Re: [TLS] RC4 Considered Harmful (Was: RC4 deprecation path)

[Marsh Ray <[e-mail]>]

-----Original Message-----
From: Martin Rex
Sent: Wednesday, April 23, 2014 8:07 AM
>
>  - are parts of the RC4 algorithm invertible?

Yes, in the sense that knowledge of the ~1600 bit state allows one to determine forward *and backwards* in the stream.

> - is it possible to recreate the RC4 internal state from a certain
    amount of keystream octets.

This was done for WEP, which is particularly pathological in the way it uses the raw password as the key. 

TLS uses a unique 128 bit PRF-derived key on every handshake. I haven't heard of anyone being able to attack this method of keying.

> - how many keystream octets would be necessary

(Speculation) At least 1600/8 = 200 bytes or so.

> - will those known keystream octets have to be from specific locations
    (or consecutive)

Known attacks rely on specific locations.

(Speculation) Other attacks probably would benefit from specific locations, but would probably not require perfectly contiguous known plaintext.

>  - how big is the workfactor?

Who knows?

> I'm _not_ saying that this hasn't happened.  But without the slightest indication
> about a _real_ problem with the RC4 algorithm internals, I refuse to be terrorized.

There are real, known attacks on the RC4 algorithm internals, even with the solid keying as used by TLS.

> PS: the most attractive target for breaking is the key exchange algorithm, because
> that would make the traffic protection keys (MAC and encrypt) available
> independent of the crypto an mac algorithms and their strength.

That doesn't mean the cipher won't be attacked *too* :-)

- Marsh
-----------------------------------
Usual boilerplate disclaimers apply.