Theoretical cryptanalysis of the Klimov-Shamir number generator TF-1
<|reference_start|>Theoretical cryptanalysis of the Klimov-Shamir number generator TF-1: The internal state of the Klimov-Shamir number generator TF-1 consists of four words of size w bits each, whereas its intended strength is 2^{2w}. We exploit an asymmetry in its output function to show that the internal state can be recovered after having 2^w outputs, using 2^{1.5w} operations. For w=32 the attack is practical, but for their recommended w=64 it is only of theoretical interest.<|reference_end|>
@article{tsaban2005theoretical,
    title={Theoretical cryptanalysis of the Klimov-Shamir number generator TF-1},
    author={Boaz Tsaban},
    journal={Journal of Cryptology 20 (2007), 389-392},
    year={2005},
    doi={10.1007/s00145-007-0564-4},
    archivePrefix={arXiv},
    eprint={cs/0507063},
    primaryClass={cs.CR cs.CC}
}