Is RC4 a problem for password-based authentication? This is a follow-up question to Does TLS use RC4-drop[n]?.

As mentioned in section 6 of RFC4345, there are weak distinguishers for RC4 keystreams available that even work for keystreams that originate from different keys, and regardless of the distance from the start of the keystream. Doesn't that make an attack on schemes that send user passwords in RC4 protected connections?

I'm thinking about protocols that always send the password at a well known offset, e.g. TLS protected IMAP and SMTP.

Theoretically, it should even be possible with an HTML authentication form, but the position of the password in the response might not be as obvious in that case.

Has anybody ever tried to recover a password from a number of RC4 protected IMAP or (authenticated) SMTP connections? Because of the BEAST attack, many mail services now default to RC4 for encrypting user connections (which always include the credentials at a fixed offset), and depending on the mail client used, authentication might happen frequently (especially IMAP clients often keep a number of IMAP connections open, which might be forced to reconnect even more frequently by an active attacker).
By George, you're on to something.

To answer the question you asked, I don't know of anyone actually attempting to recover a password this way, or it even being discussed.  However, it does appear to be feasible, given enough encrypted streams.

How many are enough?  Well, I've started running a few simulations; preliminary results indicate that with perhaps 2 billion encrypted streams that encode the same password, the attacker may be able to deduce enough information to narrow possible passwords to a reasonably small set.

I'll update this answer as I get more precise information on the number of streams needed; however, I've seen enough to be fairly confident that this attack can work.

UPDATE

I have experimentally verified the fact that you can decrypt RC4 if you get the same message encrypted enough times, albeit with somewhat more than I suggested above.  In particular, I encrypted a 16 character password using RC4/DROP-512.  With 8 billion encrypted messages (with the RC4 key for each message being chosen randomly and independently), I was able to successfully recover the exact password by analyzing the statistics for the streams.

I'll be writing up an eprint article detailing my observations.