# Cryptanalys of “bad” RC4 implementation

I need help of cryptanalyzing a "bad" RC4 implementation to recover an encrypted text of 13742 bytes.

I don't know the key and this implementation does not utilize the drop-n routine.

But, I know the key length (256). Also, I think it is a bad implementation because the KSA is as follows:

def ksa(key) :                                   # RC4_KSA_STANDARD
S = range(256)[::-1]                           # S = range(256)

j = 0
for i in range(256) :
j = (j + S[i] + key[i]) % 256                # j = (j + S[i] + key[i % len(key)]) % 256
S[i], S[j] = S[j], S[i]

return(S)

1. The initialisation of S is inverted ([::-1])
2. j is calculated without key[i % len(key)]

My hypothesis: recover the first round with the first 256 bytes of encrypted text (because KSA is maybe more "predictable" without key[i + len(key) % 256]).

My questions are:

• Am I on the right track?
• Otherwise, is there some better strategy?
• What is the calculation to conduct the attack to obtain the plaintext message?

I have a little problem with the mathematical logic in some aspects (is my bad asperger side). If anyone would be kind enough to explain this to me?

• There might be some weird behavior when i == j – Q-Club Feb 12 '18 at 6:40