Linear Properties in T-Functions
Håvard Molland, Tor Helleseth · IEEE Transactions on Information Theory · 2006
Linear equations have always been powerful tools in cryptanalysis. In this correspondence, we present a general linear equation of minimum weight 3 in F2that holds for all state lengths n and all shifts i of sequences generated by the T-function xi=xi-12orC+xi-1mod 2nproposed by Klimov and Shamir. It is surprising that these linear properties exist, and they indicate that the sequences generated by the T-functions have more structures than claimed by Klimov and Shamir