Subject: Re: I-D ACTION:draft-ietf-pppext-mppe-keys-01.txt

From: David Wagner <[email-masked]>
Date: Fri, 8 Oct 1999 21:06:59 +0000 ()

In article <[email-masked]>,
Glen Zorn  <[email-masked]> wrote:
> On Wed, 22 Sep 1999, David Wagner wrote:
> > The MPPE key derivation process uses a fixed prefix, 0xD1269E, to
> > derive 40-bit RC4 session keys.
> >
> > I find this use of a "magic number" very suspicious.  Where did
> > this value come from?
>
> Nobody knows where it came from.  It's been suggested that it was picked
> out of thin air by someone who left the company a long time ago.  As far
> as anyone knows there are no "special properties".

On the contrary, my preliminary statistical tests show two "special properties"
for the class of RC4 keys starting with prefix 0xD1269E:

  * The first byte of output takes on the value 0x09 with prob. 0.0054,
    which is noticeably higher than the 1/256 = 0.0039 probability you
    get for a secure cipher (or for RC4 with a random prefix).

  * The RC4 key schedule mixes some entries in the state table poorly,
    for this class of keys.  For instance, S[1] = 0xF8 holds with prob.
    1/e = 0.38, and S[2] = 0x98 holds with a similarly large probability.

Neither of these seem directly usable in any practical attack on the cipher.
Still, I find them suspicious, and perhaps indicative of more subtle flaws.

It is these special properties of the 0xD1269E prefix which raises a red flag
in my mind.

---

From: Glen Zorn <[email-masked]>
Date: Tue, 12 Oct 1999 10:38:25 -0700 (PDT)

> for the class of RC4 keys starting with prefix 0xD1269E:

Perhaps I was unclear: what I _meant_ was that no one here at Microsoft 
knows of any "special properties" imparted by this choice of constants. 

> It is these special properties of the 0xD1269E prefix which raises a red flag

Are these "properties" unique to the prefix in question or might similar
properties acrue from any constant prefix?