See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/275605075

RC4 stream cipher and possible attacks on WEP

Article in International Journal of Advanced Computer Science and Applications · March 2012
DOI: 10.14569/IJACSA.2012.030319

CITATIONS READS
10 1,517

2 authors:

Lazar Stosic Milena Bogdanović

Institute of management and knowledge, Skopje, Macedonia Univerzitet Metropolitan
51 PUBLICATIONS 159 CITATIONS 25 PUBLICATIONS 27 CITATIONS

SEE PROFILE SEE PROFILE

Some of the authors of this publication are also working on these related projects:

Graph Invariants View project

Comparative aspects of the professional-pedagogical preparation of the students - future children's teachers / on the example of VTU View project

All content following this page was uploaded by Milena Bogdanović on 10 May 2015.

The user has requested enhancement of the downloaded file.

 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 3, No. 3, 2012

RC4 stream cipher and possible attacks on WEP

Lazar Stošić Milena Bogdanović
College for professional studies educators Teacher Training Faculty
Aleksinac, Serbia University of Niš
Vranje, Serbia

Abstract—In this paper we analyze and present some weaknesses (The Key Scheduling Algorithm and the Pseudo-Random Generation
and possible attacks on the RC4 stream cipher which were Algorithm)
published in many journals. We review some advantages and In practical applications, stream ciphers are used with a
disadvantages which come from several authors, as well as session key which is derived from a shared secret key and an
similarities and differences which can be observed in the Initial Value (IV, which is transmitted unencrypted). The
published results. Also, we analyze the Key Scheduling Algorithm derivation of the session key can be done in various ways, such
(KSA) which derives the initial state from a variable size key, and as concatenated ager the IV.
strengths and weaknesses of the RCS stream cipher. Using
examples from other papers, we show that RC4 is completely Section I is the introduction to this paper. Section II
insecure in a common mode of operation which is used in the presents the features of RC4 family ciphers, strengths and
widely deployed Wired Equivalent Privacy protocol (WEP, which weaknesses of the RC4 stream cipher and existing attack
is part of the 802.11 standard). methods aimed at them.
Section III shows the Wired Equivalent Privacy protocol,
Keywords-RC4 stream cipher; KSA; WEP; security of WEP; WEP
attack.
used for encrypting wirelessly transmitted packets on IEEE
802.11 networks.
I. INTRODUCTION Section IV presents discussion of what this study has
RC4, a fast output-feedback cipher, is one of the most shown, strengths and weaknesses of the methods, how the
widely used cryptosystems on the Internet, commonly used as results support the current literature or refute current
the default cipher for SSL/TLS connections [20]. It was knowledge and their impact on current thinking or practice.
designed by Ron Rivest in 1987 for RSA Data Security, Inc., Section V concludes this paper.
and kept as a trade secret until it leaked out in 1994 and is now
available for public analysis [18]. RC4 is currently being II. RC4 STREAM CIPHER
standardized by the IETF under the name “Arcfour” [23]. RSA RC4 has a secret internal state which is a permutation of all
DSI did not confirm that the published algorithm is in the RC4 N=2n possible n bits words, along with two indices in it. In
algorithm, but experimental tests showed that it produces the practical applications, n=8, and thus RC4, has a huge state of
same outputs as the RC4 software. The RC4 key stream (1)
generation algorithm updates the RC4 internal state and
generates one byte of key stream. The key stream is XORed to
log 2 [ [256]  S 256 )  log 2 (216  256!)  1700 
2
the plaintext to generate the ciphertext. RC4 is comprised of
two algorithms: the Key Scheduling Algorithm (KSA) which
turns a random key (whose typical size is 40-256 bits) into an The initial state is derived from a variable-size key by a
initial permutation S of {0,..., N-1}, which uses the secret key Key-Scheduling Algorithm (KSA), and then RC4 alternately
to create a pseudo-random initial state, and the Pseudo Random modifies the state (by exchanging two out of the N values) and
Generation Algorithm (PRGA), which generates the pseudo- produces an output (by picking one of the N values).
random stream to generate a pseudo-random output sequence.
Both algorithms are presented in Fig. 1. RC4's internal state consists of a 256-byte array S, defining
a permutation, as well as two integers 0 ≤ i; j ≤ 255 acting as
pointers into the array.
The RC4 key setup initializes the internal state using a key
K of up to 256 bytes. RC4 keys are 2048 bits long, and their
internal state consists of two counters i and j (each within
�0�255_) plus an array of 256 8-bit bytes, called the S-box.
The S-box is initialized using the key K as follows (2):

