- Linear feedback shift register
[

xor gate provides feedback to the register that shifts bits from left to right. The maximal sequence consists of every possible state except the "0000" state.]A

**linear feedback shift register**(LFSR) is ashift register whose input bit is a linear function of its previous state.The only linear functions of single bits are xor and inverse-xor; thus it is a shift register whose input bit is driven by the

exclusive-or (xor) of some bits of the overall shift register value.The initial value of the LFSR is called the seed, and because the operation of the register is deterministic, the sequence of values produced by the register is completely determined by its current (or previous) state. Likewise, because the register has a finite number of possible states, it must eventually enter a repeating cycle. However, an LFSR with a well-chosen feedback function can produce a sequence of bits which appears random and which has a very long cycle.

Applications of LFSRs include generating pseudo-random numbers, pseudo-noise sequences, fast digital counters, and

whitening sequences . Both hardware and software implementations of LFSRs are common.**Fibonacci LFSRs** The list of the bits' positions that affect the next state is called the tap sequence. In the diagram the sequence is [16,14,13,11,0] . The taps are XOR'd sequentially with the output and then fed back into the leftmost bit.

hex shown will be followed by 5670 hex.* The outputs that influence the input are called "taps" (white in the diagram).

* A maximal LFSR produces anm-sequence (i.e. cycles through all possible $2^n-1$ states within the shift register except the state where all bits are zero), unless it contains all zeros, in which case it will never change.The sequence of numbers generated by an LFSR can be considered a

binary numeral system just as valid asGray code or the natural binary code.The tap sequence of an LFSR can be represented as a

polynomial mod 2. This means that the coefficients of the polynomial must be 1's or 0's. This is called the feedback polynomial or characteristic polynomial. For example, if the taps are at the 16th, 14th, 13th and 11th bits (as shown), the feedback polynomial is:::$x^\{16\}\; +\; x^\{14\}\; +\; x^\{13\}\; +\; x^\{11\}\; +\; 1,$The 'one' in the polynomial does not correspond to a tap - it corresponds to the input to the first bit (i.e. "x

^{0}", which is equivalent to 1). The powers of the terms represent the tapped bits, counting from the left. The first and last bits are always connected as an input and tap respectively.Tables of

primitive polynomial s from which maximal LFSRs can be constructed are given below and in the references.* The LFSR will only be maximal if the number of taps is even; just 2 or 4 taps can suffice even for extremely long sequences.

* The set of taps must berelatively prime , and share no common divisor to all taps.

* There can be more than one maximal tap sequence for a given LFSR length

* Once one maximal tap sequence has been found, another automatically follows. If the tap sequence, in an "n"-bit LFSR, is [n,A,B,C,0] , where the 0 corresponds to the $x^0=1$ term, then the corresponding 'mirror' sequence is [n,n-C,n-B,n-A,0] . So the tap sequence [32,3,2,0] has as its counterpart [32,30,29,0] . Both give a maximal sequence.Some example C/C++ code is below:

uint16_t reg = 0xACE1; uint16_t bit; while(1) { bit = (reg & 0x0001) ^ ((reg & 0x0004) >> 2) ^ ((reg & 0x0008) >> 3) ^ ((reg & 0x0020) >> 5); reg = (reg >> 1) | (bit << 15); printf("%04X ",reg); }

The above code assumes the right most bit is actually bit 1, not bit 16.

**Galois LFSRs**Named after the French mathematician

Évariste Galois , a "Galois" LFSR, or an LFSR in Galois configuration, is an alternate structure that can generate the sameFact|date=August 2008 output sequences as a conventional LFSR. In the Galois configuration, when the system is clocked, bits that are not taps are shifted as normal to the next flip-flop. The taps, on the other hand, are XOR'd with the new output, which also becomes the new input. These won't be shifted in until the next clock cycle.To generate the same output sequence, the order of the taps is the "counterpart" (see above) of the order for the conventional LFSR, otherwise the sequence will be in reverse. Note that the internal state of the LFSR is not necessarily the same. The Galois register shown has the same output as the Fibonnacci register in the first section.

* Galois LFSRs do not concatenate every tap to produce the new input (the XOR'ing is done within the LFSR and no XOR gates are run in serial, therefore the propagation times are reduced to that of one XOR rather than a whole chain), thus it is possible for each tap to be computed in parallel, increasing the speed of execution.

* In a software implementation of an LFSR, the Galois form is more efficient as the XOR operations can be implemented a word at a time: only the output bit must be examined individually.Below is a code example of a 32-bit maximal period Galois LFSR that is valid in C and

C++ , (assuming that unsigned int has 32 bit precision):`unsigned int lfsr = 1; unsigned int period = 0; do { lfsr = (lfsr >> 1) ^ (-(lfsr & 1u) & 0xd0000001u); /* taps 32 31 29 1 */ ++period; } while(lfsr != 1u);`

And here is the code for the 16 bit example in the figure.

`unsigned short lfsr = 0xACE1u; unsigned int period = 0; do { lfsr = (lfsr >> 1) ^ (-(short)(lfsr & 1u) & 0xB400u); ++period; } while(lfsr != 0xACE1u);`

**ome Polynomials for Maximal LFSRs****Output-stream properties*** Ones and zeroes occur in 'runs'. The output stream 0110100, for example consists of five runs of lengths 1,2,1,1,2, in order. In one period of a maximal LFSR, $2^\{n-1\}$ runs occur (for example, a six bit LFSR will have 32 runs). Exactly $1/2$ of these runs will be one bit long, $1/4$ will be two bits long, up to a single run of zeroes $n-1$ bits long, and a single run of ones $n$ bits long. This same property is statistically expected in a truly random sequence.

