The linear complexity of the self-shrinking generator

The self-shrinking generator, a stream cipher due to Meier and Staffelbach (see Advances in Cryptology-EUROCRYPT'94, Berlin, Germany, p.205-14, 1995 and Lecture Notes in Computer Science, vol.950), uses the output of a primitive binary linear-feedback shift register (LFSR) of length n to generate a keystream sequence of period dividing 2/sup n-1/. The article proves that the linear complexity of the keystream is at most 2/sup n-1/-(n-2). This confirms the surprising experimental observations of Meier and Staffelbach.