Linear Properties in T-Functions

Linear equations have always been powerful tools in cryptanalysis. In this correspondence, we present a general linear equation of minimum weight 3 in F
₂
that holds for all state lengths n and all shifts i of sequences generated by the T-function x
_i
=x
_i-1

²
orC+x
_i-1
mod 2
ⁿ
proposed by Klimov and Shamir. It is surprising that these linear properties exist, and they indicate that the sequences generated by the T-functions have more structures than claimed by Klimov and Shamir