How to describe RC4 'bias' to non-tech people

Question

I'm looking for the 'plain English' version of 'bias' as used in the context of the RC4 weakness.

I know that RC4 generates a string of psuedorandom bits over, for instance, http(s) traffic. If you encrypt mostly the same data with this, there is little change in what you're encrypting, and this allows for similarities in your output. So, part of your strings will look the same, and may even be repeating what you've seen before.

Can I use 'similarities in your output' or 'parts of strings that repeat themselves' as a translation for 'bias' in this context, or is there a better explanation?

Answer 1

I think explaining the weakness in RC4 to a non-technical audience would be very similar to explaining the role of randomness in crypto to a similar audience.

Let's say I want my army to attack at dawn, so I encrypt the message "attack at dawn," generate a ciphertext c_0, and send it to my army, who then attacks my enemy at dawn. Great.

Next week, I want to attack at dawn again. So I use a different key and encrypt my message "attack at dawn" again, to generate a ciphertext c_1, which I then said to my army. Imagine I do this n times to produce n ciphertexts.

If my enemy can read the messages I send, he will look for patterns (biases) in the messages I send right before my army attacks at dawn. If there is something similar with all these messages (e.g. they all start with a "?" character), my enemy might be able to guess that any message beginning with "?" corresponds to "attack at dawn." However, if you can't find any pattern in the ciphertexts, the enemy learns nothing about your communication.

The weakness in RC4 lies in the fact that the same message encrypted with different keys produces ciphertexts that have common patterns (statistical biases). These are usually much more subtle than beginning with the same character, but the point is the same.