基于E_0算法的猜测决定攻击

Guess and determine attack on E_0 algorithm

对短距离无线蓝牙技术中使用的E0序列密码算法进行了猜测决定攻击,攻击中利用线性逼近的方法做出了一个巧妙的攻击假设,降低了攻击所需的猜测量,并且通过一个检验方程降低了候选状态的数量,攻击的计算复杂度为O(276),需要约988bit密钥流,属于短密钥流攻击。相对于长密钥流攻击,短密钥流攻击所需的密钥流不超过2 745bit,对E0的安全性更具威胁。与目前已有的针对E0的短密钥流攻击相比,所提出猜测决定的攻击结果是最好的。

A guess and determine attack on E0 was presented, the stream cipher that was used in the short-range wireless technology Bluetooth. In the attack, an ingenious assumption by linear approximation to diminish the number of values that have to be guessed was made. Futher more, a test equation to reduce the number of the guessed candidates was used. The guess and determine attack on E0 with time complexity of 0（276） required about 988 keystream bit. Compared with long keystream attacks, short keystream attacks were more threatening to Eo cipher which require less than 2 745 bit. This attack which belongs to short keystream attack was the fastest state recovery attack on E0 so far compared with any other existed short keystream attacks.