RC4 in TLS is pretty bad too: http://www.isg.rhul.ac.uk/tls/ http://www.isg.rhul.ac.uk/tls/ "Our second attack applies to TLS and can be carried out in a sing

RC4 in TLS is pretty bad too: http://www.isg.rhul.ac.uk/tls/ http://www.isg.rhul.ac.uk/tls/ "Our second attack applies to TLS and can be carried out in a single connection or session (but tolerates multiple connections/sessions). It exploits certain double-byte biases in RC4 keystreams (the Fluhrer-McGrew biases). It targets plaintext bytes located at any position in the TLS plaintext stream. The number of encryptions needed to reliably recover a set of 16 consecutive targeted plaintext bytes is around 10 times 2^30, but already with only 6 times 2^30 sessions, these target bytes can be recovered with 50% reliability. Since this double-byte bias attack does not require the TLS Handshake Protocol to be rerun, it can in practice be more efficient than our single-byte bias attack." http://www.isg.rhul.ac.uk/tls/RC4biases.pdf http://www.isg.rhul.ac.uk/tls/RC4biases.pdf edit: I could not get star to show-up, so I just spelled it out as 'times.'