session.
4. Digital signature mechanisms arising from symmetric-key encryption typically require either large keys for the public verification function or the use of a TTP.

	(iii) Advantages of public-key cryptography
	1. Only the private key must be kept secret (authenticity of public keys must, however, be guaranteed).
2. The administration of keys on a network requires the presence of only a functionally trusted TTP  as opposed to an unconditionally trusted TTP. Depending on the mode of usage, the TTP might only be required in an “off-line” manner, as opposed to in real time.
3. Depending on the mode of usage, a private key/public key pair may remain unchanged for considerable periods of time, e.g., many sessions (even several years).
4. Many public-key schemes yield relatively efficient digital signature mechanisms. The key used to describe the public verification function is typically much smaller than for the symmetric-key counterpart.
5. In a large network, the number of keys necessary may be considerably smaller than in the symmetric-key scenario.

	(iv) Disadvantages of public-key encryption
1. Throughput rates for the most popular public-key encryption methods are several orders of magnitude slower than the best known symmetric-key schemes.
2. Key sizes are typically much larger than those required for symmetric-key encryption, and the size of public-key signatures is larger than that of tags providing data origin authentication from symmetric-key techniques.
3. No public-key scheme has been proven to be secure (the same can be said for block ciphers). The most effective public-key encryption schemes found to date have their security based on the presumed difficulty of a small set of number-theoretic problems.
4. Public-key cryptography does not have as extensive a history as symmetric-key encryption, being discovered only in the mid 1970s.
	Summary of comparison : Symmetric-key and public-key encryption have a number of complementary advantages. Current cryptographic systems exploit the strengths of each. An example will serve to illustrate.
Public-key encryption techniques may be used to establish a key for a symmetric-key system being used by communicating entities A and B. In this scenario A and B can take advantage of the long term nature of the public/private keys of the public-key scheme and the performance efficiencies of the symmetric-key scheme. Since data encryption is frequently the most time consuming part of the encryption process, the public-key scheme for key establishment is a small fraction of the total encryption process between A and B. To date, the computational performance of public-key encryption is inferior to that of symmetric-key encryption. There is, however, no proof that this must be the case. The important points in practice are:
1. Public-key cryptography facilitates efficient signatures (particularly non-repudiation) and key management and 
2. Symmetric-key cryptography is efficient for encryption and some data integrity applications.
Remark (key sizes: symmetric key vs. private key) Private keys in public-key systems must be larger (e.g., 1024 bits for RSA) than secret keys in symmetric-key systems (e.g.,64or 128 bits) because whereas (for secure algorithms) the most efficient attack on symmetric key systems is an exhaustive key search, all known public-key systems are subject to “shortcut” attacks (e.g., factoring) more efficient than exhaustive search. Consequently, for equivalent security, symmetric keys have bit lengths considerably smaller than that of private keys in public-key systems, e.g., by a factor of 10 or more.

2.4 Stream Ciphers vs. Block Ciphers
Stream ciphers apply a simple, always changing transformation to one symbol at a time whereas block ciphers apply a more complex, but static transformation to a group of symbols at once. Stream ciphers can be faster than block ciphers, especially if they are based on LFSRs and implemented in hardware. However, the distinction between both types of ciphers is not clear. If a block cipher is used in cipher block chaining (CBC) mode, one can consider this as a stream cipher which operates on large symbols (i. e. symbols of the size of one block). This could lead to the conclusion that stream- and block ciphers work at different levels of abstraction. Whereas stream ciphers work in a particular mode of operation, block ciphers are just building blocks to construct a mode of operation.

	Additionally, there are some modes of operation for block ciphers whose intention is to provide stream cipher like properties. These are the cipher feedback (CFB) mode, the output feedback (OFB) mode, the key feedback (KFB) mode and the counter(CTR) mode. There, the block cipher is used to generate a key-stream which is then XORed with the plaintext. On the other hand, turning a stream cipher into a block cipher is also possible, but less efficient though. Simplified, what is required is to put the stream cipher into the round function of a Feistel based block cipher. There is much theoretical knowledge and there are many tools available to analyze various properties of the building blocks of stream ciphers. Until recently nothing comparable was available for block ciphers. Till the mid 90s all used block ciphers were based on a Feistel Structure  which arose in the early 70s. The Data Encryption Standard (DES), which held a predominant position in the area of block ciphers for more than two decades, uses this structure as well. The design criteria for the DES, especially for its S-boxes, are kept secret and DES proved to be highly resistant against cryptanalytic shortcut attacks. Later Substitution Permutation Networks (SPNs) have been used to design new block ciphers. Together with the “Wide trail design strategy" , these efforts led to the ability of giving block ciphers valuable properties such as provable resistance against linear or differential cryptanalysis.

	Stream ciphers on the other hand have never been standardized but tend to be proprietary and even classified. The AES  is the current standard for general purpose block ciphers, but there is no comparable standard for stream ciphers. This is reflected by the fact that the widely used RC4, perceived as the de facto standard for stream ciphers, is proprietary. Even though the number of new stream cipher proposals is growing and the state of affair for both seems to converge a little bit there is still much do be done: none of the stream ciphers submitted to the NESSIE project have been recommended because all suffered at least from slight weaknesses.

2.4.1 Desirable Characteristics of Stream and Block Ciphers
	Stream Ciphers:
	Large Period: For every key the sequence should have a very large period so that no part of enciphering sequence is used repeatedly within a reasonable time.
Complexity: Given a segment of sequence, it should not be possible to predict the preceding or following segment.
	Sound Statistical Properties: In bit stream the ones and zeroes should be evenly distributed in the sequence and also poses good autocorrelation properties.
	Variability: Variability should be high to ensure that a brute force attack become infeasible.
	Correlation Immunity: Functions used should be non linear and correlation immune.

Block Ciphers: 
1) Avalanche Effect: A 1-bit change of the key or plain text should produce a radical change in the cipher text. If f(p,k) = C , where p stand for plain text , k for the key transformation and C for cipher text. One bit change either in p or k produces radical change in the cipher text C.
2) The algorithm should contain a non-commutative combination of substitution and permutation.
3. The algorithm should include substitution and permutations under the control of both the input data and the key.
4. The length of cipher text should be same as length of the plaintext.
5. There should be no simple relationship between any possible keys and cipher text bits.
6. All possible keys should produce a strong cipher that does not have any statistical or language oriented weakness that can be exploited by the cryptanalyst.
7. The length of the key and the text should be adjusted to meet application requirements and security strength requirements.
8.  Block length should be large.
9. The algorithms should be easily and efficiently implementable on main frames, minicomputers and microcomputers(In fact the functions used in the algorithm are limited to Xor and Bit Shifting).

2.5 Analysis of Stream Ciphers
Various stream ciphers are used in today's applications. They range from software based applications like web browsers to wireless communication hardware like mobile phones and WLAN equipment. The used stream ciphers range from the de facto standard RC4 to designs specially targeted for a particular use. Even those specially designed for a particular purpose rely on a number of well known structures. When designing stream ciphers, there are however more structures available than in the case of block ciphers. 
	The security of cryptographic algorithms can be evaluated by means of crypt-analysis. Mathematical relations between plaintext, ciphertext and key are used to find weaknesses. 

					Chapter 3
                                     Stream Cipher
3.1 Introduction
Stream ciphers are an important class of encryption algorithms. They encrypt individual characters (usually binary digits) of a plaintext message one at a time, using an encryption transformation, which varies with time. By contrast, block ciphers tend to simultaneously encrypt groups of characters of a plaintext message using a fixed encryption transformation. Stream ciphers are generally faster than block ciphers in hardware, and have less complex hardware circuitry. They are also more appropriate, and in some cases mandatory (e.g., in some telecommunications applications), when buffering is limited or when characters must be individually processed as they are received. Because they have limited or no error propagation, stream ciphers may also be advantageous in situations where transmission errors are highly probable.

	There is a vast body of theoretical knowledge on stream ciphers, and various design principles for stream ciphers have been proposed and extensively analyzed. However, there are relatively few fully specified stream cipher algorithms in the open literature. This unfortunate state of affairs can partially be explained by the fact that most stream ciphers used in practice tend to be proprietary and confidential. By contrast, numerous concrete block cipher proposals have been published, some of which have been standardized or placed in the public domain. Nevertheless, because of their significant advantages, stream ciphers are widely used today, and one can expect increasingly more concrete proposals in the coming years.

3.1.1 Classification of Stream Ciphers
As described in the introductory chapter, encryption schemes can be symmetric(using the same secret key for both encryption and decryption) as well as asymmetric(encryption and decryption use different keys). Even for the special case of stream ciphers, there is this distinction: there are symmetric as well as asymmetric stream ciphers. No doubt, symmetric stream ciphers build the majority, but there is an example for the latter: the Blum-Goldwasser probabilistic encryption scheme which is based on the Blum-Blum-Shub (BBS) pseudorandom number generator. This was a novel approach, since the BBS-generator has a strong security proof, which relates the difficulty of distinguishing output bits from random to the difficulty of integer factorization. However, this scheme has no relevance for practical (fast) stream ciphers and therefore, the remainder of this chapter will deal solely with symmetrical stream ciphers. Stream ciphers can also be synchronous or asynchronous. In a synchronous stream cipher, the generated key-stream is independent from the processed plain-text or cipher-text. Hence it can be pre-generated as well. A bit-error in the plain-text (e. g. a flipping bit) affects only the corresponding bit of the cipher-text. One drawback is that both the sender and the receiver have to be synchronized. Insertion or deletion of bits by an active attacker causes immediate loss of synchronization but is thus detected immediately as well.

	Asynchronous stream ciphers on the other hand use parts of the generated cipher-text in the key-stream generation. Whereas a key-stream can be pre-generated with synchronous stream ciphers because it is independent of the plain-text, this is not the case for asynchronous stream ciphers. They can resynchronize after insertion- or deletion of bits and are therefore sometimes called self-synchronized. Even if this can be an important property, this type of stream cipher did not receive much interest; so the remainder of this chapter will deal with synchronous stream ciphers. Menezes et al. names the one-time pad as a separate type of stream cipher. In this case, the key-stream is truly random and not generated in a deterministic way as it is done by the other types.

	Stream ciphers can be either symmetric-key or public-key. Most of the stream ciphers are  symmetric-key ciphers; the Blum-Goldwasser is a stream cipher based on probabilistic public-key encryption.

3.2 Basic Building Blocks of Stream Ciphers
Block ciphers are round based; their basic building blocks are used in an iterative manner to produce a set of output symbols. Stream ciphers use different building blocks(though some are similar to block ciphers as well) and combine them in a certain way using an internal state to produce single output symbols. Some of these building blocks and combinations thereof are now considered.

3.3 Linear feedback shift registers
Linear feedback shift registers (LFSRs) are used in many of the keystream generators that have been proposed in the literature. There are several reasons for this:
1. LFSRs are well suited to hardware implementation .
2. They can produce sequences of large period .
3. They can produce sequences with good statistical properties, and
4. Because of their structure, they can be readily analyzed using algebraic techniques.
3.3.1 Definition A linear feedback shift register (LFSR) of length L consists of L stages (or delay elements) numbered 0. 1….. L - 1, each capable of storing one bit and having one input and one output; and a clock which controls the movement of data. During each unit of time the following operations are performed:
(i) the content of stage 0 is output and forms part of the output sequence;
(ii) the content of stage i is moved to stage i - 1 for each i, 1 £ i £ L - 1; and
(iii) the new content of stage L - 1 is the feedback bit sj which is calculated by adding
together modulo 2 the previous contents of a fixed subset of stages 0; 1; : : : ; L - 1.

Stage1

Stage1

Stage1

Stage1

				Figure 3.1

Figure 3.1 depicts an LFSR. Referring to the figure 3.1, each ci is either 0 or 1; the closed semi-circles are AND gates; and the feedback bit sj is the modulo 2 sum of the contents of those stages i, 0 £ i £ L - 1, for which cL-i = 1.
3.3.2 Definition The LFSR of Figure 3.1 is denoted [L;C(D)], where C(D) = 1+c1D +c2D2 + _ _ _ + cLDL Î Z2[D] is the connection polynomial. The LFSR is said to be nonsingular if the degree of C(D) is L (that is, cL = 1). If the initial content of stage i is si Î{0,1};  for each i, 0£ i £ L - 1, then [sL-1; : : : ; s1; s0] is called the initial state of the LFSR.
3.3.3 Fact If the initial state of the LFSR in above figure is [sL-1; : : : ; s1; s0], then the output sequence s = s0; s1; s2; : : : is uniquely determined by the following recursion:
sj = (c1sj-1 + c2sj-2 + _ _ _ + cLsj-L) mod 2 for j ³ L:
3.3.4 Example (output sequence of an LFSR) consider the LFSR (4;1 + D + D4) depicted in Figure 3.2. If the initial state of the LFSR is [0; 0; 0; 0], the output sequence is the zero sequence. The following tables show the contents of the stages D3, D2, D1, D0 at the end of each unit of time t when the initial state is [0; 1; 1; 0].

t
	D3
	D2
	D1
	D0
		t	D3	D2	D1	D0	
0
1
2
3
4
5
6
7

	0
0
1
0
0
0
1
1

	1
0
0
1
0
0
0
1

	1
1
0
0
1
0
0
0

	0
1
1
0
0
1
0
0

		8
9
10
11
12
13
14
15	1
1
0
1
0
1
1
0	1
1
1
0
1
0
1
1	1
1
1
1
0
1
0
1	0
1
1
1
1
0
1
0	

The output sequence is s = 0; 1; 1; 0; 0; 1; 0; 0; 0; 1; 1; 1; 1; 0; 1; : : :, and is periodic with period 15 .
Fact 3.3.5 explains the significance of an LFSR being non-singular.

