Folláth, János

Periodica Mathematica Hungarica

DEA University of Debrecen Electronic Archive

Construction of Pseudorandom Binary Sequencesusing Additive Characters over GF(2k)JA´NOS FOLLA´THFaculty of Computer Science, University of DebrecenAlve´gi u´t 15, H-5000 Szolnok, Hungary, E-mail: follathj@inf.unideb.huIn a series of papers Mauduit and Sa´rko¨zy (partly with coauthors) studied finite pseudorandombinary sequences and they constructed sequences with strong pseudorandom properties. In theseconstructions fields with prime order were used. In this paper a new construction is presented,which is based on finite fields of order 2k.Categories and Subject Descriptors: E.3 [Data]: Data Encryption; G.2.0 [Mathematics ofComputing]: Discrete Mathematics—General; G.3 [Mathematics of Computing]: Probabil-ity and StatisticsGeneral Terms: Security,DesignAdditional Key Words and Phrases: Binary sequence, Character sums, Normality measure, Pseu-dorandom1. INTRODUCTIONMauduit and Sa´rko¨zy studied pseudorandom binary sequences ofEN = {e1, . . . , eN} ∈ {−1,+1}Nand introduced the following measures of pseudorandomness of binary sequences[Mauduit and Sa´rko¨zy 1997]:Definition 1. The well-distribution measure of EN is defined asW (EN ) = maxa,b,t∣∣∣∣∣∣t−1∑j=0ea+jb∣∣∣∣∣∣ ,where the maximum is taken over all a, b, t with a, b, t ∈ N, 1 ≤ a+ b ≤ a+ tb ≤ N .Definition 2. The correlation measure of order k of EN is:Ck(EN ) = maxM,D∣∣∣∣∣M∑n=1en+d1en+d2 . . . en+dk∣∣∣∣∣ ,where the maximum is taken over all D = (d1, . . . , dk) (d1 < . . . < dk are non-negative integers) and M ∈ N with M + dk ≤ N .Definition 3. Combined (well-distribution-correlation) PR-measure of order kEN is defined as:Qk(EN ) = maxa,b,t,D|Z(a, b, t,D)|Mathematics subject classification number: 68P25, 11T23.2 · Ja´nos Folla´thwhereZ(a, b, t,D) =∣∣∣∣∣∣t∑j=0ea+jb+d1ea+jb+d2 . . . ea+jb+dk∣∣∣∣∣∣ . (1.1)Definition 4. Combined PR-measure of EN :Q(EN ) = maxk≤logNQk(EN ).A pseudo-random sequence is considered good if both W (EN ) and Ck(EN ) (atleast for small k) are small in terms of N : both of them are o(N) as N →∞. LaterCassaigne, Mauduit and Sa´rko¨zy [Cassaigne et al. 2002] showed that this terminol-ogy is justified since for almost all EN ∈ {−1,+1}N , both W (EN ) and Ck(EN )are less than N1/2(logN)c. Moreover, in [Mauduit and Sa´rko¨zy 1997] was shownthat{(np)}, 0 < n < p, where(np)is the Legendre symbol, forms a good pseu-dorandom sequence. Later in [Goubin et al. 2004] and [Gyarmati et al. 2005] thisconstruction was extended to a large family of good pseudorandom sequences. Thelater construction and its pseudorandom measures are described in the followingtheorem (proved in [Gyarmati et al. 2005]):Theorem 1. Let p be an odd prime, λ ∈ F∗p be of multiplicative order T andf(x) ∈ Fp[x] be of degree k and not of the form cxα(g(x))2 with c ∈ Fp, α ∈N, g(x) ∈ Fp[x]. Define the sequence ET = {e1, . . . , eT } byen ={ (f(λn)p)if p ∤ f(λn),1 if p | f(λn).Then we haveW (ET ) < 5kp1/2 log pMoreover, assume that also l ∈ N, T is a prime, and