# Known-plaintext attack against E0 with 2745 bits per frame instead of 24

In the paper The Conditional Correlation Attack: A Practical Attack on Bluetooth Encryption, an attack against the E0 cipher is described which can break it efficiently in a known-plaintext attack:

Our best attack finds the original encryption key for two-level E0 using the first 24 bits of 223.8 frames and with 238 computations. This is clearly the fastest and only practical known-plaintext attack on Bluetooth encryption compared with all existing attacks.

Interestingly, the attack requires the first 24 bits of a number of frames. Each frame is 2745 bits in size. They mention that predictable redundancy in the Bluetooth frame may make it possible to turn this into a ciphertext-only attack. If we assume that it's not the case but additionally allow the attacker to access the entire frame rather than the first 24 bits, how efficient does the attack become? How many fewer frames will an attacker need to recover the initial 128-bit key, or are all bits past the first 24 unnecessary?

• Correlation attack requires $x$ data to pass a threshold. I think, in the end, they will need the $\lceil 24*2^{33.8}/2745 \rceil$ frames. – kelalaka Aug 25 '19 at 17:59