Hacking the Xbox

Chapter 7 - A Brief Primer on Security 111
for encrypting real-time data streams and embedded applications where
processor performance and storage space is tight. TEA has a 128-bit key
and it operates on 64-bits of data at a time, and each of its 32 rounds
uses only shifts, XORs and additions. (The algorithm, given in Listing 7-1
and Figure 7-2, is optimized for implementation on 32-bit generalpurpose
processors.)
The bantam TEA algorithm is believed to be quite secure when used to
encrypt and decrypt data. However, TEA is not used for encryption in
the Xbox; it is actually used as a hash function by operating the cipher in
a modified Davies-Meyer mode. The region to be hashed is divided into
64-bit blocks. These source data blocks are used as half of the key input
to TEA. The other half of the key input comes from the result of the
previous TEA operation, and the first TEA operation uses a magic
number as its input.
The result is a 64-bit hash function, as depicted in Figure 7-1. This hash is
weak against birthday attacks, especially given the computational efficiency
of TEA, as only 2 32 message pairs need to be tested on average to
find a collision. Even though a birthday attack does not apply in the
Xbox’s usage scenario, the Xbox runs the hash twice, each time with a
different magic number seed, and concatenates the results to generate a
single 128-bit hash value — probably in an attempt to foil brute-force
attacks.
Unfortunately, TEA has a weakness in its key schedule: every TEA key
has four related keys. In other words, for every key, you can generate
three other keys that produce the same ciphertext result with the same
input data. Related-key generation is as simple as complementing pairs of
key bits (bits 31 and 63 is one pair, bits 95 and 127 are the other pair).
This makes TEA unsuitable for use as a hash function, and this weakness
is well documented in the paper “Key-schedule cryptanalysis of IDEA,
G-DES, GOST, SAFER, and triple-DES,” by John Kelsey, Bruce
Schneier, and David Wagner, presented many years ago at CRYPTO
1996. This weakness was later leveraged by a team headed by Andy
Green to break the second version of the Xbox security scheme.
RC-4
RC-4 (Ron’s Code or Rivest Cipher 4) is a variable key-length stream
cipher by Ron Rivest. The heart of RC-4 is the keystream generator. It
can be thought of as a cryptographic pseudo-random number generator
(CPRNG). The output of the CPRNG is XOR’d one byte at a time with a
plaintext stream to generate the ciphertext. Decryption is accomplished in a
similar fashion. Loosely speaking, the generator is “seeded” with a value
(the key) of up to 256 bytes (2048 bits) long. If the key is shorter than 256
bytes, it is repeated to fill out the 256 bytes before use as a seed; this enables
variable-length keys. In the Xbox, the key is 16 bytes (128 bits) in length,
and thus the cipher is dubbed RC-4/128.