either min{(4k)l, (4l)k} ≤ Tor 2 is a primitive root modulo T . Then we also haveCl(ET ) ≤ 5klp1/2 log p.There were further good sequences constructed in [Sa´rko¨zy 2001]. These se-quences are based on the notion of index and multiplicative characters play a cru-cial role in the proofs. Many other sequences were studied, but the upper boundsobtained for W (EN ) and Cl(EN ) were much weaker, than for the constructionsmentioned. One of these weaker constructions is still of particular interest: in[Mauduit et al. 2004] in the proof the properties of additive characters were uti-lized.The construction and its properties are summarized in the following theorem:Theorem 2. Let p an odd prime, f(x) ∈ Fp[x] of degree d, and define Ep ={e1, . . . , ep} byen ={+1 if 0 ≤ rp(f(n)) < p/2,−1 if p/2 ≤ rp(f(n)) < pPseudorandom Binary Sequences · 3where rp(n) denotes the unique r ∈ {0, . . . , p − 1} such that n ≡ r (mod p). Thenwe haveW (Ep)≪ dp1/2(log p)2.For 2 ≤ l ≤ d− 1 we also haveCl(Ep)≪ dp1/2(log p)l+1.All the above mentioned constructions are using prime fields of odd character-istic. It is natural idea to try to give further good sequences by using fields withcharacteristic 2. The application of fields of characteristic 2 enables one to useadditive characters in a more direct way than in Theorem 2.The generator presented in [Goubin et al. 2004] not only has good pseudorandommeasures, but also possesses the strict avalanche property [To´th 2007]. There areresults about its family complexity [Ahlswede et al. 2003], the computational com-plexity of the best known attacks and an extremly fast implementation [Hoffsteinand Lieman 2001]. Furthermore the bound on its higher order correlation measureenables one to estimate its linear complexity profile [Brandsta¨tter and Winterhof2006]. Although its security cannot be proven by reduction, the above enumeratedarguments make the generator a good candidate for cryptographic use. The mainresult of this paper and the first step in a search for pseudorandom sequence fami-lies of similar good quality as the above mentioned construction is to consider thepseudorandom measures of binary sequences based on additive characters over Fq.2. THE PSEUDORANDOMNESS OF THE TRACEIn this paper a new pseudorandom sequence generator is proposed, whose pseudo-random measures are better than of the top quality constructions (like in Theorem1).Theorem 3. Let Fq be a finite field of characteristic two and its multiplicativegroup of prime order. Let χ be a non principal additive character, and α a primitiveelement of Fq and let f(x) ∈ Fq[x] of odd degree d and let I be the set of exponentsin the terms with nonzero coefficient in f(x). For the minimal polynomial of αiover F2 write mi(x). LetEq−1 = {χ(f(α1)), χ(f(α2)), . . . , χ(f(αq−1))} ∈ {−1,+1}q−1,Let D′ ⊆ {1, . . . , q−1} such that∏i∈I mi(x) does not divide the polynomial d(x) =∑di∈D′xdi ,thenmaxa,b,t,D′|Z(a, b, t,D′)| ≤ 9dq1/2 log q. (2.1)Let D ⊆ {1, . . . , q−1} such that∏i∈I mi(x) divides the polynomial d(x) =∑di∈Dxdi ,thenmaxa,b,t,D|Z(a, b, t,D)| = maxD(q − 1− maxdi∈Ddi). (2.2)Remark 1. In the D = {1, . . . , k} case, with |I| > k the divisibility property ofthe first part and (2.1) hold.4 · Ja´nos Folla´thTheorem 4. Let Fq be a finite field of characteristic two and its multiplicativegroup of prime order. Let χ be a non principal additive character, and α a primitiveelement of Fq and let f(x) ∈ Fq[x] of odd degree d ≥ log q and let the coefficientsof its terms be zero if and only if the term has an even exponent. IfEq−1 = {χ(f(α1)), χ(f(α2)), . . . , χ(f(αq−1))} ∈ {−1,+1}q−1,then :Q(EN ) ≤ 9dq1/2 log q. (2.3)Corollary 1. Obviously we have:W (EN ) ≤ 9dq1/2 log qfurthermore for l ≤ d+ 1Cl(EN ) ≤ 9dq1/2 log q.3. CHARACTER SUMSTo give an upper bound for incomplete character sums we will use the followinginequality:Lemma 1. If m ∈ N, the function g(x) : Z → C is periodic with period m, andX, Y are real numbers with Y > 0 then∣∣∣∣ ∑X<n≤X+Yg(n)∣∣∣∣ ≤ Y + 1m∣∣∣∣m∑n=1g(n)∣∣∣∣+ ∑1≤|h|≤m/2|h|−1∣∣∣∣m∑n=1g(n)e(hnm)∣∣∣∣.Proof. This is implicit in [Vinogradov 2003], and it is presented in this explicitform in [Tieta¨va¨inen 1988] and [Friedlander and Iwaniec 1993] and it is also relatedto the Erdo˝s-Tura´n inequality.To complete the proof we will also have to give an upper bound for the followingcharacter sum:Lemma 2. Let χ be a non-principal additive character and α a primitive elementof Fq. Let h ∈ Z, h 6≡ 0 mod (q − 1) and let f(x) ∈ Fq[x] with its degree d beingodd. Then ∣∣∣∣q−1∑n=1χ(f(αn))e(hnq − 1)∣∣∣∣ ≤ dq1/2.Proof. This is an immediate consequence of Theorem 2G in [Schmidt 1976].Lemma 3. Suppose that χ is a non-principal additive character and α a primitiveelement in Fq, furthermore let f(x) ∈ Fq[x] be of odd degree d. Let X, Y be realnumbers with 0 ≤ X < X + Y ≤ q − 1. Then∣∣∣∣ ∑X<n≤X+Yχ(f(αn))∣∣∣∣ < 9dq1/2 log q.Pseudorandom Binary Sequences · 5Proof. Applying Lemma 1 with m = q − 1 and g(x) = χ(f(αx)):∣∣∣∣ ∑X<n≤X+Yχ(f(αn))∣∣∣∣ ≤ Y + 1q − 1∣∣∣∣q−1∑n=1χ(f(αn))∣∣∣∣+∑1≤|h|≤ q−12|h|−1∣∣∣∣q−1∑n=1χ(f(αn))e(hnq − 1)∣∣∣∣.By applying Lemma 2 and Weil’s theorem (Theorem 5.38 in [Lidl and Niederreiter1997]) we obtain:∣∣∣∣ ∑X<n≤X+Yχ(f(αn))∣∣∣∣ < 2dq1/2 + 2 ∑1≤h≤ q−12|h|−1dq1/2< 2dq1/2(1 + (1 + log(q − 12))) < 2dq1/2(2 + log q)≤ 2dq1/2(log qlog 2+ log q)< 9dq1/2 log qand this completes the proof.4. PROOF OF THEOREM 3Let Z(a, b, t,D) defined by (1.1), for k < q − 1 we have|Z(a, b, t,D)| =∣∣∣∣t∑n=0χ(f(αa+nb+d1))χ(f(αa+nb+d2)) . . . χ(f(αa+nb+dk))∣∣∣∣for all a, b, t,D = (d1, . . . , dk) such thata+ nb+ dl ∈ {1, . . . , q − 1} for n = 0, 1, . . . , t and l = 1, . . . , k. (4.1)Suppose that f(x) =∑di=0 aixi. Write aij = aiαi(a+dj) and fj(x) =∑di=0 aijxi.Then|Z(a, b, t,D)| =∣∣∣∣t∑n=0χ(f1(αnb))χ(f2(αnb)) . . . χ(fk(αnb))∣∣∣∣ =∣∣∣∣t∑n=0χ(f˜(αnb))∣∣∣∣where f˜(x) =∑di=0 a′ixi, a′i =∑kj=0 aij =∑kj=0 ai(αi)a+dj . Let d˜(x) = xad(x) =∑kj=0 xa+dj now a′i = aid˜(αi). d˜(x) can be treated as a polynomial over F2 andso follows, that d˜(αi) is zero if and only if the minimal polynomial mi(x) of αidivides d˜(x). Since mi(x) 6= x and is