Figure 3.2
3.3.5 Fact Every output sequence (i.e., for all possible initial states) of an LFSR (L,C(D)) is periodic if and only if the connection polynomial C(D) has degree L.
If an LFSR (L,C(D)) is singular (i.e., C(D) has degree less than L), then not all output sequences are periodic. However, the output sequences are ultimately periodic; that is, the sequences obtained by ignoring a certain finite number of terms at the beginning are periodic. For the remainder of this chapter, it will be assumed that all LFSRs are nonsingular.
Fact 3.3.6 determines the periods of the output sequences of some special types of non-singular LFSRs.
3.3.6 Fact (periods of LFSR output sequences) Let C(D)Î Z2[D] be a connection polynomial of degree L.
(i) If C(D) is irreducible over Z2 then each of the 2L - 1 nonzero initial states of the non-singular LFSR (L,C(D)) produces an output sequence with period equal to the least positive integer N such that C(D) divides 1 + DN in Z2[D]. (Note: it is always the case that this N is a divisor of 2L - 1.
(ii) If C(D) is a primitive polynomial then each of the 2L-1 nonzero initial states of the non-singular LFSR (L,C(D)) produces an output sequence with maximum possible period 2L - 1.
Fact 2.3.6(ii) motivates the following definition.
3.3.7 Definition If C(D) Î Z2[D] is a primitive polynomial of degree L, then (L,C(D)) is called a maximum-length LFSR. The output of a maximum-length LFSR with non-zero initial state is called an m-sequence.
Fact 3.3.8 demonstrates that the output sequences of maximum-length LFSRs have good statistical properties.
3.3.8 Fact (statistical properties of m-sequences) Let s be an m-sequence that is generated by a maximum-length LFSR of length L.
(i) Let k be an integer, 1 £ k £ L, and let s be any subsequence of length 2L +k - 2. Then each non-zero sequence of length k appears exactly 2L-k times as a subsequence of s. Furthermore, the zero sequence of length k appears exactly 2L-k-1 times as a subsequence of s. In other words, the distribution of patterns having fixed length of at most L is almost uniform.
(ii) s satisfies Golomb’s randomness postulates. That is, every m-sequence is also a pn-sequence .
3.3.9 Example (m-sequence) Since C(D) = 1+D + D4 is a primitive polynomial over Z2, the LFSR (4, 1+ D+ D4) is a maximum-length LFSR. Hence, the output sequence of this LFSR is an m-sequence of maximum possible period N = 24-1 = 15 ( Example 3.3.4 ).

3.4 Stream ciphers based on LFSRs
As mentioned in the beginning, linear feedback shift registers are widely used in key-stream generators because they are well-suited for hardware implementation, produce sequences having large periods and good statistical properties, and are readily analyzed using algebraic techniques. Unfortunately, the output sequences of LFSRs are also easily predictable, as the following argument shows. Suppose that the output sequences of an LFSR has linear complexity L. The connection polynomial C(D) of an LFSR of length L which generates s can be efficiently determined using the Berlekamp-Massey algorithm from any (short) subsequence t of s having length at least n = 2L. Having determined C(D), the LFSR (L,C(D)) can then be initialized with any substring of t having length L, and used to generate the remainder of the sequences.
	An adversary may obtain the required subsequence t of s by mounting a known or chosen plaintext attack on the stream cipher: if the adversary knows the plaintext subsequence m1,m2,….mn corresponding to a cipher-text sequence c1; c2; : : : ; cn, the corresponding key-stream bits are obtained as mi Å ci, 1 £ i £ n.
3.4.1 Note (use of LFSRs in key-stream generators) Since a well-designed system should be secure against known-plaintext attacks, an LFSR should never be used by itself as a key-stream generator. Nevertheless, LFSRs are desirable because of their very low implementation costs. Three general methodologies for destroying the linearity properties of LFSRs are discussed in this section:
(i) using a nonlinear combining function on the outputs of several LFSRs ;
(ii) using a nonlinear filtering function on the contents of a single LFSR ; and
(iii) using the output of one (or more) LFSRs to control the clock of one (or more) other LFSRs .

For essentially all possible secret keys, the output sequence of an LFSR-based key-stream generator should have the following properties:
1. large period;
2. large linear complexity; and
3. good statistical properties .
It is emphasized that these properties are only necessary conditions for a key-stream generator to be considered cryptographically secure. Since mathematical proofs of security of such generators are not known, such generators can only be deemed computationally secure after having withstood sufficient public scrutiny.
 3.4.2 Note (connection polynomial) Since a desirable property of a key-stream generator is that its output sequences have large periods, component LFSRs should always be chosen to be maximum-length LFSRs, i.e., the LFSRs should be of the form (L,C(D)) where C(D)ÎZ2[D] is a primitive polynomial of degree L (see Definition 3.3.7 and Fact 3.3.6(ii)). 
3.4.3 Note (known vs. secret connection polynomial) The LFSRs in an LFSR-based key-stream generator may have known or secret connection polynomials. For known connections, the secret key generally consists of the initial contents of the component LFSRs. For secret connections, the secret key for the key-stream generator generally consists of both the initial contents and the connections.
For LFSRs of length L with secret connections, the connection polynomials should be selected uniformly at random from the set of all primitive polynomials of degree L over Z2.
Secret connections are generally recommended over known connections as the former are more resistant to certain attacks, which use pre computation for analyzing the particular connection, and because the former are more amenable to statistical analysis. Secret connection LFSRs have the drawback of requiring extra circuitry to implement in hardware. However, because of the extra security possible with secret connections, choosing shorter LFSRs may sometimes compensate for this cost.

3.4.4 sparse vs. dense connection polynomial 
For implementation purposes, it is advantageous to choose an LFSR that is sparse; i.e., only a few of the coefficients of the connection polynomial are non-zero. Then only a small number of connections must be made between the stages of the LFSR in order to compute the feedback bit. For example, the connection polynomial might be chosen to be a primitive trinomial. However, in some LFSR-based key-stream generators, special attacks can be mounted if sparse connection polynomials are used. Hence, it is generally recommended not to use sparse connection polynomials in LFSR-based key-stream generators.

3.5 Linear complexity
This subsection summarizes selected results about the linear complexity of sequences. All sequences are assumed to be binary sequences. Notation: s denotes an infinite sequence whose terms are s0, s1, s2,…. sn denotes a finite sequence of length n whose terms are s0; s1; : : : ; sn-1.
3.5.1 Definition An LFSR is said to generate a sequence s if there is some initial state for which the output sequence of the LFSR is s. Similarly, an LFSR is said to generate a finite sequence sn if there is some initial state for which the output sequence of the LFSR has sn as its first n terms.
3.5.2 Definition The linear complexity of an infinite binary sequence s, denoted L(s), is defined as follows:
(i) if s is the zero sequence s = 0; 0; 0; : : : , then L(s) = 0;
(ii) if no LFSR generates s, then L(s) = 1;
(iii) otherwise, L(s) is the length of the shortest LFSR that generates s.
3.5.3 Definition The linear complexity of a finite binary sequence sn, denoted L(sn), is the length of the shortest LFSR that generates a sequence having sn as its first n terms.
Facts 3.5.4 – 3.5.7 summarize some basic results about linear complexity.
3.5.4 properties of linear complexity Let s and t be binary sequences.
(i) For any n ³ 1, the linear complexity of the subsequence sn satisfies 0 £ L(sn) £ n.
(ii) L(sn) = 0 if and only if sn is the zero sequence of length n.
(iii) L(sn) = n if and only if sn = 0; 0; 0; : : : ; 0; 1.
(iv) If s is periodic with period N, then L(s) £ N.
(v) L(s Å t) £  L(s) + L(t), where s Å t denotes the bitwise XOR of s and t.
3.5.5 Fact If the polynomial C(D) Î Z2[D] is irreducible over Z2 and has degree L, then each of the 2L-1 non-zero initial states of the non-singular LFSR (L;C(D)) produces an output sequence with linear complexity L.
3.5.6 Expectation and variance of the linear complexity of a random sequence
 Let sn be chosen uniformly at random from the set of all binary sequences of length n, and let L(sn) be the linear complexity of sn. Let B(n) denote the parity function: B(n) = 0 if n is even;
B(n) = 1 if n is odd.
(i) The expected linear complexity of sn is
E(L(sn)) =n/2+(4 + B(n))/18-1/2n(n/3+2/9) Hence, for moderately large n, E(L(sn)) @ n/2+2/9 if n is even, and E(L(sn)) @ n/2 + 5 /18 if n is odd.
 (ii) The variance of the linear complexity of sn is Var(L(sn)) =
86/81-1/2n[(((14 - B(n))/27)n +(82 - 2B(n))/81 ] –1/22n(1/9n2 +4/27n +4/81)
Hence, Var(L(sn)) @ 86/81 for moderately large n.
3.5.7 Expectation of the linear complexity of a random periodic sequence 
Let sn be chosen uniformly at random from the set of all binary sequences of length n, where n = 2t for some fixed t ³1, and let s be the n-periodic infinite sequence obtained by repeating the sequence sn. Then the expected linear complexity of s is E(L(sn)) = n - 1 + 2-n.
The linear complexity profile of a binary sequence is introduced next.
3.5.8 Definition Let s = s0; s1; : : : be a binary sequence, and let LN denote the linear complexity of the subsequence sN = s0; s1; : : : ; sN-1, N ³ 0. The sequence L1; L2;…is called the linear complexity profile of s. Similarly, if sn = s0; s1; : : : ; sn-1 is a finite
binary sequence, the sequence L1; L2; : : : ; Ln is called the linear complexity profile of sn. The linear complexity profile of a sequence can be computed using the Berlekamp- Massey algorithm. The following properties of the linear complexity profile can be deduced .
3.5.9 Properties of linear complexity profile 
Let L1; L2; : : : be the linear complexity profile of a sequence s = s0; s1; : : : .
(i) If j > i, then Lj ³ Li.
(ii) LN+1 > LN is possible only if LN £N/2.
(iii) If LN+1 > LN, then LN+1 + LN = N + 1.
The linear complexity profile of a sequence s can be graphed by plotting the points (N; LN), N ³ 1, in the N ´ L plane and joining successive points by a horizontal line followed by a vertical line, if necessary (see Figure 3.3). Fact 3.5.9 can then be interpreted as saying that the graph of a linear complexity profile is non-decreasing. Moreover, a (vertical) jump in the graph can only occur from below the line L = N=2; if a jump occurs, then it is symmetric about this line. Fact 3.5.10 shows that the expected linear complexity of a random sequence should closely follow the line L = N=2.
3.5.10 Expected linear complexity profile of a random sequence Let s = s0; s1; be a random sequence, and let LN be the linear complexity of the subsequence sN = s0; s1; .. ;sN-1 for each N ³ 1. For any fixed index N ³1, the expected smallest j for which LN+j > LN is 2 if LN £ N/2, or 2 + 2LN - N if LN > N/2. Moreover, the expected increase in linear complexity is 2 if LN ³  N/2, or N - 2LN + 2 if LN < N/2.
 Example (linear complexity profile) Consider the 20-periodic sequence s with cycle
s20 = 1; 0; 0; 1; 0; 0; 1; 1; 1; 1; 0; 0; 0; 1; 0; 0; 1; 1; 1; 0:
The linear complexity profile of s is 1; 1; 1; 3; 3; 3; 3; 5; 5; 5; 6; 6; 6; 8; 8; 8; 9; 9; 10; 10; 11,11; 11; 11; 14; 14; 14; 14; 15; 15; 15; 17; 17; 17; 18; 18; 19; 19; 19; 19; : : :. 

Figure 3.3 shows the graph of the linear complexity profile of s. 

Figure 3.3: Linear complexity profile of the 20-periodic sequence of Example 3.5.11.

As is the case with all statistical tests for randomness, the condition that a sequence has a linear complexity profile that closely resembles that of a random sequence is necessary but not sufficient for s to be considered random. This point is illustrated in the following example.
 Example (limitations of the linear complexity profile) The linear complexity profile of the sequence s defined as
si = 1; if i = 2j - 1 for some j ³ 0,
       0; otherwise; follows the line L = N/2 as closely as possible. That is, L(sN) = [(N + 1)]/2 for all N ³1. However, the sequence s is clearly non-random. 

