# Known Plaintext attack against XTEA?

I'm looking for information on known-plaintext attacks against XTEA. I'm most interested in the worst case scenario: if an attacker has all 8 bytes of input and all 8 bytes of output, how much information can they learn about the key (and how easily). Or I guess worse than that is if they have multiple such pairs of blocks produced with the same key.

Additionally, suppose an attacker knows all 8 bytes of plaintext, but only X bytes of ciphertext (including their position in the block). Then what kind of information can they determine about the key? (this has applications when other modes, like CTR, are used and a crib occurs in the first block).

-

## migrated from stackoverflow.comJan 17 '12 at 22:34

This question came from our site for professional and enthusiast programmers.

I know no published attack against the XTEA algorithm, much less one working with a few plaintext/ciphertext pairs and a random key.

There are published attacks against reduced variants of XTEA, AFAIK either with much less than half of the 64 rounds, or up to 36 rounds but assuming related or/and weak keys in addition of known plaintext. Often, especially as the number of rounds grows, much more than one plaintext/ciphertext pair is required.

By the metric of how much extra rounds this Feistel cipher has above the threshold where it it gets broken, XTEA seems on the safe side.

The single known practical weakness of the XTEA algorithm is its 64-bit block size, which opens the door to attacks on modes of operation and protocols using XTEA, especially when the amount of data involved reaches a few megabytes gigabytes processed with the same key. We also must fear attacks against implementations of XTEA, in particular by side-channel cryptanalysis.

-
Thanks for the detailed response. Would you be able to elaborate at all on why the block size is a weakness? –  sh1ftst0rm Jan 18 '12 at 21:47
@bmearns: Alice stores a 45 GB movie ripped from a Blue-Ray disk, encrypted with XTEA in CBC mode, in hope to hide what the file really is (she added a little random data at the end so that the size is increased). There are well over $2^{32}$ 64-bit blocks in the encrypted file, thus odds are that at least two are identical. The XOR of the blocks preceding these identical blocks in the ciphertext will match the XOR of the blocks at this position in the original, and this allows positive identification of the original Blue-Ray title. –  fgrieu Jan 19 '12 at 21:07
Wow, that's pretty amazing. I don't fully understand the attack, but I get the general idea. I'll have to play around with CBC and see if I can make sense of it. Thanks! –  sh1ftst0rm Jan 20 '12 at 17:01