Statistical weakness in Spritz against VMPC-R: in search for the RC4 replacement.
Bartosz Zoltak · 2014
We found a statistical weakness in the Spritz algorithm designed by Ronald L. Rivest and Jacob C. N. Schuldt. For N = 8: Prob(output(x) = output(x + 2)) = 1/N + 0.000498. The bias becomes statistically significant (for N = 8) after observing about 2 outputs. Analogous bias occurs for N = 16. We propose an algorithm (VMPC-R) which for N = 8 produced 2 (31 million times more) outputs which remained undistinguishable from random in the same battery of tests. Supported by a series of additional statistical tests and security analyses we present VMPC-R as an algorithm we hope can be considered a worthwhile replacement for RC4.