A CRYPTANALYTIC ATTACK ON RC4 STREAM CIPHER

Transcription

1 A CRYPTANALYTIC ATTACK ON RC4 STREAM CIPHER VIOLETA TOMAŠEVIĆ, SLOBODAN BOJANIĆ 2 and OCTAVIO NIETO-TALADRIZ 2 The Mihajlo Pupin Institute, Volgina 5, 000 Belgrade, SERBIA AND MONTENEGRO 2 Technical University of Madrid Dpto. de Ingeniería Electrónica, E.T.S.I. de Telecounicación, Ciudad Universitaria s/n, Madrid SPAIN Abstract: The RC4 strea cipher, widely used in telecounication systes, is analysed by a new cryptanalytic algorith, which exploits the cobinatorial nature of the RC4 to reduce the search space over the exhaustive search. This algorith finds the initial state of the RC4 using a sall segent of output strea by collecting the inforation available at given tie. To forulate our attack, we have proposed the tree representation of the RC4, which contains all possible inforation at given tie. Since all available inforation could not be practically exploited, we introduced an abstraction in for of the general conditions in order to consider the reasonable aount of inforation. The proposed algorith exaines the general conditions ordered in the tree structure using the hill-clibing search strategy. Each exaination produces new inforation. The solution is found when a sufficient aount of inforation is reached. Although the coplexity of this attack is significantly better than in the case of exhaustive search, it is still insufficient to enace the security of the RC4 cipher. Key-Words: telecounication systes, strea cipher, cryptanalysis, RC4, coplexity, hill-clibing Introduction The alleged RC4 strea cipher is one of a sall nuber of proposed algoriths based on the tableshuffling principle []. The RC4 initial table, derived for the secret key, varies slowly in tie steps by swapping two its entries, while the other entries in the table reain the sae. The output function deterines the position in the table whose value is used as an output sybol. A sequence of output sybols akes the strea, which is XORed with the plaintext to generate the final ciphertext. The RC4 algorith is widely used, aong others, in telecounication systes where high speed and low delay are required. The cryptanalysis of the RC4 strea cipher [2] has been ainly devoted to the statistical analysis of the RC4 output sequence [3], [4] or to the initialization weaknesses of this strea cipher [5]-[7]. It is still an open question if these results can be used in the RC4 practical cryptanalysis. The concrete cryptanalytic algoriths have been very rare in the literature up to now. The ost iportant algoriths for decipherent of RC4 are an algorith forulated by Knudsen et al. [8] and the other, very siilar one, by Mister and Tavares [9]. These algoriths find the correct initial table using a sall segent of output strea. Both of the track the steps of the RC4 algorith and according to the current content of the table, assign the values fro the set of allowed ones to unknown table entries. Since the output sequence depends on the initial table only, the knowledge of the initial table enables generating the output sequence without knowing the secret key. Although these attacks do not pose a practical threat to the security of the cipher, they could be used in copleting the internal state, given soe additional inforation [0]. Our cryptanalytic efforts regarding RC4 strea cipher were devoted to finding axiu inforation about the current state available at given tie and to forulate an algorith based on this inforation. To this end, we proposed the tree representation of the RC4, which contains the set of trees, each for one output sybol. In their nodes and branches, these trees encopass all possible inforation at given tie. However, since the trees are progressively large we could not exploit all available inforation in our attack. This proble is iinent for all other attacks, since there is no eritorious way for deterination if their actions and conclusions are based on the full set of inforation at given tie. In our algorith, we proposed an analytical abstraction, naed the general

