Applied Mathematical Modelling 31 (2007) 226–235

www.elsevier.com/locate/apm

Modelling nonlinear sequence generators

in terms of linear cellular automata q
a,* b
Amparo Fúster-Sabater , Dolores de la Guı́a-Martı́nez
a
Instituto de Fı́sica Aplicada, CSIC, C/Serrano 144, 28006 Madrid, Spain
b
Centro Técnico de Informática, CSIC, C/Pinar 19, 28006 Madrid, Spain

Received 1 March 2005; received in revised form 1 July 2005; accepted 30 August 2005
Available online 19 October 2005

Abstract

In this work, a wide family of LFSR-based sequence generators, the so-called clock-controlled shrinking generators
(CCSGs), has been analyzed and identified with a subset of linear cellular automata (CA). In fact, a pair of linear models
describing the behavior of the CCSGs can be derived. The algorithm that converts a given CCSG into a CA-based linear
model is very simple and can be applied to CCSGs in a range of practical interest. The linearity of these cellular models can
be advantageously used in two different ways: (a) for the analysis and/or cryptanalysis of the CCSGs and (b) for the recon-
struction of the output sequence obtained from this kind of generators.
Ó 2005 Elsevier Inc. All rights reserved.

Keywords: Cellular automata; Clock-controlled generators; Pseudorandom sequence; Linear modelling

1. Introduction

Cellular automata (CA) are discrete dynamic systems characterized by a simple structure but a complex
behavior, see [1–5]. They are built up by individual elements, called cells, related among them in many varied
ways. CA have been used in application areas so different as physical system simulation, biological process,
species evolution, socio-economical models or test pattern generation. Their simple, modular, and cascable
structure makes them very attractive for VLSI implementations. CA can be characterized by several param-
eters which determine their behavior e.g. the number of states per cell, the function U (the so-called rule) under
which the cellular automaton evolves to the next state, the number of neighbor cells which are included in U,
the number of preceding states included in U, the geometric structure and dimension of the automaton (the
cells can be arranged on a line or in a square or cubic lattice in two, three or more dimensions), etc.
On the other hand, linear feedback shift registers (LFSRs) [6] are electronic devices currently used in the
generation of pseudorandom sequences. The inherent simplicity of LFSRs, their ease of implementation,

q
Research supported by Ministerio de Educación y Ciencia (Spain) under grant SEG2004-02418 and SEG2004-04352-C04-03.
*
Corresponding author. Tel.: +34 91 5631284; fax: +34 91 411 76 51.
E-mail addresses: [email protected] (A. Fúster-Sabater), [email protected] (D. de la Guı́a-Martı́nez).

0307-904X/$ - see front matter Ó 2005 Elsevier Inc. All rights reserved.
doi:10.1016/j.apm.2005.08.013
 A. Fúster-Sabater, D. de la Guı́a-Martı́nez / Applied Mathematical Modelling 31 (2007) 226–235 227

and the good statistical properties of their output sequences turn them into natural building blocks for the
design of pseudorandom sequence generators with applications in spread-spectrum communications, circuit
testing, error-correcting codes, numerical simulations or cryptography.
CA and LFSRs are special forms of a more general mathematical structure: finite state machines [7]. In
recent years, one-dimensional CA have been proposed as an alternative to LFSRs [3,8–10] in the sense that
every sequence generated by a LFSR can be obtained from one-dimensional CA too. Pseudorandom sequence
generators currently involve several LFSRs combined by means of nonlinear functions or irregular clocking
techniques (see [11,12]). Then, the question that arises in a natural way is: are there one-dimensional CA able
to produce the sequence obtained from any LFSR-based generator? The answer is yes and, in fact, this paper
considers the problem of given a particular LFSR-based generator how to find one-dimensional CA that
reproduce its output sequence. More precisely, in this work it is shown that a wide class of LFSR-based non-
linear generators, the so-called Clock-Controlled Shrinking Generators (CCSGs) [13], can be described in
terms of one-dimensional CA configurations. The automata here presented unify in a simple structure the
above mentioned class of sequence generators. Moreover, CCSGs that is generators conceived and designed
as nonlinear models are converted into linear one-dimensional CA. Once the generators have been linearized,
all the theoretical background on linear CA found in the literature can be applied to their analysis and/or
cryptanalysis. The conversion procedure is very simple and can be realized in a range of practical interest.
The paper is organized as follows: in Section 2, basic concepts e.g. one-dimensional CA, CCSGs or the Cattel
and Muzio cellular synthesis method are introduced. A simple algorithm to determine the pair of CA correspond-
ing to a particular shrinking generator and its generalization to clock-controlled shrinking generators are given in
Sections 3 and 4, respectively. A simple approach to the reconstruction of the generated sequence that exploits
the linearity of the CA-based model is presented in Section 5. Finally, conclusions in Section 6 end the paper.

