FINITE-FIELDS

Summary

Work over the binary extension field with nbits = 64*3 = 192. The internal state evolves affinely and the output is the top 64 bits of the 192-bit state.

$$S_{t+1}=a,S_t+b \text{ in } \mathbb{F}_{2^{192}}$$ $$y_t=\lfloor S_t / 2^{128}\rfloor \in {0,\ldots,2^{64}-1}$$

The challenge prints 200 outputs values $= [y_0,\ldots,y_{199}]$, then takes two more outputs $v_1=y_{200}$, $v_2=y_{201}$ to form the AES-ECB key (big-endian):

$$\text{key}=(v_2 \ll 64)\ | \ v_1$$