eight corresponding coefficients from GF(64) sum to zero, thereby eliminating {a9}}} as a component in the representation of {bn}. Since a9 has order 7, it is an element of GF(8) and, therefore, has a three term trace and a degree-three minimum polynomial. Hence, this missing term accounts for the difference of three between Key's bound and the achieved linear span. It has been pointed out [24] that for cryptographic applications, linear span is only one of several measures that must be considered in selecting a key sequence. This note of caution applies equally well to the selection of spectrum-spreading sequences. For example, the logic imposed on the m- sequence generator of Figure 5.11 produces an output whose linear span is 31, the period of the m-sequence generator. On the other hand, the AND gate output will be a "1" only when the all-ones 5-tuple appears in the reg- ister, an event which occurs only once in the 31 bit period of the generator. Pseudonoise Generators Figure 5.11. A high-linear-span generator. The output of such a generator can hardly be called pseudorandom, when a prediction that an output bit will be zero is correct 96.7% of the time. The following result suggests a simple way to guarantee nearly equal num- bers of zeros and ones in the output of a generator. THEOREM 5.11. Let s = (r1, ..., = , r'M) denote the memory state of an m- sequence generator. If the output of NLFFL on the memory state can be represented in the form b=rifr1.ir (5.174) for some i, where f(.) is any Boolean function independent of ri, then the NLFFL output sequence will be balanced. Proof. Since the state M-tuple takes on all possible values except all-zeros during one period of operation, then the states (r1, , Vi-1, 1, li+1,..., r'm) each occur once for each choice of the remain- ing values of the r}'s,j # i, excluding all-zeros. Each such state pair will con- tribute one 0 and one 1 in one period of the NLFFL output when (5.174) holds. Therefore, one full period of the output will have either (a) one more 0 than 1