2. Basic structures

In the following subsections, we introduce the general characteristics of the basic structures we are dealing
with: one-dimensional cellular automata, the shrinking generator and the class of clock-controlled shrinking
generators. Throughout the work, only binary CA and LFSRs will be considered. In addition, all the LFSRs
we are dealing with are maximal-length LFSRs whose output sequences are PN-sequences [6].

2.1. One-dimensional cellular automata

One-dimensional cellular automata can be described as n-cell registers [1], whose cell contents are updated
at the same time according to a particular rule; that is to say a k-variable function denoted by U. If the func-
tion U is a linear function, so is the cellular automaton. When k input binary variables are considered, then
there is a total of 2k kdifferent neighbor configurations. Therefore, for cellular automata with binary contents
there can be up to 22 different mappings to the next state. Moreover, if k = 2r + 1, then the next state xitþ1 of
the cell xti depends on the current state of k neighbor cells xtþ1
i ¼ Uðxtir ; . . . ; xti ; . . . ; xtiþr Þ ði ¼ 1; . . . ; nÞ.
CA are called uniform whether all cells evolve under the same rule while CA are called hybrid whether dif-
ferent cells evolve under different rules. At the ends of the array, two different boundary conditions are pos-
sible: null automata when cells with permanent null contents are supposed adjacent to the extreme cells or
periodic automata when extreme cells are supposed adjacent.
In this paper, all the automata considered will be one-dimensional null hybrid CA with k = 3 and linear
rules 90 and 150. Such rules are described as follows:
Rule 90 Rule 150
xtþ1
i ¼ xti1 þ xtiþ1 xitþ1 ¼ xti1 þ xti þ xtiþ1
111 110 101 100 011 010 001 000 111 110 101 100 011 010 001 000
0 1 0 1 1 0 1 0 1 0 0 1 0 1 1 0
01011010 ðbinaryÞ ¼ 90 ðdecimalÞ 10010110 ðbinaryÞ ¼ 150 ðdecimalÞ
Remark that the names rule 90 and rule 150 derive from the decimal values of their next-state functions.
228 A. Fúster-Sabater, D. de la Guı́a-Martı́nez / Applied Mathematical Modelling 31 (2007) 226–235

Table 1
An one-dimensional null hybrid linear cellular automaton of 10 cells with rule 90 and rule 150 starting at a given initial state
90 150 150 150 90 90 150 150 150 90
0 0 0 1 1 1 0 1 1 0
0 0 1 0 0 1 0 0 0 1
0 1 1 1 1 0 1 0 1 0
1 0 1 1 1 0 1 0 1 1
0 0 0 1 1 0 1 0 0 1
0 0 1 0 1 0 1 1 1 0
0 1 1 0 0 0 0 1 0 1
1 0 0 1 0 0 1 1 0 0
0 1 1 1 1 1 0 0 1 0
1
.. ..0 1. ..1 ..0 1. 1. 1. 1. ..1
. . .. . . .. .. .. .. .

For an one-dimensional null hybrid cellular automaton of length n = 10 cells, configuration rules
(90, 150, 150, 150, 90, 90, 150, 150, 150, 90) and initial state (0, 0, 0, 1, 1, 1, 0, 1, 1, 0), Table 1 illustrates the forma-
tion of its output sequences (binary sequences read vertically) and the succession of states (binary configura-
tions of 10 bits read horizontally). For the above mentioned rules, the different states of the automaton are
grouped in closed cycles. The number of different output sequences for a particular cycle is 6n as the same
sequence (although shifted) may appear simultaneously in different cells. At the same time, all the sequences
in a cycle will have the same period and linear complexity [2] as well as any output sequence of the automaton
can be produced at any cell provided that we get the right state cycle.

