A practical distinguisher for the Shannon cipher

In this paper, we present a practical linear distinguisher on the Shannon stream cipher. Shannon is a synchronous stream cipher that uses at most 256-bit secret key. In the specification for Shannon, designers state that the intention of the design is to make sure that there are no distinguishing attacks on Shannon requiring less than 280 keystream words and less than 2128 computations. In this work we use the Crossword Puzzle attack technique to construct a distinguisher which requires a keystream of length about 231 words with workload about 231.