* LFSR output streams aredeterministic . If you know the present state, you can predict the next state. This is not possible with truly random events such as nuclear decay.

* The output stream is reversible; an LFSR with mirrored tap sequence will cycle through the states in reverse order.**Applications**LFSRs can be implemented in hardware, and this makes them useful in applications that require very fast generation of a pseudo-random sequence, such as

direct-sequence spread spectrum radio.The

Global Positioning System uses an LFSR to rapidly transmit a sequence that indicates high-precision relative time offsets.TheNintendo Entertainment System video game console also has an LFSR as part of its sound system. ( [*http://nocash.emubase.de/everynes.htm*] )**Uses as counters**The repeating sequence of states of an LFSR allows it to be used as a divider, or as a counter when a non-binary sequence is acceptable as is often the case where computer index or framing locations need to be machine-readable. LFSR

counter s have simpler feedback logic than natural binary counters orGray code counters, and therefore can operate at higher clock rates. However it is necessary to ensure that the LFSR never enters an all-zeros state, for example by presetting it at start-up to any other state in the sequence.The table of primitive polynomials shows how LFSR's can be arranged in Fibonacci or Galois form to give maximal periods. One can obtain any other period by adding to an LFSR that has a longer period some logic that shortens the sequence by skipping some state(s), e.g. as tabulated in [*http://www.xilinx.com/support/documentation/application_notes/xapp052.pdf*] .**Uses in cryptography**LFSRs have long been used as

pseudo-random number generator s for use instream cipher s (especially inmilitary cryptography ), due to the ease of construction from simpleelectromechanical orelectronic circuits , long periods, and very uniformly distributed outputs. However, an LFSR is a linear system, leading to fairly easycryptanalysis . For example, given a stretch of known plaintext and corresponding ciphertext, a stretch of LFSR output used in the system described above can be recovered, and from the output sequence one can construct an LFSR of minimal size by using theBerlekamp-Massey algorithm , which with the known output can be used to simulate the intended receiver to recover the remaining plaintext.Three general methods are employed to reduce this problem in LFSR-based stream ciphers:

*Non-linear combination of severalbit s from the LFSR state;

* Non-linear combination of the outputs of two or more LFSRs; or

* Irregular clocking of the LFSR, as in thealternating step generator .Important LFSR-based stream ciphers include

A5/1 andA5/2 , used inGSM cell phones, E0, used inBluetooth , and theshrinking generator . The A5/2 cipher has been broken and both A5/1 and E0 have serious weaknesses.**Uses in digital broadcasting and communications**To prevent short repeating sequences (e.g., runs of 0's or 1's) from forming spectral lines that may complicate symbol tracking at thereceiver or interfere with other transmissions, linear feedback registers are often used to "randomize" the transmitted bitstream. Thisrandomization is removed at the receiver after demodulation.When the LFSR runs at the same rate as the transmitted symbol stream, this technique is referred to as scrambling.When the LFSR runs considerably faster than the symbol stream, expanding the bandwidth of the transmitted signal, this is

direct-sequence spread spectrum .Neither scheme should be confused with

encryption orencipherment ; scrambling and spreading with LFSRs do*not*protect the information from eavesdropping.Digital broadcasting systems that use linear feedback registers:

*ATSC Standards (HDTV transmission system – North America)

* DAB (Digital audio broadcasting system -- for radio)

*DVB-T (HDTV transmission system – Europe, Australasia)

*NICAM (digital audio system for television)Other digital communications systems using LFSRs:

* IBS (INTELSAT business service)

* IDR (Intermediate Data Rate service)

* SDI (Serial Digital Interface transmission)

* Data transfer overPSTN (according to theITU-T V-series recommendations)

*CDMA (Code Division Multiple Access) cellular telephony

* 100BASE-T2 "fast" Ethernet scrambles bits using a LFSR

* 1000BASE-T Ethernet, the most common form of Gigabit Ethernet, scrambles bits using a LFSR**ee also*** Pinwheel

*Mersenne twister

*PN Sequences

*Maximum length sequence **External links*** [

*http://www.newwaveinstruments.com/resources/articles/m_sequence_linear_feedback_shift_register_lfsr.htm LFSR Reference*] LFSR theory and implementation, maximal length sequences, and comprehensive feedback tables for lengths from 7 to 16,777,215 (3 to 24 stages), and partial tables for lengths up to 4,294,967,295 (25 to 32 stages).

* [*http://www.itu.int/rec/T-REC-O.151-199210-I/en International Telecommunications Union Recommendation O.151*] (August 1992)

* [*http://www.xilinx.com/bvdocs/appnotes/xapp052.pdf Maximal Length LFSR table*] with length from 3 to 168

* [*http://www.physics.otago.ac.nz/px/research/electronics/papers/technical-reports/lfsr_table.pdf Maximal Length LFSR table*] with length from 1 to 786, also 1024 and 2048.

* [*http://www.maxim-ic.com/appnotes.cfm?appnote_number=1743&CMP=WP-9 Pseudo-Random Number Generation Routine*]

* http://www.ee.ualberta.ca/~elliott/ee552/studentAppNotes/1999f/Drivers_Ed/lfsr.html

* http://www.quadibloc.com/crypto/co040801.htm

* [*http://www.yikes.com/~ptolemy/lfsr_web/index.htm Simple explanation of LFSRs for Engineers*]

* [*http://www.ece.cmu.edu/~koopman/lfsr/index.html Feedback terms*]

* [*http://homepage.mac.com/afj/lfsr.html General LFSR Theory*]

* [*http://homepage.mac.com/afj/taplist.html Table of Maximal Tap Sequences*]

* [*http://www-rocq.inria.fr/codes/LFSR/index.html Shift register code generator*]

*Wikimedia Foundation.
2010.*