Revisiting RC4 key collision: Faster search algorithm and new 22-byte colliding key pairs

Abstract

If two different secret keys of stream cipher RC4 yield the same internal state after the key scheduling algorithm (KSA) and hence generate the same sequence of keystream bits, they are called a colliding key pair. The number of possible internal states of RC4 stream cipher is very large (approximately 2¹⁷⁰⁰), which makes finding key collision hard for practical key lengths (i.e., less than 30 bytes). Matsui (2009) for the first time reported a 24-byte colliding key pair and one 20-byte near-colliding key pair (i.e., for which the state arrays after the KSA differ in at most two positions) for RC4. Subsequently, Chen and Miyaji (2011) designed a more efficient search algorithm using Matsui’s collision pattern and reported a 22-byte colliding key pair which remains the only shortest known colliding key pair so far. In this paper, we show some limitations of both the above approaches and propose a faster collision search algorithm that overcomes these limitations. Using our algorithm, we are able to find three additional 22-byte colliding key pairs that are different from the one reported by Chen and Miyaji. We additionally give 12 new 20-byte near-colliding key pairs. These results are significant, considering the argument by Biham and Dunkelman (2007), that for shorter keys there might be no instances of collision at all.