# Known Plaintext attack against XTEA?

I'm looking for information on known-plaintext attacks against XTEA. I'm most interested in the worst case scenario: if an attacker has all 8 bytes of input and all 8 bytes of output, how much information can they learn about the key (and how easily). Or I guess worse than that is if they have multiple such pairs of blocks produced with the same key.

Additionally, suppose an attacker knows all 8 bytes of plaintext, but only X bytes of ciphertext (including their position in the block). Then what kind of information can they determine about the key? (this has applications when other modes, like CTR, are used and a crib occurs in the first block).

-

## migrated from stackoverflow.comJan 17 '12 at 22:34

This question came from our site for professional and enthusiast programmers.

@bmearns: Alice stores a 45 GB movie ripped from a Blue-Ray disk, encrypted with XTEA in CBC mode, in hope to hide what the file really is (she added a little random data at the end so that the size is increased). There are well over $2^{32}$ 64-bit blocks in the encrypted file, thus odds are that at least two are identical. The XOR of the blocks preceding these identical blocks in the ciphertext will match the XOR of the blocks at this position in the original, and this allows positive identification of the original Blue-Ray title. –  fgrieu Jan 19 '12 at 21:07