| • Science | • People | • Locations | • Timeline |
| XTEA | |
|---|---|
| Two Feistel rounds (a "cycle") of XTEA | |
| General | |
| Designer(s) | Roger Needham and David Wheeler |
| First published | 1997 |
| Derived from | Tiny Encryption Algorithm (TEA) |
| Cipher(s) based on this design | - |
| Algorithm detail | |
| Block size(s) | 64 bits |
| Key size(s) | 128 bits |
| Structure | Feistel network |
| Number of rounds | variable; recommended 64 Feistel rounds; 32 "cycles" |
| Best cryptanalysis | |
| A related-key differential attack can break 26 out of 64 rounds of XTEA, requiring 220.5 chosen plaintexts and a time complexity of 2115.15 (Ko et al, 2004). | |
In cryptography, XTEA (eXtended TEA) is a block cipher designed to correct weaknesses in TEA. The cipher's designers were David Wheeler and Roger Needham of the Cambridge Computer Laboratory, and the algorithm was presented in an unpublished technical report in 1997 (Needham and Wheeler, 1997). It is not subject to any patents.
Like TEA, XTEA is a 64-bit block Feistel network with a 128-bit key and a suggested 64 rounds. Several differences from TEA are apparent, including a somewhat more complex key-schedule and a rearrangement of the shifts, XORs and additions.
Presented along with XTEA was a variable-width block cipher termed Block TEA, which uses the XTEA round function but applies it cyclically across an entire message for several iterations. Because it operates on the entire message, Block TEA has the property that it does not need a mode of operationIn cryptography, a block cipher operates on blocks of fixed length, often 64 or 128 bits. To encrypt longer messages, several modes of operation may be used. While many modes provide only confidentiality, some modes also ensure message integrity. This dis. An attack on the full Block TEA was described in (Saarinen, 1998), which also details a weakness in Block TEA's successor, XXTEA.
As of 2004, the best attack reported on XTEA is a related-key differential attack on 26 out of 64 rounds of XTEA, requiring 220.5 chosen plaintexts and a time complexity of 2115.15 (Ko et al, 2004).