S[j] K := S[(S[i] + S[j]) mod 256] output K endwhile Thus, this produces a stream of which are XORed with the to obtain the . So . RC4-based random number generators Several operating systems include , an API originating in OpenBSD providing access to a random number generator originally based on RC4. In OpenBSD 5.5, released in May 2014, was modified to use ChaCha20. The implementations of arc4random in FreeBSD, NetBSD and Linux's libbsd also use ChaCha20. According to manual pages shipped with the operating system, in the 2017 release of macOS and iOS operating systems, Apple replaced RC4 with AES in its implementation of arc4random. Man pages for the new arc4random include the backronym "A Replacement Call for Random" for ARC4 as a mnemonic, as it provides better random data than rand() does. Proposed new random number generators are often compared to the RC4 random number generator. Several attacks on RC4 are able to distinguish its output from a random sequence. Implementation Many stream ciphers are based on linear-feedback shift registers (LFSRs), which, while efficient in hardware, are less so in software. The design of RC4 avoids the use of LFSRs and is ideal for software implementation, as it requires only byte manipulations. It uses 256 bytes of memory for the state array, S[0] through S[255], k bytes of memory for the key, key[0] through key[k−1], and integer variables, i, j, and K. Performing a modular reduction of some value modulo 256 can be done with a bitwise AND with 255 (which is equivalent to taking the low-order byte of the value in question). Test vectors These test vectors are not official, but convenient for anyone testing their own RC4 program. The keys and plaintext are ASCII, the keystream and ciphertext are in hexadecimal. Security Unlike a modern stream cipher (such as those in eSTREAM), RC4 does not take a separate nonce alongside the key. This means that if a single long-term key is to be used to securely encrypt multiple streams, the protocol must specify how to combine the nonce and the long-term key to generate the stream key for RC4. One approach to addressing this is to generate a "fresh" RC4 key by hashing a long-term key with a nonce. However, many applications that use RC4 simply concatenate key and nonce; RC4's weak key schedule then gives rise to related-key attacks, like the Fluhrer, Mantin and