New iterated RC4 key correlations

Abstract

This paper investigates key correlations of the keystream generated from RC4, and then presents significant improvements for a plaintext recovery attack on WPA-TKIP from the attack by Isobe et al. at FSE 2013. We first discuss newly discovered key correlations between 2 bytes of the RC4 key and a keystream byte in each round. Such correlations are referred as iterated RC4 key correlations. We further apply our iterated RC4 key correlations to the plaintext recovery attack on WPA-TKIP in the same way as the attack by Sen Gupta et al. at FSE 2014, and achieve significant improvements for recovering 8 bytes of a plaintext from the attack by Isobe et al. at FSE 2013. Our result implies that WPA-TKIP further lowers the security level of generic RC4.