DESCRIPTION
===========

In the following description:
  o[], r[], and out[] are a 256-element arrays of 8-byte values
  keylength is the length of the key
  key[] is a keylength-element array of 8-byte values

To key the cipher, the key is expanded to 256 bytes. This is done by
concatenating multiple copies of the key together, the modifying it so that no
values are repeated in the key. To ensure the lack of duplicates, o[i] is
incremented if there are any j such that o[i] = o[j], and this is done until
there are no such j. In psuedocode:

  Fill o[] with zeros
  Set j = 0
  For i = 0..255
    o[i] = key[j]
    repeat
      FoundDup = false
      for k = 0..i-1
        if o[k] = o[i] then
          o[i] = (o[i] + 1) mod 255
          FoundDup = true
    until FoundDup = false
    j = (j + 1) mod keylength

This initial permutation is then has many elements swapped around in it:

  For j = 0..41
    For i = 0..255
      Set n = o[(i+1) mod 256]
      Swap o[n] and o[i]

Finally, the reverse of the permutation r[] is generated, and changed slightly:

  For i = 0..255
    r[i] = o[255-i]
  For i = 0..7
    Set n = r[(i+1) mod 256]
    Swap r[n] and r[i]

At this point the key setup is complete, and the cipher is ready
To generate a chunk of 256 random bytes, o[] and r[] are permuted, and then
xored with the previous buffer to generate the new output. In psuedocode:

  For i = 0..255
    Set n = o[(i+1) mod 256]
    Swap o[n] and o[i]
    Set n = r[(i+1) mod 256]
    Swap r[n] and r[i]
  for i = 0..255
    set out[i] = out[i] xor o[i] xor r[i]

out[i] then contains 256 bytes of data, which is the keystream.


KEY SCHEDULE WEAKNESSES
=======================

There is a slight weakness in the key setup, as several keys can generate the
same state. For example the keys
  00 00
  00 01
Generate the same o[] state:
  00 01 02 03 04 05 06 ...

This gets worse as the keys get bigger: for a 32-bit key, there are at least 24
ways to make the o[] state:
  00 01 02 03 04 05 06 ...
Some are:
  00 00 00 00
  00 01 01 01
  00 00 02 02
  00 01 02 03
For a 256-bit key, there are 32 factorial, or 2.6313*(10^35) ways of making the
stated o[] state.

Unique o[] states are generated by keys where where there are no values in the
key (when treating it as an 8-bit key) for which there is an earlier values that
is one less (mod 256 of course) or equal. Mathematically, a key generates a
unique o[] state if and only if:
  for all 0<=i<n/8
    for all 0<=j<i
      key[i] != key[j] + 1 (mod 256) and
      key[i] != key[j]

If there is an i,j where the conditions are broken, then the same o[] state is
generated if key[i] = key[j] or key[i] = key[j] + 1 (mod 256). If there are no
i,j where this occurs, then the first n/8 bytes of o[] will be the same as the
key, so obviously the state is unique.

This means that for a n-bit key, there are 
  256*254*...*(256-((n/8)-1)*2)
  = 2^(n/8)*128!/(128-(n/8))!
safe keys.

This means that a 128-bit key loses 1.410683564 bits, and a 256-bit key loses
6.11543571 bits. All other keys generate unique states.