## 2 Motivation
In the design of the PRGA+ algorithm (see Algorithm 6), the main cryptanalytic results about RC4 PRGA was taken into consideration. ```
1:KSA shuffled permutation \(S[0\ldots N-1]\). 2:Pseudo-random keystream bytes \(z\). 3:\(j=0\)
4:for\(i=0\to L\)do
5:\(i=(i+1)\mod N\)
6:\(j=(j+S[i])\mod N\)
7:\(Swap(S[i],S[j])\)
8:\(t=(S[i]+S[j])\mod N\)
9:\(t^{\prime}=((S[(i\gg 3)\oplus(j\ll 5)]+S[(i\ll 5)\oplus(j\gg 3)])\mod N) \oplus 0\)AA
10:\(t^{\prime\prime}=(j+S[j])\mod N\)
11:Output\(z=(S[t]+S[t^{\prime}])\oplus S[t^{\prime\prime}]\)
12:endfor
```

**Algorithm 6** PRGA+

Where \(\gg\) and \(\ll\) mean right shifting and left shifting, respectively, and L is the number of output bytes. The proposed design is based on avoiding that each output byte depends only on one input of the permutation. In this sense, they incorporate the exclusive or operation \(\oplus\) and two new indices \(t^{\prime}\), and \(t^{\prime\prime}\). ### RC4A Algorithm

The stream cipher RC4A was proposed in [26] with the objective to reduce the correlations between output bytes and internal variables by increasing the internal state (see Algorithms 7 and 8). ```
1:Secret keys \(K_{1}[0\ldots N-1]\) and \(K_{2}[0\ldots N-1]\). 2:Shuffled permutation \(S_{1}[0\ldots N-1]\) and \(S_{2}[0\ldots N-1]\). 3:for\(i=0\to N-1\)do
4:\(S_{1}[i]=i\)
5:\(S_{2}[i]=i\)
6:endfor
7:\(j_{1}=0\)
8:\(j_{2}=0\)
9:for\(i=0\to N-1\)do
10:\(j_{1}=(j_{1}+S_{1}[i]+K_{1}[i\mod keyLength])\mod N\)
11:\(Swap(S_{1}[i],S_{1}[j_{1}])\)
12:endfor
13:for\(i=0\to N-1\)do
14:\(j_{2}=(j_{2}+S_{2}[i]+K_{2}[i\mod keyLength])\mod N\)
15:\(Swap(S_{2}[i],S_{2}[j_{2}])\)
16:endfor
```

**Algorithm 7** RC4A KSA

The difference between the algorithms RC4A KSA (see Algorithm 7) and KSA RC4 is that the first generates two state table by using two different keys. Thus, secret internal state of RC4A consists of two permutations \(S_{1},S_{2}\) and three variables \(i,j_{1},j_{2}\). ```
1:KSA shuffled permutations \(S_{1}[0\ldots N-1]\) and \(S_{2}[0\ldots N-1]\). 2:Pseudo-random keystream bytes \(z\). 3:\(j_{1}=0\)
4:\(j_{2}=0\)
5:for\(i=0\to L\)do
6:\(i=(i+1)\mod N\)
7:\(j_{1}=(j_{1}+S_{1}[i])\mod N\)
8:\(Swap(S_{1}[i],S_{1}[j_{1}])\mod N\)
9:Output\(z_{1}=S_{2}[(S_{1}[i]+S_{1}[j_{1}])\mod N]\)
10:\(j_{2}=(j_{2}+S_{2}[i])\mod N\)
11:\(Swap(S_{2}[i],S_{2}[j_{2}])\)
12:Output\(z_{2}=S_{1}[(S_{2}[i]+S_{2}[j_{2}])\mod N]\)
13:endfor
```

**Algorithm 8** RC4A PRGA

In each round two output bytes are generated, the first byte is generated from \(S_{2}\) and the second byte is generated from \(S_{1}\). Thus, this cipher speed up the RC4 encryption. ### VMPC Algorithm

In [25] was proposed the algorithm VMPC (see Algorithms 9 and 10), whose name comes from \"Variably Modified Permutation Composition\", which is based in the transformation \(z=S[S_{k}[S_{k-1}[\ldots[S_{1}[S[x]]]\ldots]]],0\leq x\leq N-1\), where \(x\in\{0,1,\ldots,N\}\) and \(S_{k}[x]=(S[x]+k)\mod N\). Such transformation is called a k-level VMPC function. ```
1:Secret keys \(K[0\ldots N-1]\) and \(IV[0\ldots N-1]\). 2:Shuffled permutation \(S[0\ldots N-1]\). 3:for\(i=0\to N\)do
4:\(S[i]=i\)
5:endfor
6:\(j=0\)
7:for\(k=0\to 3N-1\)do
8:\(i=k\mod N\)
9:\(j=S[(j+S[i]+K[k\mod keyLength])\mod N]\)
10:\(Swap(S[i],S[j])\)
11:endfor
```

**Algorithm 9** VMPC KSA

In the KSA, the main differences from RC4 are that the length of loop where permutation S is updated six times more than RC4--firstly, three times with the key, and after three times more with the initialization vector IV. The second update is an optional loop in KSA used by the designer to improve the diffusion using an initialization vector. However, designer statements show that it is possible to obtain good diffusion without using the initialization vector. ```
0: KSA Shuffled permutation \(S[0\dots N-1]\), the last key dependence value of the index \(j\). 0: Pseudo-random keystream bytes \(z\).