I've been exploring around, trying to understand if such thing is even possible. I have some RC4 ciphertext which I know it's plaintext and I would like to extract the key just from cipher and plaintext. While reading through "RC4 Stream Cipher and it's variants" by Goutam Paul I came a cross (4.1.1) PRGAreverse algorithm on p.65 (Chapter 4.1) providing candidates for S by supplying to it a state of S and state number:
As both KSA and PRGA are deterministic, I guess this PRGAreverse algorithm should work but I'm having difficulties understanding the probability for each candidate. I mean, let's say I get 5 candidates for S[i], i=0, then how should I know which is the right one without trying to use it against the ciphertext nor plaintext?