Bias is a systematic departure from uniform behavior. In cryptography, a biased choice or output makes some values more likely than others, so an attacker can prioritize guesses instead of searching every possibility equally. Even a small deviation can sharply reduce the practical work needed to find a secret. section 2.1 section 2.1.1
Why nonuniform choices help attackers
An eight-digit value that looks like a date has far fewer plausible values than an unrestricted eight-digit number: 12 months × 31 days × 150 years = 55,800 candidates. Its length has not changed, but its distribution has. An attacker needs roughly 28,000 guesses on average rather than 50 million. The same problem applies when a biased random-number generator selects cryptographic keys. section 2.1.1
RC4 illustrates a more subtle bias: its key-scheduling algorithm should leave recovered keystream bytes unrelated to the original key. Instead, particular WEP initialization vectors make a targeted key byte statistically more likely to influence the first keystream byte. One packet is not proof of a key byte; the weakness emerges across many packets. section 4.3.2 section 10.1.2
Equation 4.8
\[\label{equation:wep-weak-iv} IV = [L, 255, X]\]The weak-IV form selects an RC4 key-byte position L while fixing the second IV byte at 255; varying X supplies many observations for the same target. section 4.3.2
The FMS attack turns this bias into key guesses by:
- Collecting encrypted WEP packets whose visible IV has the form [L, 255, X] for the key-byte index being targeted. section 4.3.2
- Recovering the first keystream byte by XORing known plaintext with the corresponding ciphertext byte. section 4.3.2
- Using the RC4 KSA state and that keystream byte to compute a candidate for the target key byte. section 4.3.2
- Counting candidates over many packets and choosing the most frequent value; then repeating for later bytes using the recovered prefix. section 4.3.2 section 10.1.2
Sample size is part of the attack. With 50,000 messages, frequency voting recovers demonstrated test keys byte by byte. With only 500, incorrect high-frequency guesses can corrupt later recovery. A bias therefore supplies evidence, not certainty, and reliable exploitation depends on accumulating enough observations. section 4.3.2
Treat biased cryptographic outputs as security failures. Random key selection should be uniform across its output range. For RC4’s early-output weaknesses, discarding an initial portion of keystream is noted as a mitigation, but the underlying lesson is to avoid designs or configurations that let observable inputs repeatedly amplify biased outcomes. section 2.1.1 section 10.1.2