2 conditions, of the tree inforation in order to consider a reasonable aount of inforation. Each general condition represents all conditions fro the sub-tree. For each general condition, the probability that it leads to the solution is found. To reduce the search space, we ordered the general conditions in a tree structure in respect to their probabilities. Further, we defined the cryptanalytic algorith that exaines the general conditions contained in the tree nodes using the hill-clibing search strategy. Each exaination gives new inforation, so that the aount of inforation increases in each step. After collecting sufficient inforation, soe entries, or the whole initial table are found. Although the results show that the search space in our algorith is significantly reduced over the exhaustive search, this still poses no threat in practical applications. The rest of this paper is organized as follows. In Section 2, we give a short description of RC4, and show how the tree-like inforation of the RC4 can be represented by the general conditions. Section 3 presents our search algorith for the initial table reconstruction. In Section 4 the coplexity of our algorith is estiated. We conclude in Section 5. 2 General Conditions The RC4 is a faily of algoriths paraeterized by a positive integer n (usually n = 8). As it is described in [], the internal state of RC4 at tie t consists of a perutation table S t of 2 n different n-bit values which varies slowly in tie steps by swapping two entries indexed by two n-bit pointers i t and j t. For the pointers i 0 and j 0 initialized to zero, the RC4 algorith can be described as: i t = t () j t = j t- + S t- ( t ) (2) S t ( t ) = S t- ( j t ), S t ( j t ) = S t- ( t ) (3) Z t = S t ( S t ( t ) + S t ( j t ) ) (4) Equation (4), which describes the generation of the output sybol Z t, can be written as: Z t = S t (L t ), L t = S t ( t ) + S t ( j t ) (5) The content of the S t table can be given by: S t (t) = S t- ( j t ) (6) St ( k), k jt St ( k t) = St () t, k = jt (7) Applying equations (6) and (7), it follows that equation (5) can be represented by the tree structure shown in Figure. The tree corresponds to the output sybol Z t and consists of the nodes distributed at t levels. Nodes at tree level i, 0 < i t refer to the set of all possible positions in the S t-i table where Z t could be found. The nodes are connected by the branches, which represent the conditions to pass fro one node to another. Each path in this tree represents an AND function of the conditions expressed by the branches on this path. At tie t, the RC4 can be represented by the set of t trees, each for one output sybol. These trees contain all possible inforation about the current state because they refer to all positions (and related conditions) in the S i tables, 0 i t, where the output sybols could be found. For larger t, the tree grows very fast, and the nuber of conditions becoes enorous. In striving to reduce the search space, we propose a ethod to replace the entire sets of particular conditions by the analytically forulated general conditions. Cobining equations (2)-(5), there follows: S t- (t) = j t - j t- (8) S t- (j t ) = L t - j t + j t- (9) On the basis of equations (8) and (9), it is possible to replace the whole sub-trees whose roots correspond to the expressions like S k- (k) and S k- (j k ) by ore general conditions. One general condition can be exained instead of all conditions fro the given sub-tree. For exaple, the subtree linked to the node Z t = S t- (j t ) (denoted by in Figure ) can be replaced by the general condition C (Table ) so that the condition on the path to this node L t = t is cobined with this equation and equations (8) and (9). In a siilar way, we can derive the other general conditions. Since the tree is partitioned into 2t+ parts, the general conditions at tie t, denoted as Ci, i =,,5, corresponding to the sub-trees indicated by nubers fro to 5, are given in Table. As can be seen, the conditions C3 and C4 encopass t- conditions each. Also, they do not exist at the initial tie. The expression pos(z t ) denotes the position of Z t in the initial table. All calculations are odulo 2 n. By introducing the general conditions, we neglect soe inforation, but significantly decrease the nuber of conditions that will be exained. The probabilities that general conditions lead to the solution are generally unequal and can be deterined by ultiplying the known probabilities of conditions on the path to the given node (Table 2). Since these probabilities depend on tie, the general conditions are not always, i.e. for each tie, ordered in the sae way in respect to their probability.