3.6 Golomb’s randomness postulates
Golomb’s randomness postulates  are presented here for historical reasons
– they were one of the first attempts to establish some necessary conditions for a periodic pseudorandom sequence to look random. It is emphasized that these conditions are far from being sufficient for such sequences to be considered random. Unless otherwise stated, all sequences are binary sequences.
3.6.1 Definition Let s = s0, s1, s2, . . . be an infinite sequence. The subsequence consisting of the first n terms of s is denoted by sn = s0, s1, . . . , sn-1.
3.6.2 Definition The sequence s = s0, s1, s2, . . . is said to be N-periodic if si = si+N for
all i ³0. The sequence s is periodic if it is N-periodic for some positive integer N. The period of a periodic sequence s is the smallest positive integer N for which s is N-periodic.
If s is a periodic sequence of period N, then the cycle of s is the subsequence sN.
3.6.3 Definition Let s be a sequence. A run of s is a subsequence of s consisting of consecutive 0’s or consecutive 1’s which is neither preceded nor succeeded by the same symbol. A run of 0’s is called a gap, while a run of 1’s is called a block.
3.6.4 Definition Let s = s0, s1, s2, . . . be a periodic sequence of period N. The autocorrelation function of s is the integer-valued function C(t) defined as
C(t) = 1/N ((2si - 1) · (2si+t – 1) for 1 £ t £N-1
The autocorrelation function C(t) measures the amount of similarity between the sequence s and a shift of s by t positions. If s is a random periodic sequence of period N, then |N · C(t)| can be expected to be quite small for all values of t, 0 < t <N.
3.6.5 Definition Let s be a periodic sequence of period N. Golomb’s randomness postulates are the following.
R1: In the cycle sN of s, the number of 1’s differs from the number of 0’s by at most 1.
R2: In the cycle sN, at least half the runs have length 1, at least one-fourth have length 2, at least one-eighth have length 3, etc., as long as the number of runs so indicated exceeds 1. Moreover, for each of these lengths, there are (almost) equally many gaps and blocks.
R3: The autocorrelation function C(t) is two-valued. That is for some integer K,
N · C(t) =(2si - 1) · (2si+t - 1) =  N, if t = 0,
K, if 1 £ t £N-1
Note: Postulate R2 implies postulate R1.
3.6.6 Definition A binary sequence which satisfies Golomb’s randomness postulates is called a pseudo-noise sequence or a pn-sequence.
Pseudo-noise sequences arise in practice as output sequences of maximum-length linear feedback shift registers (Fact 3.3.8).
3.6.7 Example (pn-sequence) Consider the periodic sequence s of period N = 15 with cycle
s15 = 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 1, 1, 0, 1.
The following shows that the sequence s satisfies Golomb’s randomness postulates.
R1: The number of 0’s in s15 is 7, while the number of 1’s is 8.
R2: s15 has 8 runs. There are 4 runs of length 1 (2 gaps and 2 blocks), 2 runs of length 2 (1 gap and 1 block), 1 run of length 3 (1 gap), and 1 run of length 4 (1 block).
R3: The autocorrelation function C(t) takes on two values: C(0) = 1 and C(t) = -1/15
for 1 £ t £14. Hence, s is a pn-sequence.

3.7 Attacks on Stream Ciphers
The purpose of a good key-stream generator is to produce an output which can ideally not be distinguished from a truly random source. This is however impossible, but the goal is to make it as close to a truly random symbol stream as possible. The cryptanalyst can refer to a multitude of statistical tools and theoretical knowledge to attempt an attack. A way to classify attacks on stream ciphers is as follows:
	Cipher-text-only attack: This is the hardest type of attack for the cryptanalyst since no other information than the output of the cipher can be used. The goal is to recover the used key.
	Known-plaintext attack: Having a cipher-text, the corresponding plaintext is known. In the case of a stream cipher, knowing the plaintext means knowing the key-stream which has been applied to it. The goal is to determine the key which generated the key-stream.
	Distinguishing from a truly random sequence: This new security criterion was proposed by Coppersmith et al. , but it doesn't lead to any knowledge about the plaintext or the used key. Particular attacks often rely on the existence of certain building blocks inside the stream cipher. However, some don't: e. g. there can be a time/memory tradeoff: The time effort of a brute force attack is separated into a smaller time effort and an additional memory effort which could lead to a practical attack. An approach, which can be better than brute force, is described subsequently.

3.7.1 Correlation Attacks
Correlation attacks on stream ciphers were introduced by Siegenthaler and try to establish a link between the key-stream and one of the LFSRs inside the generator. This is done via exploiting weaknesses in the combining function, which has several LFSRs as input. Once one LFSR is analyzed, attention is given to another LFSR. This approach is sometimes referred to as divide-and-conquer attack.
Further improvements have been made on the basic idea, and these are generally called fast correlation attacks.

3.7.2 Other Attacks
A short description and further references on other attacks such as linear consistency attack; sub-key guessing attack, inversion attack etc. can be found. A fairly new type of attack are algebraic attacks (or higher order correlation attack). 

3.8 Practical Considerations
Practical stream ciphers employ more than one of the above mentioned strategies to remove linearity from the output of LFSRs. Examples thereof are SNOW or SOBER. However, stream ciphers don't have to be based on LFSRs. Especially if software performance is important, LFSRs are not the best choice. Stream ciphers, which take a complete different approach, are RC4, SEAL or SCREAM. The above description of LFSRs is suitable for hardware implementations, but its implementation in software is very inefficient. However, LFSRs do not have to use a binary representation, in fact any finite field is possible. A finite field more suitable for software implementation might be GF((2n)m) where n is the word size of the underlying processor and m is the degree of the polynomial. One important property of synchronous stream ciphers is that the key-stream is independent of the plaintext and can be pre-generated. This strictly prohibits the reuse of the same key for different plaintexts. There are two solutions to this problem.
	To seed the key-stream generator, use initialization vectors and subsequently derive a session key for it (e. g. using the output of a hash function with the concatenation of IV and key as input). 
	For practical reasons the stream ciphers should have the property to reach every point of the key-stream within sub linear amount of time. Another feature has received considerable interest: the ability to add message integrity protection or message authentication to the cipher-text of the stream ciphers. This is especially important for the cipher-text of (synchronous) stream ciphers since bit manipulations in the cipher-text can lead to predictable modifications of the corresponding plain-text. Proposals like Helix , Multi-S01 from Hitachi, which has been submitted to CRYPTREC - a Japanese e-Government initiative, or SOBER 128  from Qualcomm, which is the successor of the NESSIE submission SOBER-t32, already include such a feature. 

					Chapter 4
 			 Linear Statistical Weakness of RC4

4.1 The RC4 Stream Cipher
RC4 specifies a whole family of algorithms whose differences lie in the used word-size n; typically, the word-size is 8. Furthermore, key-sizes between 1 and 2048 bits are possible, however practical values are between 40 and 256 bits.
RC4 algorithm consists of two phases
(i)	Key-Scheduling Algorithm (KSA)
(ii)	Pseudo-random Generation Algorithm (PRGA)

Key-Scheduling  Algorithm (KSA) turns a  variable-size key (with a typical size of 5-32  bytes) into an initial permutation S of {0,1,….N-1} and PRGA uses this permutation to generate a pseudo-random keystream of length l.

KSA( )
Input  :  Key K[0, 1 , ….l - 1]
Output : Permutation S[0, 1 ,…N-1]
Initialization :
        For  i =0……N-1
                   S[i ]= i 
       J=0
Scrambling  :
         For  i  =0 …. N-1
                 j = j +S[i ] +  K[ i mod l]              
                 Swap( S[i ], S[j ])                                               

        PRGA( )
       Input :  Permutation  S[0,1,……N-1]
      Output:  Pseudo-random sequence Z[0], Z[1], ….. Z[len-1]

Initialization: 
                        i =0
                        j= 0
                        Generation loop :
                           For k = 0,  1 , ….. len -1
                                 i = i +1
                                 j= j+ S[i ]       
                                 Swap( S[i ], S[j ])      
                                 Z[k] = S [ S[i ] +S[j] ]                    

PRGA initializes two indices i and j to 0, and then loops over four simple operations which increment i as a counter, increments j pseudo randomly, exchange the two values of S pointed to by i and j, and output the value of S pointed to by  S[i ] +S[j]                               

S[0]	S[1]		S[t]		S[i]		S[j]			

                                                               +

For each entry of the table 2n values are possible, thus leading to a total number of (2n)! different table-states. Using a word-size of  8, the number of different table-states is (28)!  21684. 
Both parts access an internal table of size n  2n bits, which can be viewed as an array containing 2n words of size n. The internal table has a size of n   2n bits, the total number of states is not     (which would be 22048 in the case of n = 8). 

4.2 Statistical properties and it’s significance
For some sequences like LFSR  it is possible to derive statistical properties, whereas for others these properties are measured using statistical tests. For key-stream generators like RC4 such theoretical results are difficult to establish. The results typically deal with the relative frequency of occurrence of  blocks of successive symbols within a period, where the block size is assumed to be smaller than memory. 
The linear statistical weakness is a linear relation among the key-stream bits that holds with probability different from one half. It has been proved that for many practical schemes including clock-controlled LFSRs the key-stream sequence length needed to detect the weakness is considerably shorter than the period. Although the weakness may not lead to a significant plaintext uncertainty reduction, it is structure dependent and can be used as such to distinguish between different types of key-stream generators and for secret key reconstruction as well. Linear models of individual components of a key-stream generator can be utilized in correlation attacks, whereas multiple linear models can also be used to mount fast correlation attacks on  clock-controlled LFSRs.
	Linear models of of RC4  can be derived using LSCA(Linear sequential Circuit Approximation) method . The LSCA method consists in determining and solving a linear and sequential circuit that approximates a given key-stream generator and yields linear models with comparatively large correlation coefficients c, where the probability of corresponding  linear relation  among the key-stream bits is (1+c)/2. It also gives an estimate of c. In case of  RC4 a special technique is needed to be developed to obtain more accurate value of c.
	Given a parameter n, the internal state of RC4 consists of a table of 2n binary words of dimension n which at each time define the positions of two words in the table to be swapped to produce the table at the next time. The internal memory is thus practically given as M = n .2 n  + 2 n.
	Let z = ( zt ) t=1…∞  denote the least significant bit output sequence of RC4 and let             dz  = ( dzt =  z t +  z t+1 )  t = 1…∞ and  d2zt =  ( z t  +  z t+2 ) t=1 .. ∞ denotes its first and second binary derivatives, respectively. Objective is to find out correlation of dz and d2z with 1 and 0. This correlation can be used to detect the length of sequence needed to detect statistical weakness. In fact if correlation is c then length of sequence is of order O(c-2).

4.3 Correlation properties of random Boolean functions
	Let f denote an arbitrary Boolean function of n variables and let f(X) denote the value of f at a point X = (x0,x1,….xn-1) ε {0,1}n. As usual correlation coefficient between any two binary random variables x and y is defined as c= Pr(x=y)- Pr(x ≠y). The correlation coefficient of a single binary random variable x is defined as the correlation coefficient between x and a constant zero variable. 
Prop. 1.   Let X and Y are two independent uniformly distributed n-dimensional binary random variables and let f be a uniformly random Boolean function of n variables. Let l be an arbitrary linear Boolean function of n variables (including the constant zero function). Then the correlation coefficient between f(X) + f(Y) and l(X) + l(Y) is equal to 1/2n.
Proof.      Let cf  denote the correlation coefficient between f(X) +l (X) and f(Y)+l(Y) for any fixed f. The correlation coefficient c is then equal to the expected value of cf over uniformly random f. The correlation coefficient cf. is clearly equal to the correlation coefficient of f(X)+ l(X)+ f(Y)+ l(Y) which in turn is equal to the product of correlation coefficients of  f(X)+ l(X) and f(Y) + l(Y), as X and Y are independent. Since the two are equal we get that c f = c (f , l) 2. Since l is fixed , c is then equal to the expected value E(c(f)2), where c(f) is itself given as 2 l - n ( k – 2 n – l ) with k being number of zeros in the truth table of f.  As k has the binomial distribution   { (2 n C k) 2 -2 n } k=0..2 n  It follows that E(c (f)2 )= 2 2(l--n) Var(k)= 2 –n because the variance Var( k ) is equal to 2 ( n – 2 ).
Prop 2. Let X and Y are two independent uniformly distributed n-dimensional binary random variables and let f be a uniformly random balanced boolean function of n variables. Let l  be an arbitrary nonzero linear Boolean function of n variables. Then correlation coefficient of f(X) +f(Y) is equal to 0 and the correlation coefficient c between f(X) +f(Y) and l(X) +l(Y) is equal to 1/(2n – 1 )( Instead of linear , l may be any balanced Boolean function of n variables.)
Proof.  For any balanced f, the correlation coefficient of f(X)  is equal to zero. Then the correlation coefficient of  f(X)+ f(Y) is equal to zero since for any fixed f, it is the product of two zero correlation coefficients. Second proceeding along similar lines as in the proof of Proposition 1, we get that c= E( c (f , l) 2 ). Since l is balanced and fixed c(f,l) is given as 2 2-n (k - 2 n-2) where k is the number of zerosin the half of truth table of f where l(X)=0.  The probability distribution of k is { ( 2 n-1    k )2 / (2n 2 n-1) } for k=0 to 2 n-1
Prop 3.
Let l be an arbitrary nonzero linear Boolean function of n variables and let f be a uniformly random balanced Boolean function of n variables such that c(f, l)=c where c is a given constant. Then the correlation coefficient of  f(X) +l(X) is equal to c for any given fixed X. (Instead of being linear,       l maybe any balanced Boolean function of  n variables.
Prop4.
Let X be a uniformly distributed n-dimensional binary random variable and let f be a uniformly random balanced boolean function fo na variables. Let X+1 denote the integer addition modulo 2n of X and l. Then the correlation coefficient of f(X)+f(X+1)+1 is equal to 1/(2 n -1). Furthermore , let l be a linear function defined as l(X)=x0 and let f be in addition such that c( f, l )=c where c is a given constant. Then the correlation coefficient of f(X)+ f(X+1)+1 is equal to c2  for any fixed  X.(Instead of X+1, one may take any permutation P(X) such that P(X) ¹ X, X  ε{0,1}n , but then a balanced function l has to be defined appropriately.

4.4 Linear Models

The essence of the linear sequential circuit approximation (LSCA) method  applied to binary key-stream  generators is in finding good linear approximations to the output and the component next-state functions and in solving the resulting linear sequential circuit . Its objective is to obtain feed forward linear transformers (i.e., linear sequential transforms with finite input memory ) of the output sequence that are correlated to linear transforms of the initial state variables (to be used in correlation attacks) and , in particular, to the  constant  zero sequence, in which case the output linear transform defines a linear relation among the output bits that holds with probability different from one half. The resulting probabilistic linear recursion is called a linear model. Estimating the correlation, coefficients can be a problem on its own. In the underlying probabilistic model, the initial state is assumed to be a random and uniformly distributed, and if the next–state  is one-to-one, then the internal state at any time is also uniformly distributed , so that the  the resulting correlation coefficients are time independent .

