Why isn't the alternating step generator used more often? According to the Wikipedia entry for the Alternating Step pseudorandom number generator, there is no public cryptanalysis for this device since it was invented back in 1987 by C.G. Gunther. I have several questions about this:


If it hasn't been cracked since 1987, why is it not considered to be a candidate for a "one way function" like the RSA crypto system, the discrete logarithm system, etc.?
If it is unbreakable, why isn't everybody using it? 
Why doesn't Mr. Gunther have a U.S. patent for such a great invention?
A stream cipher, RSA, or whatever you designate by the expression &quot;discrete logarithm system&quot;, are not &quot;one-way functions&quot;. In particular, asymmetric encryption algorithms and digital signature algorithms provide functionality which is not doable (or not with the same usability) with only the &quot;scrambling&quot; techniques of symmetric cryptography. Let's not confuse things.
ASG is a stream cipher: it produces a key-dependent sequence of pseudo-random bits, which can be combined with some data (bitwise XOR) to encrypt or decrypt it. This is symmetric encryption. As a symmetric encryption engine, it is rather lousy:

Linear Feedback Shift Registers are inefficient in software. They used to be popular in the 70s and 80s because a LFSR is inexpensive, in terms of silicon area, when implemented in a custom ASIC. However, the World has evolved since, and has gone more and more software-based. As of 2011, extreme silicon efficiency is relevant only to very small platforms (RFID tags). For all others, ASG is just slow.

ASG is wasteful of its state. For n-bit security, it requires three LFSR of size at least n bits. Compare it with A5/1: A5/1, with m bits of state, has a security equivalent to 22m/3. The original A5/1 state size is only 64 bits, so its security is in the realm of the highly breakable and open to many kinds of optimizations with precomputations; but the structure of A5/1 could be extended to longer registers, and yield adequate security. For instance, with three LFSR with a total size of 192 bits, you could get with an A5/1-like cipher about 128 bits of security, which is, in simple terms, &quot;totally unbreakable for the foreseeable future&quot;. To get the same security level with ASG, you need 384 bits of state, i.e. twice as much.

There is more to a stream cipher than simply spouting out bits. A complete specification should define how the key is transformed into the initial state, preferably along with an Initialization Vector, so that one could encrypt several messages with the same key (exactly what RC4 lacks, and it proved to be an endless source of vulnerable implementations). Weaknesses often hide in those steps. Without such a specification, ASG is like a car engine: regardless of its power, it will not get you far unless you add wheels.


As @Marsh points out, ASG has been patented. This alone is enough to explain that it is not widely used. There is no shortage of good stream ciphers, that we do not know how to break; why would anybody use yet another one, of questionable efficiency and subject to usage conditions and assorted royalties ? In cryptography, a patent is often a way to make sure that a given algorithm will not get used.