2.2. The shrinking generator

The shrinking generator is a binary sequence generator [14] composed by two LFSRs: a control register,
called R1, that decimates the sequence produced by the other register, called R2. We denote by Lj (j = 1, 2) their
corresponding lengths and by Pj(x) 2 GF(2)[x] (j = 1, 2) their corresponding characteristic polynomials [6].
The sequence produced by the LFSR R1, that is {ai}, controls the bits of the sequence produced by R2, that is
{bi}, which are included in the output sequence {cj} (the shrunken sequence), according to the following rule P:

1. If ai ¼ 1 ) cj ¼ bi .
2. If ai ¼ 0 ) bi is discarded.

A simple example illustrates the behavior of this structure.

Example 1. Let us consider the following LFSRs:

1. Shift register R1 of length L1 = 3, characteristic polynomial P1(x) = 1 + x2 + x3 and initial state

IS1 = (1, 0, 0). The sequence generated by R1 is {ai} = {1, 0, 0, 1, 1, 1, 0} with period T 1 ¼ 2L1  1 ¼ 7.
2. Shift register R2 of length L2 = 4, characteristic polynomial P2(x) = 1 + x + x4 and initial state
IS2 = (1, 0, 0, 0). The sequence generated by R2 is {bi} = {1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1} with period
T 2 ¼ 2L2  1 ¼ 15.

The output sequence {cj} is given by

{ai} ! 1 0 0 1 1 1 0 1 0 0 1 1 1 0 1 0 0 1 1 1 0 1 . . .
{bi} ! 1 0 0 0 1 0 0 1 1 0 1 0 1 1 1 1 0 0 0 1 0 0 . . .
{cj} ! 1 0 1 0 1 1 0 1 1 0 0 1 0 . . .

The underlined bits 0 or 1 in {bi} are discarded. In brief, the sequence produced by the shrinking generator
is an irregular decimation of {bi} from the bits of {ai}.
 A. Fúster-Sabater, D. de la Guı́a-Martı́nez / Applied Mathematical Modelling 31 (2007) 226–235 229

According to [14], the period of the shrunken sequence is

T ¼ ð2L2  1Þ2ðL1 1Þ ð1Þ
and its linear complexity [12], notated LC, satisfies the following inequality:
L2 2ðL1 2Þ < LC 6 L2 2ðL1 1Þ . ð2Þ
In addition, it can be proved [14] that the output sequence has some nice distributional statistics too. There-
fore, this scheme is suitable for practical implementation of stream cipher cryptosystems and pattern
generators.

2.3. The clock-controlled shrinking generators

The clock-controlled shrinking generators constitute a wide class of clock-controlled sequence generators
[13] with applications in cryptography, error correcting codes and digital signature. An CCSG is a sequence
generator composed of two LFSRs notated R1 and R2. The parameters of both registers are defined as those of
Section 2.2. At any time t, the control register R1 is clocked normally while the second register R2 is clocked a
number of times given by an integer decimation function notated Xt. In fact, if A0 ðtÞ; A1 ðtÞ; . . . ; AL1 1 ðtÞ are the
binary cell contents of R1 at time t, then Xt is defined as
X t ¼ 1 þ 20 Ai0 ðtÞ þ 21 Ai1 ðtÞ þ    þ 2w1 Aiw1 ðtÞ; ð3Þ
where i0, i1, . . . , iw1 2 {0, 1, . . . , L1  1} and 0 < w 6 L1  1.
In this way, the output sequence of an CCSG is obtained from a double decimation. First, {bi} the output
sequence of R2 is decimated by means of Xt giving rise to the sequence fb0i g. Then, the same decimation rule P,
defined in Section 2.2, is applied to the sequence fb0i g. Remark that if Xt  1 (no cells are selected in R1), then
the proposed generator is just the shrinking generator. Let us see a simple example of CCSG.
Example 2. For the same LFSRs defined in the previous example and the function Xt = 1 + 20A0(t) with
w = 1, the decimated sequence fb0i g is given by

{bi} ! 1 0 0 0 1 0 0 1 1 0 1 0 1 1 1 1 0 0 0 1 0 0 1 1 0 1 0 1 1 1 1 . . .
Xt ! 2 1 1 2 2 2 1 2 1 1 2 2 2 1 2 1 1 2 2 . . .
fb0i g ! 1 0 0 1 0 1 1 0 1 1 1 0 1 0 1 0 1 0 1 1 . . .

