Linear Properties in T-Functions

Linear equations have always been powerful tools in cryptanalysis. In this correspondence, we present a general linear equation of minimum weight 3 in F<sub>2</sub> that holds for all state lengths n and all shifts i of sequences generated by the T-function x<sub>i</sub>=x<sub>i-1</sub> <sup>2</sup>orC+x<sub>i-1</sub> mod 2<sup>n</sup> proposed by Klimov and Shamir. It is surprising that these linear properties exist, and they indicate that the sequences generated by the T-functions have more structures than claimed by Klimov and Shamir