Subject: Re: [Cfrg] New draft: draft-josefsson-rc4-test-vectors-00.txt

From: Joachim Strömbergson <[email-masked]>
Date: Fri, 04 Jun 2010 09:48:45 +0200

Aloha!

I'm currently updating the RC4 testvector draft by Simon Josefsson and
myself. Does anybody on the list have any comments I would be grateful
for getting them and incorporating the changes.

http://www.ietf.org/id/draft-josefsson-rc4-test-vectors-00.txt

Thanks!

- -- 
Med vänlig hälsning, Yours

Joachim Strömbergson - Alltid i harmonisk svängning.
========================================================================
Kryptoblog - IT-säkerhet på svenska
http://www.strombergson.com/kryptoblog
========================================================================

---

From: David McGrew <[email-masked]>
Date: Fri, 4 Jun 2010 09:11:22 -0700

Hi Joachim,

the security considerations section is currently empty.  I suggest the  
following text:

The RC4 algorithm does not meet the basic criteria required for an  
encryption algorithm, as its output is distinguishable from random.   
The use of RC4 is NOT RECOMMENDED; in particular, its use in new  
specifications is discouraged.  This note is intended only to aid the  
interoperability of existing specifications that make use of RC4.

David

On Jun 4, 2010, at 12:48 AM, Joachim Strömbergson wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Aloha!
>
> = 
> = 
> ======================================================================
> = 
> = 
> ======================================================================
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (Darwin)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkwIr90ACgkQZoPr8HT30QEDWgCfQKcsFJrdwDkMjCokTMjn/4+j
> OmMAoNVmKXHQ3CXAwFyRfdzEmBUDqVP1
> =aRLf
> -----END PGP SIGNATURE-----
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg

---

From: "Jim Schaad" <[email-masked]>
Date: Fri, 4 Jun 2010 14:08:04 -0700

>From personal history, I often find just having test vectors to be less than helpful without at least one set of intermediate values that I can use to try and find out why my answer and the test vector don't match.   I don't know what the best set of intermediate values would be for RC4 but a simple programming error is difficult to find for the best of the encryption algorithms.

Jim

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Joachim Strömbergson
> Sent: Friday, June 04, 2010 12:49 AM
> To: [email-masked]
> Subject: Re: [Cfrg] New draft: draft-josefsson-rc4-test-vectors-00.txt
> 
> Med v�nlig h�lsning, Yours
> 
> Joachim Str�mbergson - Alltid i harmonisk sv�ngning.
> Kryptoblog - IT-s�kerhet p� svenska

---

From: Simon Josefsson <[email-masked]>
Date: Mon, 07 Jun 2010 17:05:59 +0200

> encryption algorithm, as its output is distinguishable from random.

I agree with this.

> interoperability of existing specifications that make use of RC4.

Agreed, although the document is not intended to provide any normative
statements, so I'd prefer to avoid dragging in RFC 2119 language if that
can be avoided.  Merely lower-casing NOT RECOMMENDED would solve this
for me.

/Simon

---

From: Simon Josefsson <[email-masked]>
Date: Mon, 07 Jun 2010 17:10:37 +0200

"Jim Schaad" <[email-masked]> writes:

> From personal history, I often find just having test vectors to be
> less than helpful without at least one set of intermediate values that
> I can use to try and find out why my answer and the test vector don't
> match.  I don't know what the best set of intermediate values would be
> for RC4 but a simple programming error is difficult to find for the
> best of the encryption algorithms.

I agree, although I equally wouldn't know what the best set of
intermediate values would be for RC4.  If someone wants to contribute
text on this for one key, that would be welcome.

Given existing deployment, I suspect that today's practical problems
with the algorithm is not to generate the right key stream but to make
sure you truncate it properly.

/Simon

---

From: Joachim Strömbergson <[email-masked]>
Date: Mon, 07 Jun 2010 21:36:00 +0200

Aloha!

> text on this for one key, that would be welcome.

Given the following rc4 pseudo code:

i = 0
j = 0
while generate_keystream:
    ip = (ip + 1) % 256
    id = S[ip]   	
    jp = (jp + id) % 256
    jd = S[jp]
    swap(S[ip], S[jp])
    kp = jd + jp % 256
    return S[kp]

the pointers ip, jp and kp as well as id and jd are good internal state
variables to debug implementations with.

> sure you truncate it properly.

Fully agreed.

- --