  In this paper we study the security of the Bluetooth stream cipher E0 from
the viewpoint it is a "difference stream cipher", that is, it is defined by a
system of explicit difference equations over the finite field GF(2). This
approach highlights some issues of the Bluetooth encryption such as the
invertibility of its state transition map, a special set of 14 bits of its
132-bit state which when guessed implies linear equations among the other bits
and finally a small number of spurious keys, with 83 guessed bits, which are
compatible with a keystream of about 60 bits. Exploiting these issues, we
implement an algebraic attack using Gr\"obner bases, SAT solvers and Binary
Decision Diagrams. Testing activities suggest that the version based on
Gr\"obner bases is the best one and it is able to attack E0 in about 2^79
seconds on an Intel i9 CPU. To the best of our knowledge, this work improves
any previous attack based on a short keystream, hence fitting with Bluetooth
specifications.