According to the decimation function Xt, the underlined bits 0 or 1 in {bi} are discarded in order to produce
the sequence fb0i g. Then the output sequence {cj} of the CCSG output sequence is given by

{ai} ! 1 0 0 1 1 1 0 1 0 0 1 1 1 0 1 0 0 1 1 1 0 1 . . .
fb0i g ! 1 0 0 1 0 1 1 0 1 1 1 0 1 0 1 0 1 0 1 1 . . .
{cj} ! 1 1 0 1 0 1 0 1 1 0 1 1 . . .

The underlined bits 0 or 1 in fb0i g are discarded.

In brief, the sequence produced by an CCSG is an irregular double decimation of the sequence generated by
R2 from the function Xt and the bits of R1. This construction allows one to generate a large family of different
sequences by using the same LFSR initial states and characteristic polynomials but modifying the decimation
function. Period, linear complexity and statistical properties of the generated sequences by CCSGs have been
established in [13].

2.4. Cattel and Muzio synthesis algorithm

The Cattell and Muzio synthesis algorithm [15] presents a method of obtaining two CA (based on rules 90
and 150) corresponding to a given polynomial. Such an algorithm takes as input an irreducible polynomial
Q(x) 2 GF(2)[x] defined over a finite field and computes two reversal linear CA whose output sequences have
230 A. Fúster-Sabater, D. de la Guı́a-Martı́nez / Applied Mathematical Modelling 31 (2007) 226–235

Q(x) as characteristic polynomial. Such CA are written as binary strings with the following codification:
0 = rule 90 and 1 = rule 150. The theoretical foundations of the algorithm can be found in [16]. The total num-
ber of operations required for this algorithm is listed in [15] (Table II, p. 334). It is shown that the number of
operations grows linearly with the degree of the polynomial, so the method does not suffer from any sort of
exponential blow-up. The method is efficient for all practical applications (e.g. in 1996 finding a pair of length
300 CA took 16 CPU seconds on a SPARC 10 workstation). For cryptographic applications, the degree of the
irreducible (primitive) polynomial is L2  64, so that the consuming time is negligible.
Finally, a list of one-dimensional linear hybrid cellular automata of degree through 500 can be found in [17].

3. CA-based linear models for the shrinking generator

In this section, an algorithm to determine the pair of one-dimensional linear CA corresponding to a given
shrinking generator is presented. Such an algorithm is based on the following results:
Lemma 1. The characteristic polynomial of the shrunken sequence is of the form P(x)N, where P(x) 2 GF(2)[x]
is a L2-degree polynomial and N is an integer satisfying the inequality 2ðL1 2Þ < N 6 2ðL1 1Þ .

Sketch of proof. The idea of the proof consists in demonstrating the uniqueness of the polynomial P(x) that
defines the linear recurrence relation satisfied by {cj} for both the upper and lower bounds on the linear com-
plexity. The values of such bounds are given in Eq. (2). h

Lemma 2. Let P2(x) 2 GF(2)[x] be the characteristic polynomial of R2 and let a be a root of P2(x) in the exten-
sion field GF ð2L2 Þ. Then, P(x) 2 GF(2)[x] is the characteristic polynomial of cyclotomic coset 2L1  1, that is
L1 1
P ðxÞ ¼ ðx þ aE Þðx þ a2E Þ    ðx þ a2 E
Þ ð4Þ

being E an integer given by

E ¼ 20 þ 21 þ    þ 2L1 1 . ð5Þ

Sketch of proof. The shrunken sequence can be written as an interleaved sequence [18] made out of an unique
PN-sequence repeated 2ðL1 1Þ times where 2ðL1 1Þ is the number of 1 0 s in a full period of {ai}. Such a PN-
sequence is obtained from {bi} taking digits separated a distance 2L1  1. That is the PN-sequence is the char-
acteristic sequence associated with the cyclotomic coset 2L1  1 whose characteristic polynomial is P(x). h
Remark that P(x) depends exclusively on the characteristic polynomial of the register R2 and on the length
L1 of the register R1. In addition, the polynomial P(x) will be the input to the Cattell and Muzio synthesis
algorithm [15]. Based on such an algorithm, the following result is derived:
Proposition 1. Let Q(x) 2 GF(2)[x] be a polynomial defined over a finite field and let s1 and s2 two binary strings
codifying the two linear CA obtained from the Cattell and Muzio algorithm. Then, the two binary strings
corresponding to the polynomial Q(x) Æ Q(x) are
S 0i ¼ S i  S i i ¼ 1; 2
where Si is the binary string si whose least significant bit has been complemented, S i is the mirror image of Si and
the symbol * denotes concatenation.

