A practical distinguisher for the Shannon cipher

In this paper, we present a practical linear distinguisher on the Shannon stream cipher. Shannon is a synchronous stream cipher that uses at most 256-bit secret key. In the specification for Shannon, designers state that the intention of the design is to make sure that there are no distinguishing attacks on Shannon requiring less than 2^8^0 keystream words and less than 2^1^2^8 computations. In this work we use the Crossword Puzzle attack technique to construct a distinguisher which requires a keystream of length about 2^3^1 words with workload about 2^3^1.