Guess-and-Determine Algebraic Attack on the Self-Shrinking Generator

In this paper we propose a new guess-and-determine attack on the self-shrinking generator (SSG), proposed by Meier and Staffelbach at Eurocrypt’94. The main idea of our attack consists in guessing some information about the internal bitstream of SSG, and expressing this information by a system of polynomial equations on the still unknown key bits. From a practical point of view, we show that using a SAT solver, such as MiniSAT, is the best way of solving this polynomial system. As a result, when the Hamming weight of the feedback polynomial (defining the LFSR in SSG) is at most 5, we obtain here a new efficient and practical attack against SSG, improving the method presented by Zhang and Feng at Asiacrypt’06. Our attack also provides the best known time/memory/data tradeoff against SSG.