The RC4 cipher possibly exhibits low level bias in it's long run PRNG keystream. I'm specifically excluding short term bias attacks which I'm defining as outputs < 1024 bytes. Are there any real world attacks that exploit this feature?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
0
I'm happy to have a crack at this one, providing I've understood your question correctly.
Firstly I wouldn't say the cipher possibly exhibits low level bias at any point. It experiences plenty of bias and I'll attempt to explain how we can use it to launch practical attacks. As I'd imagine you know, the strongest bias is found right at the start of the KSA, in fact there are numerous biases in the KSA, but the KSA only represents the first 256 bytes, assuming we don't drop any.
The problem is, there's plenty of evidence (not just speculation) of the biases extending to any point in the key stream (asin the PRNG or PRGA part). See this again.
Your question asked for real world attacks? Well contrary to some prior belief that because BEAST did not effect RC4 TLS, that RC4 was suitable for TLS, I'd recommend reading this as suggestion otherwise or alternatively this.
The Bar Mitzvah Crypto attack, discovered and demonstrated by Itsik Mantin in 2015, should be the best proof that the IETF were onto something when they introduced the idea to ban RC4 altogether in TLS the year before.
I know you were probably looking for something more in an answer but considering the question, this is about all there is to be said. How practical you think The Bar Mitzvah Crypto attack is, may be a question for debate.... but if we accept that NSA gathering of information, constantly with the same patterns in it (do I really need citations for this?), then it absolutely is the case that long key streams show significant enough bias and having enough of them allows data recovery and even in the circumstances of especially weak keys, key recovery all together.
If we have a heavily biased round (the KSA) and a knowingly biased round (the PRGA) plus a handful of real world exploits, we can assume the attacks will only keep getting worse, but yeah: it's already practical to use bias to attack RC4, even in RC4-drop-768.
EDIT
It's probably worth reading this too Mathy Vanhoef and Frank Piessens, go into huge detail on biases
