Article Contents
Article Contents

# Internal state recovery of Espresso stream cipher using conditional sampling resistance and TMDTO attack

• Espresso is a stream cipher proposed for the 5G wireless communication system. Since the design of this cipher is based on the Galois configuration of NLFSR, the cipher has a short propagation delay, and it is the fastest among the ciphers below 1500 GE, including Grain-128 and Trivium. The time-memory-data tradeoff (TMDTO) attack on this cipher and finding the conditional BSW sampling resistance are difficult due to its Galois configuration. This paper demonstrates the calculation of conditional BSW-sampling resistance of Espresso stream cipher, which is based on Galois configuration, and also mounts the TMDTO attack on the cipher by employing the calculated sampling resistance. It is also shown that the attack complexities of TMDTO attack are lower than those claimed by the designers of the ciphers.

Mathematics Subject Classification: Primary: 68P25, 94A60; Secondary: 06E30.

 Citation:

• Table 1.  State Bits required to calculate feedback bits

 Row Feedback bit calculaton because of (5) Column 0 Feedback bit calculaton because of (6) Column 1 Feedback bit calculaton because of (7) Column 2 Feedback bit calculaton because of (8) Column 3 Feedback bit calculaton because of (9) Column 4 Feedback bits State bits appeared on RHS of (5) Feedback bits State bits appeared on RHS of (6) Feedback bits State bits appeared on RHS of (7) Feedback bits State bits appeared on RHS of (8) Feedback bits State bits appeared on RHS of (2) 0 $x_{256}^0$ $x_{0}, \underline{x_{41}}, \overline{x_{70}}$ $x_{252}^1$ $x_{252}, x_{42},$ $x_{83}, x_{8}$ $x_{248}^2$ $x_{248}, x_{44},$ $x_{102}, x_{40}$ $x_{244}^3$ $x_{244}, x_{43},$ $x_{118}, x_{103}$ $x_{240}^4$ $x_{240}, \overline{x_{46}},$ $\underline{x_{141}}, x_{117}$ 1 $x_{257}^0$ $x_{1}, \underline{x_{42}}, \overline{x_{71}}$ $x_{253}^1$ $x_{253}, x_{43},$ $x_{84}, x_{9}$ $x_{249}^2$ $x_{249}, x_{45},$ $x_{103}, x_{41}$ $x_{245}^3$ $x_{245}, x_{44},$ $x_{119}, x_{104}$ $x_{241}^4$ $x_{241}, \overline{x_{47}},$ $\underline{x_{142}}, x_{118}$ 2 $x_{258}^0$ $x_{2}, \underline{x_{43}}, \overline{x_{72}}$ $x_{254}^1$ $x_{254}, x_{44},$ $x_{85}, x_{10}$ $x_{250}^2$ $x_{250}, \overline{x_{46}},$ $\underline{x_{104}}, x_{42}$ $x_{246}^3$ $x_{246}, x_{45},$ $x_{120}, x_{105}$ $x_{242}^4$ $x_{242}, \overline{x_{48}},$ $\underline{x_{143}}, x_{119}$ 3 $x_{259}^0$ $x_{3}, \underline{x_{44}}, \overline{x_{73}}$ $x_{255}^1$ $x_{255}, x_{45},$ $x_{86}, x_{11}$ $x_{251}^2$ $x_{251}, \overline{x_{47}},$ $\underline{x_{105}}, x_{43}$ $x_{247}^3$ $x_{247}, \overline{x_{46}},$ $\underline{x_{121}}, x_{106}$ $x_{243}^4$ $x_{243}, \overline{x_{49}},$ $\underline{x_{144}}, x_{120}$ 4 $x_{260}^0$ $x_{4}, \underline{x_{45}}, \overline{x_{74}}$ $x_{256}^1$ $x_{256}^0, \overline{x_{46}},$ $\underline{x_{87}}, x_{12}$ $x_{252}^2$ $x_{252}^1, \overline{x_{48}},$ $\underline{x_{106}}, x_{44}$ $x_{248}^3$ $x_{248}^2, \overline{x_{47}},$ $\underline{x_{122}}, x_{107}$ $x_{244}^4$ $x_{244}^3, \overline{x_{50}},$ $\underline{x_{145}}, x_{121}$ 5 $x_{261}^0$ $x_{5}, \overline{x_{46}}, \overline{x_{75}}$ $x_{257}^1$ $x_{257}^0, \overline{x_{47}},$ $\underline{x_{88}}, x_{13}$ $x_{253}^2$ $x_{253}^1, \overline{x_{49}},$ $\underline{x_{107}}, x_{45}$ $x_{249}^3$ $x_{249}^2, \overline{x_{48}},$ $\underline{x_{123}}, x_{108}$ $x_{245}^4$ $x_{245}^3, \overline{x_{51}},$ $\underline{x_{146}}, x_{122}$ 6 $x_{262}^0$ $x_{6}, \overline{x_{47}}, \overline{x_{76}}$ $x_{258}^1$ $x_{258}^0, \overline{x_{48}},$ $\underline{x_{89}}, x_{14}$ $x_{254}^2$ $x_{254}^1, \overline{x_{50}},$ $\underline{x_{108}}, \overline{x_{46}}$ $x_{250}^3$ $x_{250}^2, \overline{x_{49}},$ $\underline{x_{124}}, x_{109}$ $x_{246}^4$ $x_{246}^3, \overline{x_{52}},$ $\underline{x_{147}}, x_{123}$ 7 $x_{263}^0$ $x_{7}, \overline{x_{48}}, \underline{x_{77}}$ $x_{259}^1$ $x_{259}^0, \overline{x_{49}},$ $\underline{x_{90}}, x_{15}$ $x_{255}^2$ $x_{255}^1, \overline{x_{51}},$ $\underline{x_{109}}, \overline{x_{47}}$ $x_{251}^3$ $x_{251}^2, \overline{x_{50}},$ $\underline{x_{125}}, x_{110}$ $x_{247}^4$ $x_{247}^3, \overline{x_{53}},$ $\underline{x_{148}}, x_{124}$ 8 $x_{264}^0$ $x_{8}, \overline{x_{49}}, \underline{x_{78}}$ $x_{260}^1$ $x_{260}^0, \overline{x_{50}},$ $\underline{x_{91}}, x_{16}$ $x_{256}^2$ $x_{256}^1, \overline{x_{52}},$ $\underline{x_{110}}, \overline{x_{48}}$ $x_{252}^3$ $x_{252}^2, \overline{x_{51}},$ $\underline{x_{126}}, x_{111}$ $x_{248}^4$ $x_{248}^3, \overline{x_{54}},$ $\underline{x_{149}}, x_{125}$ 9 $x_{265}^0$ $x_{9}, \overline{x_{50}}, \underline{x_{79}}$ $x_{261}^1$ $x_{261}^0, \overline{x_{51}},$ $\underline{x_{92}}, x_{17}$ $x_{257}^2$ $x_{257}^1, \overline{x_{53}},$ $\underline{x_{111}}, \overline{x_{49}}$ $x_{253}^3$ $x_{253}^2, \overline{x_{52}},$ $\underline{x_{127}}, x_{112}$ $x_{249}^4$ $x_{249}^3, \overline{x_{55}},$ $\underline{x_{150}}, x_{126}$ 10 $x_{266}^0$ $x_{10}, \overline{x_{51}}, \underline{x_{80}}$ $x_{262}^1$ $x_{262}^0, \overline{x_{52}},$ $\underline{x_{93}}, x_{18}$ $x_{258}^2$ $x_{258}^1, \overline{x_{54}},$ $\underline{x_{112}}, \overline{x_{50}}$ $x_{254}^3$ $x_{254}^2, \overline{x_{53}},$ $\underline{x_{128}}, x_{113}$ $x_{250}^4$ $x_{250}^3, \overline{x_{56}},$ $\underline{x_{151}}, x_{127}$ 11 $x_{267}^0$ $x_{11}, \overline{x_{52}}, \underline{x_{81}}$ $x_{263}^1$ $x_{263}^0, \overline{x_{53}},$ $\underline{x_{94}}, x_{19}$ $x_{259}^2$ $x_{259}^1, \overline{x_{55}},$ $\underline{x_{113}}, \overline{x_{51}}$ $x_{255}^3$ $x_{255}^2, \overline{x_{54}},$ $\underline{x_{129}}, x_{114}$ $x_{251}^4$ $x_{251}^3, \overline{x_{57}},$ $\underline{x_{152}}, x_{128}$ 12 $x_{268}^0$ $x_{12}, \overline{x_{53}}, \underline{x_{82}}$ $x_{264}^1$ $x_{264}^0, \overline{x_{54}},$ $\underline{x_{95}}, x_{20}$ $x_{260}^2$ $x_{260}^1, \overline{x_{56}},$ $\underline{x_{114}}, \overline{x_{52}}$ $x_{256}^3$ $x_{256}^2, \overline{x_{55}},$ $\underline{x_{130}}, x_{115}$ $x_{252}^4$ $x_{252}^3, \overline{x_{58}},$ $\underline{x_{153}}, x_{129}$ 13 $x_{269}^0$ $x_{13}, \overline{x_{54}}, \underline{x_{83}}$ $x_{265}^1$ $x_{265}^0, \overline{x_{55}},$ $\underline{x_{96}}, x_{21}$ $x_{261}^2$ $x_{261}^1, \overline{x_{57}},$ $\underline{x_{115}}, \overline{x_{53}}$ $x_{257}^3$ $x_{257}^2, \overline{x_{56}},$ $\underline{x_{131}}, x_{116}$ $x_{253}^4$ $x_{253}^3, \overline{x_{59}},$ $\underline{x_{154}}, x_{130}$ 14 $x_{270}^0$ $x_{14}, \overline{x_{55}}, \underline{x_{84}}$ $x_{266}^1$ $x_{266}^0, \overline{x_{56}},$ $\underline{x_{97}}, x_{22}$ $x_{262}^2$ $x_{262}^1, \overline{x_{58}},$ $\underline{x_{116}}, \overline{x_{54}}$ $x_{258}^3$ $x_{258}^2, \overline{x_{57}},$ $\underline{x_{132}}, x_{117}$ $x_{254}^4$ $x_{254}^3, \overline{x_{60}},$ $\underline{x_{155}}, x_{131}$ 15 $x_{271}^0$ $x_{15}, \overline{x_{56}}, \underline{x_{85}}$ $x_{267}^1$ $x_{267}^0, \overline{x_{57}},$ $\underline{x_{98}}, x_{23}$ $x_{263}^2$ $x_{263}^1, \overline{x_{59}},$ $\underline{x_{117}}, \overline{x_{55}}$ $x_{259}^3$ $x_{259}^2, \overline{x_{58}},$ $\underline{x_{133}}, x_{118}$ $x_{255}^4$ $x_{255}^3, \overline{x_{61}},$ $\underline{x_{156}}, x_{132}$ 16 $x_{272}^0$ $x_{16}, \overline{x_{57}}, \underline{x_{86}}$ $x_{268}^1$ $x_{268}^0, \overline{x_{58}},$ $\underline{x_{99}}, x_{24}$ $x_{264}^2$ $x_{264}^1, \overline{x_{60}},$ $\underline{x_{118}}, \overline{x_{56}}$ $x_{260}^3$ $x_{260}^2, \overline{x_{59}},$ $\underline{x_{134}}, x_{119}$ $x_{256}^4$ $x_{256}^3, \overline{x_{62}},$ $\underline{x_{157}}, x_{133}$ 17 $x_{273}^0$ $x_{17}, \overline{x_{58}}, \underline{x_{87}}$ $x_{269}^1$ $x_{269}^0, \overline{x_{59}},$ $\underline{x_{100}}, x_{25}$ $x_{265}^2$ $x_{265}^1, \overline{x_{61}},$ $\underline{x_{119}}, \overline{x_{57}}$ $x_{261}^3$ $x_{261}^2, \overline{x_{60}},$ $\underline{x_{135}}, x_{120}$ $x_{257}^4$ $x_{257}^3, \overline{x_{63}},$ $\underline{x_{158}}, x_{134}$ 18 $x_{274}^0$ $x_{18}, \overline{x_{59}}, \underline{x_{88}}$ $x_{270}^1$ $x_{270}^0, \overline{x_{60}},$ $\underline{x_{101}}, x_{26}$ $x_{266}^2$ $x_{266}^1, \overline{x_{62}},$ $\underline{x_{120}}, \overline{x_{58}}$ $x_{262}^3$ $x_{262}^2, \overline{x_{61}},$ $\underline{x_{136}}, x_{121}$ $x_{258}^4$ $x_{258}^3, \overline{x_{64}},$ $\underline{x_{159}}, x_{135}$ 19 $x_{275}^0$ $x_{19}, \overline{x_{60}}, \underline{x_{89}}$ $x_{271}^1$ $x_{271}^0, \overline{x_{61}},$ $\underline{x_{102}}, x_{27}$ $x_{267}^2$ $x_{267}^1, \overline{x_{63}},$ $\underline{x_{121}}, \overline{x_{59}}$ $x_{263}^3$ $x_{263}^2, \overline{x_{62}},$ $\underline{x_{137}}, x_{122}$ $x_{259}^4$ $x_{259}^3, \overline{x_{65}},$ $\underline{x_{160}}, x_{136}$ 20 $x_{276}^0$ $x_{20}, \overline{x_{61}}, \underline{x_{90}}$ $x_{272}^1$ $x_{272}^0, \overline{x_{62}},$ $\underline{x_{103}}, x_{28}$ $x_{268}^2$ $x_{268}^1, \overline{x_{64}},$ $\underline{x_{122}}, \overline{x_{60}}$ $x_{264}^3$ $x_{264}^2, \overline{x_{63}},$ $\underline{x_{138}}, x_{123}$ $x_{260}^4$ $x_{260}^3, \overline{x_{66}},$ $\underline{x_{161}}, x_{137}$ 21 $x_{277}^0$ $x_{21}, \overline{x_{62}}, \underline{x_{91}}$ $x_{273}^1$ $x_{273}^0, \overline{x_{63}},$ $\underline{x_{104}}, x_{29}$ $x_{269}^2$ $x_{269}^1, \overline{x_{65}},$ $\underline{x_{123}}, \overline{x_{61}}$ $x_{265}^3$ $x_{265}^2, \overline{x_{64}},$ $\underline{x_{139}}, x_{124}$ $x_{261}^4$ $x_{261}^3, \overline{x_{67}},$ $\underline{x_{162}}, x_{138}$ 22 $x_{278}^0$ $x_{22}, \overline{x_{63}}, \underline{x_{92}}$ $x_{274}^1$ $x_{274}^0, \overline{x_{64}},$ $\underline{x_{105}}, x_{30}$ $x_{270}^2$ $x_{270}^1, \overline{x_{66}},$ $\underline{x_{124}}, \overline{x_{62}}$ $x_{266}^3$ $x_{266}^2, \overline{x_{65}},$ $\underline{x_{140}}, x_{125}$ $x_{262}^4$ $x_{262}^3, \overline{x_{68}},$ $\underline{x_{163}}, x_{139}$ 23 $x_{279}^0$ $x_{23}, \overline{x_{64}}, \underline{x_{93}}$ $x_{275}^1$ $x_{275}^0, \overline{x_{65}},$ $\underline{x_{106}}, x_{31}$ $x_{271}^2$ $x_{271}^1, \overline{x_{67}},$ $\underline{x_{125}}, \overline{x_{63}}$ $x_{267}^3$ $x_{267}^2, \overline{x_{66}},$ $\underline{x_{141}}, x_{126}$ $x_{263}^4$ $x_{263}^3, \overline{x_{69}},$ $\underline{x_{164}}, x_{140}$ 24 $x_{280}^0$ $x_{24}, \overline{x_{65}}, \underline{x_{94}}$ $x_{276}^1$ $x_{276}^0, \overline{x_{66}},$ $\underline{x_{107}}, x_{32}$ $x_{272}^2$ $x_{272}^1, \overline{x_{68}},$ $\underline{x_{126}}, \overline{x_{64}}$ $x_{268}^3$ $x_{268}^2, \overline{x_{67}},$ $\underline{x_{142}}, x_{127}$ $x_{264}^4$ $x_{264}^3, \overline{x_{70}},$ $\underline{x_{165}}, x_{141}$ 25 $x_{281}^0$ $x_{25}, \overline{x_{66}}, \underline{x_{95}}$ $x_{277}^1$ $x_{277}^0, \overline{x_{67}},$ $\underline{x_{108}}, x_{33}$ $x_{273}^2$ $x_{273}^1, \overline{x_{69}},$ $\underline{x_{127}}, \overline{x_{65}}$ $x_{269}^3$ $x_{269}^2, \overline{x_{68}},$ $\underline{x_{143}}, x_{128}$ $x_{265}^4$ $x_{265}^3, \overline{x_{71}},$ $\underline{x_{166}}, x_{142}$ 26 $x_{282}^0$ $x_{26}, \overline{x_{67}}, \underline{x_{96}}$ $x_{278}^1$ $x_{278}^0, \overline{x_{68}},$ $\underline{x_{109}}, x_{34}$ $x_{274}^2$ $x_{274}^1, \overline{x_{70}},$ $\underline{x_{128}}, \overline{x_{66}}$ $x_{270}^3$ $x_{270}^2, \overline{x_{69}},$ $\underline{x_{144}}, x_{129}$ $x_{266}^4$ $x_{266}^3, \overline{x_{72}},$ $\underline{x_{167}}, x_{143}$ 27 $x_{283}^0$ $x_{27}, \overline{x_{68}}, \underline{x_{97}}$ $x_{279}^1$ $x_{279}^0, \overline{x_{69}},$ $\underline{x_{110}}, x_{35}$ $x_{275}^2$ $x_{275}^1, \overline{x_{71}},$ $\underline{x_{129}}, \overline{x_{67}}$ $x_{271}^3$ $x_{271}^2, \overline{x_{70}},$ $\underline{x_{145}}, x_{130}$ $x_{267}^4$ $x_{267}^3, \overline{x_{73}},$ $\underline{x_{168}}, x_{144}$ 28 $x_{284}^0$ $x_{28}, \overline{x_{69}}, \underline{x_{98}}$ $x_{280}^1$ $x_{280}^0, \overline{x_{70}},$ $\underline{x_{111}}, x_{36}$ $x_{276}^2$ $x_{276}^1, \overline{x_{72}},$ $\underline{x_{130}}, \overline{x_{68}}$ $x_{272}^3$ $x_{272}^2, \overline{x_{71}},$ $\underline{x_{146}}, x_{131}$ $x_{268}^4$ $x_{268}^3, \overline{x_{74}},$ $\underline{x_{169}}, x_{145}$ 29 $x_{285}^0$ $x_{29}, \overline{x_{70}}, \underline{x_{99}}$ $x_{281}^1$ $x_{281}^0, \overline{x_{71}},$ $\underline{x_{112}}, x_{37}$ $x_{277}^2$ $x_{277}^1, \overline{x_{73}},$ $\underline{x_{131}}, \overline{x_{69}}$ $x_{273}^3$ $x_{273}^2, \overline{x_{72}},$ $\underline{x_{147}}, x_{132}$ $x_{269}^4$ $x_{269}^3, \overline{x_{75}},$ $\underline{x_{170}}, x_{146}$ 30 $x_{286}^0$ $x_{30}, \overline{x_{71}}, \underline{x_{100}}$ $x_{282}^1$ $x_{282}^0, \overline{x_{72}},$ $\underline{x_{113}}, x_{38}$ $x_{278}^2$ $x_{278}^1, \overline{x_{74}},$ $\underline{x_{132}}, \overline{x_{70}}$ $x_{274}^3$ $x_{274}^2, \overline{x_{73}},$ $\underline{x_{148}}, x_{133}$ $x_{270}^4$ $x_{270}^3, \overline{x_{76}},$ $\underline{x_{171}}, x_{147}$ 31 $x_{287}^0$ $x_{31}, \overline{x_{72}}, \underline{x_{101}}$ $x_{283}^1$ $x_{283}^0, \overline{x_{73}},$ $\underline{x_{114}}, x_{39}$ $x_{279}^2$ $x_{279}^1, \overline{x_{75}},$ $\underline{x_{133}}, \overline{x_{71}}$ $x_{275}^3$ $x_{275}^2, \overline{x_{74}},$ $\underline{x_{149}}, x_{134}$ $x_{271}^4$ $x_{271}^3, x_{77},$ $x_{172}, x_{148}$ 32 $x_{288}^0$ $x_{32}, \overline{x_{73}}, \underline{x_{102}}$ $x_{284}^1$ $x_{284}^0, \overline{x_{74}},$ $\underline{x_{115}}, x_{40}$ $x_{280}^2$ $x_{280}^1, \overline{x_{76}},$ $\underline{x_{134}}, \overline{x_{72}}$ $x_{276}^3$ $x_{276}^2, \overline{x_{75}},$ $\underline{x_{150}}, x_{135}$ $x_{272}^4$ $x_{272}^3, x_{78},$ $x_{173}, x_{149}$ 33 $x_{289}^0$ $x_{33}, \overline{x_{74}}, \underline{x_{103}}$ $x_{285}^1$ $x_{285}^0, \overline{x_{75}},$ $\underline{x_{116}}, x_{41}$ $x_{281}^2$ $x_{281}^1, x_{77},$ $x_{135}, \overline{x_{73}}$ $x_{277}^3$ $x_{277}^2, \overline{x_{76}},$ $\underline{x_{151}}, x_{136}$ $x_{273}^4$ $x_{273}^3, x_{79},$ $x_{174}, x_{150}$ 34 $x_{290}^0$ $x_{34}, \overline{x_{75}}, \underline{x_{104}}$ $x_{286}^1$ $\underline{x_{286}^0}, \overline{x_{76}},$ $\underline{x_{117}}, x_{42}$ $x_{282}^2$ $x_{282}^1, x_{78},$ $x_{136}, \overline{x_{74}}$ $x_{278}^3$ $x_{278}^2, x_{77},$ $x_{152}, x_{137}$ $x_{274}^4$ $x_{274}^3, x_{80},$ $x_{175}, x_{151}$

