Editing Stream cipher attacks (section)

==Reused key attack==
[[Stream cipher]]s are vulnerable to attack if the same key is used twice (depth of two) or more.

Say we send messages ''A'' and ''B'' of the same length, both encrypted using same key, ''K''.  The stream cipher produces a string of bits ''C(K)'' the same length as the messages.  The encrypted versions of the messages then are:

:''E(A) = A xor C''
:''E(B) = B xor C''

where ''xor'' is performed bit by bit.

Say an adversary has intercepted ''E(A)'' and ''E(B)''.  They can easily compute:

:''E(A) xor E(B)''

However, ''xor'' is [[commutative]] and has the property that ''X xor X = 0''  (self-inverse) so:
:''E(A) xor E(B) = (A xor C) xor (B xor C) = A xor B xor C xor C = A xor B''

If one message is longer than the other, our adversary just truncates the longer message to the size of the shorter and their attack will only reveal that portion of the longer message.  In other words, if anyone intercepts two messages encrypted with the same key, they can recover ''A xor B'', which is a form of [[running key cipher]].  Even if neither message is known, as long as both messages are in a natural language, such a cipher can often be broken by paper-and-pencil methods.  During [[World War II]], British cryptanalyst [[John Tiltman]] accomplished this with the [[Lorenz cipher]] (dubbed "Tunny"). With an average [[personal computer]], such ciphers can usually be broken in a matter of minutes.  If one message is known, the solution is trivial.

Another situation where recovery is trivial is if [[traffic-flow security]] measures have each station sending a continuous stream of cipher bits, with null characters (e.g. ''LTRS'' in [[Baudot code|Baudot]]) being sent when there is no real traffic. This is common in military communications. In that case, and if the transmission channel is not fully loaded, there is a good likelihood that one of the ciphertext streams will be just nulls. The [[NSA]] goes to great lengths to prevent keys from being used twice. 1960s-era encryption systems often included a [[punched card]] reader for loading keys. The mechanism would automatically cut the card in half when the card was removed, preventing its reuse.<ref>[https://www.nsa.gov/about/_files/cryptologic_heritage/publications/misc/tsec_kw26.pdf Securing Record Communications: The TSEC/KW-26] {{Webarchive|url=https://web.archive.org/web/20121010011445/https://www.nsa.gov/about/_files/cryptologic_heritage/publications/misc/tsec_kw26.pdf |date=2012-10-10 }}, Melville Klein, NSA history series</ref>{{rp|p. 6}}

One way to avoid this problem is to use an [[initialization vector]] (IV), sent in the clear, that is combined with a secret master key to create a one-time key for the stream cipher. This is done in several common systems that use the popular stream cipher [[RC4]], including [[Wired Equivalent Privacy]] (WEP), [[Wi-Fi Protected Access]] (WPA) and [[Ciphersaber]]. One of the many problems with WEP was that its IV was too short, 24 bits. This meant that there was a high likelihood that the same IV would be used twice if more than a few thousand packets were sent with the same master key (see [[birthday attack]]), subjecting the packets with duplicated IV to the key reuse attack. This problem was fixed in WPA by changing the "master" key frequently.