Editing RC4 (section)

===Fluhrer, Mantin and Shamir attack===
{{Main article|Fluhrer, Mantin and Shamir attack}}

In 2001, a new and surprising discovery was made by [[Scott Fluhrer|Fluhrer]], [[Itsik Mantin|Mantin]] and [[Adi Shamir|Shamir]]: over all the possible RC4 keys, the statistics for the first few bytes of output keystream are strongly non-random, leaking information about the key. If the nonce and long-term key are simply concatenated to generate the RC4 key, this long-term key can be discovered by analysing a large number of messages encrypted with this key.<ref>{{cite journal |first1=Scott R. |last1=Fluhrer |first2=Itsik |last2=Mantin |first3=Adi |last3=Shamir |title=Weaknesses in the Key Scheduling Algorithm of RC4 |journal=[[Selected Areas in Cryptography]] |year=2001 |pages=1–24 |url=http://www.wisdom.weizmann.ac.il/~itsik/RC4/Papers/Rc4_ksa.ps |archive-url=https://web.archive.org/web/20040602051734/http://www.wisdom.weizmann.ac.il/~itsik/RC4/Papers/Rc4_ksa.ps |archive-date=2 June 2004}}</ref> This and related effects were then used to break the [[Wired Equivalent Privacy|WEP]] ("wired equivalent privacy") encryption used with [[802.11]] [[wireless network]]s. This caused a scramble for a standards-based replacement for WEP in the 802.11 market and led to the [[IEEE&nbsp;802.11i]] effort and [[Wi-Fi Protected Access|WPA]].<ref>{{cite web |url=http://findarticles.com/p/articles/mi_m0DIS/is_2003_Jan/ai_n27590035/ |archive-url=https://archive.today/20120709120158/http://findarticles.com/p/articles/mi_m0DIS/is_2003_Jan/ai_n27590035/ |url-status=dead |archive-date=2012-07-09 |title=Interim technology for wireless LAN security: WPA to replace WEP while industry develops new security standard}}</ref>

Protocols can defend against this attack by discarding the initial portion of the keystream. Such a modified algorithm is traditionally called "RC4-drop[{{mvar|n}}]", where {{mvar|n}} is the number of initial keystream bytes that are dropped. The SCAN default is {{mvar|n}} = 768&nbsp;bytes, but a conservative value would be {{mvar|n}} = 3072&nbsp;bytes.<ref>{{cite web |url=http://www.users.zetnet.co.uk/hopwood/crypto/scan/cs.html#RC4-drop |title=RC4-drop(nbytes) in the ''Standard Cryptographic Algorithm Naming'' database}}</ref>

The Fluhrer, Mantin and Shamir attack does not apply to RC4-based SSL, since SSL generates the encryption keys it uses for RC4 by hashing, meaning that different SSL sessions have unrelated keys.<ref>{{cite web |first=Ron |last=Rivest |url=https://www.rsa.com/rsalabs/node.asp?id=2009 |title=RSA Security Response to Weaknesses in Key Scheduling Algorithm of RC4}}</ref>