Table 2.  State Bits required to calculate feedback bits

 Row Feedback bit calculaton because of (10) Column 5 Feedback bit calculaton because of (11) Column 6 Feedback bit calculaton because of (12) Column 7 Feedback bit calculaton because of (13) Column 8 Feedback bit calculaton because of (14) Column 9 Feedback bits State bits appeared on RHS of (10) Feedback bits State bits appeared on RHS of (11) Feedback bits State bits appeared on RHS of (12) Feedback bits State bits appeared on RHS of (13) Feedback bits State bits appeared on RHS of (14) 0 $x_{236}^5$ $x_{236}, \overline{x_{67}}, \underline{x_{90}, x_{110}, x_{137}}$ $x_{232}^6$ $x_{232}, \overline{x_{50}},$ $\underline{x_{159}}, x_{189}$ $x_{218}^7$ $x_{218}, \underline{x_{3}}, \overline{x_{32}}$ $x_{214}^8$ $x_{214}, x_{4}, x_{45}$ $x_{210}^9$ $x_{210}, \underline{x_{6}}, \overline{x_{64}}$ 1 $x_{237}^5$ $x_{237}, \overline{x_{68}}, \underline{x_{91}, x_{111}, x_{138}}$ $x_{233}^6$ $x_{233}, \overline{x_{51}},$ $\underline{x_{160}}, x_{190}$ $x_{219}^7$ $x_{219}, \underline{x_{4}}, \overline{x_{33}}$ $x_{215}^8$ $x_{215}, \underline{x_{5}}, \overline{x_{46}}$ $x_{211}^9$ $x_{211}, \underline{x_{7}}, \overline{x_{65}}$ 2 $x_{238}^5$ $x_{238}, \overline{x_{69}}, \underline{x_{92}, x_{112}, x_{139}}$ $x_{234}^6$ $x_{234}, \overline{x_{52}},$ $\underline{x_{161}}, x_{191}$ $x_{220}^7$ $x_{220}, \underline{x_{5}}, \overline{x_{34}}$ $x_{216}^8$ $x_{216}, \underline{x_{6}}, \overline{x_{47}}$ $x_{212}^9$ $x_{212}, \underline{x_{8}}, \overline{x_{66}}$ 3 $x_{239}^5$ $x_{239}, \overline{x_{70}}, \underline{x_{93}, x_{113}, x_{140}}$ $x_{235}^6$ $x_{235}, \overline{x_{53}},$ $\underline{x_{162}}, x_{192}$ $x_{221}^7$ $x_{221}, \underline{x_{6}}, \overline{x_{35}}$ $x_{217}^8$ $x_{217}, \underline{x_{7}}, \overline{x_{48}}$ $x_{213}^9$ $x_{213}, \underline{x_{9}}, \overline{x_{67}}$ 4 $x_{240}^5$ $x_{240}^4, \overline{x_{71}}, \underline{x_{94}, x_{114}, x_{141}}$ $x_{236}^6$ $x_{236}^5, \overline{x_{54}},$ $\underline{x_{163}}, x_{193}$ $x_{222}^7$ $x_{222}, \underline{x_{7}}, \overline{x_{36}}$ $x_{218}^8$ $x_{218}^7, \underline{x_{8}}, \overline{x_{49}}$ $x_{214}^9$ $x_{214}^8, \underline{x_{10}}, \overline{x_{68}}$ 5 $x_{241}^5$ $x_{241}^4, \overline{x_{72}}, \underline{x_{95}, x_{115}, x_{142}}$ $x_{237}^6$ $x_{237}^5, \overline{x_{55}},$ $\underline{x_{164}}, x_{194}^{13}$ $x_{223}^7$ $x_{223}, x_{8}, x_{37}$ $x_{219}^8$ $x_{219}^7, \underline{x_{9}}, \overline{x_{50}}$ $x_{215}^9$ $x_{215}^8, \underline{x_{11}}, \overline{x_{69}}$ 6 $x_{242}^5$ $x_{242}^4, \overline{x_{73}}, \underline{x_{96}, x_{116}, x_{143}}$ $x_{238}^6$ $x_{238}^5, \overline{x_{56}},$ $\underline{x_{165}}, x_{195}^{13}$ $x_{224}^7$ $x_{224}, x_{9}, x_{38}$ $x_{220}^8$ $x_{220}^7, \underline{x_{10}}, \overline{x_{51}}$ $x_{216}^9$ $x_{216}^8, \underline{x_{12}}, \overline{x_{70}}$ 7 $x_{243}^5$ $x_{243}^4, \overline{x_{74}}, \underline{x_{97}, x_{117}, x_{144}}$ $x_{239}^6$ $x_{239}^5, \overline{x_{57}},$ $\underline{x_{166}}, x_{196}^{13}$ $x_{225}^7$ $x_{225}, x_{10}, x_{39}$ $x_{221}^8$ $x_{221}^7, \underline{x_{11}}, \overline{x_{52}}$ $x_{217}^9$ $x_{217}^8, \underline{x_{13}}, \overline{x_{71}}$ 8 $x_{244}^5$ $x_{244}^4, \overline{x_{75}}, \underline{x_{98}, x_{118}, x_{145}}$ $x_{240}^6$ $x_{240}^5, \overline{x_{58}},$ $\underline{x_{167}}, x_{197}^{13}$ $x_{226}^7$ $x_{226}, x_{11}, x_{40}$ $x_{222}^8$ $x_{222}^7, \underline{x_{12}}, \overline{x_{53}}$ $x_{218}^9$ $x_{218}^8, \underline{x_{14}}, \overline{x_{72}}$ 9 $x_{245}^5$ $x_{245}^4, \overline{x_{76}}, \underline{x_{99}, x_{119}, x_{146}}$ $x_{241}^6$ $x_{241}^5, \overline{x_{59}},$ $\underline{x_{168}}, x_{198}^{13}$ $x_{227}^7$ $x_{227}, x_{12}, x_{41}$ $x_{223}^8$ $x_{223}^7, \underline{x_{13}}, \overline{x_{54}}$ $x_{219}^9$ $x_{219}^8, \underline{x_{15}}, \overline{x_{73}}$ 10 $x_{246}^5$ $x_{246}^4, x_{77}, x_{100}, x_{120}, x_{147}$ $x_{242}^6$ $x_{242}^5, \overline{x_{60}},$ $\underline{x_{169}}, x_{199}^{13}$ $x_{228}^7$ $x_{228}, x_{13}, x_{42}$ $x_{224}^8$ $x_{224}^7, \underline{x_{14}}, \overline{x_{55}}$ $x_{220}^9$ $x_{220}^8, \underline{x_{16}}, \overline{x_{74}}$ 11 $x_{247}^5$ $x_{247}^4, x_{78}, x_{101}, x_{121}, x_{148}$ $x_{243}^6$ $x_{243}^5, \overline{x_{61}},$ $\underline{x_{170}}, x_{200}^{13}$ $x_{229}^7$ $x_{229}, x_{14}, x_{43}$ $x_{225}^8$ $x_{225}^7, \underline{x_{15}}, \overline{x_{56}}$ $x_{221}^9$ $x_{221}^8, \underline{x_{17}}, \overline{x_{75}}$ 12 $x_{248}^5$ $x_{248}^4, x_{79}, x_{102}, x_{122}, x_{149}$ $x_{244}^6$ $x_{244}^5, \overline{x_{62}},$ $\underline{x_{171}}, x_{201}^{13}$ $x_{230}^7$ $x_{230}, x_{15}, x_{44}$ $x_{226}^8$ $x_{226}^7, \underline{x_{16}}, \overline{x_{57}}$ $x_{222}^9$ $x_{222}^8, \underline{x_{18}}, \overline{x_{76}}$ 13 $x_{249}^5$ $x_{249}^4, x_{80}, x_{103}, x_{123}, x_{150}$ $x_{245}^6$ $x_{245}^5, \overline{x_{63}},$ $\underline{x_{172}}, x_{202}^{13}$ $x_{231}^7$ $x_{231}, x_{16}, x_{45}$ $x_{227}^8$ $x_{227}^7, \underline{x_{17}}, \overline{x_{58}}$ $x_{223}^9$ $x_{223}^8, x_{19}, x_{77}$ 14 $x_{250}^5$ $x_{250}^4, x_{81}, x_{104}, x_{124}, x_{151}$ $x_{246}^6$ $x_{246}^5, \overline{x_{64}},$ $\underline{x_{173}}, x_{203}^{13}$ $x_{232}^7$ $x_{232}^6, \underline{x_{17}}, \overline{x_{46}}$ $x_{228}^8$ $x_{228}^7, \underline{x_{18}}, \overline{x_{59}}$ $x_{224}^9$ $x_{224}^8, x_{20}, x_{78}$ 15 $x_{251}^5$ $x_{251}^4, x_{82}, x_{105}, x_{125}, x_{152}$ $x_{247}^6$ $x_{247}^5, \overline{x_{65}},$ $\underline{x_{174}}, x_{204}^{13}$ $x_{233}^7$ $x_{233}^6, \underline{x_{18}}, \overline{x_{47}}$ $x_{229}^8$ $x_{229}^7, \underline{x_{19}}, \overline{x_{60}}$ $x_{225}^9$ $x_{225}^8, x_{21}, x_{79}$ 16 $x_{252}^5$ $x_{252}^4, x_{83}, x_{106}, x_{126}, x_{153}$ $x_{248}^6$ $x_{248}^5, \overline{x_{66}},$ $\underline{x_{175}}, x_{205}^{13}$ $x_{234}^7$ $x_{234}^6, \underline{x_{19}}, \overline{x_{48}}$ $x_{230}^8$ $x_{230}^7, \underline{x_{20}}, \overline{x_{61}}$ $x_{226}^9$ $x_{226}^8, x_{22}, x_{80}$ 17 $x_{253}^5$ $x_{253}^4, x_{84}, x_{107}, x_{127}, x_{154}$ $x_{249}^6$ $x_{249}^5, \overline{x_{67}},$ $\underline{x_{176}}, x_{206}^{13}$ $x_{235}^7$ $x_{235}^6, \underline{x_{20}}, \overline{x_{49}}$ $x_{231}^8$ $x_{231}^7, \underline{x_{21}}, \overline{x_{62}}$ $x_{227}^9$ $x_{227}^8, x_{23}, x_{81}$ 18 $x_{254}^5$ $x_{254}^4, x_{85}, x_{108}, x_{128}, x_{155}$ $x_{250}^6$ $x_{250}^5, \overline{x_{68}},$ $\underline{x_{177}}, x_{207}^{13}$ $x_{236}^7$ $x_{236}^6, \underline{x_{21}}, \overline{x_{50}}$ $x_{232}^8$ $x_{232}^7, \underline{x_{22}}, \overline{x_{63}}$ $x_{228}^9$ $x_{228}^8, x_{24}, x_{82}$ 19 $x_{255}^5$ $x_{255}^4, x_{86}, x_{109}, x_{129}, x_{156}$ $x_{251}^6$ $x_{251}^5, \overline{x_{69}},$ $\underline{x_{178}}, x_{208}^{13}$ $x_{237}^7$ $x_{237}^6, \underline{x_{22}}, \overline{x_{51}}$ $x_{233}^8$ $x_{233}^7, \underline{x_{23}}, \overline{x_{64}}$ $x_{229}^9$ $x_{229}^8, x_{25}, x_{83}$ 20 $x_{256}^5$ $x_{256}^4, x_{87}, x_{110}, x_{130}, x_{157}$ $x_{252}^6$ $x_{252}^5, \overline{x_{70}},$ $\underline{x_{179}}, x_{209}^{13}$ $x_{238}^7$ $x_{238}^6, \underline{x_{23}}, \overline{x_{52}}$ $x_{234}^8$ $x_{234}^7, \underline{x_{24}}, \overline{x_{65}}$ $x_{230}^9$ $x_{230}^8, x_{26}, x_{84}$ 21 $x_{257}^5$ $x_{257}^4, x_{88}, x_{111}, x_{131}, x_{158}$ $x_{253}^6$ $x_{253}^5, \overline{x_{71}},$ $\underline{x_{180}}, x_{210}^{13}$ $x_{239}^7$ $x_{239}^6, \underline{x_{24}}, \overline{x_{53}}$ $x_{235}^8$ $x_{235}^7, \underline{x_{25}}, \overline{x_{66}}$ $x_{231}^9$ $x_{231}^8, x_{27}, x_{85}$ 22 $x_{258}^5$ $x_{258}^4, x_{89}, x_{112}, x_{132}, x_{159}$ $x_{254}^6$ $x_{254}^5, \overline{x_{72}},$ $\underline{x_{181}}, x_{211}^{13}$ $x_{240}^7$ $x_{240}^6, \underline{x_{25}}, \overline{x_{54}}$ $x_{236}^8$ $x_{236}^7, \underline{x_{26}}, \overline{x_{67}}$ $x_{232}^9$ $x_{232}^8, x_{28}, x_{86}$ 23 $x_{259}^5$ $x_{259}^4, x_{90}, x_{113}, x_{133}, x_{160}$ $x_{255}^6$ $x_{255}^5, \overline{x_{73}},$ $\underline{x_{182}}, x_{212}^{13}$ $x_{241}^7$ $x_{241}^6, \underline{x_{26}}, \overline{x_{55}}$ $x_{237}^8$ $x_{237}^7, \underline{x_{27}}, \overline{x_{68}}$ $x_{233}^9$ $x_{233}^8, \overline{x_{29}}, \underline{x_{87}}$ 24 $x_{260}^5$ $x_{260}^4, x_{91}, x_{114}, x_{134}, x_{161}$ $x_{256}^6$ $x_{256}^5, \overline{x_{74}},$ $\underline{x_{183}}, x_{213}^{13}$ $x_{242}^7$ $x_{242}^6, \underline{x_{27}}, \overline{x_{56}}$ $x_{238}^8$ $x_{238}^7, \underline{x_{28}}, \overline{x_{69}}$ $x_{234}^9$ $x_{234}^8, \overline{x_{30}}, \underline{x_{88}}$ 25 $x_{261}^5$ $x_{261}^4, x_{92}, x_{115}, x_{135}, x_{162}$ $x_{257}^6$ $x_{257}^5, \overline{x_{75}},$ $\underline{x_{184}}, x_{214}^{13}$ $x_{243}^7$ $x_{243}^6, \underline{x_{28}}, \overline{x_{57}}$ $x_{239}^8$ $x_{239}^7, \overline{x_{29}}, \overline{x_{70}}$ $x_{235}^9$ $x_{235}^8, \overline{x_{31}}, \underline{x_{89}}$ 26 $x_{262}^5$ $x_{262}^4, x_{93}, x_{116}, x_{136}, x_{163}$ $x_{258}^6$ $x_{258}^5, \overline{x_{76}},$ $\underline{x_{185}}, x_{215}^{13}$ $x_{244}^7$ $x_{244}^6, \overline{x_{29}}, \overline{x_{58}}$ $x_{240}^8$ $x_{240}^7, \overline{x_{30}}, \overline{x_{71}}$ $x_{236}^9$ $x_{236}^8, \overline{x_{32}}, \underline{x_{90}}$ 27 $x_{263}^5$ $x_{263}^4, x_{94}, x_{117}, x_{137}, x_{164}$ $x_{259}^6$ $x_{259}^5, x_{77},$ $x_{186}, x_{216}^{13}$ $x_{245}^7$ $x_{245}^6, \overline{x_{30}}, \overline{x_{59}}$ $x_{241}^8$ $x_{241}^7, \overline{x_{31}}, \overline{x_{72}}$ $x_{237}^9$ $x_{237}^8, \overline{x_{33}}, \underline{x_{91}}$ 28 $x_{264}^5$ $x_{264}^4, x_{95}, x_{118}, x_{138}, x_{165}$ $x_{260}^6$ $x_{260}^5, x_{78},$ $x_{187}, x_{217}^{13}$ $x_{246}^7$ $x_{246}^6, \overline{x_{31}}, \overline{x_{60}}$ $x_{242}^8$ $x_{242}^7, \overline{x_{32}}, \overline{x_{73}}$ $x_{238}^9$ $x_{238}^8, \overline{x_{34}}, \underline{x_{92}}$ 29 $x_{265}^5$ $x_{265}^4, x_{96}, x_{119}, x_{139}, x_{166}$ $x_{261}^6$ $x_{261}^5, x_{79},$ $x_{188}, x_{218}^{13}$ $x_{247}^7$ $x_{247}^6, \overline{x_{32}}, \overline{x_{61}}$ $x_{243}^8$ $x_{243}^7, \overline{x_{33}}, \overline{x_{74}}$ $x_{239}^9$ $x_{239}^8, \overline{x_{35}}, \underline{x_{93}}$ 30 $x_{266}^5$ $x_{266}^4, x_{97}, x_{120}, x_{140}, x_{167}$ $x_{262}^6$ $x_{262}^5, x_{80},$ $x_{189}, x_{219}^{13}$ $x_{248}^7$ $x_{248}^6, \overline{x_{33}}, \overline{x_{62}}$ $x_{244}^8$ $x_{244}^7, \overline{x_{34}}, \overline{x_{75}}$ $x_{240}^9$ $x_{240}^8, \overline{x_{36}}, \underline{x_{94}}$ 31 $x_{267}^5$ $x_{267}^4, x_{98}, x_{121}, x_{141}, x_{168}$ $x_{263}^6$ $x_{263}^5, x_{81},$ $x_{190}, x_{220}^{13}$ $x_{249}^7$ $x_{249}^6, \overline{x_{34}}, \overline{x_{63}}$ $x_{245}^8$ $x_{245}^7, \overline{x_{35}}, \overline{x_{76}}$ $x_{241}^9$ $x_{241}^8, x_{37}, x_{95}$ 32 $x_{268}^5$ $x_{268}^4, x_{99}, x_{122}, x_{142}, x_{169}$ $x_{264}^6$ $x_{264}^5, x_{82},$ $x_{191}, x_{221}^{13}$ $x_{250}^7$ $x_{250}^6, \overline{x_{35}}, \overline{x_{64}}$ $x_{246}^8$ $x_{246}^7, \overline{x_{36}},\underline{x_{77}}$ $x_{242}^9$ $x_{242}^8, x_{38}, x_{96}$ 33 $x_{269}^5$ $x_{269}^4, x_{100}, x_{123}, x_{143}, x_{170}$ $x_{265}^6$ $x_{265}^5, x_{83},$ $x_{192}, x_{222}^{13}$ $x_{251}^7$ $x_{251}^6, \overline{x_{36}}, \overline{x_{65}}$ $x_{247}^8$ $x_{247}^7, x_{37}, x_{78}$ $x_{243}^9$ $x_{243}^8, x_{39}, x_{97}$ 34 $x_{270}^5$ $x_{270}^4, x_{101}, x_{124}, x_{144}, x_{171}$ $x_{266}^6$ $x_{266}^5, x_{84},$ $x_{193}, x_{223}^{13}$ $x_{252}^7$ $x_{252}^6, \underline{x_{37}}, \overline{x_{66}}$ $x_{248}^8$ $x_{248}^7, x_{38}, x_{79}$ $x_{244}^9$ $x_{244}^8, x_{40}, x_{98}$