                  In the case of  RC4 , the next–state function is one-to-one and the balanced initial table  (each n-bit word appears exactly once ) can be assumed to be uniformly random. But the initial pointer words io and jo are fixed to zero. It follows that for every t ³ 0, the table St is uniformly random, and balanced  whereas it  is deterministic and known and it is uniformly distributed for t>=1, but dependent on s[t]. As a consequence while the dependence between jt and s[t] is insignificant, the deterministic nature of  it may in principle lead to linear models with time dependent correlation coefficients. A related approach is to fix the initial state and to consider the same linear relation at random times, in which case the average value of the correlation coefficients over time is relevant. If the tail and cycle lengths combined are big (As one should expect for RC4), then the obtained correlation coefficient should be close to the value corresponding to a fixed time and a random initial state.

	Since RC4 has n binary outputs one should first decide on a linear combination of these outputs to be linearly approximated. To maximize the correlation coefficients individual binary outputs need to be considered. Let zt(k), it(k), jt(k) and st(k) denote kth component of zt, it, jt, st respectively 0<k<n-1 where k=0 corresponds to  least significant bit of the corresponding n-bit words. St defines a uniformly random balanced vectorial Boolean function{0,1} n à {0, 1}n  of so that st(k) is a uniformly balanced Boolean function of n variables. As the linearization of zt and jt necessarily involves finding linear approximation to St the problem is to find such approximations leading to the correlation coefficients that do not vanish for a random St. The main part of  LCSA is that St can be approximated by S t-1 because of the slow change of the table of swapping. Another point is that St-1(k) is approximated by kth binary input. As before all additions of l-bit words are integer additions modulo 2l (usually l=1 or l=n).

	  As a result, we get z t (k) = St-1(i t-1+1)+ St-1 (j t-1+ St-1 (i t-1   +1)) = j t-1(k) where s t-1(k) is linearized exactly twice. It then follows that z t (k) +z t+1(k)= j t-1(k) +z t (k) = it(k), where it(k) is known for every t>=1. The total number of linear approximations needed is five. In order for overall correlation coefficients not to vanish the total number of linear approximations to st-1(k) should be even, because positive and negative correlation coefficient would otherwise cancel out. More precisely Proposition 2 can be extended to deal with an arbitrary number of linear approximations, in which case the resulting correlation coefficient is related to the even central moments of the probability distributions and odd central moments are necessarily equal to zero. So the binary derivative of any binary component of the n-dimensional output sequence does not represent a linear model with a nonzero correlation coefficient.

                 Further by adding two successive bits of the first binary derivative sequence we get that  zt (k) + zt+2(k) = i t (k) + i (t+1)(k) which is further equal to 1 if k=0 and can be approximated as 0 if 1<=k <=n-1. the total number of linear approximations needed for this is at most ten and will be shown be equal to six. Accordingly second binary derivative of any binary component of the output sequence defines a linear model with a nonzero correlation coefficient, to be determined in sequel. The most significant correlation coefficient is obtained for the least significant bit, that is for k=0. Other linear models for RC4 should have smaller or much smaller correlation coefficients.
                 Now to estimate the correlation coefficient between the secondary binary derivative       zt’’ (0) = z t (0) + z t+2 (0) and 1 , for any t>=1 . Letting F= S t,  F’ = S t+1, F’’= S t+2, X=  i t and y = j t, we have
           
             Z’’t (0) = F (0)( F(x) +F(y)+ F ’’(0) (F’’(X+2) + F’’(Y+F(X+1)+ F’(X+2)))
Where Y is uniformly distributed, F is a  uniformly random vectorial Boolean function and F’ and F’’ are obtained From F by one and two random swapping of two n-bit words, respectively, whereas X is fixed for any particular t and is uniformly distributed for a random t.
             Direct computation of the correlation coefficient by using previous equation is not possible since the functions F, F’ and F’’ are random. The starting point of our approach is forming the following series of linear approximations

     Z’’ t  (0) =   F(0) (X)   + F(0) (Y) + F’’(0)( F’’(X+2) +F’’(Y+ F(X+1) +F’(X+2))) …(1)
                   =  F(0) (X) + F(0) (Y) + F’’(0) (X+2) +F ‘’(0)(Y +F(X+1) + F’(X+2))      …(2)
                   = F(0) (X) +F(0)(Y) +F’’(0)(X+2) +Y(0) +F(0)(X+1) +F’(0) (X+2)            …(3)
                   = F(0) (X) + Y(0) + F’’(0)(X+2)+ Y(0) +F(0)(X+1) + F’(0) (X+2)              ….(4)
                   = F(0)(X) + F(0)(X+1)                                                                            ….(5)
                   =1
Correlation coefficients of the individual linear approximations can be conditioned on the random functions in an appropriate way
                Let                    c f  =  c (F(0),      X (0) )	
                                         c f ’  =  c (F ‘(0),    X (0) )	
                                         c f ’’  =  c (F ‘ ‘(0), X (0) )
be the correlation coefficients where subscripts f indicates the dependence upon a particular balanced Boolean function f.

Let m denote the number of bits where F(0) and F’’(0) are effectively different. Under the independence assumption that the individual linear approximations are independent when conditioned on cf ,  m’ and m, the correlation coefficient between    z’’t (0) and 1 is given as cf 4 cf’’ 2e m  where cf ’’= cf e m , e m= 1- m 2 1- n  if  F(0) is a uniformly random balanced Boolean function with a fixed correlation coefficient cf to X(0)  where X is either uniformly distributed or fixed. The resulting correlation coefficient conditioned on cf, m’ and m is thus equal to  cf6 e m2 e m’. Here the independence assumption is the only tractable way of combining the individual linear approximations.

Consequently  the overall correlation coefficient is then given as
                                           c  = E(cf 6) E(em2) E(e m)   
From the proof  of previous lemmas cf can be expressed as 2 2- n (k- 2 n-2) where k (standing for the number of zeros in the half of the truth table of f= F(0)  where X (0) =0 has the probability distribution
                                                           n-1             n
                                            Pr(k) = (2   C  k ) / ( 2    C     n – 1 )         0 <=k <= 2 n-1
                                                                                                                                2
The random variable m’ takes 0 and 2 each with probability ½ so that

                              E(e m)  = e’ E (m’) = 1- 2 l - n  which tends to 1 as 2 n increases.

 Probability distribution of m  is not straight-forward to derive ,but it can be shown that
                                           E(m) =               4 N 2 – 7 N +2
                                                                       2 N (N-1)
   E(m) <2 since effective changes in two successive swappings can be canceled out but  as N increases we have Pr(m=0) =1/4, Pr(m=2)=1/2,Pr(m=4) =1/4 and E(m)=2
So we get
       
                                          E (em 2 )   =             N 4 – 9 N 3 +38 N2 – 64 N + 40
                                                           		                 N3 (N-1)
 Which of course tends to 1 as N = 2 n increases
 Finally    E(cf 6 )   = 2 –6 ( n - 2)  mu 6

                                                                   2 n  - 1
                               mu 6 =   å        ( k – 2 n-2 ) 6 ( 2 n-1  C  k ) 2  
                                            k=0
                                                        
                                                            (2 n   C  2 n-1)

                                        = 15* 2 3(n-4)

 Overall correlation coefficient c  can be approximated to be 15*2 –3n
The necessary sequence length to detect with high probability the second binary derivative statistical weakness is O(c –2 ) that is neglecting a small constant less that 10

                            L  =  2 6n /225 = 10* 1.8 n - 2.35
 It has been shown that correlation coefficient  for the first binary derivative is equal to zero and more importantly the correlation coefficient between second binary derivative and 1 is around     15*2 –3n where n is the word size of RC4. These theoretical results agrees well with experimental results obtained through computer simulations.

The output sequence length needed to detect the corresponding linear statistical weakness is then around 64n / 225 which is significantly smaller than 2M where M= n.2 n +2n. Resulting plaintext uncertainty reduction may not be practically important unless n is small, the determined linear model can be used to distinguish RC4 from other key-stream generators and also to recover the unknown parameter n.

						Chapter 5
	          		      	  Digraph Probabilities
	
With which probability each digraph (that is, each successive pair of n-bit outputs) will appear in the output of RC4 is indirectly computable, given some reasonable assumptions. The probability of each digraph for each value of the i index is also computable. By taking advantage of the information on i rather than averaging over all values of i and allowing some of the details about the statistical anomalies to wash away, it is possible to more effectively distinguish RC4 from randomness.

	To simplify analysis one can idealize the key set up phase. Key set up phase will generate each permutation with equal probability, and will assign all possible values to j with equal probability. Then after any fixed N steps all states of j and the permutation will still have equal probability, because the next state function is invertible. This is an idealization; actual RC4 key setup routine generates only 2 nk  different permutations, where nk is the number of bits in the key, while there are 2n! possible permutations. Intuitively, our idealization becomes a close approximation of the internal state after RC4 runs for a short period of time.

	However based upon the assumption that the i pointer is initially zero after the key setup phase, and at each step i  changes  in a predictable manner, the attacker can assume knowledge of the i pointer for each output. Exact digraph probabilities, under the assumptions given above, can be computed by counting the number of internal states consistent with each digraph. This approach works with RC4 because only a limited amount of the unknown internal state actually affects each output, though the total amount of internal state is quite large. Following table gives list of values which are known or unknown during the process of generation of  keystream.

      Variable                                                Cryptanalyst’s knowledge

        i                                                              known (increments regularly)
        j                                                              unknown
     S[i]                                                            unknown
S[j]                                                             unknown
S[S[i]+S[j]]                                                known (first output)

S[i+1]                                                         unknown
S[j+S[i+1]]                                                 known (second output)
S[j +S[i+1]] if i+1= S[i+1]+ S[j+S[i+1]]
S[i+1] if  j+S[i+1] = S[i+1] +S[j +S[i+1]

   	As the next-state algorithm progresses, for each successive unknown value, any value that is consistent with previously seen states is equally probable. Thus the probability of a diagraph (a, b) for a particular value of  i  can be found by stepping through all possible values of all other variables, and counting the number of times  each output is consistent with the fixed values of  i , a  and b. The consistency of  a  set of  values  is determined by the fact that S is a permutation. Because the start states were considered equally probable, this immediately gives us the exact value of the probability of I, (a, b). This approach requires about 25n  operations to compute the probability of a single digraph for a given value of i as there are five n-bit unknowns. Approximately 28n operations are required to compute the probabilities of a digraph for all values of i as there  are  five n-bit unknowns. Approximately 28n operations are required to compute the probabilities of a digraph for all values of i. This puts the most interesting case of n=8 out of immediate reach, with a computational cost of      2 64 operations. However this difficulty can be circumvented by computing the exact n =3, 4, 5 digraph distributions for all i, observing which digraphs have anomalous probabilities, and estimating the probabilities of the anomalous probabilities, and estimating the probabilities of the  anomalous digraphs for RC4/8.

5.1 Anomalous RC4 Outputs
 The full digraph distributions for n=3, 4 and 5 are computable with about 240 operations. It  has been found that the distributions were significantly different from uniform distribution. In addition, there is a consistency (across different values of n) to the irregularities in digraph possibilities. In addition one particular type of digraph is more probable than expected by a factor of approximately 1 +2 –n+1 seven type of digraphs are more probable than expected  by approximately 1+2-n and three types of digraphs are less probable  than expected by approximately 1+ 2-n  and  three types of digraphs are less probable than expected by approximately 1+ 2 –n . These results can be summarized as follows
           Digraph                       Value(s) of  i                                  Probability

          (0, 0)                                  i =1                                           2 -2n (1 +   2 –n+1)
          (0, 0)                                  i¹1, 2n -1                                  2-2n (1 +    2-n   )
          (0, 1)                                  i ¹ 0,  1                                      2-2n (1 +    2-n )
          (i+1, 2n-1)                          i ¹ 2n- 2                                      2-2n(1 +   2 –n )
          (2 n -1, i+1)                         i ¹1, 2n-2                                    .

Appearance of a digraph in the RC4 output at a given value of  i  is considered as a positive event when it is significantly more probable than expected. Negative appearance is similarly defined to be the appearance of a digraph at a given i that is significantly less probable than expected.

5.2 Extrapolating to Higher values of n
To apply our attack to higher values of n without directly computing the digraph probabilities of positive events and negative events by running RC4/8 with several randomly selected keys and counting the occurrences of those events in the RC4 output. The observed probabilities (derived using RC4/8 with 10 starting keys for a length of 2 38 for each key), along with the computed expected probability from a truly random sequence, are given as
                                        Positive Events     Negative Events
RC4/8                      0.00007630      0.00003022
Random                   0.00007600     0.000003034
				
	It is possible to distinguish between these two probability distributions with a 10% false positive and false negative rate by observing 2 30.6 successive outputs using above table. In order to evaluate the effectiveness of extrapolation approach, the amount of key-stream using test is computed. For RC4/5 selected positive/negative events require 2 18.76 key-stream outputs, while optimal test using exact probabilities of all digraphs require 2 18.72 key-stream outputs. These numbers agree to experimental results within a small factor, suggesting that the extrapolation approach is close to optimal.

5.3 Reason behind Statistical Anomalies
Let internal state of RC4 immediately before starting first output of digraph is

    *  …..,*,1,0,*,…….*,AA,*,  ….           Where  AA=I
                    i                     j

where *  denotes unspecified element. Ellipses indicate unspecified number of unspecified elements. The mechanism that leads to the (0, 1) digraph starts in above state where AA=i.
	Following through the steps in the next-state function, the first output will be 0 and at the following step 4, be in the state
 
                  *,……,*,1,AA,*,…..*,0,….