3 Figure. Tree representation of the RC4 algorith

4 Table. General conditions C: j t = t - Z t + j t- L t = t S t- (t) = t - Z t S t- (j t ) = Z t Level 0 A A 0 A 2 A 3 C2: j t = Z t + j t- L t = j t t S t- (t) = Z t S t- (j t ) = j t A A 2 A 3 A 4 A 5... C3 (p [2, t]): C4 (p [2, t]): Z t = j t-p+ - j t-p L t = j t-p+ t, t-, t-2,, t-p+, j t, j t-, j t-2,, j t-p+2 S t-p (t-p+) = Z t S t- (t) = j t -j t- S t- (j t ) = j t-p+ - j t +j t- Z t = L t-p+ - j t-p+ + j t-p L t = t-p+ j t, j t-, j t-2,, j t-p+2 S t-p+ (t-p+)= Z t S t- (t) = j t - j t- S t- (j t ) = t - p + - j t + j t- C5: L t t, t-, t-2,,, j t, j t-, j t-2,, j L t = pos(z t ) S t- (t) = j t - j t- S t- (j t ) = pos(z t )- j t + j t- Table 2. Probabilities of the general conditions General condition Probability C /2 n C2 (2 n - )/2 2n C3(p [2, t]) (2 n - ) p- (2 n - p)/2 n (p+) C4(p [2, t]) (2 n ) p- /2 n p C5 (2 n ) t (2 n - t)/2 n (t+) 3 Reconstruction of the RC4 initial table To forulate our attack, we organized the general conditions into the tree structure shown in Figure 2. At given tie t, this tree consists of the nodes distributed at t+ levels. The level zero serves as a tree root only, and its node is fictitious, i.e. it is not exained. Nodes at tree level i, 0 < i t correspond to the 2i+ general conditions at tie i. They represent the general conditions in a decreasing order of their probabilities, and therefore, instead as Ci, are denoted as A k i, k 2i+. By observing this order, a reduction of search space is achieved. - A A - A 2 - A 3 - A 2 A 3 A A 2-2 A A 2- A 2 A 2+ Figure 2. The tree of general conditions The inforation collected up to the given tie represents the current state of the attack. This state contains inforation about paraeters j i and L i, 0 < i t, as well as relations aong the. The general condition has to be exained taking into account the current state. As a consequence of the exaination, a new state, which contains additional inforation, is derived. In that way, the transition fro one state to another is assured, and the aount of inforation increases in each step. When the actual state has sufficient inforation, a part, or the whole initial table is found. To find the RC4 initial table, our algorith applies the basic principle of the hill-clibing search strategy []. This strategy uses the heuristic estiation function to describe how uch the final state is far fro the current state. In our case, it corresponds to the probability that soe general condition leads to the solution. Initially, there is not any inforation (epty current state). The algorith starts with the general conditions represented by the nodes at the first level. These nodes, as well as the nodes at soe other level are exained fro left to right (Figure 2) so that the ost proising states are favoured. Thus, at level k, k we first exained the A node. If the general condition represented by this node is satisfied, a new state is created, and the algorith passes to the first node at the next level, A k+ (denoted by the solid line in Figure 2). Otherwise, if a contradiction occurs, the algorith exaines the next node at the current level, in this case A k 2 (denoted by the dashed line). The siilar holds for all other nodes at the given level. As it can be observed, if the general condition in soe

