Question

I'm studying the RC4 algorithm and I have the following questions:

On all questions assume that an expanded (2048-bit) key is used, and that the first 4096 bytes of the KeystreamIm are discarded.

After the above process, is the resulting S-box indistinguishable from a random permutation of the numbers 0 through 255?

Assuming the above process, are the bytes generated indistinguishable from random data?

Answer 1

As for your first question "is the S-box indistinguishable from a random permutation?", well, there are likely some subtle biases. For one, we know that, after exactly 4096 steps, the combination j=1 and SBox[1]=1 is impossible; that's because i=0 after 4096 steps, and the combination j=i+1 and SBox[j]=1 is known to be impossible (given the standard RC4 key setup; this was first observed by Hal Finney). Because of this, there is likely a bias away from SBox[1]=1 after exactly 4096 steps, and so this would appear likely to be a distinguisher (albeit not a strong one) from a random permutation.

As for your second question "are the bytes generated indistinguishable from random data?", the answer for that is "definitely not". We know how to distinguish a roughly Gigabyte output of RC4 from a random stream; note that discarding an arbitrary amount of RC4 keystream before you start sampling does not affect this attack.