Sketch of proof. The result is just a generalization of the Cattell and Muzio synthesis algorithm, see [15,16].
The concatenation is due to the fact that rule 90 (150) at the end of the array in null automata is equivalent to
two consecutive rules 150 (90) with identical sequences. h
According to the previous results, the following linearization algorithm is introduced:

Input: A shrinking generator characterized by two LFSRs, R1 and R2, with their corresponding lengths, L1
and L2, and the characteristic polynomial P2(x) of the register R2.
 A. Fúster-Sabater, D. de la Guı́a-Martı́nez / Applied Mathematical Modelling 31 (2007) 226–235 231

Step 1: From L1 and P2(x), compute the polynomial P(x) as

L1 1
P ðxÞ ¼ ðx þ aE Þðx þ a2E Þ    ðx þ a2 E
Þ ð6Þ
0 1 L1 1
with E ¼ 2 þ 2 þ    þ 2 .
Step 2: From P(x), apply the Cattell and Muzio synthesis algorithm [15] to determine the two linear CA (with
rules 90 and 150), notated si, whose characteristic polynomial is P(x).
Step 3: For each si separately, we proceed:
3.1. Complement its least significant bit. The resulting binary string is notated Si.
3.2. Compute the mirror image of Si, notated S i , and concatenate both strings
S 0i ¼ S i  S i .

3.3. Apply steps 3.1 and 3.2 to each S 0i recursively L1  1 times.

Output: Two binary strings of length n ¼ L2 2L1 1 codifying the linear CA corresponding to the given shrink-
ing generator.
Remark 1. The characteristic polynomial of the register R1 is not needed. Thus all the shrinking generators
with the same R2 but different registers R1 (all of them with the same length L1) can be modelled by the same
pair of one-dimensional linear CA.

Remark 2. It can be noticed that the computational requirements of the linearization algorithm are mini-
mum. In fact, it just consists in the application of the Cattell and Muzio synthesis algorithm whose consuming
time is negligible plus (L1  1) concatenations of binary strings. Both procedures can be carried out on a sim-
ple PC.
In any case, thanks to this simple algorithm a linear model producing the output sequence of the shrinking
generator is obtained. In order to clarify the previous steps a simple numerical example is presented.

Input: A shrinking generator characterized by two LFSRs R1 of length L1 = 3 and R2 of length L2 = 5 and
characteristic polynomial P2(x) = 1 + x + x2 + x4 + x5. Now E = 23  1.

Step 1: P(x) is the characteristic polynomial of the cyclotomic coset 7. Thus,

P ðxÞ ¼ 1 þ x2 þ x5 .
Step 2: From P(x) and applying the Cattell and Muzio synthesis algorithm, two reversal linear CA whose
characteristic polynomial is P(x) can be determined. Such CA are written in binary format as
01111
11110

Step 3: Computation of the required pair of CA.

For the first automaton:
01111
0111001110
0 1 1 1 0 0 1 1 1 1 1 1 1 1 0 0 1 1 1 0 ðfinal automatonÞ
For the second automaton:
11110
1111111111
1 1 1 1 1 1 1 1 1 0 0 1 1 1 1 1 1 1 1 1 ðfinal automatonÞ
For each automaton, the procedure in Step 3 has been carried out twice as L1  1 = 2.
232 A. Fúster-Sabater, D. de la Guı́a-Martı́nez / Applied Mathematical Modelling 31 (2007) 226–235

Output: Two binary strings of length n = 20 codifying the required CA.

In this way, we have obtained a pair of linear CA among whose output sequences we can obtain the shrun-
ken sequence corresponding to the given shrinking generator. Remark that the model based on CA is a linear
one. In addition, for each one of the previous automata there are state cycles where the shrunken sequence is
generated at any one of the cells.

4. CA-based linear models for the clock-controlled shrinking generators

In this section, an algorithm to determine the pair of one-dimensional linear CA corresponding to a given
CCSG is presented. Such an algorithm is based on the following results:
Lemma 3. The characteristic polynomial of the output sequence of a CCSG is of the form P 0 (x)N, where
P 0 (x) 2 GF(2)[x] is a L2-degree polynomial and N is an integer satisfying the inequality 2ðL1 2Þ < N 6 2ðL1 1Þ .

