The linear consistency attack is a divide-and-conquer technique which provides a known plaintext attack on stream ciphers. It was introduced by Zeng et al. in 1989. It has been applied to various keystream generators, like the Jenning generator [2], the stop-and-go generator of Beth and Piper [2], and the E0 cipher used in Bluetooth [1].
The linear consistency attack applies as soon as it is possible to single out a portion K 1 of the secret key and to form a system \( Ax = b \) of linear equations, where the matrix A only depends on K 1 and the right-side vector b is determined by the known keystream bits. Then, an exhaustive key search on K 1 can be performed. The correct value of K i can be distinguished from a wrong one by checking whether the linear system is consistent or not. Once K i has been recovered, the solution x of the system may provide some additional bits of the secret key.