# Does “double RC4” exhibit the same weaknesses as standard RC4?

I know that RC4 is weak. However, I don't know if two RC4 streams XORed with each other can be attacked in the same way that one can, especially if $n$ bytes are dropped.

Assume keys and IVs are independent and random.

(This is purely theoretical, I don't plan on using it in practice).

• I think RC4 is broken in a known / chosen plaintext scenario and if you do double-RC4, then an attacker should no longer be able to learn the keystream of a specific instance, but only the combined keystream of both instances, but I don't know the RC4 attacks well enough to make a proper answer. – SEJPM Apr 12 '16 at 19:00
• The only weakness in RC4-drop-n (for sufficiently large n), I know of, are the n-gram biases. Those should become much smaller when combining two key-streams, so the amount of data you can produce before it becomes distinguishable should become much bigger. – CodesInChaos Apr 12 '16 at 20:38
• @CodesInChaos Rings true enough. Not sure enough for an answer? What's your doubt? Also: "Duplicate local variable n" :P – Maarten Bodewes Apr 12 '16 at 23:48
• @MaartenBodewes I'm too lazy to figure out the details. And poncho is our RC4 expert here. – CodesInChaos Apr 13 '16 at 7:14

A rough estimate would be that you need quadratically as much ciphertext, so that you can attack first one layer and then the next. That would imply >$2^{55}$ captures instead of the ~$2^{28}$ in the attack demonstration, which would likely be too much to use in practice. However, depending on whether or not the two keystreams are aligned, that could be an overestimate or an underestimate.