The question is about E0, the stream cipher used to secure Bluetooth communication. The impression I get is that it's more secure than A5/1. Also, why wasn't AES used instead?


Bluetooth has gone through a few transitions in protocol. Bluetooth BR/EDR uses E0/SAFER for a cipher and Bluetooth LE uses AES-CCM. Fundamentally, when you write a specification as an engineer, you are looking for a minimally viable CMOS implementation. You make choices that are not always the best from a cryptographic standpoint because you have space or power constraints. For instance, AES is rather large compared to some stream ciphers and I believe the motivation of using E0 was die space because LFSRs are smaller than an AES implementation. I personally use SIMON over AES in hardware because it's smaller, faster and lower power in a CMOS implementation, and this is particularly true when you are encoding a "bit stream", such you'll have in RFID or Bluetooth.

I know from being in a meeting that FIPS-140 validation for Bluetooth was an important conversation with the Bluetooth LE spec, which is why AES was added. I can only assume that AES was not used in the original ICs due to cost on the hardware side. Looking at 130nm dies (so, back in the day), AES would cost me about 0.03 USD in area. Just by guessing the area of E0, I would say it's 0.01 USD, so it must have mostly been an economic consideration during the time of early adoption.

E0 itself is not particularly secure and is vulnerable to known plaintext attacks.

  • 1
    $\begingroup$ Although this explains why E0 is used in Bluetooth, it doesn't explain how secure it is. You may want to edit your answer to mention its security (as far as I know, one-level E0 is severely vulnerable to known plaintext attacks, and two-level E0, used in 2.1 to 4.0, is slightly less vulnerable). $\endgroup$ – forest Jan 6 at 11:00
  • 2
    $\begingroup$ @forest I am aware that E0 is not secure; however, I'm not really competent as a cryptographer. I'll see if I can find something. If you are knowledgeable in the shortcomings of E0 specifics, feel free to edit in a blurb or a link. $\endgroup$ – b degnan Jan 6 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.