	 And output be 1. This mechanism occurs approximately 2-3n times and since other mechanism outputs a  (0,1)   2 –2n of the time, this accounts for the observed increase   over expected.
For the (0, 0) positive events, the additional mechanism starts with the following state

  *, …….*,AA,0,*,…….,BB,*,…… where AA= i +1-j and BB=j
	The negative events on the hand correspond to mechanisms that normally contribute to the expected output which do not work in those particular cases. For example a normal method of producing a repeated digraph (AA, AA) is

    *,……,*BB,-1,*,…..*,AA,*, ….

	Here the value AA occurs at location BB-1. This outputs an AA, and steps into state :

*,……,*,-1,BB,*,….,*,AA, *,*…..

This will output another AA, unless AA happens to be either BB or –1. In either case, this will output a BB. Since normal (AA, AA) pairs rely on this to achieve a near-expected rate, the lack of this mechanism for (-1, -1) prevents the output once every approximately 2-3n outputs, which accounts for the reduction of approximately  a factor of   2-n  that we observe.
 These mechanisms do not depend on the value of n, and so can be expected to operate in the n=8 case. This supports extrapolated approach which assumes that the positive and negative events to still apply in that case.

5.4 Analysis of Fortuitous States
There are RC4 states in which only N elements of the permutation S are involved in the next N successive outputs. These states are called fortuitous states. Since the variable I sweeps through the array regularly, it will always index N different array elements on N successive outputs (for N ….. 2n). So , the necessary  and sufficient , condition for a fortuitous state is that the elements pointed to by  j and pointed to by S[i] + S[j] must from the set of N array elements indexed by i.
                 An example of an n  N = 3 fortuitous state follows :

             i                      j
            *,  255   ,2 ,    1,   *,   *,……………..
   1. advance i  to 1 
   2. advance j  to 2
   3. swap s[1] and s[2]
   4. output s[1]=2

           *,2, 255,1,*,*,………………….
   1.  advance i to 2
   2. advance j j to 1
   3. swap s[2] and s[1]
   4. output s[1]=255
        j     i
*, 255,  2,   1,  *  ,   *,…….
1. advance i to 3
2. advance j to 2
3. swap s[3] and s[2]
4. output s[3]=2

*,255,1,2,*,* ……
If  i=0 at the first step and assuming that all permutations and settings for j are equally probable, then the above initial conditions will hold with probability 1/(256*256*255*254). When the initial condition hold, the output sequence will always be (2,255,2). If RC4 outputs all trigraphs with equal probability (result of previous section imply that it does not but it is used as an approximation) the sequence (2,255,2) will occur at i=0 with probability 1/(256*56*256). This implies that, when the output is the sequence ( 2, 255, 2)  when i=0 the this scenario is caused.
That output approximately 1/253 of the time. In other words, if the attacker sees at offset 0, the sequence (2,255,2) he can guess  the j was initially 3, and s[1], s[2], s[3] was initially 255,2 and 1 and be right a nontrivial portion of time.

The number of fortuitous states can be found using a state-counting algorithm similar to that given above. The numbers of such states, for small N are given as follows

                      Length             Number    Lg(Expected)        Expected False Hits
                              2             516                 22.9                      255
                              3             290                 31.8                      253
                              4           6540                 35.2                      250
                             5            25,419              41.3                     246
                            6            101,819             47.2                     241

Above table lists for each N , the  number of fortuitous state of that length, the logarithm(base 2) of the expected time between occurrences of any fortuitous state of that length and the expected number within that length of false hits. By false hit, we mean those output patterns that have identical patterns as a fortuitous state but are not caused by fortuitous state. For example , an attacker can expect to see ,in a key-stream of length 2 35.2 one fortuitous state of length 4 and 250 output patterns that look like fortuitous states.
 	It is not immediately clear how an attacker can use this information. What saves RC4 from immediate break is that the state space is so huge that an attacker who directly guess 56 bits still has so many bits unguessed that there is no obvious state to proceed.
	However, it does appear to be a weakness that the attacker can guess significant portion of internal state at times with nontrivial probabilities.

	                       				Chapter 6
			                Weaknesses in key scheduling

 It is easier to prove the invariance weakness only for a simplified variant of KSA that is KSA*. The only difference between them is that KSA* updates i at the beginning of the loop whereas KSA updates i at the end of the loop. Existence of this weakness in KSA* and modifications required for KSA is described in this section.

KSA (K)
		For i=0 …. N-1
                              S[i] =i;
                   i =0
                   j=0
                   Repeat N times
                              J= j + S[i] + K[i  mod l]
                              Swap(s[i], s[j])
                              i =i +1

KSA *(K)
		For i=0 …. N-1
                              S[i] =i;
                   i =0
                   j=0
                   Repeat N times
                              i =i +1
                              J= j + S[i] + K[i  mod l]
                              Swap(s[i], s[j])

6.1 Definitions
      Definitions 1.  Let S be a permutation of {0,1,…… N-1}, t be an index in S and b be some integer. Then if S[t] = t (mod b) , the permutation S is said to b-conserve the index t. Otherwise the permutation S is said to b-unconserve the index t.
 
      St, it, jt  denotes permutation  and indexes  after round t in case of KSA*. Let Ib(S) = N denotes the number of indices that a permutation b-conserves. For the sake of simplicity I(t) is written instead of Ib (St).

Definitions 2. A permutation S of  {0,1,2,….N-1} is b-conserving if Ib(S)=N and is almost b-conserving if Ib(S) >= N-2

Definitions 3. Let b, l be integers and let K be an l words key. Then K is called a b-exact key if for any index t K[t mod l]=(1-t) mod b. In case K[0] =1 and msb(K[1]) =1,K is called a special b-exact key.
For all these conditions to hold , it is necessary(but not sufficient) that b/l.

6.2 The Weakness
Let q ,= n and l be integers and b =2q . Suppose that b/l and let K be a b –exact key of l words. Then the permutation S= KSA*(K) is b-conserving.
 Lemma 1. If  i t+1= j t+1 (mod b) then i t+1= i t
 Proof :  The only operation that might affect S (and maybe I) is the swapping operation. However, when i t+1 and jt+1 are equivalent (mod b),    s t+1 b-conserves  i t+1 (j t+1) if and only if st b-conserved jt (it). Thus the number of indices S b-conserves remains the same.
Proof :  It can be proved by induction on t that for any 1<t<N it turns out that I b(st) = n  and it turns out that it = jt mod b . This in particular implies that I N = N which makes the output permutation b-conserving.
For t=0( before the first round) the claim is trivial because i0=j0=0 and s0 is the identity permutation which  is b-conserving. Then i t+1=i t + 1 and

            J t+1 = j t+ St[i t+1]+ K[i t+1 mod l] = i t + i t+1 +(1 -  i t+1)= i t+1= i t+1
 Thus i t+1= j t+1 mod b and by applying lemma 1 we get i t+1= i t=n and therefore s t+1 is b-conserving.
 KSA* thus transforms special transforms special patterns in the key into corresponding patterns in the initial permutation. The fraction of determined permutation bits is proportional to the fraction of fixed key bits. For example, applying this result to RC4 n=8,l=6 and q=1,6 out of the 48 key bits completely determine 252 out 1684 permutation bits.

6.3 Adjustments to KSA
   The small difference between KSA* and KSA is essential in that KSA, applied to a b-exact key, does not preserve the equivalence(mod b) of i and j after the first round. Analyzing its execution on a b –exact key gives

j1 = j0 + s0[i1] + k[i1] = 0 + s0[0] + k[0] = k[0] = k[0] =1 <>0 = i1
thus the structure described in  earlier section cannot be preserved by the cyclic use of the words of k. However the invariance weakness can be adjusted to the real KSA and the proper modifications can be formulated in the following theorem.

Theorem 2. Let q <= n and l be integers and b= 2q . Suppose that b/l and let K be a special b-exact key of l words. Then
Pr ( KSA(K) is almost b-conserved )>= 2/5.
Where the probability is over the rest of  the  key  bits.

During the first round, two deviations from KSA* execution occur. The first one is Non-equivalence  of i and j which is expected to cause non-equivalent entries to be swapped during the next rounds, thus ruining the dedicated structure that was preserved during KSA* execution. The second deviation is that s b-unconserves two of the indices i1=0 and j1=k[0]. However discrepancy of i, j can be canceled by forcing K[0] ( and  j1 ) to 1. In this case, the discrepancy in s[j1] causes an improper value to be added to j , thus repairing its non-equivalence to i during the second round. At this point still there are two unconserved indices, and this aberration is dragged across the whole execution into resulting permutation. Although these corrupted entries might interfere with j updates, the pseudo-random j might reach them before they are used to update j and send them into a region in s where they cannot affect the next value of j. The probability of this lucky event is amplified by the fact that the corrupted entries are i1=0 which is not touched until the termination of  the KSA due to distance from the current location of  i  and j2= 1+ k[1] > n/2 that is far from i1=2 which gives j  many opportunities to reach before i does it.  The probability of N/2 pseudo-random j’s to reach an arbitrary value can be bounded below by 2/5 and extensive experimentation indicates that this probability is actually close to one half.

6.4 Key –Output Correlation
This section analyzes the propagation of the weak key patterns into the generated outputs. First a proof is given which deals with highly biased behavior of weakened variant of the PRGA, applied to a b-conserving permutation.  Next it is shown that the prefix of the original PRGA is highly correlated to the swapless variant (on the same initial permutation),which implies the existence of biases in the PRGA distribution for these keys.

	Let RC4* be a weakened variant of RC4 with no swap operations. Let q <=n,  b=2q and s0 be a b-conserving permutation. Let {X t} t=1…µ  be the output sequence generated by applying RC4 to RC4* to s0 and x t= X t mod b. Then the sequence {x t} t=1, .µ is constant.

	Since there are no swap operation, the permutation does not change and remains b-conserving throughout the generation process. Since all the values of s are known (mod b) as well as the initial indices  i =j=0  (mod b) and thus the round operation ( and the output values) can be simulated mod b independently of s. Consequently the output sequence (mod b ) is constant and deeper analysis implies that it is periodic with period 2b.

At Each step of PRGA S changes in at most two locations and thus we can expect the prefix of the output stream generated by RC4 from some permutation S0 to be highly correlated with the stream generated from same S0 by RC4. In particular the stream generated by RC4 from an almost b-conserving permutation is expected to be highly correlated with the constant sub-stream {x t}.  This correlation can be estimated for n=8, ,l=16 and different q’s . For example, a special 2-exact key completely determines 20 output bits with probability 2-4.2 instead of  2-20 and a special 16-exact key completely determines 40 output bits with probability 2-2.3 instead of 2-40.

So  a strong probabilistic correlation between some bits of secret key and some bits of output bit stream for a large class of weak keys have been shown. 

6.5 Cryptanalytic Applications of the Invariance Weakness
There is a significant statistical bias in the second output word of RC4. This bias can be used to construct an efficient algorithm which distinguishes between RC4 outputs and truly random sequences by analyzing only one word from O(N) different output streams. This is an extremely efficient distinguisher, but it can be easily avoided by discarding the first two words from each output stream. If these two words are discarded, he best known distinguisher requires about 230 output words. A new observation that for significant fraction of keys, a significant number of initial output words contain an easily recognizable pattern. This bias is flattened when the keys are chosen from a uniform distribution, but it does not completely disappear and can be used to construct an efficient distinguisher even when the first two words of each output sequence are discarded.

Probability of a special 2q exact key to be transformed into a 2q conserving permutation, does not depend upon the key length l. However the number of predetermined bits is linear in l and consequently the size of  this bias also depends on l. For 64 bit keys the new distinguisher it requires only 2 21 data instead of the previously best number of 2 30 output words.

It is an important fact that the specified output pattern extend over several dozen words, and thus the quality of distinguisher is almost unaffected by discarding the first few words. For example, discarding the first two words causes the data required for the distinguisher to grow by a factor of   2 0.5 and 22.  Another important observation is that the biases in the lsb’s distribution can be combined in a natural way with the biased distribution of lsb’s of English text into efficient distinguisher of RC4 streams from randomness in a ciphertextonly attack in which the attacker does not know the actual English plaintext which was encrypted by RC4.

Chapter 7
          	           		     Analysis of WEP

  The IEEE 802.11 wireless network standard (Also known as  Wi-Fi) is an extremely popular way to connect multiple PC’s at home or in the office without using the cables. Since such a wireless network is very vulnerable to eavesdropping and misuse the standard specifies the Wired Equivalent Privacy (WEP) encryption protocol which can be used to make the security of wireless communication comparable to wired communication. WEP uses a 40-bit secret key (which was the largest easily exportable key when WEP was designed) shared between all users and the network access point. For every packet, the sender chooses a new 24-bit initialization vector (IV) and the 64-bit RC4 key is the concatenation of the chosen IV and shared key. Such an IV mode of operation is commonly used in stream ciphers in order to generate different PRGA outputs from the same long term key, and frequent resetting of the PRGA is designed to overcome the unreliable nature of Wireless LAN environment.
 
Several vulnerabilities of this WEP protocol have been explored. Simplest weakness is the small size of the secret key and the IV : A 40-bit key can be recovered by an exhaustive search in less than a day if sufficient amount of computational resources are available. In addition, the limited size (2 24) of the IV space implies that IV(and thus key-streams) are reused during the encryption of different packets. Consequently this mode can be attacked by constructing a dictionary of all the  224 IVs along with their key-streams. In addition, WEP defines no easy mechanism for changing of  shared key and thus the key is usually changed infrequently increasing attacker’s chance to construct the dictionary. Other known attacks exploit the poor authentication to spoof the messages. However these are secondary attacks which do not allow the attacker to  derive the key with  an attack which is faster than exhaustive search. Present attack describes practical way of extracting key.