Table 3.  State Bits required to calculate feedback bits

 Row Feedback bit calculaton because of (15) Column 10 Feedback bit calculaton because of (16) Column11 Feedback bit calculaton because of (17) Column 12 Feedback bit calculaton because of (18) Column 13 Feedback bits State bits appeared on RHS of (15) Feedback bits State bits appeared on RHS of (16) Feedback bits State bits appeared on RHS of (17) Feedback bits State bits appeared on RHS of (18) 0 $x_{206}^{10}$ $x_{206}, x_{5}, x_{80}$ $x_{202}^{11}$ $x_{202}, x_{8},$ $x_{103}$ $x_{198}^{12}$ $x_{198}, \overline{x_{29}}, \overline{x_{52}}, \overline{x_{72}}, \underline{x_{99}}$ $x_{194}^{13}$ $x_{194}, x_{12}, x_{121}$ 1 $x_{207}^{10}$ $x_{207}, x_{6}, x_{81}$ $x_{203}^{11}$ $x_{203}, x_{9},$ $x_{104}$ $x_{199}^{12}$ $x_{199}, \overline{x_{30}}, \overline{x_{53}}, \overline{x_{73}}, \underline{x_{100}}$ $x_{195}^{13}$ $x_{195}, x_{13}, x_{122}$ 2 $x_{208}^{10}$ $x_{208}, x_{7}, x_{82}$ $x_{204}^{11}$ $x_{204}, x_{10},$ $x_{105}$ $x_{200}^{12}$ $x_{200}, \overline{x_{31}}, \overline{x_{54}}, \overline{x_{74}}, \underline{x_{101}}$ $x_{196}^{13}$ $x_{196}, x_{14}, x_{123}$ 3 $x_{209}^{10}$ $x_{209}, x_{8}, x_{83}$ $x_{205}^{11}$ $x_{205}, x_{11},$ $x_{106}$ $x_{201}^{12}$ $x_{201}, \overline{x_{32}}, \overline{x_{55}}, \overline{x_{75}}, \underline{x_{102}}$ $x_{197}^{13}$ $x_{197}, x_{15}, x_{124}$ 4 $x_{210}^{10}$ $x_{210}^9, x_{9}, x_{84}$ $x_{206}^{11}$ $x_{206}^{10}, x_{12},$ $x_{107}$ $x_{202}^{12}$ $x_{202}^{11}, \overline{x_{33}}, \overline{x_{56}}, \overline{x_{76}}, \underline{x_{103}}$ $x_{198}^{13}$ $x_{198}^{12}, x_{16}, x_{125}$ 5 $x_{211}^{10}$ $x_{211}^9, x_{10}, x_{85}$ $x_{207}^{11}$ $x_{207}^{10}, x_{13},$ $x_{108}$ $x_{203}^{12}$ $x_{203}^{11}, \overline{x_{34}}, \overline{x_{57}}, \underline{x_{77}}, \underline{x_{104}}$ $x_{199}^{13}$ $x_{199}^{12}, x_{17}, x_{126}$ 6 $x_{212}^{10}$ $x_{212}^9, x_{11}, x_{86}$ $x_{208}^{11}$ $x_{208}^{10}, x_{14},$ $x_{109}$ $x_{204}^{12}$ $x_{204}^{11}, \overline{x_{35}}, \overline{x_{58}}, \underline{x_{78}}, \underline{x_{105}}$ $x_{200}^{13}$ $x_{200}^{12}, x_{18}, x_{127}$ 7 $x_{213}^{10}$ $x_{213}^9, x_{12}, x_{87}$ $x_{209}^{11}$ $x_{209}^{10}, x_{15},$ $x_{110}$ $x_{205}^{12}$ $x_{205}^{11}, \overline{x_{36}}, \overline{x_{59}}, \underline{x_{79}}, \underline{x_{106}}$ $x_{201}^{13}$ $x_{201}^{12}, x_{19}, x_{128}$ 8 $x_{214}^{10}$ $x_{214}^9, x_{13}, x_{88}$ $x_{210}^{11}$ $x_{210}^{10}, x_{16},$ $x_{111}$ $x_{206}^{12}$ $x_{206}^{11}, \underline{x_{37}}, \overline{x_{60}}, \underline{x_{80}}, \underline{x_{107}}$ $x_{202}^{13}$ $x_{202}^{12}, x_{20}, x_{129}$ 9 $x_{215}^{10}$ $x_{215}^9, x_{14}, x_{89}$ $x_{211}^{11}$ $x_{211}^{10}, x_{17},$ $x_{112}$ $x_{207}^{12}$ $x_{207}^{11}, \underline{x_{38}}, \overline{x_{61}}, \underline{x_{81}}, \underline{x_{108}}$ $x_{203}^{13}$ $x_{203}^{12}, x_{21}, x_{130}$ 10 $x_{216}^{10}$ $x_{216}^9, x_{15}, x_{90}$ $x_{212}^{11}$ $x_{212}^{10}, x_{18},$ $x_{113}$ $x_{208}^{12}$ $x_{208}^{11}, \underline{x_{39}}, \overline{x_{62}}, \underline{x_{82}}, \underline{x_{109}}$ $x_{204}^{13}$ $x_{204}^{12}, x_{22}, x_{131}$ 11 $x_{217}^{10}$ $x_{217}^9, x_{16}, x_{91}$ $x_{213}^{11}$ $x_{213}^{10}, x_{19},$ $x_{114}$ $x_{209}^{12}$ $x_{209}^{11}, \underline{x_{40}}, \overline{x_{63}}, \underline{x_{83}}, \underline{x_{110}}$ $x_{205}^{13}$ $x_{205}^{12}, x_{23}, x_{132}$ 12 $x_{218}^{10}$ $x_{218}^9, x_{17}, x_{92}$ $x_{214}^{11}$ $x_{214}^{10}, x_{20},$ $x_{115}$ $x_{210}^{12}$ $x_{210}^{11}, \underline{x_{41}}, \overline{x_{64}}, \underline{x_{84}}, \underline{x_{111}}$ $x_{206}^{13}$ $x_{206}^{12}, x_{24}, x_{133}$ 13 $x_{219}^{10}$ $x_{219}^9, x_{18}, x_{93}$ $x_{215}^{11}$ $x_{215}^{10}, x_{21},$ $x_{116}$ $x_{211}^{12}$ $x_{211}^{11}, \underline{x_{42}}, \overline{x_{65}}, \underline{x_{85}}, \underline{x_{112}}$ $x_{207}^{13}$ $x_{207}^{12}, x_{25}, x_{134}$ 14 $x_{220}^{10}$ $x_{220}^9, x_{19}, x_{94}$ $x_{216}^{11}$ $x_{216}^{10}, x_{22},$ $x_{117}$ $x_{212}^{12}$ $x_{212}^{11}, \underline{x_{43}}, \overline{x_{66}}, \underline{x_{86}}, \underline{x_{113}}$ $x_{208}^{13}$ $x_{208}^{12}, x_{26}, x_{135}$ 15 $x_{221}^{10}$ $x_{221}^9, x_{20}, x_{95}$ $x_{217}^{11}$ $x_{217}^{10}, x_{23},$ $x_{118}$ $x_{213}^{12}$ $x_{213}^{11}, \underline{x_{44}}, \overline{x_{67}}, \underline{x_{87}}, \underline{x_{114}}$ $x_{209}^{13}$ $x_{209}^{12}, x_{27}, x_{136}$ 16 $x_{222}^{10}$ $x_{222}^9, x_{21}, x_{96}$ $x_{218}^{11}$ $x_{218}^{10}, x_{24},$ $x_{119}$ $x_{214}^{12}$ $x_{214}^{11}, \underline{x_{45}}, \overline{x_{68}}, \underline{x_{88}}, \underline{x_{115}}$ $x_{210}^{13}$ $x_{210}^{12}, x_{28}, x_{137}$ 17 $x_{223}^{10}$ $x_{223}^9, x_{22}, x_{97}$ $x_{219}^{11}$ $x_{219}^{10}, x_{25},$ $x_{120}$ $x_{215}^{12}$ $x_{215}^{11}, \overline{x_{46}}, \overline{x_{69}}, \underline{x_{89}}, \underline{x_{116}}$ $x_{211}^{13}$ $x_{211}^{12}, \overline{x_{29}}, \underline{x_{138}}$ 18 $x_{224}^{10}$ $x_{224}^9, x_{23}, x_{98}$ $x_{220}^{11}$ $x_{220}^{10}, x_{26},$ $x_{121}$ $x_{216}^{12}$ $x_{216}^{11}, \overline{x_{47}}, \overline{x_{70}}, \underline{x_{90}}, \underline{x_{117}}$ $x_{212}^{13}$ $x_{212}^{12}, \overline{x_{30}}, \underline{x_{139}}$ 19 $x_{225}^{10}$ $x_{225}^9, x_{24}, x_{99}$ $x_{221}^{11}$ $x_{221}^{10}, x_{27},$ $x_{122}$ $x_{217}^{12}$ $x_{217}^{11}, \overline{x_{48}}, \overline{x_{71}}, \underline{x_{91}}, \underline{x_{118}}$ $x_{213}^{13}$ $x_{213}^{12}, \overline{x_{31}}, \underline{x_{140}}$ 20 $x_{226}^{10}$ $x_{226}^9, x_{25}, x_{100}$ $x_{222}^{11}$ $x_{222}^{10}, x_{28},$ $x_{123}$ $x_{218}^{12}$ $x_{218}^{11}, \overline{x_{49}}, \overline{x_{72}}, \underline{x_{92}}, \underline{x_{119}}$ $x_{214}^{13}$ $x_{214}^{12}, \overline{x_{32}}, \underline{x_{141}}$ 21 $x_{227}^{10}$ $x_{227}^9, x_{26}, x_{101}$ $x_{223}^{11}$ $x_{223}^{10}, \overline{x_{29}},$ $\underline{x_{124}}$ $x_{219}^{12}$ $x_{219}^{11}, \overline{x_{50}}, \overline{x_{73}}, \underline{x_{93}}, \underline{x_{120}}$ $x_{215}^{13}$ $x_{215}^{12}, \overline{x_{33}}, \underline{x_{142}}$ 22 $x_{228}^{10}$ $x_{228}^9, x_{27}, x_{102}$ $x_{224}^{11}$ $x_{224}^{10}, \overline{x_{30}},$ $\underline{x_{125}}$ $x_{220}^{12}$ $x_{220}^{11}, \overline{x_{51}}, \overline{x_{74}}, \underline{x_{94}}, \underline{x_{121}}$ $x_{216}^{13}$ $x_{216}^{12}, \overline{x_{34}}, \underline{x_{143}}$ 23 $x_{229}^{10}$ $x_{229}^9, x_{28}, x_{103}$ $x_{225}^{11}$ $x_{225}^{10}, \overline{x_{31}},$ $\underline{x_{126}}$ $x_{221}^{12}$ $x_{221}^{11}, \overline{x_{52}}, \overline{x_{75}}, \underline{x_{95}}, \underline{x_{122}}$ $x_{217}^{13}$ $x_{217}^{12}, \overline{x_{35}}, \underline{x_{144}}$ 24 $x_{230}^{10}$ $x_{230}^9, \overline{x_{29}}, \underline{x_{104}}$ $x_{226}^{11}$ $x_{226}^{10}, \overline{x_{32}},$ $\underline{x_{127}}$ $x_{222}^{12}$ $x_{222}^{11}, \overline{x_{53}}, \overline{x_{76}}, \underline{x_{96}}, \underline{x_{123}}$ $x_{218}^{13}$ $x_{218}^{12}, \overline{x_{36}}, \underline{x_{145}}$ 25 $x_{231}^{10}$ $x_{231}^9, \overline{x_{30}}, \underline{x_{105}}$ $x_{227}^{11}$ $x_{227}^{10}, \overline{x_{33}},$ $\underline{x_{128}}$ $x_{223}^{12}$ $x_{223}^{11}, \overline{x_{54}}, \underline{x_{77}}, \underline{x_{97}}, \underline{x_{124}}$ $x_{219}^{13}$ $x_{219}^{12}, x_{37}, x_{146}$ 26 $x_{232}^{10}$ $x_{232}^9, \overline{x_{31}}, \underline{x_{106}}$ $x_{228}^{11}$ $x_{228}^{10}, \overline{x_{34}},$ $\underline{x_{129}}$ $x_{224}^{12}$ $x_{224}^{11}, \overline{x_{55}}, \underline{x_{78}}, \underline{x_{98}}, \underline{x_{125}}$ $x_{220}^{13}$ $x_{220}^{12}, x_{38}, x_{147}$ 27 $x_{233}^{10}$ $x_{233}^9, \overline{x_{32}}, \underline{x_{107}}$ $x_{229}^{11}$ $x_{229}^{10}, \overline{x_{35}},$ $\underline{x_{130}}$ $x_{225}^{12}$ $x_{225}^{11}, \overline{x_{56}}, \underline{x_{79}}, \underline{x_{99}}, \underline{x_{126}}$ $x_{221}^{13}$ $x_{221}^{12}, x_{39}, x_{148}$ 28 $x_{234}^{10}$ $x_{234}^9, \overline{x_{33}}, \underline{x_{108}}$ $x_{230}^{11}$ $x_{230}^{10}, \overline{x_{36}},$ $\underline{x_{131}}$ $x_{226}^{12}$ $x_{226}^{11}, \overline{x_{57}}, \underline{x_{80}}, \underline{x_{100}}, \underline{x_{127}}$ $x_{222}^{13}$ $x_{222}^{12}, x_{40}, x_{149}$ 29 $x_{235}^{10}$ $x_{235}^9, \overline{x_{34}}, \underline{x_{109}}$ $x_{231}^{11}$ $x_{231}^{10}, x_{37},$ $x_{132}$ $x_{227}^{12}$ $x_{227}^{11}, \overline{x_{58}}, \underline{x_{81}}, \underline{x_{101}}, \underline{x_{128}}$ $x_{223}^{13}$ $x_{223}^{12}, x_{41}, x_{150}$ 30 $x_{236}^{10}$ $x_{236}^9, \overline{x_{35}}, \underline{x_{110}}$ $x_{232}^{11}$ $x_{232}^{10}, x_{38},$ $x_{133}$ $x_{228}^{12}$ $x_{228}^{11}, \overline{x_{59}}, \underline{x_{82}}, \underline{x_{102}}, \underline{x_{129}}$ $x_{224}^{13}$ $x_{224}^{12}, x_{42}, x_{151}$ 31 $x_{237}^{10}$ $x_{237}^9, \overline{x_{36}}, \underline{x_{111}}$ $x_{233}^{11}$ $x_{233}^{10}, x_{39},$ $x_{134}$ $x_{229}^{12}$ $x_{229}^{11}, \overline{x_{60}}, \underline{x_{83}}, \underline{x_{103}}, \underline{x_{130}}$ $x_{225}^{13}$ $x_{225}^{12}, x_{43}, x_{152}$ 32 $x_{238}^{10}$ $x_{238}^9, x_{37}, x_{112}$ $x_{234}^{11}$ $x_{234}^{10}, x_{40},$ $x_{135}$ $x_{230}^{12}$ $x_{230}^{11}, \overline{x_{61}}, \underline{x_{84}}, \underline{x_{104}}, \underline{x_{131}}$ $x_{226}^{13}$ $x_{226}^{12}, x_{44}, x_{153}$ 33 $x_{239}^{10}$ $x_{239}^9, x_{38}, x_{113}$ $x_{235}^{11}$ $x_{235}^{10}, x_{41},$ $x_{136}$ $x_{231}^{12}$ $x_{231}^{11}, \overline{x_{62}}, \underline{x_{85}}, \underline{x_{105}}, \underline{x_{132}}$ $x_{227}^{13}$ $x_{227}^{12}, x_{45}, x_{154}$ 34 $x_{240}^{10}$ $x_{240}^9, x_{39}, x_{114}$ $x_{236}^{11}$ $x_{236}^{10}, x_{42},$ $x_{137}$ $x_{232}^{12}$ $x_{232}^{11}, \overline{x_{63}}, \underline{x_{86}}, \underline{x_{106}}, \underline{x_{133}}$ $x_{228}^{13}$ $x_{228}^{12}, \overline{x_{46}}, \underline{x_{155}}$

