Faster Correlation Attack on Bluetooth Keystream Generator E0

Abstract

Abstract. We study both distinguishing and key-recovery attacks against E0, the keystream generator used in Bluetooth by means of correlation. First, a powerful computation method of correlations is formulated by a recursive expression, which makes it easier to calculate correlations of the finite state machine output sequences up to 26 bits for E0 and allows us to verify the two known correlations to be the largest for the first time. Second, we apply the concept of convolution to the analysis of the distinguisher based on all correlations, and propose an efficient distinguisher due to the linear dependency of the largest correlations. Last, we propose a novel maximum likelihood decoding algorithm based on fast Walsh transform to recover the closest codeword for any linear code of dimension L and length n. It requires time O(n + L · 2 L ) and memory min(n, 2 L ). This can speed up many attacks such as fast correlation attacks. We apply it to E0, and our best key-recovery attack works in 2 39 time given 2 39 consecutive bits after O(2 37 ) precomputation. This is the best known attack against E0 so far. BackgroundCorrelation properties play an important role in the security of nonlinear LFSRbased combination generators in stream ciphers. As name implies, the word correlation in stream ciphers is frequently referred to as the intrinsic relation between the keystream and a subset of the LFSR subsequences. The earliest studies dated back to [21,25,27] in the 80's and the concept of correlation immunity was proposed as a security criterion. In the 90's Meier-Staffelbach [22] analyzed correlation properties of combiners with one memory bit, followed by Golić [12] focusing on correlation properties of a general combiner with m-bit memory. Recently, a series of fast correlation attacks sprang up, to name but a few [5-7, 16, 24]. Thereupon we dedicate this paper to the generalized correlation attacks against E0, a combiner with 4-bit memory used in the short-range wireless technology Bluetooth. Prior to our work, existed various attacks [1, 8, 10, 11, 13-15, 17, 26] against E0. The best key-recovery attacks are algebraic attacks [1,8], whose basic approach is to use the polynomial canceling all memory bits and involving only key bits, instead of considering the multiple polynomial to cancel the key bits in the distinguishing attack; besides, [9,13,14] discussed correlations of E0. In [14], Hermelin-Nyberg for the first time presented a rough computation method to compute the correlation (called bias for our purpose), but neither did they formalize the computation systematically, nor did they attempt to find a larger correlation. In [9,13], two larger correlations for a short sequence of up to 6 bits were exposed. However, due to the limit of the computation method, no one was certain about the existence of a larger correlation for a longer sequence, which is critical to the security of E0.

Cryptanalysis of Bluetooth Keystream Generator Two-Level E0

“…As time/data tradeoff, we might also expect to have some other linearly independent biases to be large enough so that the time is decreased at somewhat reasonably increasing cost of data/memory complexities. Nonetheless, using the computation formula of [12], we find none such bias that leads to the data complexity of less than 2 50 .…”

“…Our starting point would be the bias inside the FSM, which was discovered by [9,6] and further proved in [12] to be the the largest bias up to 26-bit output …”

“…where D def = D ⊗4 with ⊗ representing the regular convolutional product (see [12]), and D is the distribution of …”

“…After the earlier results [10,9,6] of correlation (also called bias) properties inside the Finite State Machine (FSM) towards the one-level E0, most recently, [12] systematically studied the biases and proved two previously known large biases to be the only largest up to 26 consecutive bits of the FSM output sequences. Attacks against E0 mostly focus on one-level E0 only and the best attacks [12,1,5] work on one impractically long frame of keystream without exception. Nevertheless, a few attacks [15,11,[7][8][9] apply to two-level E0; compared with feasible attack complexities on one-level E0, attack complexities on two-level E0 are extremely high and make the practical Bluetooth E0 unbroken.…”

Fast correlation attacks against stream ciphers and related open problems

“…Similar attacks can be mounted for instance against combiners with memory, as shown in [27]. A nice example of such attacks is the recent cryptanalysis of E0 presented by Lu and Vaudenay [28], [29].…”