ALGORITHMS FOR SOLVING LINEAR AND POLYNOMIAL ...

In other words, the above equations were repeated for each i as applicable,and for each of µ total plaintext-ciphertext message pairs.2.3.9 Variable and Equation CountConsider a plaintext-ciphertext pair P ⃗ , C. ⃗ There are 560 equations, one foreach L i , with i ∈ [0, 559], plus another 32 for the C i , with i ∈ [0, 32]. However, thefirst 32 of these are of the form L i = P i for i ∈ [0, 32], and the last 32 of these areof the form L i−528 = C i for i ∈ [528, 559]. Thus we can substitute and drop down to528 equations. This is precisely one equation for each round, which is the new bitintroduced into the shift register.The 64 bits of the key are unknown. Also, of the 560 L i , the first and last 32are known, but the inner 496 are not. This yields 560 variables.If there are µ plaintext-ciphertext message pairs, then there are 528µ equations.However, there are only 496µ + 64 variables, because the key does not changefrom pair to pair.2.3.10 Dropping the Degree to QuadraticInstead of the previously derivedNLF (a, b, c, d, e) = d ⊕ e ⊕ ac ⊕ ae ⊕ bc ⊕ be ⊕ cd ⊕ de ⊕ ade ⊕ ace ⊕ abd ⊕ abcone can doNLF (a, b, c, d, e) = d ⊕ e ⊕ ac ⊕ β ⊕ bc ⊕ be ⊕ cd ⊕ de ⊕ dβ ⊕ cβ ⊕ αd ⊕ αcα = ab14