It has occured to me that, because the RC4 key crackers spend most of their time in key setup, you can crack N SSL sessions that you captured in not substantially more time than it took to crack 1. This is analagous to the way brute force Unix password file hacking operates.
This occurred to me a whila ago too, and I thought it a very cool idea, as it would mean you could do loads of keys at once with little additional compute time. Then I changed my mind, there's a reason this doesn't work with 40 + 88 SSL, I think. It works well enough for straight RC4, as you just compare lots of keys at once, the RC4 output which will be XORed just gets compared against lots of sample plain text / cipher texts simulataneously. The actual key used is the 40 bit key you're bruting, plus what is effectively an 88 bit salt (in unix password nomenclature, only unix password salts are typically 12 bits). The actual 128 bit RC4 key is generated by taking the MD5 of the known and unknown key bits, plus a couple of other things. As the 88 known bits are randomly generated you can't combine work. If I have misunderstood something, or there is a way to work around this, please explain, because being able to do this would be a huge boon to the key breaker. It would allow you to break keys at a ferocious rate if you had lots of keys to break. Adam