Sketch of proof. The idea of the proof is analogous to that one developed in Lemma 1. h
Remark that, according to the structure of the CCSGs, the polynomial P 0 (x) depends on the characteristic
polynomial of the register R2, the length L1 of the register R1 and the decimation function Xt. Before, P(x) was
the characteristic polynomial of the cyclotomic coset E, where E ¼ 20 þ 21 þ    þ 2L1 1 was a fixed separation
distance between the digits drawn from the sequence {bi}. Now, this distance D is variable and is a function of
Xt. The computation of D gives rise to the following result:
Lemma 4. Let P2(x) 2 GF(2)[x] be the characteristic polynomial of R2 and let a be a root of P2(x) in the
extension field GF ð2L2 Þ. Then, P 0 (x) 2 GF(2)[x] is the characteristic polynomial of cyclotomic coset D, where D
is given by
!
2w
X
L1 w
D¼2 i  1 ¼ ð1 þ 2w Þ 2L1 1  1. ð7Þ
i¼1

Sketch of proof. The idea of the proof is analogous to that one developed in Lemma 2. In fact, the distance D
can be computed taking into account that the function Xt takes values in the interval [1, 2, . . . , 2w] and the num-
ber of times that each one of these values appears in a period of the output sequence is given by 2L1 w . A simple
computation, based on the sum of the terms of an arithmetic progression, completes the sketch. h
From the previous results, it can be noticed that the algorithm to determine the CA corresponding to a
given CCSG is analogous to that one developed in Section 3; just the expression of E in Eq. (4) must be here
replaced by the expression of D in Eq. (7). A simple numerical example is presented.

Input: A CCSG characterized by: Two LFSRs R1 of length L1 = 3 and R2 of length L2 = 5 and character-
istic polynomial P2(x) = 1 + x + x2 + x4 + x5 plus the decimation function Xt = 1 + 20A0(t) + 21A1
(t) + 22A2(t) with w = 3.

Step 1: P 0 (x) is the characteristic polynomial of the cyclotomic coset D. Now D  4 mod 31, that is we are
dealing with the cyclotomic coset 1. Thus, the corresponding characteristic polynomial is
P 0 ðxÞ ¼ 1 þ x þ x2 þ x4 þ x5 .

Step 2: From P 0 (x) and applying the Cattell and Muzio synthesis algorithm, two reversal linear CA whose
characteristic polynomial is P 0 (x) can be determined. Such CA are written in binary format as

10000
00001
 A. Fúster-Sabater, D. de la Guı́a-Martı́nez / Applied Mathematical Modelling 31 (2007) 226–235 233

Step 3: Computation of the required pair of CA.

For the first automaton:
10000
1000110001
1 0 0 0 1 1 0 0 0 0 0 0 0 0 1 1 0 0 0 1 ðfinal automatonÞ
For the second automaton:

00001

0000000000
0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 ðfinal automatonÞ

For each automaton, the procedure in Step 3 has been carried out twice as L1  1 = 2.

Output: Two binary strings of length n = 20 codifying the required CA.

Remark 3. From a point of view of the CA-based linear models, the shrinking generator or any one of the
CCGS are entirely analogous. Thus, the fact of introduce an additional decimation function does neither
increase the complexity of the generator nor improve its resistance against cryptanalytic attacks since both
kinds of generators can be linearized by the same class of CA-based models.

5. A simple approach to the output sequence reconstruction for this class of sequence generators

Since CA-based linear models describing the behavior of CCSGs have been derived, a cryptanalytic attack
that exploits the weaknesses of these models has been also developed. It consists in reconstructing the CCSG
output sequence from an amount of such a sequence (the intercepted subsequence). The key idea of this attack
is based on the study of the repeated sequences in the automata under consideration and the relative shifts
among such sequences. In fact, the sequence at a extreme cell of the automaton is repeated on average once
out of L2 cells. In order to determine these shifts, the algorithm of Bardell [19] to phase-shift analysis of CA is
applied. The approach is composed by several steps:

Step 1: The portion of M intercepted bits of the output sequence is placed at the most right (left) cell of one of
the automata. This provides shifted portions of the same output sequence produced at different cells.
The lengths of these subsequences are (on average) (M  L2), (M  2L2), (M  3L2), . . . , (M  pL2)
where p = bM/L2c.
Step 2: The locations of the different cells that generate the same output sequence as well as the relative shifts
among these sequences are detected via Bardells algorithm.
Step 3: Repeat Steps 1 and 2 for every one of the subsequences obtained above.

