Explanation of $z^{-1}$ and $T_{1,2}$ within E0 Bluetooth encryption algorithm I am trying to understand how E0 Bluetooth algorithm exactly works. I know that $y_t$ is the sum of $x_1$ to $x_4$ and can take values $0, 1, 2, 3, 4$. Also $S_{t+1}$ = $(y_t + c_t)/2$ and can be $\{0,1,2,3\}$. But I don't understand what $z^{-1}$ and $T_{1,2}$ means.



According to the Bluetooth core specification:


  $T_1$ and $T_2$ are two different linear bijections over $GF(4)$.


Picture and explanation is on page 164.

Can you please clarify this and provide some examples?
This article  Cryptanalysis of the Bluetooth Stream Cipher by Canniere et al. explains in details;

\begin{align}
T_1 : \mathbb Z^2_2 &amp;\mapsto \mathbb Z^2_2\\
(x_1, x_0) &amp;\to (x_1, x_0)\\
\end{align}

\begin{align}
T_2 : \mathbb  Z^2_2 &amp;\mapsto \mathbb  Z^2_2\\
(x_1, x_0) &amp;\to (x_1, x_1 \oplus x_0)\\
\end{align}

$Z^{-1}$ are 2-bit digital delay lines. $Z^{-1}$ is delay one sample and $Z^{-N}$ is delay by $N$ sample. This can be implemented by circular buffer in electronics and with arrays in software.

Why $T_1$ and $T_2$ are bijections? $T_1$ is bijection since it is just swapping the values. To prove that $T_2$ is a bijection; first, notice that it is surjective. To see it is an injective notice that we can find the inverse of every element on the range.



Extra:

To understand $\mathbb Z_2^2$ we need to construct it: We can also represent $\mathbb Z_2^2 $ as $\operatorname{GF}(2^2)$. It is the second-degree extension of $\operatorname{GF}(2)$ by the roots of the polynomial $x^2 + x + 1$. Let $\alpha$ is one root then the second root is $\beta  = 1 + \alpha$.

By using $1 + 1 = 0$ and $\alpha^2 = \alpha + 1$ we can build the addition and multiplication tables.

Addition:
$$
\begin{array}{c|cccc}
+  &amp; 0&amp;   1&amp;   \alpha &amp;  \beta  \\
\hline
    0&amp;   0 &amp;  1 &amp;  \alpha &amp;  \beta \\ 
1 &amp;  1 &amp;  0 &amp;  \beta &amp;  \alpha  \\
\alpha &amp;  \alpha &amp;  \beta &amp;  0 &amp;  1  \\
\beta &amp;  \beta &amp;  \alpha &amp;  1 &amp;  0  \end{array}
$$

Multiplication:
$$\begin{array}{c|cccc}
\cdot &amp;   0 &amp;  1 &amp;  \alpha &amp;  \beta  \\
\hline
0 &amp;  0 &amp;  0 &amp;  0 &amp;  0  \\
1 &amp;  0 &amp;  1 &amp;  \alpha &amp;  \beta  \\
\alpha &amp;  0 &amp;  \alpha &amp;  \beta &amp;  1  \\
\beta &amp;  0 &amp;  \beta &amp;  1 &amp;  \alpha  
  \end{array}$$