Analysing and exploiting the Mantin biases in RC4

Remi Bricout, Sean Murphy, Kenneth Paterson, Thyla Van Der Merwe

Research output: Contribution to journalArticlepeer-review


We explore the use of the Mantin biases (Mantin, Eurocrypt 2005) to recover plaintexts from RC4-encrypted traffic. We provide a more fine-grained analysis of these biases than in Mantin’s original work. We show that, in fact, the original analysis was incorrect in certain cases: the Mantin biases are sometimes non-existent, and sometimes stronger than originally predicted. We then show how to use these biases in a plaintext recovery attack. Our attack targets two unknown bytes of plaintext that are located close to sequences of known plaintext bytes, a situation that arises in practice when RC4 is used in, for example, TLS. We provide a statistical framework that enables us to make predictions about the performance of this attack and its variants. We then extend the attack using standard dynamic programming techniques to tackle the problem of recovering longer plaintexts, a setting of practical interest in recovering HTTP session cookies and user passwords that are protected by RC4 in TLS. We perform experiments showing that we can successfully recover 16-byte plaintexts with 80% success rate using 231231 ciphertexts, an improvement over previous attacks.
Original languageEnglish
Pages (from-to)743–770
Number of pages28
JournalDesigns, Codes and Cryptography
Issue number4
Early online date28 Mar 2017
Publication statusPublished - Apr 2018

Cite this