7.1 The WEP Attack
In order to carry out the attack the cryptanalyst needs  the first output word of a large number of RC4 streams along with the IV that was used to generate each one of them. Since in WEP the IVs are transmitted in the clear and the first message word in most packets is a known constant these requirements are  automatically satisfied.
Let us indicate an RC4 state after using keywords [0…..r] (i. e after r+1 rounds) during KSA as S r, i r, j r and t r thus the KSA output S* can also be denoted by S N-1. In addition there are other functions over permutation related to applying the first PRGA round to the given permutation. I(S), J(S), T(S) and Z(S) are the state indices the output index and the output word of the first PRGA round given as an input. Thus I(S) =1 , J(S)=S[1], T(S) =  S[1] +S[S[1]] and Z(S) is usually S[T[S]] (unless T(S) is I(S) or J(S)). K represents l-word RC4 key which is a concatenation of the initialization vector IV (whose length is denoted by l’’) and the secret key SK(whose length is denoted by l’).

7.2 Basic Idea
The basic step of the attack assumes knowledge of some prefix of the RC4 keywords, and derives and the next keyword (which we sometimes denote as the target key-word). The attack starts with the known IV as a basis, and repeatedly applies the sub-attack in order to recover all the keywords in the secret key SK.

	 Let us assume that the first x words of the key are known. This makes it possible to simulate the first x rounds of the KSA and compute the permutation S x-1. and the indices i x-1 and j x-1 at that point. The next value of  i  is also known (i x  = x) but the next value of j  ( jx ) depends on the unknown target  keyword K[x] and thus it was in position jx just before this round. Consequently given Sx[x] it can be computed that which value was in position jx in the known permutation  S x-1 and by inverting this permutation jx can be recovered. Thus the target keyword depends on jx which depends upon Sx[x]. The main idea of the sub-attack is to identify and isolate cases where the first output word(which is assumed to be known) is correlated with Sx[x] and thus with target keyword. By analyzing such cases, the sub-attack uses the known output word to guess the target keyword with a significant success probability. Attack is probabilistic rather deterministic, but it can be repeated with multiple IVs in order to make statistical conformation about the target keyword more robust.

7.3 Detailed description
The attack has been applied by concentrating on cases in which the first output byte z has a relatively high probability to be equal to Sx[x]. In order to create such situation it has to be guaranteed that

1	z is defined with high probability only by known permutation values.
2	The most likely value of z is equal to S x [x]

	Because i scans through the permutation, the values that occur to the right of x at round x participate in an exchange (and are almost changed) at some other round. However values that occur to the left of x (including position x itself) have a reasonably high probability to remain untouched until the end of the KSA, since the index j chooses N-x random values among the N possible values in the remaining rounds, and thus it misses any particular value with probability which is at least the constant e –1 (and which gets even higher as x increases ).
 
	The first output word z is determined by only three permutation values (those in locations I(S), J(S) and T(S). In order to satisfy the first requirement, we want I(Sx) and J(Sx) to be in positions 0 ……..x of  the Sx. In order to satisfy second requirement it has to be ensured that the index T(Sx) of the output word is exactly x. In other words only those cases are interesting in which 1, Sx[1]< x  and Sx[1]+Sx[Sx[1]] = x. When this happens it is said that the state of RC4 is in an x-resolved condition, and the first output word has the high probability to be Sx[x]. In addition, since the state after x rounds is completely determined by the first(known) x keywords, we can define for every x a class of keys, which se denote as x-good keys, which are guaranteed to lead to a x-resolved state after x KSA rounds.

	When an x-good key occurs, the values in positions 1, S[1] and S[1]+ S[S[1]] have a relatively high probability to remain untouched during rounds x+1, ….., N-1. The probability that three locations will not be pointed to by a pseudo random index during the remaining N-1-x rounds is better than ((1-1/N)N)3 = e –3 = 5%.

	Thus when an x-good key occurs the output word is equal to Sx[x] with probability of at least 5%. As specified above the target keyword can then guessed from the first output word z  through the relations K[x] = jx – j x-1-S x-1[x] = Sx-1 –1[Sx[x]]- j x-1- S x-1[x]= S x-1[z] –j x-1- S x-1[x].  This guess is correct with probability better than 5%, which is 12 times higher than the 1/256 probability of guessing an incorrect value for n=8. Thus using a voting process, in which each x-good key votes for some target keyword candidate and we can identify the correct keyword with probability better than 0.5 by examining just 80 x-good keys.

	Hence if some x-prefix of the RC4 is known, one can derive the next keyword by analyzing only 60 pairs of an x-good key and the first output word it produces. By starting with known IV part of the key and repeatedly using this technique, we can recover the keywords one by one until the whole keyword is extracted. This time complexity of the attack is negligible, and the main difficulty in applying this attack is the collection of sufficiently many good keys.

	Fraction of x-good keys for n=8 increases from 2 –14.62 for x=3 to 2 –10.44 for x=16( the probability increases with x  since for large x there are more acceptable values for J(Sx)). The number of pairs required for sub-attack is 60.1/fraction which varies between 2 20.32 and 2 16.35( for x= 16). Here x1-good key is not necessarily x2-good and thus the same collection of (IV, z) pairs can be used to find the 60 good pairs for all possible values of x. Consequently total number of pairs which are needed by the complete attack is the maximum, rather than the sum, of the corresponding numbers in the sub-attacks. In particular one can attack WEP with an arbitrary ling key and randomly chosen 3-word IVs by collecting only 2 20.32 (IV, z) pairs. If WEP is modified by using16-word IVs and 16-word shared key ( as used in improved version of WEP unofficially known as WEP2) the data complexity of the attack actually drops to 2 16.35. Experimental results obtained by implementing this attack is given in Appendix-3. It shows that if  221 bytes are known then all 5 bytes of the key can be determined correctly.

	Implications of this attack is that those who are using WEP2 protocol to provide confidentiality of their 802.11b communications should consider these protocol to be broken. Remedial action to improve the security is to include the security at higher levels or truncate few bytes (approximately 1000 byte) to remove correlation  and then use the portion of key-stream to encrypt the data.

		

		         Chapter 8
            		              Systematic Cryptanalysis

8.1 Brute force attack
 Brute force attack consisting of trying all possible keys to decrypt the cipher text and then see when the obtained plain-text is near to English language text. Serious implementation of the attack requires optimized implementation of RC4. Unrolling of the loops and few other tricks help in optimization. Assuming that used RC4 consists of 40-bit key, it will require search of 1-trillion keys. When this attack was implemented on a cluster of workstations consisting of 4-nodes it took approximately 65 hours to search the whole key-space. Each node consists of 3.2 GHz 64-bit Intel Xeon processor equipped with 256 Gbyte of RAM. Study has shown that it is not possible to attack 128-bit RC4 using Brute force attack.

8.2 Obtaining key from the RC4 State
	   RC4 consists of  two parts  (i) Initialization    (ii) Key stream generation

During initialization a random permutation of n-words are generated using a key. Using this random permutation key-stream is generated . Brute force attack discussed in the previous section tries all possible keys to get random permutation which is then used to in conjuction with cipher-text to  determine the actual key. When the size of the key increases this approach requires huge amount of computation. To avoid this computation other attacks have been applied. First question is that does there exists other equivalent keys which will generate same permutation. Answer is Yes .
Following algorithm can be used to determine key length of n-words (irrespective of the actual key size selected).

   Let   S[0] S[1]………..S[2 n-1 ] is the initial state of s-box

1.	For z from 0 to 2n  -  1
S[z] = z

2.	j=0

3.	for  i from 0 to 2n –1
i)	Let t be  the index for which S[t]= S[i]
ii)	Set k [i ] = (t - j - S[i ]  ) mod  2 n   
iii)	Set j = (j + S[i ] +k [i ]  ) mod 2 n               
iv)	 Swap (S[i ] ,  S[j ])

	At the end of this procedure k[0], k[1], …….k[2n-1] is a key for the desired initial state . This procedure will typically produce a full length key. RC4-n is used with a key length much smaller than this. For most attacks however any key is useful to the cryptanalyst so long as it generates the correct key-stream.
 
	For most variable-length ciphers increasing the key length can only increase the security of the cryptosystem. For RC4, however this remains true only provided that the keylength is substantially smaller than maximum allowed keylength. A full key generating  a given initial state can easily be computed allowing various kind of attacks.

8.3 Forward Tracking Attack
Since previous attack produces a key which is equivalent to the original, finding the key in RC4 is equivalent to finding the initial state of the s-box. Now in order to determine that initial state method of forward tracking is very useful. Detailed description of forward tracking is as follows 

 Let    k[0], k[1], k[2],……………. .k[ len-1 ] is the observed keystream of length len

  This algorithm will produce all possible RC4 states

Forwardtrack( k, len)
   1.  Initialize the array a[0] , a[1], ………..a[2 n  -1] to a random permutation of the integers  0,…..,2n 
   2.   set numavail = 2n
   3. set s[t] = unassigned  (0 < t < 2n )
3.	 set i=0 and j=0
4.	 call  forwardone(k, len, s, i , j, numavail)

Forwardone(k, len, s, i ,j, numavail)   
       1.  If len =0  s[0],s[1]……s[2n-1]  i  and j is a solution state. Return to the caller.       
 2    set psi=0 and psj=0
     3.   set  fixedsi=0 and fixedsj=0
 4.  set  i =  (i + 1) mod 2n
 5.  If   s[i ] =  unassigned
              i)      set     s[i ]= a [psi ]        
             ii)     swap a [numavail-1 ]   and  a [psi  ]
             iii)    set numavil = numavail – 1
             vi)  set fixedsi = 1 .
    6 . set j = (j + S[i  ]) mod 2 n.
    7. If  S[j  ] = unassigned and psj < numavail
(a)	Set S[j ]= A[psj ]
(b)	Swap A[numavail-1] and  A[psj]
(c)	 Set numavail = numavail –1.
(d)	 Set fixedsj = 1.

     8. If S[j] = unassigned  and psj < numavail
(a)	Set t = ( S[i ] + S[j ] ) mod 2n.
(b)	If t = i then set t = j else if t = j then set t= i.
(c)	 If  S[t ]= K[0] then
                      i.   Swap S[i ]and S[j ].
                      ii.  call farwardone (k+1,len-1,a , i  , j, numavail)   
                     iii.  swap  s[i  ] and s[j ]
(d)	 Otherwise if s[t] = unassigned and k[0]  {A[0],A[1],…..A[numavail-1] }
       i    Let z be the entry for which A[z]= k[0] 
                      ii   set   s[t]= a[z]
                     iii   swap a[z] and a[numavail-1]
                     iv   numavail= numavail -1
                     v   swap s[i  ] and s[j]
                    vi   call forwardone(k+1, len-1, a , i  ,j, numavail)
                    vii    swap s[i  ] and s[j ]
                    viii   set numavail= numavail +1
                    ix   swap a[z] and a[numavail-1]      
                    x    s[t ] = unasigned
 
9.    set haveanothertry=0
10.	If  (fixedsj =1)then 
       i)    set s[j] = unassigned
                  ii )    set numavail= numavail+1
                 iii )   swap a[psj] and  a[numavail-1]
                 iv )   set psj= psj +1
 v)    if  (psj >= numavail) then
a)	set s[i ] = unassigned
b)	set numavail= numavail+1
c)	swap a[psi] and  a[numavail-1]
d)	set psj=0
e)	psi= psi +1
f)	if   (psi < numavail) then  haveanothertry =1
 If  psj < numavail then set haveanothertry =1 

11 .Otherwise if  fixedsi =1 then
                   a)   set    s[ i  ] =   unassigned
                   b)   set  numavail= numavail +1
                   c)   swap  a[psi] and a[numavail-1]
d)   set psi =psi +1
 e)  psj =0
g)	If   psi <numavail then set haveanothertry =1

12. If haveanothertry =1 the gotostep 5.

This algorithm outputs all possible states that RC4 could be in given that it output the given key-stream.
In fact, the algorithm is a depth-first searching algorithm : it searches through a tree in which each node at depth d is a value for the pair (i ,j, s) which could result after the  first d key-stream elements have been produced. The number of nodes in the tree represents the complexity of the algorithm, assuming that the time needed to identify the nodes providing a valid solution is negligible. Important steps of  the algorithm can be  understood as follows

1.	Initially, before any key-stream has been observed, all states are equally likely and the counters  i and j are set to zero. This is represented by the node (0, 0, {?, ?, ?,?}) corresponding to 24 distinct starting states.

2.	RC4 key-stream generation is now undertaken, i is incremented to 1and a value must be assigned to S [i  ]= S[1 ] . Four possibilities exists  S[0]=0, s[1]=1, s[1]=2 and s[1]=3 and these must be considered in turn.

3.	If s[1]=0 the j is still 0 after adjusting j and the state is (1, 0,{0,?,?,?}) after swapping s[i ] and s[j ]. The value 0 is observed as first key-stream byte and thus s[i ] + s[j ] =0. This would imply that s[1 ]=0 which is not possible since s[0] =0. Thus the initial choice does not lead to a potential solution.

4.	If s[1]=1  were chosen then j=1 after adjustment, and swapping s[i  ]and    s[j ]has no affect. The observed key-stream output requires that s[s[0] +s[0]]= s[2] =0 which leads to the possible solution (1,1,{?,1,0,?})

5.	Similarly if s[1]=2 then after swapping step the state is (1,2,{?,?,2,?)) and s[s[1]+s[2]] =0 or s[s[1]+2] =0 must be arranged. This can be done in one way s[1]= 1 and s[3]=0.

6.	 Finally if s[1]=3 the state (1,3,{0,1,?,3}) is the only possibility.

7.	Carrying  on in this fashion starting at each of the nodes at depth 1 leads to the remainder of the diagram shown below

Results of the experiments carried-out is given in Appendix-1 . Following observations can be made from the data otained.

