7
$\begingroup$

I know that RC4 is weak. However, I don't know if two RC4 streams XORed with each other can be attacked in the same way that one can, especially if $n$ bytes are dropped.

Assume keys and IVs are independent and random.

(This is purely theoretical, I don't plan on using it in practice).

Improve this question
$\endgroup$
4
  • $\begingroup$ I think RC4 is broken in a known / chosen plaintext scenario and if you do double-RC4, then an attacker should no longer be able to learn the keystream of a specific instance, but only the combined keystream of both instances, but I don't know the RC4 attacks well enough to make a proper answer. $\endgroup$
    – SEJPM
    Apr 12, 2016 at 19:00
  • 2
    $\begingroup$ The only weakness in RC4-drop-n (for sufficiently large n), I know of, are the n-gram biases. Those should become much smaller when combining two key-streams, so the amount of data you can produce before it becomes distinguishable should become much bigger. $\endgroup$
    – CodesInChaos
    Apr 12, 2016 at 20:38
  • $\begingroup$ @CodesInChaos Rings true enough. Not sure enough for an answer? What's your doubt? Also: "Duplicate local variable n" :P $\endgroup$
    – Maarten Bodewes ♦
    Apr 12, 2016 at 23:48
  • $\begingroup$ @MaartenBodewes I'm too lazy to figure out the details. And poncho is our RC4 expert here. $\endgroup$
    – CodesInChaos
    Apr 13, 2016 at 7:14

1 Answer 1

Reset to default
5
$\begingroup$

It can be attacked in the same way, but not as efficiently.

The RC4 "NOMORE" attack (pdf), for example, uses both Fluhrer-McGrew biases, which are biases towards certain pairs of values in certain positions, and Mantin's "ABSAB biases", which are repetitions of bigrams. Both of those biases will survive a XOR of two keystreams, but will be less frequent.

A rough estimate would be that you need quadratically as much ciphertext, so that you can attack first one layer and then the next. That would imply >$2^{55}$ captures instead of the ~$2^{28}$ in the attack demonstration, which would likely be too much to use in practice. However, depending on whether or not the two keystreams are aligned, that could be an overestimate or an underestimate.

It seems possible that a XOR of two independent RC4 keystreams would be too strong to practically break in such a manner, even if it was significantly below the strength implied by key size. However, distinguishing attacks require less data and are more likely to be feasible. (The attack in question decrypts cookies or other suitable data.)

Improve this answer
$\endgroup$
1
  • $\begingroup$ How would alignment affect it? $\endgroup$
    – forest ♦
    Apr 2, 2019 at 0:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.