0
$\begingroup$

When performing a FMS attack, why does the attacker have to look for a specific IV, namely, in the form of (A+3, N-1, X)? Why can't he just use any IV? This might be a naive question but I really can't wrap my head around this.

$\endgroup$
2
$\begingroup$

When performing a FMS attack, why does the attacker have to look for a specific IV, namely, in the form of (A+3, N-1, X)? Why can't he just use any IV?

Actually, the attacker needn't limit himself to those specific IVs; however not just any IV works.

FMS is essentially based on three observations:

  • The first byte generated by RC4 is a function of only three elements of the permutation immediately after the KSA; namely, $S[1]$, $S[S[1]]$ and $S[ S[1] + S[S[1]]]$, and the output will be $S[ S[1] + S[S[1]]]$ (ignoring the swap operation, which doesn't bother us for the outputs we're interested in)

  • The first $n$ bytes of the some keys will, after $n$ iterations of the KSA, set $S[1]$, $S[S[1]]$ to small values ($<n$), and $S[ S[1] + S[S[1]]]$ to a value that depends on a specific key byte.

  • The other $256-n$ iterations of the KSA algorithm will, with nontrivial probability, leave the values $S[1]$, $S[S[1]]$ and $S[ S[1] + S[S[1]]]$ undisturbed (and hence for these IVs, the first byte output has a correlation with a specific key byte)

The advantage of the (A+3, N-1, X) IVs is that this (usually) sets up the condition independent of the later bytes of the RC4 key (which is the WEP key), and hence is the easiest to explain. However, you can certainly use other IVs that set up the condition properly (and if you learn/guess the initial keys of the WEP key, you can use those to select which IVs you listen to).

$\endgroup$
2
  • $\begingroup$ just one more thing, how do you know that the first $n$ bytes of the some keys will, after $n$ iterations of the KSA, set $S[1]$, $S[S[1]]$ to small values ($<n$) ? $\endgroup$
    – Trey
    Feb 28 '18 at 23:12
  • $\begingroup$ @Trey: if you know the first $n-1$ bytes of the RC4 key, you can map out exactly what happens during the first $n-1$ iterations of the KSA (and so can look at those keys that set $S[1], S[S[1]]$ small, and $S[1] + S[S[1]]$ to $n$. Then, during the $n$th KSA iteration, the byte that's swapped into $S[n]$ will depend on the $n$th byte of the byte (and other stuff that you know) $\endgroup$
    – poncho
    Mar 1 '18 at 0:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.