The creation of the prekeys for Serpent works by XORing some previous values with a counter and a fixed value. Every word is 32 bits big and 4 words form a round key (after applying a S-Box, but this shall not be part of this question).
The original raw key of 256 bit is $w_{-8}$ to $w_{-1}$, $\phi$ is a constant term with the value hex $0x9e3779b9$. $\lll$ equals the left rotation and $\oplus$ is XORing every individual bit. The equation for the value $i$ is: $$ w_i = (w_{i-8} \oplus w_{i-5} \oplus w_{i-3} \oplus w_{i-1} \oplus \phi \oplus i) \lll 11 $$ The creators of Serpent mention that this bases on the primitive polynomial $x^8 + x^7 + x^5 + x^3 + 1$
…to ensure an even distribution of key bits throughout the rounds, and to eliminate weak keys and related keys.
(Source: http://asmaes.sourceforge.net/serpent/serpentSpecification.pdf)
My question: Does this equation form a cycle across all possible values? I am asking, because a linear feedback shift register with a primitive polynomial has the feature that every possible value (excluding all bits set to 0) will be reached and then it starts again at the first value.
- If the answer is “yes”, will this "feature" hold with other constant terms than the given $\phi$?
- If the answer is ”no”, would it be enough to remove the constant term $\phi$ and/or the applied round counter $i$ from the equation?