Figure 1. The RC4 Algorithms

110 | P a g e
www.ijacsa.thesai.org
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 3, No. 3, 2012

7) XOR the final key stream with the data to be encrypted

to give cipher text.
One of the weaknesses of RC4 initialization mechanism is a
major statistical bias in the distribution of the first output
words. This bias makes it trivial to distinguish between several
hundred short outputs of RC4 and random strings by analyzing
their second word. This weakness can be used to mount a
practical ciphertext-only attack on RC4 in some broadcast
applications, in which the same plaintext is sent to multiple
recipients under different keys. This unique statistical behavior
(2) is independent of the KSA, and remains applicable even when
RC4 starts with a totally random permutation.
Each next byte b of the keystream is produced using (3):
RC4 Strengths:
Some of RC4 Strengths [16]:
1) The difficulty of knowing which location in the table is
used to select each value in the sequence.
2) A particular RC4 key can be used only once.
(3) 3) Encryption is about 10 times faster than DES.
For shorter key, the key is repeated as many times as RC4 Weaknesses:
necessary to fill the 2048-bit key. Once the S-box is initialized
with the key, the RC4 algorithm is a loop that updates the Some of RC4 weaknesses [17] and [16]:
internal state of the S-box and returns a byte of keystream. RC4 1) The RC4 algorithm is vulnerable to analytic attacks of
only protects the secrecy of a message, not its integrity. Other the state table [6] and [15].
measures, such as the use of cryptographic checksums, are 2) WEAK KEYS: these are keys identified by cryptanalysis
commonly used along with RC4.
that is able to find circumstances under which one or more
RC4 stream cipher is used to protect internet traffic as part generated bytes are strongly correlated with small subset of
of the SSL (Secure Socket Layer) and TLS (Transport Layer the key bytes. These keys can happen in one out of 256 keys
Security) protocols, and to protect wireless networks as part of generated [10], [5] and [15].
the WEP (Wired Equivalent Privacy) and WPA (Wi-Fi Many ways to break RC4 are classified as Distinguishing
Protected Access) protocols. This attack was described by Attack, which makes use of the bias in output sequence. In
Fluhrer, Mantin and Shamir. It is a symmetric key algorithm 2004, some new stream ciphers were proposed, to which
and it is an important class of encryption algorithms. They resistance to the attacks aimed at RC4 was added. They are
encrypt individual characters (usually binary digits) of a exemplified by VMPC, a stream cipher proposed by B. Zoltak
plaintext message one at a time, using a simple time-dependent [4], and RC4A, an RC4 family algorithm improved by S. Paul
encryption transformation. The Blum-Goldwasser probabilistic and B. Preneel [11].
public-key encryption scheme described in [7] is an example of
asymmetric stream cipher. The same algorithm is used for both III. WIRED EQUIVALENT PRIVACY
encryption and decryption as the data stream is simply XORed Today, PC cards are most frequently used in home and
with the generated key sequence. The key stream is completely business networks. All computers have a security protocol
independent of the plaintext used. It uses a variable length key called Wired Equivalent Privacy (WEP). A device using an
from 1 to 256 bits to initialize a 256-bit state table. The state 802.11 card is configured with a key, that in practice usually
table is used for Subsequent generation of pseudo-random bits consists of a password or a key derived from a password.
and then to generate a pseudo-random stream which is XORed
with the plaintext to give the cipher text. Wired Equivalent Privacy (WEP) is a protocol for
encrypting wirelessly transmitted packets on IEEE 802.11
The steps for RC4 encryption algorithm are as follows [17] networks. In a WEP protected network, all packets are
and [16]: encrypted using the stream cipher RC4 under a common key,
1) Get the data to be encrypted and the selected key. the root key1 Rk. Rk is the WEP or root key and IV is the
2) Create two string arrays. initialization vector for a packet. K = Rk║IV is the session or
3) Initiate one array with numbers from 0 to 255. per packet key. X is a key stream generated using K. The WEP
protocol is designed to provide privacy to packet based
4) Fill the other array with the selected key.
wireless networks based on the 802.11b standard [19]. The
5) Randomize the first array depending on the array of the WEP encrypts by taking a secret key and a per-packet 3 byte
key. IV, and using the IV followed by the secret key as the RC4
6) Randomize the first array within itself to generate the key. The attacker is able to retrieve the first byte of the RC4
final key stream. output from each packet.

