Finding an internal state of RC4 stream cipher

Abstract

The RC4 is a stream cipher widely deployed in software applications due to its simplicity and efficiency. The paper presents a cryptanalytic attack that employs the tree representation of this cipher and introduces an abstraction in the form of general conditions for managing the information about its internal state. In order to find the initial state, the tree of general conditions is searched applying the hill-climbing strategy. The complexity of this attack is lower than that of an exhaustive search. The attack is derived from a general cryptanalytic approach for a class of table-shuffling ciphers, whose next-state function permutes the table entries. Incorporating the general conditions in the existing backtracking algorithm, the estimated complexity of the cryptanalytic attack is decreased below the best published result but the RC4 still remains a quite secure cipher in practice.

Introduction

The RC4 is a stream cipher widely deployed in software applications due to its simplicity and efficiency. The RC4 Keystream generator (Ron’s code #4, RSA Data Security Inc., 1987) is based on the table-shuffling principle and is designed for fast software implementation [14]. It is used in many commercial products, including Lotus Notes, Oracle Secure SQL, Microsoft Windows, as well as some standards such as Secure Sockets Layer standard SSL 3.0.

The RC4 is, in fact, a family of algorithms parameterized by a positive integer n, which denotes the width of a table entry and the width of output symbol in bits, as well (usually n = 8). The initial table is derived from a secret key. The table varies slowly in time steps by swapping two entries indexed by two pointers, while all other entries in the table remain the same. Then, the output function determines the position in the table whose value is used as the output symbol. A sequence of output symbols makes the stream, which is XORed with the plaintext to generate the final ciphertext. Since the output sequence depends on the initial table only, the knowledge of this table enables generating the output sequence without knowing the secret key.

The cryptanalysis research of the RC4 stream cipher has been mainly devoted to the statistical analysis of the RC4 output sequence [1], [3], [4], [7], [10], [11], or to the RC4 initialization weaknesses [2], [5], [13] that can serve for the RC4 distinguishing. It is still an open question if these results can be used in the RC4 practical cryptanalysis. Although this stream cipher was published in 1994, concrete cryptanalytic algorithms have been very rare in the literature up to now. Actually nowadays, the most important algorithms for decipherment of RC4 are an algorithm formulated by Knudsen et al. [6] and the other, very similar one, by Mister and Tavares [9]. These algorithms exploit the combinatorial nature of RC4 to reduce the search space as an improvement over the exhaustive search. Although without a real threat for the security of the cipher, the mentioned algorithms could be used in completing the internal state, given some additional information [8].

In this paper, the efforts regarding RC4 stream cipher cryptanalysis are devoted to finding maximum amount of information about the current state available at a given time and to formulating a cryptanalytic attack based on this information. Therefore, we propose the tree representation [16] of the RC4 algorithm which contains a set of trees, each for one output symbol. The nodes and branches of these trees encompass all possible information at a given time. However, since the trees are progressively large, we could not exploit practically all available information in the attack. This problem is immanent in all other attacks. In our algorithm we propose an analytical abstraction named the general conditions of the tree information in order to consider a reasonable amount of information [15]. Each general condition practically represents all conditions from a subtree. The general conditions are organized into the tree structure. Our algorithm searches this tree applying the hill-climbing strategy to find the internal state. The information gained from general conditions can also be used in other attacks on RC4 cipher and increase their efficiency. In this paper we suggest the modification of the backtracking algorithm that is given in Ref. [6].

The rest of the paper is organized in the following way. The general approach to the cryptanalysis of the stream ciphers based on table permutation is described in Section 2 with corresponding subsections about tree representation of information, the search algorithm and complexity analysis. Section 3 describes how the general approach is applied to the RC4 cryptanalysis. Section 4 presents the modified backtracking algorithm where corresponding subsections show the modification of general conditions, the effects of modified conditions examination and the complexity analysis. Conclusions are given in Section 5.