Attacking the Filter Generator over GF(2^m)

Abstract

We consider the filter generator over GF(2^m) consisting of a linear feedback shift register of length k that generates a maximal length linear sequence of period 2^mk− 1 over GF(2^m) and a Boolean function of degree d that combines bits from one element in the shift register (considered as an element in GF(2^m)) and creates a binary output bit z _t at any time t. We show how to extend a recent attack by the authors on the binary filter generator to the filter generator over GF(2^m). The attack recovers the initial state of the filter generator from L keystream bits with complexity O(L), after a pre-computation with complexity $O(L (log_2 L)^3)$, where L is the linear complexity upper bounded by $D=\sum_{i=1}^d {n \choose i}$ with n = mk, which is also the number of monomials of degree ≤ d over GF(2). In addition we explain why a function of only one element of the shift register reduces the linear complexity of the keystream significantly, compared to using the function freely on bits from several words in the initial state. We also discuss implications for the WG stream cipher [4].