## 2 Motivation
```
1:for\(i=0\to 255\)do
2:\(S[i]\gets i\)
3:endfor
4:\(j\gets 0\)
5:for\(i=0\to 255\)do
6:\(j\leftarrow(j+S[i]+K[i\mod keyLength])\mod 256\)
7: Swap \(S[i]\) and \(S[j]\)
8:endfor
```

**Algorithm 3** RC4 key-schedulingOnce the initial state is obtained, it is used by the PRGA. The purpose of the PRGA is to generate the output sequence, in this case in bytes (Algorithm 4). ```
1:\(i\gets 0\)
2:\(j\gets 0\)
3:while Generating Output do
4:\(i\leftarrow(i+1)\mod 256\)
5:\(j\leftarrow(j+S[i])\mod 256\)
6: Swap \(S[i]\) and \(S[j]\)
7:Output\(S[(S[i]+S[j])\mod 256]\)
8:endwhile
```

**Algorithm 4** RC4 pseudo-random generator

There are a variety of results on the weaknesses of the RC4 cipher [4], especially in the non-pseudorandomness of the permutation resulting from the KSA [11, 54, 55], and the reflection of input patterns in the outputs and the permutation [12, 56, 57]. ## 5 RC4 Stream Cipher Variants Description

Numerous variants of the RC4 stream cipher algorithm have been proposed in the literature, many poorly referenced. Each variant seeks to solve or strengthen the RC4 algorithm against reported weaknesses or improve its practice performance. In this section, we present the most well-known and referenced variants. ### RC4+ Algorithm

The stream cipher RC4+ was proposed in [27] to exploit the qualities of the RC4 algorithm and provide additional tools, to obtain a greater margin of safety by adding some operations to its structure. Modifications in both algorithms of the RC4 cipher are proposed and are called KSA+ and PRGA+ (see Algorithms 5 and 6). The KSA+ consists of three basic scramblings, scrambling with IV, and zigzag scrambling. The initialization and the first layer basic scrambling are the same as in the original RC4 KSA. The second layer shuffles the permutation using IVs and the secret key K, and in the third layer, more shuffling is achieved in a zigzag way (see Algorithm 5). ```
0: Secret key \(K[0\ldots N-1]\), initialization vector \(IV[0\ldots N-1]\). 0: Shuffled permutation \(S[0\ldots N-1]\). 1:for\(i=0\to N-1\)do\(\triangleright\) Initialization
2:\(S[i]=i\)
3:endfor
4:\(j=0\)
5:for\(i=0\to N-1\)do\(\triangleright\) Layer 1 Basic Scrambling
6:\(j=(j+S[i]+K[i\mod keyLength])\mod N\)
7:\(Swap(S[i],S[j])\)
8:endfor
9:for\(i=N/2-1\)down to \(0\)do\(\triangleright\) Layer 2: Scrambling with \(IV\)
10:\(j=((j+S[i])\ mod\ N)\oplus((K[i\ mod\ keyLength]+IV[i\ mod\ IVLength])\ modN)\)
11:\(Swap(S[i],S[j])\)
12:endfor
13:for\(i=N/2\to N-1\)do
14:\(j=((j+S[i])\ mod\ N)\oplus((K[i\ mod\ keyLength]+IV[i\ mod\ IVLength])\ modN)\)
15:\(Swap(S[i],S[j])\)
16:endfor
17:for\(y=0\to N-1\)do\(\triangleright\) Layer 3: Zigzag Scrambling
18:if\(y\equiv 0\mod 2\)then
19:\(i=y/2\)
20:else
21:\(i=N-(y+1)/2\)
22:\(j=(j+S[i]+K[i\ mod\ keyLength])\ modN\)
23:\(Swap(S[i],S[j])\)
24:endif
25:endfor
```

**Algorithm 5** KSA+

```
0: Secret key \(K[0\ldots N-1]\), initialization vector \(IV[0\ldots N-1]\). 0: Shuffled permutation \(S[0\ldots N-1]\). 1:for\(i=0\to N-1\)do\(\triangleright\) Initialization
2:\(S[i]=i\)
3:endfor
4:\(j=0\)
5:for\(i=0\to N-1\)do\(\triangleright\) Layer 1 Basic Scrambling
6:\(j=(j+S[i]+K[i\mod keyLength])\mod N\)
7:\(Swap(S[i],S[j])\)
8:endfor
9:for\(i=N/2-1\)down to \(0\)do\(\triangleright\) Layer 2: Scrambling with \(IV\)
10:\(j=((j+S[i])\ mod\ N)\oplus((K[i\ mod\ keyLength]+IV[i\ mod\ IVLength])\ modN)\)
11:\(Swap(S[i],S[j])\)
12:endfor
13:for\(i=N/2\to N-1\)do\(\triangleright\) Layer 2: Scrambling
14:\(j=((j+S[i])\ mod\ N)\oplus((K[i\ mod\ keyLength]+IV[i\ mod\ IVLength])\ modN)\)
15:\(Swap(S[i],S[j])\)
16:endfor
17:for\(y=0\to N-1\)do\(\triangleright\) Layer 3: Zigzag Scrambling
18:if\(y\equiv 0\mod 2\)then
19:\(i=y/2\)
20:else
21:\(i=N-(y+1)/2\)
22:\(j=(j+S[i]+K[i\ mod\ keyLength])\ modN\)
23:\(Swap(S[i],S[j])\)
24:endif
25:endfor
```

**Algorithm 6** KSA+

KSA+ was designed in order to avoid secret key correlations from the permutation bytes and to guarantee that the keystream output bytes cannot have any correlation with the secret key.