Thanks for writing this up! I'm gonna spend the rest of the day thinking about that liminal period where it was ambiguous if RC4 was broken... to some of us.
One of the fun things I did during COVID was think about what it's like for someone trying to OSINT me -- something I hadn't done since college.
Fun fact: I refused to use Wifi prior to the introduction of WPA after reading about the... Fluhrer, Mantin and Shamir attack[0]... on... Slashdot... if I recall correctly?
Yup! That period is blurring together, but this is the key part:
>For a 24-bit IV, there is a 50% probability the same IV will repeat after 5,000 packets.
I still remember being amazed by simple concepts like a dictionary attack -- five thousand sounds like a lot of something, but you could repeat five thousand packets in under five seconds when I actually tried it myself for a class or whatever.
I'd like to see the author break RC4 after he removes the bias by dropping the first 1024 bytes the cipher produces.