ations simply incre- rithm by Fluhrer, Mantin, and Shamir (FMS) was based mented the IV value by 1 for each packet sent. In such on a demonstration that the particular random number a network, the IV is bound to be reused after 224 = 16.8 generator, RC4, used in WEP is not completely random. million packets. A heavily loaded network would deliver RC4 is a proprietary algorithm that is not publicly released that much traffic in a couple of hours. Over the course of or described in detail in the standard. It has been reverse a week or two of eavesdropping, a huge number of engineered and shown to be based on fairly simple swaps packets with identical IVs and thus identical cipher of small segments of memory. Fluhrer and colleagues streams could be collected and analyzed. showed that certain IV values "leak" some information Once any cipher stream is obtained, it can be reused about the key in their cipher streams. To benefit from this even in the absence of knowledge of the shared key, be- knowledge, an attacker needs to know a few bytes of the cause any IV must be accepted. Any packets sent with plaintext, but because of the fixed nature of formats for the same IV can be decrypted (at least to the length of many common packets, this is not difficult. The number the known cipher stream); further, a packet of the same of weak IVs needed to extract the shared key is modest, length with the intruder's data can be encrypted, and the frequency of weak IVs increases for longer key prepended with the same IV, and injected into the streams, SO that for a network selecting its IVs at random, system. the time required to crack, for example, a 104-bit key is The authentication system is another weakness. If an only roughly twice that needed for a 40-bit key. Long keys eavesdropper can hear the challenge and the response, provide essentially no added security against the FMS the XOR of the challenge (plaintext) and corresponding attack. Shortly after Fluhrer et al. became available, response (cipher text) reveals the cipher st