# Multiplexed stream cipher

Consider the stream cipher that consists of 3 LFSRs, with the output of one coming being used to determine which of the other 2 is used that clock cycle.

Both the IV and the polynomials are secret.

Is this broken? I know that the related shrinking generator is not, but needs buffering to avoid timing attacks.

Yes the multiplexing generator due to Jennings, and more advanced versions have been broken. I am assuming regular synchronous clocking of all 3 LFSRs in this answer.

The attacks mentioned are either correlation attacks or linear consistency attacks or a combination of the two. A reference which also cites earlier work is

Optimal correlation attack on the multiplexer generator, Jovan Dj. Golic, Guglielmo Morgari, Information Processing Letters 109 (2009):838–841.

• Can you please expand your answer a bit? For example you could sketch how this construction was broken and maybe link to some relevant papers? – SEJPM Apr 17 '16 at 13:07