## 2 Motivation
In [51] the difference between the outputs \(Y_{r}=f(X_{r})\) and \(Y_{r}^{i}=f(X_{r}^{i})\) corresponding to the inputs \(X_{r}\) and \(X_{r}^{i}\) is called the avalanche vector \(V_{r}^{i}=Y_{r}\oplus Y_{r}^{i}\), where \(X_{r}^{i}=X_{r}\oplus e_{i}\), with \(e_{i},1\leq i\leq n\), denoting the unit vectors \(e_{1}=(1,0,\ldots,0,0,0),\ldots,\)

\(e_{n}=(0,0,\ldots,0,0,1)\). Each \(V_{r}^{i}=Y_{r}\oplus Y_{r}^{i}=(v_{r1}^{i},v_{r2}^{i},\ldots,v_{rm}^{i})\), where \(v_{rj}^{i}\in\mathbb{F}_{2}\), with \(1\leq j\leq m\) and \(1\leq i\leq n\), is called an avalanche variable, represents the row \(r\) of the matrix \(H^{i}\) defined in Table 1 in [50]. Based on its definition, the strict avalanche criterion (SAC) [51] checks whether changing any input bit implies changing approximately half of the output bits. It is said that \(f\) satisfies the SAC if for all \(i\), every avalanche variable \(v_{j}^{i}\) with \(1\leq j\leq m\) and \(1\leq i\leq n\), follows a binomial distribution with parameters \(l\) and \(1/2\), that is, \(v_{j}^{i}\sim B(l,1/2)\). On the other hand, the bit independence criterion (BIC) [51] measures the degree of independence between each pair \(v_{j}^{i},v_{k}^{i}\) of avalanche variables, with \(1\leq j,k\leq m\). In this way, the two criteria measure a different characteristic of the effect of changing one bit of the input on the output bits. The SAC verifies uniformity in the distribution of each output bit, while the BIC measures the degree of independence between the output bits. One important characteristic is to measure whether there is a correlation between these two criteria [52]. In [53], it was concluded that these two tests are quite uncorrelated by using the absolute correlation coefficient. Both algorithms have in common the construction of the avalanche matrix. This matrix constitutes the basis for the detection of statistical dependency between the inputs and outputs of \(f\). It can be seen that the BIC has a longer execution time when comparing all pairs of random variables. In SAC and BIC, the random variable \(T\) measures the number of failures of the null hypothesis \(H_{0}\) presented in [49; 50]. In the case of the SAC criterion

\[T=\sum_{i=1}^{n}\sum_{j=1}^{m}t(v_{j}^{i},\alpha_{1}),\]

and for the BIC criterion,

\[T=\sum_{i=1}^{n}\sum_{j=1}^{m-1}\sum_{k>j}^{m}t(v_{j}^{i},v_{k^{\prime}}^{i}, \alpha_{1}),\]

\(T\) can be approximated by the normal distribution with the mean and variance presented in [50] by,

\[Z_{T}=\frac{T-E(T|H_{0})}{\sqrt{\sigma^{2}(T|H_{0})}}\sim N(0,1).\]

where \(t(v_{j}^{i},\alpha_{1})\) and \(t(v_{j^{\prime}}^{i},v_{k^{\prime}}^{i},\alpha_{1})\) take value \(1\) if \(H_{0}\) is rejected with significance \(\alpha_{1}\) or \(0\) otherwise. To compare the \(Z_{T}\) value with the \(N(0,1)\) distribution, a significance level \(\alpha_{2}\) is selected. Then, it is tested if \(f\) does not satisfy the BIC if \(Z_{T}>Z_{1-\alpha_{2}}\) where \(Z_{1-\alpha_{2}}\) is the critical value of the normal distribution table with a significance level \(\alpha_{2}\). ## 4 RC4 Stream Cipher Description

[PERSON] designed the RC4 algorithm in 1987 for the company RSA Data Security [4]. Its implementation is straightforward and fast and aims to generate sequences in units of one byte and allow keys of different lengths. The internal state of RC4 consists of a permutation \(S\) of the numbers \(0,\ldots,N-1\) and two indices \(i,j\in\{0,\ldots,N-1\}\). The index \(i\) is known, while \(j\) and the permutation \(S\) remain secret. The RC4 comprises two components: the key scheduling algorithm (KSA) and the pseudo-random generator algorithm (PRGA). The KSA generates an initial state from the input parameter \(K\). This starts with an array \(\{0,1,\ldots,N-1\}\) where \(N=256\) by default. In the end, an initial state \(S_{N}\) is obtained, see Algorithm 3.