Table 4.  Equations used for recovery of 35 bits of the internal state

 Step/Row Equations used for recovery 0 \begin{aligned}x_{137}& = z_ 0 \oplus x_{ 80} \oplus x_{99} \oplus x_{227} \oplus x_{222} \oplus x_{187} \oplus x_{243}x_{217} \oplus x_{247}x_{231} \oplus x_{213}x_{235} \\ & \quad \oplus x_{255}x_{251} \oplus x_{181}x_{239} \oplus x_{174}x_{44}\oplus x_{164} \overline{x_{29}} \oplus x_{255}x_{247}x_{243}x_{213}x_{181}x_{174}\end{aligned} 1 \begin{aligned}x_{ 138}& = z_ 1 \oplus x_{ 81} \oplus x_{ 100} \oplus x_{ 228} \oplus x_{ 223} \oplus x_{188} \oplus x_{ 244}^3x_{218}^7 \oplus x_{ 248}^2x_{ 232}^6 \oplus x_{214}^8x_{236}^5 \\ & \quad\oplus x_{ 256}^0x_{252}^1 \oplus x_{182}x_{240}^4 \oplus x_{175}x_{ 45}\oplus x_{165} \overline{x_{30}} \oplus x_{256}^0x_{248}^2x_{244}^3x_{214}^8x_{182}x_{175}\end{aligned} 2 \begin{aligned}x_{ 139}& = z_ 2 \oplus x_{ 82} \oplus x_{ 101} \oplus x_{ 229} \oplus x_{ 224} \oplus x_{189} \oplus x_{ 245}^3x_{219}^7 \oplus x_{ 249}^2x_{ 233}^6 \oplus x_{215}^8x_{237}^5\\ & \quad\oplus x_{ 257}^0x_{253}^1 \oplus x_{183}x_{241}^4 \oplus x_{176}\overline{x_{ 46}}\oplus x_{166} \overline{x_{31}} \oplus x_{257}^0x_{249}^2x_{245}^3x_{215}^8x_{183}x_{176}\end{aligned} 3 \begin{aligned}x_{ 140}& = z_ 3 \oplus x_{ 83} \oplus x_{ 102} \oplus x_{ 230} \oplus x_{ 225} \oplus x_{190} \oplus x_{ 246}^3x_{220}^7 \oplus x_{ 250}^2x_{ 234}^6 \oplus x_{216}^8x_{238}^5\\ & \quad\oplus x_{ 258}^0x_{254}^1 \oplus x_{184}x_{242}^4 \oplus x_{177}\overline{x_{ 47}}\oplus x_{167} \overline{x_{32}} \oplus x_{258}^0x_{250}^2x_{246}^3x_{216}^8x_{184}x_{177}\end{aligned} 4 \begin{aligned}x_{ 141}& = z_ 4 \oplus x_{ 84} \oplus x_{ 103} \oplus x_{ 231} \oplus x_{ 226} \oplus x_{191} \oplus x_{ 247}^3x_{221}^7 \oplus x_{ 251}^2x_{ 235}^6 \oplus x_{217}^8x_{239}^5\\ & \quad\oplus x_{ 259}^0x_{255}^1 \oplus x_{185}x_{243}^4 \oplus x_{178}\overline{x_{ 48}}\oplus x_{168} \overline{x_{33}} \oplus x_{259}^0x_{251}^2x_{247}^3x_{217}^8x_{185}x_{178}\end{aligned} 5 \begin{aligned}x_{ 142}& = z_ 5 \oplus x_{ 85} \oplus x_{ 104} \oplus x_{ 232}^6 \oplus x_{ 227} \oplus x_{192} \oplus x_{ 248}^3x_{222}^7 \oplus x_{ 252}^2x_{ 236}^6 \oplus x_{218}^8x_{240}^5\\ & \quad \oplus x_{ 260}^0x_{256}^1 \oplus x_{186}x_{244}^4 \oplus x_{179}\overline{x_{ 49}}\oplus x_{169}\overline{x_{34}} \oplus x_{260}^0x_{252}^2x_{248}^3x_{218}^8x_{186}x_{179}\end{aligned} 6 \begin{aligned}x_{ 143}& = z_ 6 \oplus x_{ 86} \oplus x_{ 105} \oplus x_{ 233}^6 \oplus x_{ 228} \oplus x_{193} \oplus x_{ 249}^3x_{223}^7 \oplus x_{ 253}^2x_{ 237}^6 \oplus x_{219}^8x_{241}^5\\ & \quad \oplus x_{ 261}^0x_{257}^1 \oplus x_{187}x_{245}^4 \oplus x_{180}\overline{x_{ 50}}\oplus x_{170}\overline{x_{35}} \oplus x_{261}^0x_{253}^2x_{249}^3x_{219}^8x_{187}x_{180}\end{aligned} 7 \begin{aligned}x_{ 144}& = z_ 7 \oplus x_{ 87} \oplus x_{ 106} \oplus x_{ 234}^6 \oplus x_{ 229} \oplus x_{194}^{13} \oplus x_{ 250}^3x_{224}^7 \oplus x_{ 254}^2x_{ 238}^6 \oplus x_{220}^8x_{242}^5\\ & \quad \oplus x_{ 262}^0x_{258}^1 \oplus x_{188}x_{246}^4 \oplus x_{181}\overline{x_{ 51}}\oplus x_{171}\overline{x_{36}} \oplus x_{262}^0x_{254}^2x_{250}^3x_{220}^8x_{188}x_{181}\end{aligned} 8 \begin{aligned}x_{ 145}& = z_ 8 \oplus x_{ 88} \oplus x_{ 107} \oplus x_{ 235}^6 \oplus x_{ 230} \oplus x_{195}^{13} \oplus x_{ 251}^3x_{225}^7 \oplus x_{ 255}^2x_{ 239}^6 \oplus x_{221}^8x_{243}^5\\ & \quad\oplus x_{ 263}^0x_{259}^1 \oplus x_{189}x_{247}^4 \oplus x_{182}\overline{x_{ 52}}\oplus x_{172}x_{37} \oplus x_{263}^0x_{255}^2x_{251}^3x_{221}^8x_{189}x_{182}\end{aligned} 9 \begin{aligned}x_{ 146}& = z_ 9 \oplus x_{ 89} \oplus x_{ 108} \oplus x_{ 236}^6 \oplus x_{ 231} \oplus x_{196}^{13} \oplus x_{ 252}^3x_{226}^7 \oplus x_{ 256}^2x_{ 240}^6 \oplus x_{222}^8x_{244}^5\\ & \quad \oplus x_{ 264}^0x_{260}^1 \oplus x_{190}x_{248}^4 \oplus x_{183}\overline{x_{ 53}}\oplus x_{173}x_{38} \oplus x_{264}^0x_{256}^2x_{252}^3x_{222}^8x_{190}x_{183}\end{aligned} 10 \begin{aligned}x_{ 147}& = z_ {10} \oplus x_{ 90} \oplus x_{ 109} \oplus x_{ 237}^6 \oplus x_{ 232}^6 \oplus x_{197}^{13} \oplus x_{ 253}^3x_{227}^7 \oplus x_{ 257}^2x_{ 241}^6 \oplus x_{223}^8x_{245}^5\\ & \quad\oplus x_{ 265}^0x_{261}^1 \oplus x_{191}x_{249}^4 \oplus x_{184}\overline{x_{ 54}}\oplus x_{174}x_{39} \oplus x_{265}^0x_{257}^2x_{253}^3x_{223}^8x_{191}x_{184}\end{aligned} 11 \begin{aligned}x_{ 148}& = z_ {11} \oplus x_{ 91} \oplus x_{ 110} \oplus x_{ 238}^6 \oplus x_{ 233}^6 \oplus x_{198}^{13} \oplus x_{ 254}^3x_{228}^7 \oplus x_{ 258}^2x_{ 242}^6 \oplus x_{224}^8x_{246}^5\\ & \quad \oplus x_{ 266}^0x_{262}^1 \oplus x_{192}x_{250}^4 \oplus x_{185}\overline{x_{ 55}}\oplus x_{175}x_{40} \oplus x_{266}^0x_{258}^2x_{254}^3x_{224}^8x_{192}x_{185}\end{aligned} 12 \begin{aligned}x_{ 149}& = z_ {12} \oplus x_{ 92} \oplus x_{ 111} \oplus x_{ 239}^6 \oplus x_{ 234}^6 \oplus x_{199}^{13} \oplus x_{ 255}^3x_{229}^7 \oplus x_{ 259}^2x_{ 243}^6 \oplus x_{225}^8x_{247}^5\\ & \quad\oplus x_{ 267}^0x_{263}^1 \oplus x_{193}x_{251}^4 \oplus x_{186}\overline{x_{ 56}}\oplus x_{176}x_{41} \oplus x_{267}^0x_{259}^2x_{255}^3x_{225}^8x_{193}x_{186}\end{aligned} 13 \begin{aligned}x_{ 150}& = z_ {13} \oplus x_{ 93} \oplus x_{ 112} \oplus x_{ 240}^6 \oplus x_{ 235}^6 \oplus x_{200}^{13} \oplus x_{ 256}^3x_{230}^7 \oplus x_{ 260}^2x_{ 244}^6 \oplus x_{226}^8x_{248}^5\\ & \quad\oplus x_{ 268}^0x_{264}^1 \oplus x_{194}^{13}x_{252}^4 \oplus x_{187}\overline{x_{ 57}}\oplus x_{177}x_{42} \oplus x_{268}^0x_{260}^2x_{256}^3x_{226}^8x_{194}^{13}x_{187}\end{aligned} 14 \begin{aligned}x_{ 151}& = z_ {14} \oplus x_{ 94} \oplus x_{ 113} \oplus x_{ 241}^6 \oplus x_{ 236}^6 \oplus x_{201}^{13} \oplus x_{ 257}^3x_{231}^7 \oplus x_{ 261}^2x_{ 245}^6 \oplus x_{227}^8x_{249}^5\\ & \quad\oplus x_{ 269}^0x_{265}^1 \oplus x_{195}^{13}x_{253}^4 \oplus x_{188}\overline{x_{ 58}}\oplus x_{178}x_{43} \oplus x_{269}^0x_{261}^2x_{257}^3x_{227}^8x_{195}^{13}x_{188}\end{aligned} 15 \begin{aligned}x_{ 152}& = z_ {15} \oplus x_{ 95} \oplus x_{ 114} \oplus x_{ 242}^6 \oplus x_{ 237}^6 \oplus x_{202}^{13} \oplus x_{ 258}^3x_{232}^7 \oplus x_{ 262}^2x_{ 246}^6 \oplus x_{228}^8x_{250}^5\\ & \quad\oplus x_{ 270}^0x_{266}^1 \oplus x_{196}^{13}x_{254}^4 \oplus x_{189}\overline{x_{59}}\oplus x_{179}x_{44} \oplus x_{270}^0x_{262}^2x_{258}^3x_{228}^8x_{196}^{13}x_{189}\end{aligned} 16 \begin{aligned}x_{ 153}& = z_ {16} \oplus x_{ 96} \oplus x_{ 115} \oplus x_{ 243}^6 \oplus x_{ 238}^6 \oplus x_{203}^{13} \oplus x_{ 259}^3x_{233}^7 \oplus x_{ 263}^2x_{ 247}^6 \oplus x_{229}^8x_{251}^5\\ & \quad \oplus x_{ 271}^0x_{267}^1 \oplus x_{197}^{13}x_{255}^4 \oplus x_{190}\overline{x_{60}}\oplus x_{180}x_{45} \oplus x_{271}^0x_{263}^2x_{259}^3x_{229}^8x_{197}^{13}x_{190}\end{aligned} 17 \begin{aligned}x_{ 154}& = z_ {17} \oplus x_{ 97} \oplus x_{ 116} \oplus x_{ 244}^6 \oplus x_{ 239}^6 \oplus x_{204}^{13} \oplus x_{ 260}^3x_{234}^7 \oplus x_{ 264}^2x_{ 248}^6 \oplus x_{230}^8x_{252}^5\\ & \quad \oplus x_{ 272}^0x_{268}^1 \oplus x_{198}^{13}x_{256}^4 \oplus x_{191}\overline{x_{61}}\oplus x_{181}\overline{x_{46}} \oplus x_{272}^0x_{264}^2x_{260}^3x_{230}^8x_{198}^{13}x_{191}\end{aligned} 