Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Interesting.. It has more practical application to IMAP or POP3.

http://crypto.stackexchange.com/questions/3451/is-rc4-a-prob...



It does apply to those protocols, except that it's much harder to coerce a victim into making hundreds of millions of connections to an IMAP server.

On the other hand, those questions are based on the logic that only the first few bytes of the connection are exposed to the attack. That turns out not to be true. There are biases hundreds of bytes into the keystream. The earlier biases seem to be easier to detect, which might make an attack somewhat faster against a protocol where the secret was exchanged earlier than HTTPS.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: