 He fills the S-box S[ ] with sequential values from 0 to "n" as RC4 does when initializing the S-box from a known K[ ].He then performs the first 3 iterations of ksa() to begin initializing the S-box.After the third step, the attacker can possibly, but not definitely, derive the fourth byte of the key using the keystream output "O" by computing (O − "j" − "S"["i"]) mod "n" = "K"["i"], with the value "i" = 3 at this step.