Linear Properties in T-Functions

Linear equations have always been powerful tools in cryptanalysis. In this correspondence, we present a general linear equation of minimum weight 3 in F₂ that holds for all state lengths n and all shifts i of sequences generated by the T-function x_i=x_i-1 ²orC+x_i-1 mod 2ⁿ proposed by Klimov and Shamir. It is surprising that these linear properties exist, and they indicate that the sequences generated by the T-functions have more structures than claimed by Klimov and Shamir