111 | P a g e
www.ijacsa.thesai.org
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 3, No. 3, 2012

WEP uses a 40-bit secret key (which was the largest easily A. The WEP Attack
exportable key when WEP was designed), shared between all The attack starts with the known IV as a basis, and
the users and the network access point. For every packet, the repeatedly applies the sub-attack in order to recover all the
sender chooses a new 24 bit Initialization Vector (IV), and the keywords in the secret key SK. To conduct an attack, the
64-bit RC4 key is the concatenation of the chosen IV cryptanalyst needs the first output word of a large number of
(occurring first) and the shared key (occurring last). Such an RC4 streams along with the IV that was used to generate each
IV-based mode of operation is commonly used in stream one of them. Since in WEP the IVs are transmitted in the clear
ciphers in order to generate different PRGA outputs from the and the first message word in most packets is a known
same long term key, and the frequent resetting of the PRGA is constant, these requirements are automatically satisfied.
designed to overcome the unreliable nature of the Wireless
LAN environment. With about 60 such IVs, the attacker can re-derive the key
byte with reasonable probability of success. The number of
The simplest weakness is the small size of the secret key packets required to obtain that number of IVs depends on the
and the IV: A 40-bit key can be recovered by an exhaustive exact IVs that the sender uses. Although the 802.11b standard
search in less than one day. The limited size (224) of the IV does not specify how an implementation should generate these
space implies that IVs are reused during the encryption of IVs, common practice is to use a counter to generate them. We
different packets. This mode can be attacked by constructing a now analyze the performance of this attack for two different
dictionary of all the 224 IVs along with their corresponding key counter modes. If the counter does not start from zero, the
streams. WEP defines no easy mechanism for changing the attacker has an alternative strategy available to him. If the
shared key, and thus the key is usually changed only attacker assumes the first two bytes of secret key, than for each
infrequently, increasing the attacker’s chance to construct this initial IV byte, there are approximately 4 settings of the
dictionary. remaining two bytes that set up the permutation as required to
The first “real” attack makes it possible to derive an re-derive a particular key byte.
arbitrarily long key in time which grows only linearly with its Fluhrer S., Mantin I. and Shamir A. in their work Attacks
length in the weakest attack model of known plaintext and IV on RC4 and WEP explain that the first x words of the KSA key
developed in [12], and is outlined in the next section. are known. This makes it possible to simulate the first x rounds
A first analysis of the design failures of the WEP protocol of the KSA and compute the permutation Sx-1 and the indices ix-
was published by Borisov, Goldberg and Wagner [9] in 2001, 1 and jx-1 at that point. The next value of i is also known (ix=x)
which showed that the IV merely protects against random but the next value of j(jx) depends on the unknown target
errors but not against malicious attackers. They observed that keyword K[x] (since jx=jx-1+Sx-1[x]+K[x]) and thus each of
old IV values could be reused, thus allowing to inject the values jx and K[x] can be easily derived from the other.
messages. Consequently, given Sx[x], we can compute which value was in
position jx in the known permutation Sx-1, and by inverting this
RC4 are specified. Several PC cards reset IVs to zero every permutation, we can recover jx itself.
time they are initialized, and then increment them by one for
every use. This results in high likelihood that keystreams will IV. DISCUSSION
be reused, leading to simple cryptanalytic attacks against the RC4 is a symmetric key algorithm. Stream cipher is an
cipher, and decryption of message traffic. important class of encryption algorithms. They encrypt
Fluhrer, Mantin and Shamir presented a related key individual characters of a plaintext message one at a time, using
ciphertext-only attack against RC4 [13] as used in WEP. In a simple time-dependent encryption transformation. RC4 is
WEP, the key scheduling algorithm uses either a 64-bit packet comprised of two algorithms: the Key Scheduling Algorithm
key (40-bit secret key plus 24-bit IV) or a 128-bit key (104-bit (KSA) which turns a random key (whose typical size is 40-256
secret key plus 24-bit IV) to set up the RC4 state array, S, bits) into an initial permutation S of {0,..., N-1}, which uses the
which is a permutation of {0,…, 255}. The output generator secret key to create a pseudo-random initial state, and the
uses the state array S as well as two counters, i and j, to create a Pseudo Random Generation Algorithm (PRGA), which
pseudorandom sequence. generates the pseudo-random stream to generate a pseudo-
random output sequence.
In order for this attack to work, the IVs need to fulfill a so-
called "resolved condition". This attack was suspected to be We see that some of RC4 strengths were: the difficulty of
applicable to WEP, which was later demonstrated by Stubble- knowing which location in the table is used to select each value
field et al. [1]. Approximately 4 million different frames need in the sequence; a particular RC4 key can be used only once;
to be captured to mount this attack. Vendors reacted to this encryption is about 10 times faster than DES. On the other side,
attack by filtering IVs fulfilling the resolved condition, so- RC4 weaknesses were: The RC4 algorithm is vulnerable to
called “weak IVs”. On the other side, Klein [3] showed an analytic attacks of the state table; WEAK KEYS: these are keys
improved way of attacking RC4 using related keys that does identified by cryptanalysis that is able to find circumstances
not need the "resolved condition" on the IVs and gets by with a under which one or more generated bytes are strongly
significantly reduced number of frames. correlated with small subset of the key bytes.

