![](bg4.png)
runs of decimations is assumed for constrained edit distance matrices. It is also remark-
able that at each stage the minimum has to be obtained in order to extend the search
at a next stage, which implies the need to maintain a record of the search in the same
way that Viterbi algorithm saves a back pointer to the previous state on the maximum
probability path.
In order to avoid the computation of the edit distances for all possible initial se-
quences, we propose a graph-theoretical approach so that the computation of edit dis-
tances may be seen as a search through a basic graph. Such a basic graph is a directed
rooted tree where each non-root vertex (i + j, j), i = 0, 1, , N − M; j = 1, 2, , M,
indicates a correspondence between the bits x
i+j
and y
j
and each edge indicates either
a deletion of the bit x
i+j
when j = 0, or a possible transition due to a deletion (D) or
a substitution (S), in the remaining cases. In this way, the computation of edit distances
consists in finding the shortest paths through the graph.
For the description of our improvement, we now define a new weighted directed
graph, here called induced graph, where the costs of shortest paths come directly from
the elements of the matrix W . This induced graph is computed from the basic graph
such as follows: if we eliminate vertical edges in the previous graph by computing the
partial transitive closure of every pair of edges of the form ((i + j − 2, j − 1), (i +
j − 1, j − 1)) and ((i + j − 1, j − 1), (i + j, j)) and by substituting them by the edge
((i + j − 2, j − 1), (i + j, j)), then we get the graph that will be called induced graph.
In this graph there are as many vertices as elements in the matrix W , plus an
additional source and an additional sink. On the other hand, the directed edges in
this induced graph are defined from the computation of the edit distances described
in Equation (1), plus additional edges joining the source with the vertices associated
to the first column of W and additional edges joining the vertices associated to the
last column of W with the sink. For instance, the induced graph corresponding to a
constrained edit distance matrix with runs of decimations of maximum length 1 has
(N − M + 1) · (2M − N + 2) vertices and 2 · (N − M + 1) · (2M − N + 2) − M − 3
edges. Moreover, edges in the induced graph have different costs depending on the
specific pair of sequences X and Y , and particularly on the coincidences between the
corresponding bits of both sequences, as described in Equation (1). Note that in the
induced graph, the shortest paths between the source and the sink give us the solu-
tion of the cryptanalytic attack through the specification of both decimation and noise
sequences that can be extracted from them.
3 Search of Promising Initial States
The main idea behind the method shown in this Section comes directly from the asso-
ciation between bits x
i+j
and edges of the induced graph. Since the calculation of the
minimum edit distance implies the computation of some shortest path in such a graph,
cut sets between the source and the sink in the induced graph may be useful in order
to define a set of conditions for candidate sequences so that it is possible to establish
a minimum threshold edit distance. In this way, once an intercepted sequence fulfills
some of those stated conditions, the cost of the corresponding cut set can be guaranteed
19