Algebraic attacks on a class of stream ciphers with unknown output function

Attacks on linear feedback shift register (LFSR) based cryptosystems typically assume that all the system details except the initial state of the LFSR are known. We address the problem assuming that the nonlinear output function is also unknown and frame the problem as one of a multivariate interpolation. The solution to this problem yields a system that produces an output identical to that of the original system with some other initial state. The attack needs to observe M bits of data and has complexity O(M ^ω) where ${M = sum_{i=0}^{d} C(n, i)}$ is the number of monomials of degree at most d in n variables, n being the state size and d the degree of the output function. When the output function has annihilators of degree e < d then with O(D) bits of data one can reconstruct parts of the keystream where ${D = sum_{i=0}^{e} C(n, i)}$ .