Correlation Analysis of the Alternating Step Generator

Abstract

The alternating step generator is a well-known keystream generator consisting of two stop/go clocked LFSRs, LFSR₁ and LFSR₂, whose clocks are controlled by another LFSR, LFSR₃, which is clocked regularly. A probabilistic analysis of this generator is conducted which shows that the posterior probabilites of individual bits of the first derivatives of the regularly clocked LFSR₁ and LFSR₂ sequences, when conditioned on a given segment of the first derivative of the keystream sequence, can be computed efficiently in a number of probabilistic models of interest. The expected values of these probabilities, for a random keystream sequence, are derived by an approximate theoretical analysis and are also verified by systematic computer experiments. It is pointed out that these posterior probabilities can be enhanced in a resynchronization scenario and thus used for a low-complexity fast correlation attack on the two LFSRs. More generally, it is argued that even without resynchronization these probabilities may be significantly different from one half for fast correlation attacks based on iterative decoding algorithms to be successful, although with incresead complexity. A related method for computing the posterior probabilities of individual bits of the LFSR₃ sequence, when conditioned on both the keystream sequence and the LFSR₁ and LFSR₂ sequences, is also developed. As these posterior probabilities are much more different from one half, they can be used for a low-complexity fast correlation attack on LFSR₃, provided that the initial states of LFSR₁ and LFSR₂ are previously reconstructed.