▁ 5 0 % ▁of ▁the ▁time , ▁because ▁given ▁two ▁random ▁bit ▁sequences ▁of ▁a ▁given ▁length , ▁the ▁probability ▁of ▁agreement ▁between ▁the ▁sequences ▁at ▁any ▁particular ▁bit ▁is ▁ 0 . 5 . ▁ ▁However , ▁specific ▁individual ▁incorrect ▁keys ▁may ▁well ▁generate ▁L FS R ▁output ▁which ▁agre es ▁with ▁the ▁generator ▁output ▁more ▁or ▁less ▁often ▁than ▁exactly ▁ 5 0 % ▁of ▁the ▁time . ▁ ▁This ▁is ▁particularly ▁sal ient ▁in ▁the ▁case ▁of ▁L FS R s ▁whose ▁correlation ▁with ▁the ▁generator ▁is ▁not ▁especially ▁strong ; ▁for ▁small ▁enough ▁correl ations ▁it ▁is ▁certainly ▁not ▁outside ▁the ▁real m ▁of ▁possibility ▁that ▁an ▁incorrectly ▁guess ed ▁key ▁will ▁also ▁lead ▁to ▁L FS R ▁output ▁that ▁agre es ▁with ▁the ▁desired ▁number ▁of ▁bits ▁of ▁the ▁generator ▁output . ▁ ▁Thus ▁we ▁may ▁not ▁be ▁able ▁to ▁find ▁the ▁key ▁for ▁that ▁L FS R ▁uniqu ely ▁and ▁with ▁certain ty . ▁ ▁We ▁may ▁instead ▁find ▁a ▁number ▁of ▁possible ▁keys , ▁although ▁this ▁is ▁still ▁a ▁significant ▁bre ach ▁of ▁the ▁ci pher ' s ▁security . ▁ ▁If ▁we ▁had , ▁say , ▁a ▁meg aby te ▁of ▁known ▁plain text , ▁the ▁situation ▁would ▁be ▁substantial ly ▁different . ▁ ▁An ▁incorrect ▁key ▁may ▁generate ▁L FS R ▁output ▁that ▁agre es ▁with ▁more ▁than ▁ 5 1 2 ▁kil oby tes ▁of ▁the ▁generator ▁output , ▁but ▁not ▁likely ▁to ▁generate ▁output ▁that ▁agre es ▁with ▁as ▁much ▁as