A Practical Cryptanalysis of SSC2

SSC2 is a stream cipher that operates by XORing the output of two \half-ciphers". The rst half-cipher is constructed from a linear feedback shift register (LFSR) with a non-linear lter. The second half-cipher is constructed from a lagged Fibonacci generator (LFG) and a multiplexor that chooses values from the Fibonacci register. The second half-cipher has a small cycle length 2. By XORing the key-stream at an interval of words, the e ects of the LFR half-cipher are cancelled, leaving only the XOR of outputs of the LFSR half-cipher. Fast correlation attacks can derive the initial state of the LFSR from around 2 words of this sequence using a few hours of computation. The output of the LFSR halfcipher is then removed from the key-stream, leaving the output of the LFR half-cipher. The initial state of the LFG is obtained by identifying when the multiplexor has selected speci c words in the LFG register (this process typically takes around a second, using around 15300 outputs).