It's well-known that the RC4 keystream has significant biases that become less prominent later in the keystream. The most severe bias is in the second byte, which has a 128-1 bias towards zero. Other biases remain, and it's typically recommended to drop between 768 and 3072 bytes of the keystream.

Will dropping one more byte always reduce the bias, or is there a point when the bias is as low as it is going to get and it won't get lower as the keystream goes on? It doesn't matter if the bias is negligible.

Note that I am only talking about short-term biases, not long-term ones which RC4-dropN can't solve.

Does an N exist that results in minimum bias in RC4-dropN?

  • $\begingroup$ I'm reading the Vanhoef and Piessens paper from 2015 to see if I can find the answer myself. If this is a particularly stupid question (it probably is) and the answer turns out to be obvious, I'll delete or self-answer it. $\endgroup$ – forest Aug 3 '19 at 9:11
  • $\begingroup$ If I understand your last paragraph right, you seem to actually be asking whether the asymptotic long-term level of bias is actually attained within a finite number of steps, or whether the asymptote is only approached but never reached. Is that correct? $\endgroup$ – Ilmari Karonen Aug 3 '19 at 12:06
  • $\begingroup$ @IlmariKaronen I am asking whether a minimum level of bias can be reached in a finite number of steps. $\endgroup$ – forest Aug 3 '19 at 12:22
  • $\begingroup$ please point to the right paper, there are a few with these authors. also, proving convergence rates in random processes is notoriously hard, in general. $\endgroup$ – kodlu Aug 4 '19 at 1:23
  • $\begingroup$ @kodlu The paper I referenced in my first comment is rc4nomore.com/vanhoef-usenix2015.pdf. $\endgroup$ – forest Aug 4 '19 at 5:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.