E0 encryption algorithm attack vector E0 is used for encrypting Bluetooth communication, and it is initialised with a key of at most 128 bits. How secure is E0, and what are the E0 encryption attack vectors?
E0, being based on LFSRs, is not a particularly secure stream cipher. The key can be recovered via a known-plaintext attack given enough plaintexts. Two-level E0, which uses the keystream of one E0 instance to initialize the state of a second instance which itself encrypts only one 2745-bit frame, is vulnerable to an attack requiring 238 simple operations given the initial 24 bits of 223.8 frames. This is practical against Bluetooth even using two-level E0 for confidentiality. Note that one-level E0, which simply uses E0 directly as a stream cipher, is even more vulnerable to known-plaintext attacks.

To answer your questions directly:


E0 is not secure, even when used in the so-called two-level E0 scheme.
Known-plaintext attacks can be used to recover the key in negligible time.


If you need an extremely lightweight stream cipher, consider using ChaCha8, which is capable of encryption at the rate of 1.88 cycles per byte on a Core2Duo. Heavy optimizations may improve the keystream generation rate even more. ChaCha is an ARX cipher, using only addition, rotation, and bitwise exclusive-OR. The most secure shift register-based stream cipher out there, which is even faster, is Trivium, which takes only 80-bit keys. I'd recommend against it, but it is still better than E0.