More 40-bit RC4 nonsense

-----BEGIN PGP SIGNED MESSAGE-----

   If I recall correctly, the first byte out of the RC4 stream has
about a 40% chance of being the first byte of the key. Thus, if the
40-bit "secret" part of the key is the _beginning_ of the full 128-bit
key, then the keyspace is effectively reduced by about seven bits,
meaning that I would be able to crack a key on my PC in a couple of
days or so.
   Of course, if the "clear" 88 bits went first, there would be no
advantage whatsoever. The SSL document very carefully does not say
how they combine the two key parts to form the 128-bit key. Does
anyone know?

Raph

-----BEGIN PGP SIGNATURE-----
Version: 2.6

iQCVAwUBLu3cI/4BfQiT0bDNAQEToQQAtcy2v0sBd+g5GBrm+Pa1AykqS4tTctfu
EYga7kPry4wvGmI7/HpD+SVVDQRcJe+O9CxH9cpvRgBRIBhyvsFXVBSTW0OTJgXb
1bYh5qerD5J/gXAs0XWIp0+Hj8GqeTIRkFTseU4MDcDfQ7tOSEFvul97iSNYIytX
AMkmAEmMXxU=
=S80T
-----END PGP SIGNATURE-----

Raph Levien writes:

>   If I recall correctly, the first byte out of the RC4 stream has
>about a 40% chance of being the first byte of the key. Thus, if the
>40-bit "secret" part of the key is the _beginning_ of the full 128-bit
>key, then the keyspace is effectively reduced by about seven bits,
>meaning that I would be able to crack a key on my PC in a couple of
>days or so.
>   Of course, if the "clear" 88 bits went first, there would be no
>advantage whatsoever. The SSL document very carefully does not say
>how they combine the two key parts to form the 128-bit key. Does
>anyone know?

Why did the NSA require that an application using the Sapphire Stream Cipher
be limited to a _32-bit_ session key instead of the well-known _40-bit_
limit for RC4?  I wonder if there are other key bit leaks that cover the other 
60%?

Hmmm....

On Dec 13,  2:59pm, Michael Johnson wrote:
> Why did the NSA require that an application using the Sapphire Stream Cipher
> be limited to a _32-bit_ session key instead of the well-known _40-bit_
> limit for RC4?  I wonder if there are other key bit leaks that cover the
other
> 60%?

It could also be because they've made an investment in custom hardware
to "crack" RC4 by justifying it in terms of the volume which will result
from the special export status, whereas the volume of sapphire use they are
expecting is lower and so they'll be using off-the-shelf systems to
decrypt any streams seen from it.

							Ian.