XXTEA rounds count

I've read in Wiki that XXTEA cipher is vulnerable to "a chosen-plaintext attack requiring 2^59 queries". I'dont exactly understand how bad is that, but something tell me that it's extremely hard to implement such attack on practice. Am I right?

Another question: is it possible just to increase number of rounds to make it stronger? I mean, instead of this:

q = 6 + 52/n;


do this:

q = X + 52/n; //where X - any number greater than 6


Is that correct change of code? How else this algo can be fixed?

• Have you seem my answer to another question on XXTEA and this attack?
– fgrieu
Commented Nov 5, 2016 at 18:33

The paper describing the attack is here: https://eprint.iacr.org/2010/254.pdf

Essentially, it means:

1. There is some XXTEA-encrypted data A, the attacker has it, but he has no key.
2. The attacker makes 2^59 blocks of own data B (minimum block size is 64 bit, so this is 4194304 terabyte, ie. too much for a home computer). I didn't read in detail if there are requirements what data it is, or if the only requirement is that the attacker knows the content, but it doesn't really matter.
3. The attacker can somehow get his B-data encrypted with the same key as the A-data (without being told the key, of course).
4. The analysis of the 2^59 blocks of encrypted B-data (together with the plan data, which the attacker has, of course) is enough to extract the used key. Now the attacker can decrypt the A-data too.

Tldr It does not mean that everyone can read XXTEA-encrypted data now, but it's a lot less secure than it should be (the key has 128 bit...).

• I don't exactly understand point 3: how is it possible to encrypt some data with same key without knowing of it? And what is about increasing number of rounds to make algo stronger? Commented Nov 4, 2016 at 15:50
• @AlekDepler re: point 3: Sometimes an attacker may have access to what is called an "encryption oracle", you can read some details here. While increasing the number of rounds could provide more practical security, it doesn't necessarily do so; If you can't quantify how it improves the security of the algorithm, you should probably refrain from making such modifications personally. If the attack is a problem, consider another algorithm? The other versions of TEA don't appear to have practical attacks. Commented Nov 4, 2016 at 16:33
• @AlekDepler Addition: Practical examples of such encryption oractles vary greatly depending on the case. Random example (inaccurate easy explanation): To make a HTTPS certificate, a domain owner submits some data like the domain etc. to an CA, the CA encrypts it with their private key and sends the result back (verifiable with different public key). If the used algo is vulnerable to a cp-attack, making certificates can help me to get the private key (and then I can make valid certificates for domains I don't own): Because the CA encrypts everything I give to them. Commented Nov 4, 2016 at 19:25