Some attacks on the bit-search generator

Abstract

The bit-search generator (BSG) was proposed in 2004 and can be seen as a variant of the shrinking and self-shrinking generators. It has the advantage that it works at rate 1/3 using only one LFSR and some selection logic. We present various attacks on the BSG based on the fact that the output sequence can be uniquely denned by the differential of the input sequence. By knowing only a small part of the output sequence we can reconstruct the key with complexity O(L320.5L). This complexity can be significantly reduced in a data/time tradeoff manner to achieve a complexity of O(L320.27L) if we have O(20.27L) of keystream. We also propose a distinguishing attack that can be very efficient if the feedback polynomial is not carefully chosen. © International Association for Cryptologic Research 2005.