Editing RC4 (section)

===Royal Holloway attack===
In 2013, a group of security researchers at the Information Security Group at Royal Holloway, University of London reported an attack that can become effective using only 2<sup>34</sup> encrypted messages.<ref>{{cite news |url=https://www.theregister.co.uk/2013/03/15/tls_broken/ |title=HTTPS cookie crypto CRUMBLES AGAIN in hands of stats boffins |author=John Leyden |website=The Register |date=15 March 2013}}</ref><ref>{{cite web |url=http://www.isg.rhul.ac.uk/tls/RC4biases.pdf |title=On the Security of RC4 in TLS and WPA |last=AlFardan |publisher=Information Security Group, Royal Holloway, University of London |date=8 July 2013 |display-authors=etal |access-date=6 September 2013 |archive-date=22 September 2013 |archive-url=https://web.archive.org/web/20130922170155/http://www.isg.rhul.ac.uk/tls/RC4biases.pdf |url-status=dead }}</ref><ref>{{cite web |title=On the Security of RC4 in TLS and WPA |url=http://www.isg.rhul.ac.uk/tls/ |publisher=Information Security Group, Royal Holloway, University of London |access-date=2013-09-06}}</ref> While yet not a practical attack for most purposes, this result is sufficiently close to one that it has led to speculation that it is plausible that some state cryptologic agencies may already have better attacks that render RC4 insecure.<ref name=Leyden20130906>{{cite web |url=https://www.theregister.co.uk/2013/09/06/nsa_cryptobreaking_bullrun_analysis/ |title=That earth-shattering NSA crypto-cracking: Have spooks smashed RC4? |author=John Leyden |date=6 September 2013 |website=The Register}}</ref> Given that, {{asof|2013|lc=yes}}, a large amount of [[Transport Layer Security|TLS]] traffic uses RC4 to avoid attacks on block ciphers that use [[cipher block chaining]], if these hypothetical better attacks exist, then this would make the TLS-with-RC4 combination insecure against such attackers in a large number of practical scenarios.<ref name=Leyden20130906/>

In March 2015, researcher to Royal Holloway announced improvements to their attack, providing a 2<sup>26</sup> attack against passwords encrypted with RC4, as used in TLS.<ref>{{Cite web |title=RC4 must die |url=http://www.isg.rhul.ac.uk/tls/RC4mustdie.html}}</ref>