card reader for loading keys. The mechanism would automatically cut the card in half when the card was removed, preventing its reuse. One way to avoid this problem is to use an initialization vector (IV), sent in the clear, that is combined with a secret master key to create a one-time key for the stream cipher. This is done in several common systems that use the popular stream cipher RC4, including Wired Equivalent Privacy (WEP), Wi-Fi Protected Access (WPA) and Ciphersaber. One of the many problems with WEP was that its IV was too short, 24 bits. This meant that there was a high likelihood that the same IV would be used twice if more than a few thousand packets were sent with the same master key (see birthday attack), subjecting the packets with duplicated IV to the key reuse attack. This problem was fixed in WPA by changing the "master" key frequently. Bit-flipping attack Suppose an adversary knows the exact content of all or part of one of our messages. As a part of a man in the middle attack or replay attack, he can alter the content of the message without knowing the key, K. Say, for example, he knows a portion of the message, say an electronics fund transfer, contains the ASCII string "$1000.00". He can change that to "$9500.00" by XORing that portion of the ciphertext with the string: "$1000.00" xor "$9500.00". To see how this works, consider that the cipher text we send is just C(K) xor "$1000.00". The new message the adversary is creating is: (C(K) xor "$1000.00") xor ("$1000.00" xor "$9500.00") = C(K) xor "$1000.00" xor "$1000.00" xor "$9500.00" = C(K) xor "$9500.00" Recall that a string XORed with itself produces all zeros and that a string of zeros XORed with another string leaves that string intact. The result, C(K) xor "$9500.00", is what our ciphertext would have been if $9500 were the correct amount. Bit-flipping attacks can be prevented by including message authentication code to increase the likelihood that tampering will be detected. Chosen-IV attack Stream ciphers combine a secret key with an agreed initialization vector (IV) to produce a pseudo-random sequence which from time-to-time is re-synchronized. A "Chosen IV" attack relies on finding particular IV's which taken together probably will reveal information about the secret key. Typically multiple pairs of IV are chosen and differences in generated key-streams are then analysed