In this paper we study the security of the Bluetooth stream cipher E0 from the viewpoint it is a difference stream cipher, that is, it is defined by a system of explicit difference equations over the finite field GF(2). This approach highlights some issues of the Bluetooth encryption as the invertibility of its state transition map, a special set of 14 bits of its 132-bit state which when guessed imply linear equations among the other bits and finally a very small number of spurious keys compatible with a keystream of about 60 bits. Exploiting such issues, we implement an algebraic attack using Grobner bases, SAT solvers and Binary Decision Diagrams. Testing activities suggest that the version based on Grobner bases is the best one and it is able to attack E0 in about 2^79 seconds on an Intel i9 CPU. To the best of our knowledge, this work improves any previous attack based on a short keystream, hence fitting with Bluetooth specifications.

翻译：在本文中,我们从一个差异流密码的角度来研究蓝牙流密码E0的安全性。 也就是说, 它是由一个对有限字段GF(2)的明显差异方程式系统来定义的。 这个方法突出了蓝牙加密的一些问题, 因为它的国家过渡图是不可视的, 其132位数状态中有14位特制, 当猜想到它在其他位数中含有线性方程时, 并且最后只有极少数与大约60位关键流相容的虚假键。 探讨这些问题, 我们用格罗布纳基地、 SAT 求解器和二进制决定图进行代数攻击。 测试活动表明, 基于格罗布纳基地的版本是最好的版本, 它能够在大约2- 79 秒的英特尔 i9 CPU上攻击E0 。 根据我们所知, 这项工作改进了以前基于短串键流的任何攻击, 因此符合蓝牙规格 。