E0 is used for encrypting Bluetooth communication, and it is initialised with a key of at most 128 bits. How secure is E0, and what are the E0 encryption attack vectors?

  • 1
    $\begingroup$ possible duplicate of crypto.stackexchange.com/q/54768/18298 $\endgroup$ – kelalaka Mar 24 '19 at 16:11
  • $\begingroup$ @kelalaka I have read that question and that one is about "Bluetoth comunication security" !!! $\endgroup$ – R1w Mar 24 '19 at 16:18
  • 1
    $\begingroup$ @R1w Are you talking about "pure" E0 or two-level E0? $\endgroup$ – forest Mar 25 '19 at 1:24
  • $\begingroup$ @forest two-level E0 $\endgroup$ – R1w Mar 26 '19 at 10:26

E0, being based on LFSRs, is not a particularly secure stream cipher. The key can be recovered via a known-plaintext attack given enough plaintexts. Two-level E0, which uses the keystream of one E0 instance to initialize the state of a second instance which itself encrypts only one 2745-bit frame, is vulnerable to an attack requiring 238 simple operations given the initial 24 bits of 223.8 frames. This is practical against Bluetooth even using two-level E0 for confidentiality. Note that one-level E0, which simply uses E0 directly as a stream cipher, is even more vulnerable to known-plaintext attacks.

To answer your questions directly:

  1. E0 is not secure, even when used in the so-called two-level E0 scheme.

  2. Known-plaintext attacks can be used to recover the key in negligible time.

If you need an extremely lightweight stream cipher, consider using ChaCha8, which is capable of encryption at the rate of 1.88 cycles per byte on a Core2Duo. Heavy optimizations may improve the keystream generation rate even more. ChaCha is an ARX cipher, using only addition, rotation, and bitwise exclusive-OR. The most secure shift register-based stream cipher out there, which is even faster, is Trivium, which takes only 80-bit keys. I'd recommend against it, but it is still better than E0.

  • 3
    $\begingroup$ Nice answer. Strictly speaking Trivium has nonlinear coupled updating of its shift registers, So it's more LFSR inspired but I have erred in calling it LFSR based in an answer myself :-) $\endgroup$ – kodlu Mar 25 '19 at 3:36
  • 2
    $\begingroup$ @kodlu Good point, it uses an NLFSR. I edited my answer to say "shift register" intsead. $\endgroup$ – forest Mar 25 '19 at 4:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.