Citation Context

...ained results in a specially designed attack algorithm to recover repeatedly encrypted plaintexts. Our double-byte bias attack is again close to being practical. In our experiments, we focus on our attack’s ability to correctly recover 16 consecutive bytes of plaintext, roughly equating to an HTTP cookie. With 13 ·230 encryptions of the plaintext, we achieve a success rate of 100% in recovering all 16 bytes. We obtain better success rates for restricted plaintexts, as in the single-byte case. For further details, see Section 5. 1.2 Related Work In independent and concurrent work, Isobe et al. [13] have considered the security of RC4 against broadcast attacks. They present attacks based on both single-byte and multi-byte biases. They identify three biases in the first output bytes Zr of RC4 that we also identify (specifically, the biases towards Z3 = 0x83, Zr = r, and Zr =−r when r is a multiple of 16) as well as a new conditional bias Z1 = 0|Z2 = 0. The single-byte bias attack in [13] only considers the strongest bias at each position, whereas our single-byte bias attack simultaneously exploits all biases in each keystream position. Specifically, we use Bayes’s law to compute the a pos...

Citation Context

...relation between the keystream bytes with the Key and/or IV. The results under item 1 have been extensively used in the broadcast attack model, and some important results in this area can be found in =-=[1,6,8,9,11,19]-=-. These biases directly work on the generic RC4 cipher [6] as well when RC4 is used in protocols like WPA and TLS [1]. In particular, the work of [1] received a lot of attention due to its impact on c...

Citation Context

...short-term biases towards zero [14], Sen Gupta, Maitra, Paul and Sarkar proof of first byte bias [24], Sarkar second byte negative bias [22], Isobe, Ohigashi, Watanabe and Morii full broadcast attack =-=[8]-=-, and the most recent results by AlFardan, Bernstein, Paterson, Poettering and Schuldt [1, 4]. Broadcast attack by AlFardan et. al. [1,4]: The most prominent attempt at identifying all possible single...

Citation Context

...n also be used in broadcast schemes, when the same plaintext is encrypted with different keys. In this mode, the attacker often tries to find unconditional or conditional biases on the keystream (see =-=[41,38,63,26,1,52]-=- for the most relevant attacks.). WEP Related Work. The WEP key recovery process is harder in practice than in theory. Indeed, some bytes of the keystream may be unknown (see the Appendix of [79] for ...