RE: [Cfrg] Re: [saag] Bad day at the hash function factory

[Greg Rose <ggr at qualcomm.com>]

At 16:16 2004-08-26 -0400, Russ Housley wrote:
> At 03:22 PM 8/26/2004, Hallam-Baker, Phillip wrote:
> > RC4 has related key weaknesses that make it a poor choice of
> > cipher. Shamir's attack was a cryptanalytic one.
>
> The attack was against the way it was used in WEP.  The disclosure of the 
> first three octets of the key is always a bad idea, but WEP does just 
> that.  In the case of RC4, this disclosure is particularly bad.  However, 
> this does not mean that all uses of RC4 will suffer.  For example, TLS 
> does not disclose any portion of the RC4 key, and I am unaware of any 
> cryptanalytic results in this context.

RC4 keystream exhibits biases (Fluhrer & McGrew). These biases don't lead 
to a particularly useful attack, but to me, they are the same kind of 
warning we got about MD5 a few years ago. We should be moving away from RC4.

Greg.



Greg Rose                                    INTERNET: ggr at qualcomm.com
Qualcomm Australia       VOICE:  +61-2-9817 4188   FAX: +61-2-9817 5199
Level 3, 230 Victoria Road,             http://people.qualcomm.com/ggr/
Gladesville NSW 2111/232B EC8F 44C6 C853 D68F  E107 E6BF CD2F 1081 A37C


_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg