I have to agree with Ertugrul (not that anyone is swayed by my
assessment) that Simon Johnson's response to Unruh seems harsh and add
that his example of "Over tens of gigabytes, the bias in RC4 is
probably sufficient to tell the difference between English and say
Chinese if the plain-text was encoded in Unicode." needs to be
explained with more than jingoistic sloganeering, if Simon would be so
kind.

We're all aware of the bias that occurs around one gigabyte that will
identify the underlying algorithm as RC4.

Simon's example is quoting single data sets of at least 20 gigabytes
without re-keying and is suggesting that it is possible to distinguish
(at least) the following difference in plaintext of Unicode:

00h xxh 00h xxh 00h xxh 00h xxh... 00h xxh

xxh xxh xxh xxh xxh xxh xxh xxh... xxh xxh

were xx is a value between 00h and FFh, and further with enough
resolution to distinguish Chinese (or Japanese or Korean?) text which
seems like someone needs to hear the phrase "Slow down speed racer..."

We're all aware of the bias that occurs around one gigabyte that will
identify the underlying algorithm as RC4.

Simon's example is quoting single data sets of at least 20 gigabytes
without re-keying and is suggesting that it is possible to distinguish
(at least) the following difference in plaintext of Unicode:

"Simon Johnson" <simon.john... at (no spam) gmail.com> wrote in message

news:5c9a77a6-ff41-4491-acfc-20893dadeac4 at (no spam) 34g2000hsh.googlegroups.com...

I have to agree with Ertugrul (not that anyone is swayed by my
assessment) that Simon Johnson's response to Unruh seems harsh and add
that his example of "Over tens of gigabytes, the bias in RC4 is
probably sufficient to tell the difference between English and say
Chinese if the plain-text was encoded in Unicode." needs to be
explained with more than jingoistic sloganeering, if Simon would be so
kind.

You may find this thread interesting:
http://groups.google.com/group/sci.crypt/browse_frm/thread/e3b7a5207a...

We're all aware of the bias that occurs around one gigabyte that will
identify the underlying algorithm as RC4.

This is old research, you can actually do in around 30MB.

It's news to me, glad to hear it. Do you have a reference?

--
poncho

I really don't think that ciphers have feelings.  They have a purpose
and the purpose of RC4 is quite limited, but for its purpose it performs
very well.  It is harsh to call RC4 in the context of WPA broken,
because it isn't.  It's extremely fast and secure for usage in home
WLANs, even at a massive scale.

It's all a question of personal opinion really. There are use-cases
where using RC4 could leak information that would not be leaked as a
result of using AES.

I do feel as if RC4 gets a free pass sometimes. I'm not sure why,
although I have a suspicion that it's because Rivest invented it.

I feel that if I invented a cipher with such a bad bias it would
(rightly) be dismissed as useless.

Why products continue to use RC4 when so many AES implementations
exist is baffling. RC4 was invented in 1987. The world has moved on
from then. Attacks have moved on from then.

There is no good reason to use this cipher in 2008.

Simon.

I agree with Simon. We shouldn't continue to use
RC4 in new designs. No hurry to take it out of
existing things, though. That's the justification
for keeping it in WPA, compatibility.

I really don't think that ciphers have feelings. They have a
purpose and the purpose of RC4 is quite limited, but for its purpose
it performs very well. It is harsh to call RC4 in the context of
WPA broken, because it isn't. It's extremely fast and secure for
usage in home WLANs, even at a massive scale.

It's all a question of personal opinion really. There are use-cases
where using RC4 could leak information that would not be leaked as a
result of using AES.

I do feel as if RC4 gets a free pass sometimes. I'm not sure why,
although I have a suspicion that it's because Rivest invented it.

I feel that if I invented a cipher with such a bad bias it would
(rightly) be dismissed as useless.

Why products continue to use RC4 when so many AES implementations
exist is baffling. RC4 was invented in 1987. The world has moved on
from then. Attacks have moved on from then.

There is no good reason to use this cipher in 2008.

I have to agree with Ertugrul (not that anyone is swayed by my
assessment) that Simon Johnson's response to Unruh seems harsh and add
that his example of "Over tens of gigabytes, the bias in RC4 is
probably sufficient to tell the difference between English and say
Chinese if the plain-text was encoded in Unicode." needs to be
explained with more than jingoistic sloganeering, if Simon would be so
kind.

You may find this thread interesting:
http://groups.google.com/group/sci.crypt/browse_frm/thread/e3b7a5207a393c14/ebb1d2e542600d76

We're all aware of the bias that occurs around one gigabyte that will
identify the underlying algorithm as RC4.

This is old research, you can actually do in around 30MB.

It's all a question of personal opinion really. There are use-cases
where using RC4 could leak information that would not be leaked as a
result of using AES.

I do feel as if RC4 gets a free pass sometimes. I'm not sure why,
although I have a suspicion that it's because Rivest invented it.

I feel that if I invented a cipher with such a bad bias it would
(rightly) be dismissed as useless.

Why products continue to use RC4 when so many AES implementations
exist is baffling. RC4 was invented in 1987. The world has moved on
from then. Attacks have moved on from then.

There is no good reason to use this cipher in 2008.

Sure there are. It runs like a bat out of hell. AES is a slug
compared to RC4.

Sure there are. It runs like a bat out of hell. AES is a slug
compared to RC4. There are applications where the data comes
so fast and the processor is so limited that the choice is RC4
or nothing.

On Jul 23, 9:50=A0am, Simon Johnson <simon.john... at (no spam) gmail.com> wrote:
I really don't think that ciphers have feelings. =A0They have a purpose
and the purpose of RC4 is quite limited, but for its purpose it perform=
s
very well. =A0It is harsh to call RC4 in the context of WPA broken,
because it isn't. =A0It's extremely fast and secure for usage in home
WLANs, even at a massive scale.

It's all a question of personal opinion really. There are use-cases
where using RC4 could leak information that would not be leaked as a
result of using AES.

I do feel as if RC4 gets a free pass sometimes. I'm not sure why,
although I have a suspicion that it's because Rivest invented it.

I feel that if I invented a cipher with such a bad bias it would
(rightly) be dismissed as useless.

Why products continue to use RC4 when so many AES implementations
exist is baffling. RC4 was invented in 1987. The world has moved on
from then. Attacks have moved on from then.

There is no good reason to use this cipher in 2008.

Simon.

Everyone is weighing in and I believe the point is being made
satisfactorily regarding RC4. The scarecrow language is taking a back
seat to a more pragmatic approach.

SJ: "There is no good reason to use this cipher in 2008."

No... there are indeed still some good reasons to use RC4 based on
compatibility and continued security and I think Greg and others have
capsulized those reasons clearly along with more prudent caveats
given.

But it isn't something one should plan in a new design if it can be
avoided, and I think we all can agree on that.

We'll have to agree to differ on the claims made, because frankly, at
this point, you have not given any convincing arguments... rather you
keep pointing to articles that only reaffirm the distinguishing issue
(and also tell how to eliminate the distinguishing characteristics
and make RC4 stronger and faster).

I'm still waiting for a concrete example of being able to tell English
from Chinese in Unicode, and your hunch that you can do it is at this
point, just a hunch unless you can back it up with something like...
well... facts, OK?

RC4 is special, and to me ranks as one of the most elegant algorithms
ever, putting Rivest for that alone in the brilliant category.

But RC4 has lived a productive life and the time for retirement is at
hand.