The challenge provides a Python script that encrypts a flag using a custom-built keystream generator. The core of the generator relies on a , which is a type of mapping where the -th bit of the output only depends on the

: Observe that the LSB of the keystream is directly tied to the LSB of the initial state. Bit-Stepping : Assume the first bits of the state are known. Simulate the T-function for the next bit (

-th bits of the input [3]. While T-functions are often used to create long-period sequences, improper implementation can lead to significant linear vulnerabilities. Key Vulnerabilities

The graph above illustrates the of T-functions: bit only depends on bits , allowing for the bit-by-bit recovery used in the exploit.

, the state can be recovered one bit at a time starting from the Least Significant Bit (LSB) [4, 6].