5 node is successful, then the next node to be exained is always the first one at the next level. Therefore, in Figure 2, the first node at each level is specially denoted as a unique node at the level that can be reached fro the previous level. When the state with all inforation needed for recovering of the initial table is achieved, the algorith stops. The algorith guarantees that the solution will be found. 4 Coplexity Analysis The ain characteristic of each deciphering cryptanalytic algorith is its coplexity. The coplexity is easured by the total nuber of activities or operations that are necessary to perfor until the solution is found. What these activities represent, it depends on the individual algorith. Therefore, one should be very careful in the coparison of different cryptanalytic attacks regarding to their coplexity. For our algorith, the coplexity can be estiated as the nuber of general conditions (or nodes) that has to be exained until the initial cipher table is found. The reason for such a decision lies in the fact that the general condition exaination alters the state of the syste. Therefore, the coplexity actually represents the nuber of states that should be passed. Before we calculate the coplexity of our algorith, we have to deterine the nuber of levels,, in the tree given in Figure 2. This nuber represents the average nuber of output sybols that should be known to find the solution. The node in which the solution is found is et, on the average, at level. By a careful analysis of the general conditions, we concluded that in the path to the solution, each node at one level could precede any node at the next level. The only exception is that the general condition C2 at the first level could not precede the sae condition at the second level. Therefore, for the given output word length n, is the sallest nuber such that: 3. n 4 (2i + ) 2! i= 3 The values of for different n are given in Table Table 3. The required nuber of output sybols n To estiate the coplexity, it is necessary to deterine how any ties on the average each node in the tree given in Figure 2 is exained, and then to su these values. It is convenient to calculate the cuulative for each level in the tree. Let v s (i, k) denote the probability that the i-th node at the level k leads to the solution (Table 2). Then, the coplexity can be calculated in the following way: Coplexity = 0 FirstLeft = /* nuber of ties for the first left node at the level */ For k fro to - /* per level */ CriticalValue = FirstLeft For i fro 2 to 2k+ /* rest of the nodes at the level */ c = For j fro to i- /* to the i-th node */ c = c v s (j, k) CriticalValue = CriticalValue + FirstLeft * c FirstLeft = CriticalValue /* cuulative per level */ Coplexity = Coplexity + CriticalValue As can be seen, the cuulative value for one level (FirstLeft) represents the average nuber of exainations of the first node at the next level. The nuber of exainations of reaining nodes at the level is calculated by ultiplying the nuber that corresponds to the first node at this level, and the probability that the given node is reached, i.e. none of preceding nodes at this level was satisfied. The results obtained for the RC4 versions with different word size n are presented in Table 4. Although a significant iproveent over exhaustive search has been ade, it is still not enough to practically enace the security of the RC4 strea cipher. Table 4. The coplexity of cryptanalytic attack n our algorith exhaustive search 3.6* * * * * * * * * * * * Conclusions We have proposed a new cryptanalytic attack on the RC4 strea cipher. This attack finds the RC4 initial table using the inforation extracted fro the tree representation of the RC4 algorith. The inforation is analytically represented by eans of general conditions. Further, we have defined the tree of general conditions, which is searched using the hill-

6 clibing strategy. The aount of inforation increases in each step. After a sufficient aount of inforation is collected, it is possible to find ore unknown initial table entries at once. The coplexity of our attack was estiated by an analytical calculation. The results give us an additional arguent, which advocates for the security of the RC4 strea cipher. Our further research efforts will be devoted to investigating whether the inforation available in our algorith can help to iprove the tracking algoriths given in [8] and [9]. Acknowledgeents This work has been partially funded by the Spanish Ministry of Science and Technology under project nuber TIC C Dr. S. Bojanić is also supported through the "Raón y Cajal" progra fro the sae institution. References: [] B. Schneier, Applied Cryptography, Willey, New York, 996. [2] V. Toašević, S. Bojanić and O. Nieto-Taladriz, On the Cryptanalysis of Alleged RC4 Strea Cipher, in C. Anias and Y. Leido (eds.): Teleatics and its applications in distance education and inforatization of the society, vol., pp Havana: Editorial Universitaria Félix Varela, [3] J. Golić, Linear Statistical Weakness of Alleged RC4 Keystrea Generator, Advances in Cryptology - EUROCRYPT 997, LNCS, Vol. 233, Springer-Verlag, pp [4] S. Fluhrer, D. McGrew, Statistical Analysis of the Alleged RC4 Keystrea Generator, Fast Software Encryption - FSE [5] A. Roos, A Class of Weak Keys in the RC4 Strea Cipher, sci.crypt, Septeber 995. [6] A. Grosul, D. Wallach, A Related-Key Cryptanalysis of RC4, October [7] S. Fluhrer, I. Mantin, A. Shair, Weakness in the Key Scheduling Algorith of RC4, Selected Areas in Cryptography - SAC 200, LNCS 200. [8] L. Knudsen, W. Meier, B. Preneel, V. Rijen, S. Verdoolaege, Analysis Methods for (Alleged) RC4, Advances in Cryptology - ASIACRYPT 998, LNCS 54. [9] S. Mister, S. Tavares, Cryptanalysis of RC4-like Ciphers, Selected Areas in Cryptography - SAC 998, Kingston, Canada, pp [0] I. Mantin, A. Shair, A Practical Attack on Broadcast RC4. Fast Software Encryption, 8th International Workshop, FSE 200 Yokohaa, Japan, April 2-4, 200, Lecture Notes in Coputer Science 2355, p , Springer [] J. Pearl, Heuristics, Addison Wesley Publishing Copany, 984.