Uses matrices to recover the taps of a linear-feedback shift register from observed output bits. Because LFSR output is a linear combination, the attacker models Boolean multiplication as AND and addition as XOR, then solves for the coefficients. section 4.2.2
The recovery procedure is:
- Collect enough observed bits to form a square state matrix and a vector of subsequent output bits. section 4.2.2
- Try candidate register lengths when the length is unknown, then clone the LFSR and predict or decrypt later output. section 4.2.2
Known-plaintext recovery
A known ciphertext prefix is XORed with the known plaintext prefix to obtain keystream bits. Recovering the LFSR from those bits allows the remaining ciphertext to be decrypted; the test recovers a timestamped message.
