Cryptanalysis of Bluetooth Keystream Generator Two-Level E0

Abstract

Abstract. In this paper, we carefully study both distinguishing and key-recovery attacks against Bluetooth two-level E0 given many short frames. Based on a flaw in the resynchronization of Bluetooth E0, we are able to fully exploit the largest bias of the finite state machine inside E0 for our attacks. Our key-recovery attack works with 2 40 simple operations given the first 24 bits of 2 35 frames. Compared with all existing attacks against two-level E0, this is the best one so far. BackgroundThe short-range wireless technology Bluetooth uses the keystream generator E0 to produce the keystream for encryption. After the earlier results [10, 9, 6] of correlation (also called bias) properties inside the Finite State Machine (FSM) towards the one-level E0, most recently, [12] systematically studied the biases and proved two previously known large biases to be the only largest up to 26 consecutive bits of the FSM output sequences. Attacks against E0 mostly focus on one-level E0 only and the best attacks [12, 1, 5] work on one impractically long frame of keystream without exception. Nevertheless, a few attacks [15,11,[7][8][9] apply to two-level E0; compared with feasible attack complexities on one-level E0, attack complexities on two-level E0 are extremely high and make the practical Bluetooth E0 unbroken.The main contribution of this paper is that first based on one of the two largest biases inside the FSM within one-level E0, we identify the bias at twolevel E0 due to a resynchronization flaw in Bluetooth E0. Unlike the traditional approach to find the bias, the characterized bias does not involve the precomputation of the multiple polynomial with low weight. Second, to utilize the identified bias, we develop a novel attack to directly recover the original encryption key for two-level E0 without reconstructing the initial state of E0 at the second level. Our key-recovery attack works with 2 40 simple operations given the first 24 bits of 2 35 frames. Compared with all existing attacks [15,11,[7][8][9] against two-level E0, this is the best so far.

The Conditional Correlation Attack: A Practical Attack on Bluetooth Encryption

“…Compared with all existing attacks [13,14,16,20,24,29] on two-level E0, our attack is clearly the fastest and only practical resynchronization attack 6 so far. Note that the resynchronization attacks on one-level E0 were well studied in [3,14,24] to be much more efficient.…”

“…In order to review the reinitialization flaw discovered in [24], we first introduce some notations. Define the binary vector γ = (γ 0 , γ 1 , .…”

“…The attack exploits the resynchronization flaw recently detected in [24]. Whereas in [24], this flaw is used for a traditional distinguisher based on results [12,16,17,23] of ordinary correlations, our conditional correlation attack relies on the systematic investigation of correlations conditioned on the inputs to the FSM in E0. These correlations extend a specific conditional correlation found in [23], which relates to one of the largest known biases in E0 as proved in [23].…”

Reducing the Space Complexity of BDD-Based Attacks on Keystream Generators

“…For the minimum number of 132 available keystream bits the attack needs 2 84 polynomial time operations. The best currently known longkeystream attacks against E 0 are algebraic attacks [1] and correlation attacks [12,11]. These attacks all need a large amount of keystream (2 28 to 2 39 in the case of correlation attacks), and even in terms of time and memory requirements, [11] is the only feasible attack among them.…”

“…For each r ∈ {0, 1, 2}, a register cell q N r , N r ∈ { nr 2 − 1, nr 2 }, is selected in LFSR R r as input for the clock control. The GSM standard uses the parameters (n 0 , n 1 , n 2 ) = (19,22,23) and (N 0 , N 1 , N 2 ) = (11,12,13).…”