1	It is possible that the number of nodes as a function of depth does not simply increase then decrease as shown above. Only total number of solutions (which depends both on the number of nodes and on the number of unassigned entries in the s-box at each node) is expected to decrease monotonically as the depth increases because the amount of uncertainty in the state decreases as the number of key-stream bytes read increases.

2	For the nonzero key-stream case the total number of solutions can not decrease to zero because a valid key was used to generate the key-stream. In the experiments conducted, it has always been the case for a large enough key-stream sample, the RC4 state is uniquely identified. However it is possible that distinct but equivalent states exist.

3	For the zero key-stream case, the total number of solutions usually decreases to 0 because most RC4 systems cannot output a constant key-stream if it operates in a cycle for which all right shifts are in other cycles. This follows from the periodicity analysis.

4	Comparing the two tables it appears that for a key-stream containing many repeated zeros it is easier to recover the state than for a arbitrarily chosen key-stream. 

Using the data provided in the above table an estimate of the complexity of forward tracking can be obtained by counting the total number of nodes visited in the tree. Forward tracking procedure significantly reduces the search effort required to recover the initial state. Extrapolating the results to RC4-8 the forward tracking effort is still much larger than that required for exhaustively searching the keys of a length which could be used in current applications, but the results do give a measure of the maximum effective strength of cipher.

8.4 Backward Tracking
Instead of analyzing the key-stream in the order it is generated, it is also possible to recover the RC4 state by using the observed key-stream in reverse order. One  disadvantage  is that the value of j is known at the start of the keystream, but not at the end ,thus , a backtracking state recovery algorithm must try all possible values  of j . However, in light of the discussion at the end of the previous section , a forward tracking attack will often not have this advantage.

	Experiment shows that, neglecting the loss of the value of j at the start of the attack, backtracking is more efficient than forward tracking, although the total number of paths searched remains approximately the same. This is likely caused by the fact that it is easier to find valid paths  at a given depth in backtracking since the key-stream immediately fixes a  portion of the state .

	For reference, Appendix-2 provides node count information  and the permutations obtained for the backtracking attack with an arbitrarily chosen key-stream. Comparing it with results obtained in Appendix-1 a factor of 2n is expected is expected in number of solutions, because j is unknown at the end of the key-stream.
                                                                                                
		Depth            n=2                 n=3                n=4                  n=5

                             1               14                230                 2814                  27092

                             2                 4                647               154923            13406923
                     
                             3                 1                259               2129825           3641147280

                             4                 1                    .                      .                                 .
                       
                             5                 1                    .                        .                                .
                       
                             .                   .                    .                        .                                .

                             .                   .                    .                        .                                .

                          12                   1                   1                       1                               .

8.5 Probabilistic Model
One of the drawbacks of the tracking algorithms presented so far is that they cannot readily be distributed across several   processors. In addition, they tend to exhaustively analyze very few key-stream bytes instead of partially analyzing a large number as do most successful attacks. In this section, a probabilistic model of RC4 is developed and combined with the tracking attacks to obtain more effective attack using more key-stream data.

Define the probabilistic state of RC4 to be the matrix    P t i, j  = [  P (S i, j = j) ]

where t is the number of key-stream bytes output so far and P(Sa = B) is loosely the absolute probability that Sa has value B . Label the rows and columns from 0 to 2n –1 respectively. 
	 To determine P t+1 from Pt. Consider again the key-stream generation function reproduced below :
1.	Set i= i +1 mod 2 n.
          2.  Set   j =j + S[i]
          3.  Swap S[i] and S[j ].
     4.  Output S[si ] +S[sj] mod 2n as the next word in the keystream
             It can be seen that above algorithm  calculates P t+1 in a natural way.

Algorithm   (Probabilistic model state propagation)
Input: Pt , the current state probability matrix.
Output: P t+1, the next state probability matrix.
1.	Set i = t+1 mod 2 n.
2.	For a from 0 to 2 n – 1
(a)	Set  P t+1 2 n ,b  =  ∑  P 2n ,bt P i, a-b mod 2 n for b=0 to 2n -1
3.	For a  from 0 to 2 n -1, 4 excluding i
(b)	For b from 0 to 2n -1
    (i) Set   Set  P t+1 a ,b  =   P 2n , a  t+1 Pt i, b + ( 1 -  P 2n , a  t+1) Pt a, b

4.	For a from 0 to 2n  -  1
          (a) P t+1 i , a =  ∑  P 2n ,bt+1 Pb, a t       
               
The model just described illustrates the diffusive nature of the key generation algorithm : the row of the probability matrix pointed to by i is mapped in step 4 of Algorithm to a weighted average of the first 2n rows of the matrix.

8.5.1  Laddered Backtracking Attack
One use of the probabilistic model of section 8.5.1 is to combine it with the backtracking attack of Section 8.4.  For the full size RC4-8, the tracking attack by itself would require an unreasonable amount of time on even a high –end workstation. A backtrack to a depth of three remains feasible, but still leaves many possibilities for the initial permutation. Following figure illustrates an approach which allows the concatenation of many depth t searches in an attempt to obtain more information about the initial state. Backtracking is applied to successive blocks of t key-stream bytes, and the set of solutions found used to determine the probability matrix at the beginning of the block. This matrix is combined   with the one calculated from the previous stage, and the output propagated to the end of the block using Algorithm 8.5.1.
                                                                  Pb0
Ko	
	
Kt-1	
Kt                                                                          	
                               	
K2t-1	
K2t	
	
K3t-1	

	In this attack, all of the backtracking steps are independent, and can thus be carried out in parallel. This propagate and combines steps are likely to be much faster, but be done serially .The attack could succeed if the information obtained by backtracking and combining was not completely diffused by the propagation step .The probability matrix could then converge to a permutation of the identity matrix (in which case the complete initial state would be known) or at least provide a guide for a partial exhaustive search.  
              The probability matrix associated with the backtracking step can be calculated as outlined in Algorithm 7.5.2

Algorithm 8.5.2(RC4 Sate Probability Matrix Calculation )
Input : the set of solutions found by backtracking matrix.
Output: p, the corresponding state probability matrix.
1.	Initialize all entries of the probability matrix P to zero.
2.	For each possible solution (i’.j’.{S’o.S’1…..S’2 n-1})(where some of the S’t may be assigned):
                      (a) Let f be the number of unassigned elements in S’
                      (b) For t from 0 to 2n – 1 do
a.	If St has been assigned value a,  add f ! to P t,a.
b.	If St is assigned, add(f-1)! To each entry P t,b for each of the f value b not yet assigned to the s-box.
3.	Divide every entry in each row by the sum of the entries in the row , unless that sum is zero.
4.	Expeiments conducted have shown that only very partial information about the RC4 state can be obtained by this method unless most of the key-stream required for complete backtracking  analysis has been obtained. For example, the value of j could be inferred correctly from the probability matrix only after 12 key-stream bytes have been read, while analyzing 13 key-streams bytes would suffice to uniquely determine the RC4 state for n=4 .

                         The main hurdle in implementing this attack is to determine a suitable combination function, which should re-enforce agreements between the two input probability matrices. Two approaches have been tried, but both have not been successful:

1	Using the probability matrix from one propagated key-stream block to weight solutions of the backtracking algorithm in the next block. Thus if the solution 
                               (i’ , j ‘,{S’[0],S’[1],     S’[2n-1]}) is found backtracking it is given the weight
                                                                2n -1
                                 P (i = i’) P( j = j’)    P           P(Sz  = Sz  ‘)            
                                                                z =0   
                              when calculating the backtracking probability matrix.

2	Calculating the element-by-element weighted average of the two inputs to the combining function. If  P’k-1 is the output of the propagation step of block k-1 then

                                   P ``kt  =       t Pbkt  + (k-1) t P k-1
                                                              tk 
is the output of the combiner for block k.

8.5.3	Most Probable Path Backtracking Attack
 Another probability for attack is to use a probabilistic model to guide the backtracking attack. As before the backtracking executes the key-stream generation algorithm in reverse, working its way from the end to the beginning of the key-stream. Every time that the algorithm needs to assign a value to an s-box entry, it executes another backtracking search, starting from the current position in the key-stream to a depth d. Solutions found by the inner backtracking search are propagated to the current position (by applying the key-stream generation function k times), and the RC4 state probability matrix is constructed using the result. The most probable path backtracking algorithm then assigns the s-box entry by choosing the one which has the highest entry in the probabilistic matrix.

	Attacks like forward and backward tracking substantially reduce the effort needed to recover a key relative to the maximum allowable key size of the cipher. For example with a word size of 5 a nominal key-space of 2160 the RC4 initial state can be recovered in 242 steps for certain key-streams. In order to become practically relevant the attacks would need to exploit the reduced key-space for shorter keys, but to date the RC4 initialization algorithm remains a barrier. The attacks do provide an upper bound on the “effective” key length of RC4 which is lower than the number of RC4 initial states. Thus the large key-space effectively can not be used.

             Structures of the cycles generated by RC4 is also an inherent weakness because it may be possible, given a complete cycle, to obtain the entire RC4 initial state by inspection. However because RC4 is likely to have an expected length of 21699 the structure does not appear to pose a practical attack.

            One of RC4’s greatest strengths is that it can simply and effectively manipulate a larger state while a key-stream which sufficiently disguises that internal state. Attacks presented so far either attack the key schedule or the key-stream generation. Those attacking the key-stream use more data but face much greater task of recovering the full RC4 state. Successful attacks will likely need to take advantage of a yet to be discovered means of identifying RC4 states associated with short keys.	
.   	           

                            	     Chapter 9
				 Conclusion and Future Work

Present analysis has shown that RC4 has certain weaknesses. Some of the weaknesses can be exploited for cryptanalysis also. Study has shown that WEP can be considered as broken. Brute-force attack can be used only upto 40-bit crypto-system, but as the key size increases Brute force attack does not remain a feasible attack. RC4 can be distinguished from random sequence using approximately 1-GByte of key-stream. Theoretically system can be considered as a weak cryptosystem.. Any practical attack exploiting this non-randomness is yet to be developed. Attack such as Forward Tracking substantially reduce the effort to recover a key relative to the maximum allowable key size of the cipher. For example with a word size of 5 , a nominal key-space of 2160, the RC4 initial state can be recovered in 242 steps of certain key-streams.

	In order to be practically relevant, the attacks would need to exploit the reduced keyspace for shorter keys, but to date RC4 initialization algorithm remains a barrier. The attacks do provide an upper bound on the effective key length of RC4 which is lower than the number of RC4 initial states. Thus the large key-space cannot be  effectively used.

	One of the RC4’s greatest strengths is that it can simply and efficiently manipulate a large state while outputting a key-stream which sufficiently disguises the internal state. Attacks presented so far either attack the key schedule or the key-stream generation. Those attacking the key-schedule only make use of the first few key-stream bytes, and those attacking the key-stream use more data but face the much greater task of recovering the full RC4 state.

		                                     References

1.	Golic, J., “Linear Models fir a Time –Variant Permutation Generator”  IEEE Transactions on Information Theory, vol. 45, No. 7, pp. 2374-2382 Nov. 1999
2.	Golic , J., “ Analysis Mehods for (Alleged) RC4 “ Proceeding of ASIACRYPT ’99, Springer Verlag.
3.	Mister, S. and Tavares, S. “Cryptanalysis of RC4-like Ciphers “ in the workshop record of the Workshop on selected Areas in Cryptography(SAC ’98) Aug. 17-18 ,1999  pp.136-148
4.	Rivest, R., “The RC4 encryption algorithm “ RSA Data Security , Inc, Mar. 1992
5.	RSA Laborartories FAQ, Question 3.6.3 ,http:// www.rsasecurity.com/rsalabs/faq/3-6-3.html
6.	Schinier,B. “Applied Cryptography”, New York: Wiley, 19996
7.	Souradyuti Paul and Bart Preneel “A new weakness in the RC4 Keystream Generator ans an approach to improve the Security of the cipher” FSE 2004 ,Lecture Notes in Computer Science, Springer-Verlag,pp. 245-259,2004
8.	H .Finney “An RC4 cycle that can’t happen,” Post in sci.crypt
9.	A. Grosul D. Wallah,”A related key cryptanalysis of RC4,” Department  of Computer Science,Rice University, Technical Report TR-00—358, June 2000.
10.	 I .Mironov ,”Not so Random Shuffles of RC4” Crypto2002 (M . Yung, ed.) vol. 2442 of LNCS pp. 304-319, Springer Verlag,2002
11.	 A. Roos “Class of weak keys in the RC4 stream cipher” Post in sci.crypt September 1995.
12.	 D .E. knuth “The art of computer Programming “ vol.2 , Semi-numerical  Algorithms, Addision –Wesely Publishing Company,1981.
13.	 R. Jenkins, “Issac and RC4 “  Published on the internet at 	http://burtleburtle.net/bob/rand/iaasac.html
14.	 M. Pudovkina . “Statistical Weaknesses in the Alleged RC4 keystream generator” Cryptology ePrint Archive 2002 -171,IACR, 2002
15.	L. Knudsen, W. Meir, B. Preneel, V. Rijmen, S. Verdoolaege, “Analysis Methods for     Alleged RC4, “ Asiacrypt ‘98(K. Ohta, D. Pei, eds.), vol. 1514 of LNCS, pp. 327-341, Springer- Verlag, 1998.

