6
$\begingroup$

I'm looking for information on known-plaintext attacks against XTEA. I'm most interested in the worst case scenario: if an attacker has all 8 bytes of input and all 8 bytes of output, how much information can they learn about the key (and how easily). Or I guess worse than that is if they have multiple such pairs of blocks produced with the same key.

Additionally, suppose an attacker knows all 8 bytes of plaintext, but only X bytes of ciphertext (including their position in the block). Then what kind of information can they determine about the key? (this has applications when other modes, like CTR, are used and a crib occurs in the first block).

Improve this question
$\endgroup$
0

1 Answer 1

Reset to default
8
$\begingroup$

I know no published attack against the XTEA algorithm, much less one working with a few plaintext/ciphertext pairs and a random key.

There are published attacks against reduced variants of XTEA, AFAIK either with much less than half of the 64 rounds, or up to 36 rounds but assuming related or/and weak keys in addition of known plaintext. Often, especially as the number of rounds grows, much more than one plaintext/ciphertext pair is required.

By the metric of how much extra rounds this Feistel cipher has above the threshold where it it gets broken, XTEA seems on the safe side.

The single known practical weakness of the XTEA algorithm is its 64-bit block size, which opens the door to attacks on modes of operation and protocols using XTEA, especially when the amount of data involved reaches a few megabytes gigabytes processed with the same key. We also must fear attacks against implementations of XTEA, in particular by side-channel cryptanalysis.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Thanks for the detailed response. Would you be able to elaborate at all on why the block size is a weakness? $\endgroup$
    – brianmearns
    Commented Jan 18, 2012 at 21:47
  • 4
    $\begingroup$ @bmearns: Alice stores a 45 GB movie ripped from a Blue-Ray disk, encrypted with XTEA in CBC mode, in hope to hide what the file really is (she added a little random data at the end so that the size is increased). There are well over $2^{32}$ 64-bit blocks in the encrypted file, thus odds are that at least two are identical. The XOR of the blocks preceding these identical blocks in the ciphertext will match the XOR of the blocks at this position in the original, and this allows positive identification of the original Blue-Ray title. $\endgroup$
    – fgrieu ♦
    Commented Jan 19, 2012 at 21:07
  • $\begingroup$ Wow, that's pretty amazing. I don't fully understand the attack, but I get the general idea. I'll have to play around with CBC and see if I can make sense of it. Thanks! $\endgroup$
    – brianmearns
    Commented Jan 20, 2012 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.