Summing up the contributions of the bits provided by each automaton, we obtain that the total number of
bits reconstructed is
2
N T  Mp2 ¼ MðM=L2 Þ . ð8Þ

We know not only this number of bits but also the precise location of such bits along the sequence. Notice
that we have two different CA plus an additional pair of CA corresponding to the reverse version of the output
sequence (the pair associated to the reciprocal polynomial of P2(x)). In addition, for each automaton the inter-
cepted M-bit sequence can be placed either at the most right cell or the most left cell producing different loca-
tions of the same sequence. Thus, each one of the different automata will contribute to the reconstruction of
the output sequence with a number of bits given by the Eq. (8). Moreover, remark that the output sequence for
234 A. Fúster-Sabater, D. de la Guı́a-Martı́nez / Applied Mathematical Modelling 31 (2007) 226–235

these generators is an interleaved sequence [18] made out of a fixed PN-sequence. Hence, the portions of the
reconstructed subsequence allow us to fix the starting point of many of these PN-sequences. The rest of the
bits of each PN-sequence can be easily derived.
Once the previous steps are accomplished, the original output sequence can be reconstructed by concate-
nating all different reconstructed subsequences.
Finally, let us see a simple example of application of Bardells algorithm.
Example 3. Let us consider a cellular automaton with the following characteristics:

Number of cells n = 10
Automaton under study in binary format: 0011001100
Characteristic polynomial (1 + x + x3 + x4 + x5)2.

Let S be the shift operator defined on Xi (i = 1, . . . , 10), the state of the ith cell, such as follows:
SX i ðtÞ ¼ X i ðt þ 1Þ.
Thus, the corresponding difference equation system for the previous automaton can be written as follows:
SX 1 ¼ X 2 SX 2 ¼ X 1 þ X 3  SX 10 ¼ X 9 .
Next expressing each Xi as a function of X10, we obtain the following system:
X 1 ¼ ðS 9 þ S 4 þ S 3 þ S 2 þ S þ 1ÞX 10
X 2 ¼ ðS 8 þ S 6 þ S 5 þ S 4 þ S 3 þ S þ 1ÞX 10
..
.
X 9 ¼ ðSÞX 10 .
Analogous results can be obtained expressing each Xi as a function of X1. Now taking logarithms in both
sides of the equalities,
logðX 1 Þ ¼ logðS 9 þ S 4 þ S 3 þ S 2 þ S þ 1Þ þ logðX 10 Þ
logðX 2 Þ ¼ logðS 8 þ S 6 þ S 5 þ S 4 þ S 3 þ S þ 1Þ þ logðX 10 Þ
..
.
logðX 9 Þ ¼ logðSÞ þ logðX 10 Þ.
The base of the logarithm is R(S) and the values of the logarithms are integers over a finite domain. Accord-
ing to the Bardells algorithm, we determine the integers m (if there exist) such that Sm mod R(S) equal the
different polynomials in S included in the above system. For instance,

S 26 mod RðSÞ ¼ S 2 þ 1.

Or simply, S26 = S2 + 1 and 26 log(S) = log(S2 + 1) with log(S)  1. Now substituting in the previous system,
the following equations can be derived:

logðX 9 Þ  logðX 10 Þ ¼ 1 logðX 2 Þ  logðX 1 Þ ¼ 1

logðX 8 Þ  logðX 10 Þ ¼ 26 logðX 3 Þ  logðX 1 Þ ¼ 26
logðX 4 Þ  logðX 10 Þ ¼ 6 logðX 7 Þ  logðX 1 Þ ¼ 6.