112 | P a g e
www.ijacsa.thesai.org
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 3, No. 3, 2012

In current literature we can see that many ways to break [2] A. Bittau, M.Handley, and J. Lackey, “The final nail in WEP's coffin. In
RC4 are classified as Distinguishing Attack. These ways make IEEE Symposium on Security and Privacy”, pp. 386-400, IEEE
Computer Society, 2006.
use of the bias in output sequence. The first “real” attack makes
[3] A. Klein, “Attacks on the RC4 stream cipher”, volume 48 Issue 3, pp.
it possible to derive an arbitrarily long key in time which grows 269 – 286, Designs, Codes and Cryptography, September 2008.
only linearly with its length in the weakest attack model of doi>10.1007/s10623-008-9206-6
known plaintext and IV. A first analysis of the design failures [4] B. Zoltak: “VMPC One-Way Function and Stream Cipher,” Fast
of the WEP protocol showed that the IV merely protects Software Encryption, FSE 2004, LNCS 3017, pp.210-225, Springer-
against random errors but not against malicious attackers. They Verlag, 2004.
observed that old IV values could be reused, thus allowing to [5] E. Biham and Y. Carmeli, “Efficient Reconstruction of RC4 Keys from
inject messages. Internal States”, FSE 2008, pp. 270-288, vol. 5086, Lecture Notes in
Computer Science, Springer.
In the last few decades many stream ciphers have been [6] G. Paul, S. Rathi and S.Maitra, “Non-negligible Bias of the First Output
proposed. Most of them are easy to implement on hardware but Byte of RC4 towards the First Three Bytes of the Secret Key”,
their performance is slow when implemented on software. Proceedings of the International Workshop on Coding and Cryptography
(WCC) 2007, pp. 285-294 and Designs, Codes and Cryptography
Since RC4 is such a widely used stream cipher, it attracted Journal, pp. 123-134, vol. 49, no. 1-3, December 2008.
considerable attention in the research community since it was
[7] M. Biriyukov, A. Shamir, and D. Wagner, “Real time cryptanalysis of
proposed. The strength of the RC4 key does not grow linearly A5/1 on a PC”, FSE: Fast Software Encryption, 2000., pp. 1-18.
with the increase in the key length. [8] M. Akgun, P.r Kavak, H. Demirci, “New Results on the Key Scheduling
Algorithm of RC4”, INDOCRYPT 2008, pp. 40-52, vol. 5365, Lecture
V. CONCLUSIONS Notes in Computer Science, Springer.
The main contribution of this paper is the presentation of [9] N. Borisov, I. Goldberg, and D. Wagner, “Intercepting mobile
the established and proven deficiencies of RC4 which are communications: the insecurity of 802.11”, In ACM MobiCom 2001, pp.
180-189. ACM Press, 2001.
caused by its extreme simplicity. Based on the results of
[10] R. Basu, S. Maitra, G. Paul and T. Talukdar, “Some Sequences of the
numerous research studies, we can conclude that the Secret Pseudo-random Index j in RC4 Key Scheduling”, Proceedings of
initialization of the pseudo-random index j to 0 seems to be the the 18th International Symposium on Applied Algebra, Algebraic
most problematic operation, and both the second byte bias and Algorithms and Error Correcting Codes (AAECC), June 8-12, 2009,
the IV weakness could be avoided by using a more complex Tarragona, Spain, pp. 137-148, vol. 5527, Lecture Notes in Computer
initialization of j. Possible methods for initializing j are to use j Science, Springer.