18 \begin{aligned}x_{ 155}& = z_ {18} \oplus x_{ 98} \oplus x_{ 117} \oplus x_{ 245}^6 \oplus x_{ 240}^6 \oplus x_{205}^{13} \oplus x_{ 261}^3x_{235}^7 \oplus x_{ 265}^2x_{ 249}^6 \oplus x_{231}^8x_{253}^5\\ & \quad\oplus x_{ 273}^0x_{269}^1 \oplus x_{199}^{13}x_{257}^4 \oplus x_{192}\overline{x_{62}}\oplus x_{182}\overline{x_{47}} \oplus x_{273}^0x_{265}^2x_{261}^3x_{231}^8x_{199}^{13}x_{192}\end{aligned} 19 \begin{aligned}x_{ 156}& = z_ {19} \oplus x_{ 99} \oplus x_{ 118} \oplus x_{ 246}^6 \oplus x_{ 241}^6 \oplus x_{206}^{13} \oplus x_{ 262}^3x_{236}^7 \oplus x_{ 266}^2x_{ 250}^6 \oplus x_{232}^8x_{254}^5\\ & \quad \oplus x_{ 274}^0x_{270}^1 \oplus x_{200}^{13}x_{258}^4 \oplus x_{193}\overline{x_{63}}\oplus x_{183}\overline{x_{48}} \oplus x_{274}^0x_{266}^2x_{262}^3x_{232}^8x_{200}^{13}x_{193}\end{aligned} 20 \begin{aligned}x_{ 157}& = z_ {20} \oplus x_{100} \oplus x_{ 119} \oplus x_{ 247}^6 \oplus x_{ 242}^6 \oplus x_{207}^{13} \oplus x_{ 263}^3x_{237}^7 \oplus x_{ 267}^2x_{ 251}^6 \oplus x_{233}^8x_{255}^5\\ & \quad \oplus x_{ 275}^0x_{271}^1 \oplus x_{201}^{13}x_{259}^4 \oplus x_{194}^{13}\overline{x_{64}}\oplus x_{184}\overline{x_{49}} \oplus x_{275}^0x_{267}^2x_{263}^3x_{233}^8x_{201}^{13}x_{194}^{13}\end{aligned} 21 \begin{aligned}x_{ 158}& = z_ {21} \oplus x_{101} \oplus x_{ 120} \oplus x_{ 248}^6 \oplus x_{ 243}^6 \oplus x_{208}^{13} \oplus x_{ 264}^3x_{238}^7 \oplus x_{ 268}^2x_{ 252}^6 \oplus x_{234}^8x_{256}^5\\ & \quad \oplus x_{ 276}^0x_{272}^1 \oplus x_{202}^{13}x_{260}^4 \oplus x_{195}^{13}\overline{x_{65}}\oplus x_{185}\overline{x_{50}} \oplus x_{276}^0x_{268}^2x_{264}^3x_{234}^8x_{202}^{13}x_{195}^{13}\end{aligned} 22 \begin{aligned}x_{ 159}& = z_ {22} \oplus x_{102} \oplus x_{ 121} \oplus x_{ 249}^6 \oplus x_{ 244}^6 \oplus x_{209}^{13} \oplus x_{ 265}^3x_{239}^7 \oplus x_{ 269}^2x_{ 253}^6 \oplus x_{235}^8x_{257}^5\\ & \quad \oplus x_{ 277}^0x_{273}^1 \oplus x_{203}^{13}x_{261}^4 \oplus x_{196}^{13}\overline{x_{66}}\oplus x_{186}\overline{x_{51}} \oplus x_{277}^0x_{269}^2x_{265}^3x_{235}^8x_{203}^{13}x_{196}^{13}\end{aligned} 23 \begin{aligned}x_{ 160}& = z_ {23} \oplus x_{103} \oplus x_{ 122} \oplus x_{ 250}^6 \oplus x_{ 245}^6 \oplus x_{210}^{13} \oplus x_{ 266}^3x_{240}^7 \oplus x_{ 270}^2x_{ 254}^6 \oplus x_{236}^8x_{258}^5\\ & \quad \oplus x_{ 278}^0x_{274}^1 \oplus x_{204}^{13}x_{262}^4 \oplus x_{197}^{13}\overline{x_{67}}\oplus x_{187}\overline{x_{52}} \oplus x_{278}^0x_{270}^2x_{266}^3x_{236}^8x_{204}^{13}x_{197}^{13}\end{aligned} 24 \begin{aligned}x_{ 161}& = z_ {24} \oplus x_{104} \oplus x_{ 123} \oplus x_{ 251}^6 \oplus x_{ 246}^6 \oplus x_{211}^{13} \oplus x_{ 267}^3x_{241}^7 \oplus x_{ 271}^2x_{ 255}^6 \oplus x_{237}^8x_{259}^5\\ & \quad \oplus x_{ 279}^0x_{275}^1 \oplus x_{205}^{13}x_{263}^4 \oplus x_{198}^{13}\overline{x_{68}}\oplus x_{188}\overline{x_{53}} \oplus x_{279}^0x_{271}^2x_{267}^3x_{237}^8x_{205}^{13}x_{198}^{13} \end{aligned} 25 \begin{aligned}x_{ 162}& = z_ {25} \oplus x_{105} \oplus x_{ 124} \oplus x_{ 252}^6 \oplus x_{ 247}^6 \oplus x_{212}^{13} \oplus x_{ 268}^3x_{242}^7 \oplus x_{ 272}^2x_{ 256}^6 \oplus x_{238}^8x_{260}^5\\ & \quad\oplus x_{ 280}^0x_{276}^1 \oplus x_{206}^{13}x_{264}^4 \oplus x_{199}^{13}\overline{x_{69}}\oplus x_{189}\overline{x_{54}} \oplus x_{280}^0x_{272}^2x_{268}^3x_{238}^8x_{206}^{13}x_{199}^{13} \end{aligned} 26 \begin{aligned}x_{ 163}& = z_ {26} \oplus x_{106} \oplus x_{ 125} \oplus x_{ 253}^6 \oplus x_{ 248}^6 \oplus x_{213}^{13} \oplus x_{ 269}^3x_{243}^7 \oplus x_{ 273}^2x_{ 257}^6 \oplus x_{239}^8x_{261}^5\\ & \quad\oplus x_{ 281}^0x_{277}^1 \oplus x_{207}^{13}x_{265}^4 \oplus x_{200}^{13}\overline{x_{70}}\oplus x_{190}\overline{x_{55}} \oplus x_{281}^0x_{273}^2x_{269}^3x_{239}^8x_{207}^{13}x_{200}^{13}\end{aligned} 27 \begin{aligned}x_{ 164}& = z_ {27} \oplus x_{107} \oplus x_{ 126} \oplus x_{ 254}^6 \oplus x_{ 249}^6 \oplus x_{214}^{13} \oplus x_{ 270}^3x_{244}^7 \oplus x_{ 274}^2x_{ 258}^6 \oplus x_{240}^8x_{262}^5\\ & \quad\oplus x_{ 282}^0x_{278}^1 \oplus x_{208}^{13}x_{266}^4 \oplus x_{201}^{13}\overline{x_{71}}\oplus x_{191}\overline{x_{56}} \oplus x_{282}^0x_{274}^2x_{270}^3x_{240}^8x_{208}^{13}x_{201}^{13}\end{aligned} 28 \begin{aligned}x_{ 165}& = z_ {28} \oplus x_{108} \oplus x_{ 127} \oplus x_{ 255}^6 \oplus x_{ 250}^6 \oplus x_{215}^{13} \oplus x_{ 271}^3x_{245}^7 \oplus x_{ 275}^2x_{ 259}^6 \oplus x_{241}^8x_{263}^5\\ & \quad\oplus x_{ 283}^0x_{279}^1 \oplus x_{209}^{13}x_{267}^4 \oplus x_{202}^{13}\overline{x_{72}}\oplus x_{192}\overline{x_{57}} \oplus x_{283}^0x_{275}^2x_{271}^3x_{241}^8x_{209}^{13}x_{202}^{13}\end{aligned} 29 \begin{aligned}x_{ 166}& = z_ {29} \oplus x_{109} \oplus x_{ 128} \oplus x_{ 256}^6 \oplus x_{ 251}^6 \oplus x_{216}^{13} \oplus x_{ 272}^3x_{246}^7 \oplus x_{ 276}^2x_{ 260}^6 \oplus x_{242}^8x_{264}^5\\ & \quad\oplus x_{ 284}^0x_{280}^1 \oplus x_{210}^{13}x_{268}^4 \oplus x_{203}^{13}\overline{x_{73}}\oplus x_{193}\overline{x_{58}} \oplus x_{284}^0x_{276}^2x_{272}^3x_{242}^8x_{210}^{13}x_{203}^{13}\end{aligned} 30 \begin{aligned}x_{ 167}& = z_ {30} \oplus x_{110} \oplus x_{ 129} \oplus x_{ 257}^6 \oplus x_{ 252}^6 \oplus x_{217}^{13} \oplus x_{ 273}^3x_{247}^7 \oplus x_{ 277}^2x_{ 261}^6 \oplus x_{243}^8x_{265}^5\\ & \quad\oplus x_{ 285}^0x_{281}^1 \oplus x_{211}^{13}x_{269}^4 \oplus x_{204}^{13}\overline{x_{74}}\oplus x_{194}^{13}\overline{x_{59}} \oplus x_{285}^0x_{277}^2x_{273}^3x_{243}^8x_{211}^{13}x_{204}^{13}\end{aligned} 31 \begin{aligned}x_{ 168}& = z_ {31} \oplus x_{111} \oplus x_{ 130} \oplus x_{ 258}^6 \oplus x_{ 253}^6 \oplus x_{218}^{13} \oplus x_{ 274}^3x_{248}^7 \oplus x_{ 278}^2x_{ 262}^6 \oplus x_{244}^8x_{266}^5\\ & \quad\oplus x_{ 286}^0x_{282}^1 \oplus x_{212}^{13}x_{270}^4 \oplus x_{205}^{13}\overline{x_{75}}\oplus x_{195}^{13}\overline{x_{60}} \oplus x_{286}^0x_{278}^2x_{274}^3x_{244}^8x_{212}^{13}x_{205}^{13}\end{aligned} 32 \begin{aligned}x_{ 169}& = z_ {32} \oplus x_{112} \oplus x_{ 131} \oplus x_{ 259}^6 \oplus x_{ 254}^6 \oplus x_{219}^{13} \oplus x_{ 275}^3x_{249}^7 \oplus x_{ 279}^2x_{ 263}^6 \oplus x_{245}^8x_{267}^5\\ & \quad\oplus x_{ 287}^0x_{283}^1 \oplus x_{213}^{13}x_{271}^4 \oplus x_{206}^{13}\overline{x_{76}}\oplus x_{196}^{13}\overline{x_{61}} \oplus x_{287}^0x_{279}^2x_{275}^3x_{245}^8x_{213}^{13}x_{206}^{13}\end{aligned} 33 \begin{aligned}x_{170}& = z_ {33} \oplus x_{113} \oplus x_{ 132} \oplus x_{ 260}^6 \oplus x_{ 255}^6 \oplus x_{220}^{13} \oplus x_{ 276}^3x_{250}^7 \oplus x_{ 280}^2x_{ 264}^6 \oplus x_{246}^8x_{268}^5\\ & \quad\oplus x_{ 288}^0x_{284}^1 \oplus x_{214}^{13}x_{272}^4 \oplus x_{207}^{13}x_{77}\oplus x_{197}^{13}\overline{x_{62}} \oplus x_{288}^0x_{280}^2x_{276}^3x_{246}^8x_{214}^{13}x_{207}^{13}\end{aligned} 34 \begin{aligned} x_{171}& = z_ {34} \oplus x_{114} \oplus x_{ 133} \oplus x_{ 261}^6 \oplus x_{ 256}^6 \oplus x_{221}^{13} \oplus x_{ 277}^3x_{251}^7 \oplus x_{ 281}^2x_{ 265}^6 \oplus x_{247}^8x_{269}^5\\ & \quad\oplus x_{ 289}^0x_{285}^1 \oplus x_{215}^{13}x_{273}^4 \oplus x_{208}^{13}x_{78}\oplus x_{198}^{13}\overline{x_{63}} \oplus x_{289}^0x_{281}^2x_{277}^3x_{247}^8x_{215}^{13}x_{208}^{13}\end{aligned}

