Explanation of $z^{-1}$ and $T_{1,2}$ within E0 Bluetooth encryption algorithm
This article  Cryptanalysis of the Bluetooth Stream Cipher by Canniere et al. explains in details;

\begin{align}
T_1 : \mathbb Z^2_2 &amp;\mapsto \mathbb Z^2_2\\
(x_1, x_0) &amp;\to (x_1, x_0)\\
\end{align}

\begin{align}
T_2 : \mathbb  Z^2_2 &amp;\mapsto \mathbb  Z^2_2\\
(x_1, x_0) &amp;\to (x_1, x_1 \oplus x_0)\\
\end{align}

$Z^{-1}$ are 2-bit digital delay lines. $Z^{-1}$ is delay one sample and $Z^{-N}$ is delay by $N$ sample. This can be implemented by circular buffer in electronics and with arrays in software.

Why $T_1$ and $T_2$ are bijections? $T_1$ is bijection since it is just swapping the values. To prove that $T_2$ is a bijection; first, notice that it is surjective. To see it is an injective notice that we can find the inverse of every element on the range.



Extra:

To understand $\mathbb Z_2^2$ we need to construct it: We can also represent $\mathbb Z_2^2 $ as $\operatorname{GF}(2^2)$. It is the second-degree extension of $\operatorname{GF}(2)$ by the roots of the polynomial $x^2 + x + 1$. Let $\alpha$ is one root then the second root is $\beta  = 1 + \alpha$.

By using $1 + 1 = 0$ and $\alpha^2 = \alpha + 1$ we can build the addition and multiplication tables.

Addition:
$$
\begin{array}{c|cccc}
+  &amp; 0&amp;   1&amp;   \alpha &amp;  \beta  \\
\hline
    0&amp;   0 &amp;  1 &amp;  \alpha &amp;  \beta \\ 
1 &amp;  1 &amp;  0 &amp;  \beta &amp;  \alpha  \\
\alpha &amp;  \alpha &amp;  \beta &amp;  0 &amp;  1  \\
\beta &amp;  \beta &amp;  \alpha &amp;  1 &amp;  0  \end{array}
$$

Multiplication:
$$\begin{array}{c|cccc}
\cdot &amp;   0 &amp;  1 &amp;  \alpha &amp;  \beta  \\
\hline
0 &amp;  0 &amp;  0 &amp;  0 &amp;  0  \\
1 &amp;  0 &amp;  1 &amp;  \alpha &amp;  \beta  \\
\alpha &amp;  0 &amp;  \alpha &amp;  \beta &amp;  1  \\
\beta &amp;  0 &amp;  \beta &amp;  1 &amp;  \alpha  
  \end{array}$$