from the end of the KSA or to give it the value of one of the [11] S. Paul, and B. Preneel, “A New Weakness in the RC4 Keystream
Generator,” Fast Software Encryption, FSE 2004, LNCS 3017, pp.245-
key words. The invariance weakness and the IV weakness are 259, Springer-Verlag, 2004.
inherent consequences of the structure of the KSA. [12] S. R. Fluhrer, I. Mantin, and A. Shamir, “Weaknesses in the key
For the RC4 stream cipher, every key has a family of scheduling algorithm of RC4”, In SAC`2001, 2001.
related keys which result in a substantially similar keystream. [13] S. R. Fluhrer, I. Mantin, and A. Shamir, “Weaknesses in the key
scheduling algorithm of RC4”, In Serge Vaudenay and Amr M. Youssef,
The strength of the RC4 key does not grow linearly with the editors, Selected Areas in Cryptography 2001, volume 2259 of Lecture
increase in the key length. If RC4 is deployed using keys Notes in Computer Science, pp. 1-24. Springer, 2001.
longer than the customary 128 bits, we advise discarding the [14] S. Dorhofer, “Empirische Untersuchungen zur WLAN-Sicherheit mittels
first 256 bytes of the keystream. Wardriving”, Diplomarbeit, RWTH Aachen, September 2006. (in
German).
A perfect initialization mechanism is not easy to achieve. A
[15] V. Tomašević, S. Bojanić, O. Nieto-Taladriz, “Finding an internal state
common mode of operation to achieve these contradicting of RC4 stream cipher”, Information Sciences, Volume 177, issue 7, 01.
goals is to discard a prefix of output bits. These mute rounds April, 2007, pp.1715-1727.
usually disconnect the generated stream from the initialization [16] W. Mao, Modern Cryptography Theory and Practice, Prentice Hall, New
process, and improve the “randomness” of the generated Jersey, 2004.
stream. [17] W. Stilings, Cryptography and Network Security Principles and
practices, Fourth Edition, PEARSON, USA, 2006.
The discarded prefix should also grow in the same way [18] B. Schneier, Applied Cryptography, John Wiley and Sons, New York,
(exponentially) when enlarging RC4 words into 16 bits (which 2nd edition, 1996.
is sometimes recommended for faster encryption of large [19] LAN/MAN Standard Committee, Wireless LAN medium access control
amount of data). The expression of the invariance weakness (MAC) and physical layer (PHY) specifications, 1999 edition, IEEE
spreads over several hundred words in RC416 and eliminating standard 802.11, IEEE Computer Society, 1999.
only 256 words is not sufficient when N is larger. The reduced [20] T. Dierks and C. Allen, The TLS Protocol, Version 1.0, Internet
version RC46 can be attacked with practical complexity, while Engineering Task Force, January 1999.
for stronger version (RC4n>6) it is possible to mount enhanced [21] E. Tews, R. P. Weinmann and A. Pyshkin, “Breaking 104 bit WEP in
(but impractical) attacks. less than 60 seconds”, IACR Eprint Server,
http://eprint.iacr.org/2007/120.pdf , number 2007/120, Accessed April 1,
2007.
REFERENCES
[22] S. Fluhrer, I. Mantin, A. Shamir, “Attacks on RC4 and WEP, RSA
[1] A. Stubble, J. Ioannidis, and A. D. Rubin, “A key recovery attack on the Laboratories”,
802.11b wired equivalent privacy protocol (WEP)”, ACM Transactions http://www.rsa.com/rsalabs/cryptobytes/cryptobytes_v5n2.pdf Volume
on Information and System Security, Volume 7 Issue 2, May 2004, pp. 5, No. 2, Summer/Fall 2002
319-332.