  Appendix -1
Results of Forward Tracking

*********************************************************************

Permutation at the beginning of  encryption is : 0 1 2 3 
Index at the end of encryption is i=1  and j=1  
Permutation at the end of encryption is   0 1 2 3 
Generated key-stream of length 1 used for determining permutation is 2  

 Determined indexes are : i= 1,j= 0
 Determined Permutation s is :0 3 -1 2  

 Determined indexes are : i= 1,j= 1
 Permutation s is :-1 1 2 -1  

 Determined indexes are : i= 1,j= 2
 Permutation s is :-1 0 2 -1  

 Determined indexes are : i= 1,j= 3
 Permutation s is :2 1 -1 3  

 Determined indexes are : i= 1,j= 3
 Permutation s is :-1 2 -1 3 

 Total number of solutions are  5 

*********************************************************************

Permutation at the beginning of  encryption is : 0 1 2 3 
Index at the end of encryption is i=3  and j=1  
Permutation at the end of encryption is   0 2 3 1 
Generated key-stream of length 3 used for determining permutation is 2 1 1  

 Determined indexes are : i= 3,j= 1
 Permutation s is :-1 2 3 1 

 Total number of solutions are  1 
*********************************************************************

Permutation at the beginning of  encryption is : 0 1 2 3 4 5 6 7 
Index at the end of encryption is i=1  and j=1  
Permutation at the end of encryption is   0 1 2 3 4 5 6 7 
 Generated key-stream of length 1 used for determining permutation is 2  

 Determined indexes are : i= 1,j= 0
 Permutation s is :0 7 -1 -1 -1 -1 -1 2  

 Determined indexes are : i= 1,j= 0
 Permutation s is :0 3 -1 2 -1 -1 -1 -1  

 Determined indexes are : i= 1,j= 0
 Permutation s is :0 4 -1 -1 2 -1 -1 -1  

 Determined indexes are : i= 1,j= 0
 Permutation s is :0 5 -1 -1 -1 2 -1 -1  

 Determined indexes are : i= 1,j= 0
 Permutation s is :0 6 -1 -1 -1 -1 2 -1  

 Determined indexes are : i= 1,j= 1
 Permutation s is :-1 1 2 -1 -1 -1 -1 -1  

 Determined indexes are : i= 1,j= 2
 Permutation s is :-1 0 2 -1 -1 -1 -1 -1  

 Determined indexes are : i= 1,j= 3
 Permutation s is :-1 1 -1 3 2 -1 -1 -1  

 Determined indexes are : i= 1,j= 3
 Permutation s is :-1 7 2 3 -1 -1 -1 -1  

 Determined indexes are : i= 1,j= 3
 Permutation s is :-1 4 -1 3 -1 -1 -1 2  

 Determined indexes are : i= 1,j= 3
 Permutation s is :2 5 -1 3 -1 -1 -1 -1  

 Determined indexes are : i= 1,j= 4
 Permutation s is :-1 1 -1 -1 4 2 -1 -1  

 Determined indexes are : i= 1,j= 4
 Permutation s is :-1 3 -1 -1 4 -1 -1 2  

 Determined indexes are : i= 1,j= 4
 Permutation s is :-1 7 -1 2 4 -1 -1 -1  

 Determined indexes are : i= 1,j= 4
 Permutation s is :-1 6 2 -1 4 -1 -1 -1  

 Determined indexes are : i= 1,j= 5
 Permutation s is :-1 1 -1 -1 -1 5 2 -1  

 Determined indexes are : i= 1,j= 5
 Permutation s is :2 3 -1 -1 -1 5 -1 -1  

 Determined indexes are : i= 1,j= 5
 Permutation s is :-1 7 -1 -1 2 5 -1 -1  

 Determined indexes are : i= 1,j= 5
 Permutation s is :-1 6 -1 2 -1 5 -1 -1  

 Determined indexes are : i= 1,j= 6
 Permutation s is :-1 1 -1 -1 -1 -1 6 2  

 Determined indexes are : i= 1,j= 6
 Permutation s is :-1 4 2 -1 -1 -1 6 -1  

 Determined indexes are : i= 1,j= 6
 Permutation s is :-1 5 -1 2 -1 -1 6 -1  

 Determined indexes are : i= 1,j= 6
 Permutation s is :-1 7 -1 -1 -1 2 6 -1  

 Determined indexes are : i= 1,j= 7
 Permutation s is :2 1 -1 -1 -1 -1 -1 7  

 Determined indexes are : i= 1,j= 7
 Permutation s is :-1 2 -1 -1 -1 -1 -1 7  

 Determined indexes are : i= 1,j= 7
 Permutation s is :-1 3 2 -1 -1 -1 -1 7  

 Determined indexes are : i= 1,j= 7
 Permutation s is :-1 4 -1 2 -1 -1 -1 7  

 Determined indexes are : i= 1,j= 7
 Permutation s is :-1 5 -1 -1 2 -1 -1 7  

 Determined indexes are : i= 1,j= 7
 Permutation s is :-1 6 -1 -1 -1 2 -1 7 

 Total number of solutions are  29 

*********************************************************************

Permutation at the beginning of  encryption is : 0 1 2 3 4 5 6 7 
Index at the end of encryption is i=7  and j=0  
Permutation at the end of encryption is   7 6 3 2 1 5 4 0 
Generated key-stream of length 7 used for determining permutation is 2 5 7 2 7 3 0  

Determined indexes are : i= 7,j= 0
Permutation s is :7 6 3 2 1 5 4 0 
Total number of solutions are  1 
*********************************************************************

 Length of the permutation is 8 
 Length of text used for determining permutation is 1
 Total number of solutions are  29 
*********************************************************************

 Length of the permutation is 8 
 Length of text used for determining permutation is 2
 Total number of solutions are  76 
*********************************************************************

 Length of the permutation is 8 
 Length of text used for determining permutation is 3
 Total number of solutions are  30 
*********************************************************************

 Length of the permutation is 8 
 Length of text used for determining permutation is 4
 Total number of solutions are  3 
*********************************************************************

 Length of the permutation is 8 
 Length of text used for determining permutation is 7
 Total number of solutions are  1 

*********************************************************************

 Length of the permutation is 16 
 Length of text used for determining permutation is 1
 Total number of solutions are  173 
*********************************************************************

 Length of the permutation is 16 
 Length of text used for determining permutation is 2
 Total number of solutions are  11074 
*********************************************************************

 Length of the permutation is 16 
 Length of text used for determining permutation is 10
 Total number of solutions are  16 
*********************************************************************

 Length of the permutation is 16 
 Length of text used for determining permutation is 12
 Total number of solutions are  1 
                                 			      Appendix-2

				Results of Backward Tracking	

Length of the permutation used is : 8 
Length of the text used is : 1 
Generated key-stream is 6 
Total number of solutions are 236
*********************************************************************

Length of the permutation used is : 8 
Length of the text used is : 2 
Generated key-stream is 6 0 
 Total number of solutions are 782
*********************************************************************

Length of the permutation used is : 8 
Length of the text used is : 3 
Generated key-stream is 6 0 6 
Total number of solutions are 252
*********************************************************************

Length of the permutation used is : 8 
Length of the text used is : 4 
Generated key-stream is 
6 0 6 0 
 Total number of solutions are 57
*********************************************************************

Length of the permutation used is : 8 
Length of the text used is : 5 
Generated key-stream is 
6 0 6 0 2 
 Total number of solutions are 5
*********************************************************************

Length of the permutation used is : 8 
Length of the text used is : 7 
Generated key-stream is 
6 0 6 0 2 7 0 
 Total number of solutions are 1
********************************************************************

Length of the permutation used is : 16 
Length of the text used is : 1 
Generated key-stream is 6 
 Total number of solutions are 2788
*********************************************************************

Length of the permutation used is : 16 
Length of the text used is : 5 
Generated key-stream is 
6 8 14 14 8 
 Total number of solutions are 1148126
*********************************************************************

Length of the permutation used is : 16 
Length of the text used is : 12 
Generated key-stream is 
6 8 14 14 8 0 8 10 15 13 9 1 
Total number of solutions are 3
*********************************************************************

Length of the permutation used is : 16 
Length of the text used is : 14 
Generated key-stream is 6 8 14 14 8 0 8 10 15 13 9 1 14 11 
Total number of solutions are 1
*********************************************************************

Length of the permutation used is : 32 
Length of the text used is : 1 
Generated key-stream is 6 
Total number of solutions are 27092
*********************************************************************

Length of the permutation used is : 32 
Length of the text used is : 2 
Generated key-stream is 6 8 
Total number of solutions are 13406049

                                 

Results of WEP attack

*********************************************************************
 Key used for encryption :243 11 170 168 47 
 
 No. of initial vectors used for encryption :10000

 Most probable 3th key-byte is : 91 actual key key-byte is : 243 
 Conclusion drawn on the basis of 1 good initial vectors 
 
 Most probable 4th key-byte is : 91 actual key key-byte is : 11 
 Conclusion drawn on the basis of 0 good initial vectors 
 
 Most probable 5th key-byte is : 73 actual key key-byte is : 170 
 Conclusion drawn on the basis of 4 good initial vectors 
 
 Most probable 6th key-byte is : 245 actual key key-byte is : 168 
 Conclusion drawn on the basis of 1 good initial vectors 
 
 Most probable 7th key-byte is : 172 actual key key-byte is : 47 
 Conclusion drawn on the basis of 3 good initial vectors 
 
 Actual key is :243 11 170 168 47 
 Determined key is :91 91 73 245 172 

*********************************************************************

 Key used for encryption :243 11 170 168 47 
 
 No. of initial vectors used for encryption :100000

 Most probable 3th key-byte is : 45 actual key key-byte is : 243 
 Conclusion drawn on the basis of 9 good initial vectors 
 
 Most probable 4th key-byte is : 11 actual key key-byte is : 11 
 Conclusion drawn on the basis of 5 good initial vectors 
 
 Most probable 5th key-byte is : 170 actual key key-byte is : 170 
 Conclusion drawn on the basis of 22 good initial vectors 
 
 Most probable 6th key-byte is : 168 actual key key-byte is : 168 
 Conclusion drawn on the basis of 22 good initial vectors 
 
 Most probable 7th key-byte is : 47 actual key key-byte is : 47 
 Conclusion drawn on the basis of 28 good initial vectors 
 Actual key is :243 11 170 168 47 
 Determined key is :45 11 170 168 47
*********************************************************************
 
 Key used for encryption :243 11 170 168 47 
 
 No. of initial vectors used for encryption :400000

 Most probable 3th key-byte is : 85 actual key key-byte is : 243 
 Conclusion drawn on the basis of 30 good initial vectors 
 
 Most probable 4th key-byte is : 123 actual key key-byte is : 11 
 Conclusion drawn on the basis of 23 good initial vectors 
 
 Most probable 5th key-byte is : 170 actual key key-byte is : 170 
 Conclusion drawn on the basis of 71 good initial vectors 
 
 Most probable 6th key-byte is : 168 actual key key-byte is : 168 
 Conclusion drawn on the basis of 73 good initial vectors 
 
 Most probable 7th key-byte is : 47 actual key key-byte is : 47 
 Conclusion drawn on the basis of 107 good initial vectors 
 
 Actual key is :243 11 170 168 47 
 Determined key is :85 123 170 168 47 

 Key used for encryption :243 11 170 168 47 
 
 No. of initial vectors used for encryption :1000000
 Most probable 3th key-byte is : 85 actual key key-byte is : 243 
 Conclusion drawn on the basis of 53 good initial vectors 
 
 Most probable 4th key-byte is : 11 actual key key-byte is : 11 
 Conclusion drawn on the basis of 64 good initial vectors 
 
 Most probable 5th key-byte is : 170 actual key key-byte is : 170 
 Conclusion drawn on the basis of 180 good initial vectors 
 
 Most probable 6th key-byte is : 168 actual key key-byte is : 168 
 Conclusion drawn on the basis of 171 good initial vectors 
 
 Most probable 7th key-byte is : 47 actual key key-byte is : 47 
 Conclusion drawn on the basis of 292 good initial vectors 
 
 Actual key is :243 11 170 168 47 
 Determined key is :85 11 170 168 47 

*******************************************************************

 Key used for encryption :243 11 170 168 47 
 
 No. of initial vectors used for encryption :2000000

 Most probable 3th key-byte is : 243 actual key key-byte is : 243 
 Conclusion drawn on the basis of 99 good initial vectors 
 
 Most probable 4th key-byte is : 11 actual key key-byte is : 11 
 Conclusion drawn on the basis of 101 good initial vectors 
 
 Most probable 5th key-byte is : 170 actual key key-byte is : 170 
 Conclusion drawn on the basis of 291 good initial vectors 
 
 Most probable 6th key-byte is : 168 actual key key-byte is : 168 
 Conclusion drawn on the basis of 278 good initial vectors 
 
 Most probable 7th key-byte is : 47 actual key key-byte is : 47 
 Conclusion drawn on the basis of 584 good initial vectors 
 
 Actual key is :243 11 170 168 47 
 Determined key is :243 11 170 168 47 
**********************************************************************

 Key used for encryption :243 11 170 168 47 
 
 No. of initial vectors used for encryption :3000000

 Most probable 3th key-byte is : 243 actual key key-byte is : 243 
 Conclusion drawn on the basis of 152 good initial vectors 
 
 Most probable 4th key-byte is : 11 actual key key-byte is : 11 
 Conclusion drawn on the basis of 159 good initial vectors 
 
 Most probable 5th key-byte is : 170 actual key key-byte is : 170 
 Conclusion drawn on the basis of 468 good initial vectors 
 
 Most probable 6th key-byte is : 168 actual key key-byte is : 168 
 Conclusion drawn on the basis of 502 good initial vectors 
 
 Most probable 7th key-byte is : 47 actual key key-byte is : 47 
 Conclusion drawn on the basis of 872 good initial vectors 
 
 Actual key is :243 11 170 168 47 
 Determined key is :243 11 170 168 47 
********************************************************************