The phase-shifts of the outputs 9, 8 and 4 relative to cell 10 are 1, 26 and 6 respectively. Similar values
are obtained in the other group of cells, that is cells 2, 3 and 7 relative to cell 1. The other cells generate
different sequences. Further contributions to phase-shift analysis of CA based on 90/150 rules can be found
in [20,21].
 A. Fúster-Sabater, D. de la Guı́a-Martı́nez / Applied Mathematical Modelling 31 (2007) 226–235 235

6. Conclusions

A wide family of LFSR-based sequence generators, the so-called clock-controlled shrinking generators, has
been analyzed and identified with a subset of linear cellular automata. In this way, sequence generators con-
ceived and designed as complex nonlinear models can be written in terms of simple linear models. An easy
algorithm to compute the pair of one-dimensional linear hybrid cellular automata that generate the CCSG
output sequences has been derived. A cryptanalytic approach based on the phase-shift of cellular automata
output sequences is proposed. From the obtained results, we can create linear cellular automata-based models
to analyse/cryptanalyse the class of clock-controlled generators.

References

[1] A.K. Das, A. Ganguly, A. Dasgupta, S. Bhawmik, P.P. Chaudhuri, Efficient characterisation of cellular automata, IEE Proceedings—
Part E 1 (1990) 81–87.
[2] O. Martin, A.M. Odlyzko, S. Wolfram, Algebraic properties of cellular automata, Communications in Mathematical Physics 93
(1984) 219–258.
[3] S. Nandi, B.K. Kar, P.P. Chaudhuri, Theory and applications of cellular automata in cryptography, IEEE Transactions on
Computers 43 (1994) 1346–1357.
[4] S. Wolfram, Cellular automata as models of complexity, Nature 311 (1984) 419.
[5] S. Wolfram, Random sequence generation by cellular automata, Advances in Applied Mathematics 7 (1986) 123.
[6] S. Golomb, Shift-Register Sequences, Aegean press, 1982 (revised edition).
[7] H.S. Stone, Discrete Mathematical Structures and Their Applications, Science Research, Chicago, IL, 1973.
[8] F. Bao, Cryptanalysis of a new cellular automata cryptosystem, in: 8th Australasian Conference on Information Security and
Privacy—ACISP 2003, Lecture Notes in Computer Science, vol. 2727, Springer-Verlag, Berlin Heidelberg, New York, 2003, pp. 416–
427.
[9] S. Blackburn, S. Merphy, K. Paterson, Comments on theory and applications of cellular automata in cryptography, IEEE
Transactions on Computers 46 (1997) 637–638.
[10] S. Wolfram, Cryptography with cellular automata, in: Advances in Cryptology—CRYPTO85, Lecture Notes in Computer Science,
218, 1994, pp. 22–39.
[11] A.J. Menezes et al., Handbook of Applied Cryptography, CRC Press, New York, 1997.
[12] R.A. Rueppel, Stream ciphers, in: Gustavus J. Simmons (Ed.), Contemporary Cryptology, The Science of Information, IEEE Press,
1992, pp. 65–134.
[13] A. Kanso, Clock-controlled shrinking generator of feedback shift registers, in: 8th Australasian Conference on Information Security
and Privacy—ACISP 2003, Lecture Notes in Computer Science, 2727, 2003, pp. 443–451.
[14] D. Coppersmith, H. Krawczyk, Y. Mansour, The shrinking generator, in: Advances in Cryptology—CRYPTO93, Lecture Notes in
Computer Science, 773, Springer Verlag, Berlin Heidelberg New York, 1994, pp. 22–39.
[15] K. Cattell, J. Muzio, Synthesis of one-dimensional linear hybrid cellular automata, IEEE Transactions on Computer-Aided Design 15
(1996) 325–335.
[16] K. Cattell, J. Muzio, A linear cellular automata algorithm: theory, Dept. of Computer Science, University of Victoria, Canada, Tech.
Rep. DCS-161-IR, 1991.
[17] K. Cattell, Z. Shujian, Minimal cost one-dimensional linear hybrid cellular automata of degree through 500, Journal of Electronic
Testing: Theory and Applications 6 (1995) 255–258.
[18] G. Gong, Theory and applications of q-ary interleaved sequences, IEEE Transactions on Information theory 41 (1995) 400–411.
[19] P.H. Bardell, Analysis of cellular automata used as pseudorandom pattern generators, in: Proceedings of the IEEE International Test
Conference, Paper 34.1, 1990, pp. 762–768.
[20] S. Nandi, P.P. Chaudhuri, Additive cellular automata as an on-chip test pattern generator, Test symposium 1993, in: Proceedings of
the Second Asian, 1993, pp. 166–171.
[21] S. Cho et al., Computing phase shifts of 90/150 cellular automata sequences, in: ACRI 2004, Lecture Notes in Computer Science, vol.
3305, 2004, pp. 31–39.