weakness of RC4 comes from the insufficient key schedule; the first bytes of output reveal information about the key. This can be corrected by simply discarding some initial portion of the output stream. This is known as RC4-dropN, where N is typically a multiple of 256, such as 768 or 1024. A number of attempts have been made to strengthen RC4, notably Spritz, RC4A, VMPC, and RC4+. RC4A Souradyuti Paul and Bart Preneel have proposed an RC4 variant, which they call RC4A. RC4A uses two state arrays and , and two indexes and . Each time is incremented, two bytes are generated: First, the basic RC4 algorithm is performed using and , but in the last step, is looked up in . Second, the operation is repeated (without incrementing again) on and , and is output. Thus, the algorithm is: All arithmetic is performed modulo 256 i := 0 j1 := 0 j2 := 0 while GeneratingOutput: i := i + 1 j1 := j1 + S1[i] swap values of S1[i] and S1[j1] output S2[S1[i] + S1[j1]] j2 := j2 + S2[i] swap values of S2[i] and S2[j2] output S1[S2[i] + S2[j2]] endwhile Although the algorithm required the same number of operations per output byte, there is greater parallelism than RC4, providing a possible speed improvement. Although stronger than RC4, this algorithm has also been attacked, with Alexander Maximov and a team from NEC developing ways to distinguish its output from a truly random sequence. VMPC Variably Modified Permutation Composition (VMPC) is another RC4 variant. It uses similar key schedule as RC4, with iterating 3 × 256 = 768 times rather than 256, and with an optional additional 768 iterations to incorporate an initial vector. The output generation function operates as follows: All arithmetic is performed modulo 256. i := 0 while GeneratingOutput: a := S[i] j := S[j + a] output S[S[S[j] + 1]] Swap S[i] and S[j] (b := S[j]; S[i] := b; S[j] := a)) i := i + 1 endwhile This was attacked in the same papers as RC4A, and can be distinguished within 238 output bytes. RC4+ RC4+ is a modified version of RC4 with a more complex three-phase key schedule (taking about three times as long as RC4, or the same as RC4-drop512), and a more complex output function which performs four additional lookups in the S array for each byte output, taking approximately