Fast Attacks on Tree-Structured Ciphers

Tree-structures have been proposed for both the construction of block ciphers by Kam and Davida 7], and self-synchronous stream ciphers by K uhn 9]. Attacks on these ciphers have been given by An-derson 2] and Heys and Tavares 6]. In this paper it is demonstrated that a more eecient attack can be conducted when the underlying Boolean functions for the cells are known. It is shown that this attack requires less then 1 3 the chosen ciphertext of Anderson's original attack on K uhn's cipher. We also comment on an improved version of K uhn's cipher that was modiied in light of Anderson's original attack.