113 | P a g e
www.ijacsa.thesai.org
 (IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 3, No. 3, 2012

[23] K. Kaukonen and R. Thayer, “A Stream Cipher Encryption Algorithm Milena Bogdanović is the assistant professor at the
Arcfour”, http://tools.ietf.org/html/draft-kaukonen-cipher-arcfour-03 , Theacher Training Faculty in Vranje, Serbia (major in
Internet Engineering Task Force (IETF), July 1999. Mathematics and Informatics – Mathematics 1,
Mathematics 2, Elementary mathematical concepts, IT in
AUTHORS PROFILE Education, Educational technology, Elements of
Lazar Stošić received the Ph.D. degrees of computer sciences mathematics). She is the Reviewer of international journals
on Faculty of Informatics and Information Technology, Novi - IJACSA – International Journal of Advanced Computer
Pazar, Serbia. Professor on College for professional studies Science and Applications; Member of the editorial boards of international
educators, Aleksinac, Serbia. Member of the Society for media journals – International Journal of Computer Systems and Applications –
and science, e-learning center at the University of Zurich since Inernational Scientific Press; Reviewer of the Book of solved tasks in
2009. - Gesellschaft für Medien in der Wissenschaft (GMW) e. Mathematics 2; Experience in teaching in secondary school and university;
V., E-Learning Center der Universität Zürich, Zürich. Member of the Society Participant in numerous seminars and training for eduational reform, active
for Computer Science, Germany since 01.07.2009. - Gesellschaft für learning, Lifelong Learning, Mathematics and Applications. She is the author
Informatike e.V. (GI), German Informatics Society, Mitgliedsnummer: GI of two books and of about 40 of published scientific papers in the field of the
59631 AhrstraBe 45, 53175 Bonn, Germany. His research interests include mathematics and computer science. Her professional papers discuss problems
Information Technology, Computer System, Computer Education and in the field of applications of multimedia in teaching, combinatorial
Computer Distance Learning. optimization, genetic algorithms, directable automata.

114 | P a g e
www.ijacsa.thesai.org
View publication stats