Table 5.  Possible tradeoffs for conditional BSW sampling resistance based TMDTO attack

 $\delta$ $D'$ $T'$ $M$ $P$ $30$ $2^{104}$ $2^{99}$ $2^{122}$ $2^{152}$ $32$ $2^{106}$ $2^{103}$ $2^{118}$ $2^{150}$ $34$ $2^{108}$ $2^{107}$ $2^{114}$ $2^{148}$
•  [1] S. Babbage, A space/time tradeoff in exhaustive search attacks on stream ciphers, European Convention on Security and Detection, 408 (1995). [2] A. Biryukov and A. Shamir, Cryptanalytic time/memory/data tradeoffs for stream ciphers, ASIACRYPT 2000, Lecture Notes in Computer Science, 1976 (2000), 1-13.  doi: 10.1007/3-540-44448-3_1. [3] A. Biryukov, A. Shamir and D. Wagner, Real time cryptanalysis of A5/1 on a PC, Fast Software Encryption 2000, Lecture Notes in Computer Science, 1978 (2001), 37-44.  doi: 10.1007/3-540-44706-7_1. [4] T. E. Bjørstad, Cryptanalysis of grain using time/memory/data tradeoffs, (2008). Available from: http://www.ecrypt.eu.org/stream/grainp3.html. [5] C. Cannière and B. Preneel, Trivium, new stream cipher designs: The eSTREAM finalists, Lecture Notes in Computer Science, 4986 (2008), 244-266. [6] E. Dubrova, A transformation from the Fibonacci to the Galois NLFSRs, IEEE Transactions on Information Theory, 55 (2009), 5263-5271.  doi: 10.1109/TIT.2009.2030467. [7] E. Dubrova and M. Hell, A stream cipher for 5G wireless communications systems, Cryptography and Communications, 9 (2017), 273-289.  doi: 10.1007/s12095-015-0173-2. [8] J. Golić, Cryptanalysis of alleged $A5$ stream cipher, EUROCRYPT 1997, Lecture Notes in Computer Science, 1233 (1997), 239-255. [9] M. Hell, T. Johansson, A. Maximov and W. Meier, The Grain family of stream ciphers, new stream cipher designs: The eSTREAM finalists, Lecture Notes in Computer Science, 4986 (2008), 17-190. [10] M. E. Hellman, A cryptanalytic time-memory trade-off, IEEE Transactions on Information Theory, 26 (1980), 401-406.  doi: 10.1109/TIT.1980.1056220. [11] J. Hong and P. Sarkar, New applications of time memory data tradeoffs, ASIACRYPT 2005, Lecture Notes in Computer Science, Springer, Berlin, 3788 (2005), 353-372.  doi: 10.1007/11593447_19. [12] S. Maitra, N. Sinha, A. Siddhanti, R. Anand and S. Gangopadhyay, A TMDTO attack against Lizard, IEEE Transactions on Computers, 67 (2018), 733-739.  doi: 10.1109/TC.2017.2773062. [13] M. J. Mihaljević, S. Gangopadhyay, G. Paul and H. Imai, Internal state recovery of Grain-v1 employing normality order of the filter function, IET Information Security, 6 (2012), 55-64. [14] M. J. Mihaljević, S. Gangopadhyay, G. Paul and H. Imai, Generic cryptographic weakness of k-normal Boolean functions in certain stream ciphers and cryptanalysis of Grain-128, Periodica Mathematica Hungarica, 65 (2012), 205-227.  doi: 10.1007/s10998-012-4631-8.

Tables(5)