## 2 Motivation
1:for\(i=0\to L\)do
2:\(j=S[(j+S[i])\mod N]\)
3:Output\(z=S[(S[j]]+1)\mod N]\)
4:\(Swap(S[i],S[j])\)
5:\(i=(i+1)\mod N\)
6:endfor
```

**Algorithm 10** VMPC PRGA

### NGG Algorithm

In [24], the authors proposed some modifications to the RC4 algorithm to expand RC4 to \(32/64\) bits with a table size significantly smaller than \(2^{32}\) or \(2^{64}\). The proposed algorithm used different word and table sizes. The authors tried to keep the original structure of RC4 as much as possible, but the proposed changes affect some underlying design principles in which the security of RC4 is based (see Algorithms 11 and 12). ```
0: Secret keys \(K[0\dots N-1]\) and a pre-computed random array \(a[0\dots N-1]\). 0: Shuffled permutation \(S[0\dots N-1]\). 1:for\(i=0\to N-1\)do
2:\(S[i]=a[i]\)
3:endfor
4:\(j=0\)
5:for\(i=0\to N-1\)do
6:\(j=S[(j+S[i]+K[i\mod keyLength])\mod N\)
7:\(Swap(S[i],S[j])\)
8:\(S[i]=S[i]+S[j]\mod M\)
9:endfor
```

**Algorithm 11** NGG KSA

The new algorithm was denoted by \(RC4(n,m)\) where \(N=2^{n}\) is the size of the array \(S\) in word, \(m\) is the word size in bits, and \(n\leq m\). It can be noted that the contents of the array S do not constitute a complete permutation of 32-bit or 64-bit words. ```
1:KSA Shuffled array \(S[0\dots N-1]\). 2:Pseudo-random keystream bytes \(z\). 3:\(j=0\)
4:for\(i=0\to L\)do
5:\(i=(i+1)\mod N\)
6:\(j=(j+S[i])\mod N\)
7:\(Swap(S[i],S[j])\)
8:Output\(z=S[((S[i]+S[j])\mod M)\mod N]\)
9:\(S[((S[i]+S[j])\mod M)\mod N]=(S[i]+S[j])\mod M\)
10:endfor
```

**Algorithm 12** NGG PRGA

Where \(N=2^{n},M=2^{m}\). ### GGHN Algorithm

A version of NGG was introduced in [23], named GGHN cipher. A third variable \(k\) is used in KSA and PRGA to increase the security of the cipher, \(k\) is initialized in the KSA and is key dependent (see Algorithms 13 and 14). ```
1:Secret keys \(K[0\dots N-1]\) and a pre-computed random array \(a[0\dots N-1]\). 2:Shuffled array \(S[0\dots N-1]\). 3:for\(i=0\to N-1\)do
4:\(S[i]=a[i]\)
5:endfor
6:\(j=0,k=0\)
7:repeat
8:for\(i=0\to N-1\)do
9:\(j=S[(j+S[i]+K[i\mod keyLength])\mod N\)
10:\(Swap(S[i],S[j])\)
11:\(S[i]=S[i]+S[j]\mod M\)
12:\(k=(k+S[i])\mod M\)
13:endfor
14:until\(r\) times
```

**Algorithm 13** GGHN KSA

The value of \(r\) can be computed for different values of \(n\) and \(m\), see Table 1 in [23]. For example, for \(n=8\) and \(m=32,r=20\). ```
0: KSA Shuffled array \(S[0\ldots N-1]\). 0: Pseudo-random keystream bytes \(z\). 1:\(j=0\)
2:for\(i=0\to L\)do
3:\(i=(i+1)\mod N\)]
4:\(j=(j+S[i])\mod N\)
5:\(k=(k+S[j])\mod M\)
6:Output\(z=(S[(S[i]+S[j])\mod N]+k)\mod M\)
7:\(S[(S[i]+S[j])\mod N]=(k+S[j])\mod M\)
8:endfor
```

**Algorithm 14** GGHN PRGA

## 6 Measuring Avalanche Properties in RC4 Variants

Both statistical tests depend on the parameters \(n\) size of inputs, \(m\) size of outputs, and \(l\) number of inputs. In [50], we discuss and give recommendations for selecting these parameters to guarantee the effectiveness of the tests. The values of \(n,m\), and \(l\) in this work were selected in such a way that they conform to these recommendations based on the significance levels \(\alpha_{1}\) and \(\alpha_{2}\) chosen. ### Selecting Parameters \(n,m,l\) for Experiments

It is known [11; 12; 56] that, when using large input keys in the RC4, it is possible to find the so-called \"related keys\", which provide outputs whose values are correlated with high probability. Therefore, the maximum possible value of the size of the inputs \(n=2048\) bits was selected. According to [50], the increase of the \(m\) parameter has the most significant influence on the increase in the execution time of the tests. Furthermore, it is known [54; 55] that the first four RC4 output values have the most significant bias. Thus, from both details, \(m=32\) bits was selected. For the number \(l\) of entries, the same value used in [50] was chosen, that is, \(l=65\),\(538\). In the case of the two significance levels \(\alpha_{1}\) and \(\alpha_{2}\), values that minimize errors were selected in both cases, type I and type II.