irreducible it divides d˜(x) if and only if italso divides d(x) =∑kj=0 xdj . Consequently f˜(x) is zero polynomial if and only if∏i:ai 6=0mi(x) divides d(x). In this case we obtain|Z(a, b, t,D)| =∣∣∣∣t∑n=0χ(f˜(αnb))∣∣∣∣ = tand since (4.1) t ≤ q − 1−max1≤l≤k dl this proves (2.2).6 · Ja´nos Folla´thIf∏i:ai 6=0mi(x) does not divide d(x), then with the notation β = αb we obtain:|Z(a, b, t,D)| =∣∣∣∣t∑n=0χ(f˜(βn))∣∣∣∣.Since F∗q is of prime order, β is a primitive element of Fq if and only if b 6= q − 1.If b = q − 1 then b = 1, a = d1 = 0, thus |Z(a, b, t,D)| = |χ(f(αa+nb+d1))| = 1 andthe theorem is proved. Otherwise we can apply Lemma 3, which implies|Z(a, b, t,D)| =∣∣∣∣t∑n=0χ(f˜(βn))∣∣∣∣ ≤ 9dq1/2 log qand this proves (2.1) and completes the proof of Theorem 3.5. PROOF OF THEOREM 4Put g(x) = l.c.m.{m1(x),m3(x), . . . ,md(x)}. Then g(x) is a generator polynomialof a BCH code C over Fq. Then by the BCH bound (Theorem 8 on page 201 in[MacWilliams and Sloane 1977]) the minimum distance of C is at least d+ 1. LetM(x) =∏ d−12i=0 m2i+1(x). Since g(x)|M(x), M(x) divides d(x) ∈ F2[x] only if d(x)is a codeword. It follows that M(x) can only divide polynomials whose weight isgreater than d. Now applying Theorem 3 completes the proof.Remark 2. The proof can be applied with a slightly modified constrains onf(x) =∑di=0 aixi. If there is an integer a such that for each j = a, . . . , a+log q− 1exists a αcj conjugate of αj such that acj 6= 0 then (2.3) continues to hold.6. PARAMETER SELECTIONThe selection of the field is very restricted by Theorem 3: q−1 must be a Mersenne-prime. This means only a few candidates to a practical application: we knowpresently 44 Mersenne primes ([Me ]). Therefore by this pseudorandom generatorconstruction one should take a fixed field, best fitting to the application, and definethe sequence family by the other parameters. There are three basic approaches toaccomplish this:(1) Variable χ with fixed α and f(x)(2) Variable α with fixed χ and f(x)(3) Variable f(x) with fixed α and χIn the first two cases presently one should use field size corresponding to the 12thMersenne prime (k = 127) or greater (k = 521 and k = 607 are the other tworeasonable candidates) to resist brute force attacks. The third case offers muchmore versatility and a possibility to study the properties of the pseudorandomsequence family with more sophisticated methods. This question will be consideredin a subsequent paper.7. CONCLUSIONSThese sequences can be computed fast: using normal basis representation andthe algorithm described in [Reyhani-Masoleh and Hasan 2003] this constructionPseudorandom Binary Sequences · 7is asymptotically faster than the previous constructions mentioned in the Intro-duction. Although the pseudorandom measures of the generator are even betterthan of the previous top quality generators, it has the same drawback as the otheradditive character based generator ([Mauduit et al. 2004]). This means that thecorrelations of large order can be large (remind that even by the other constructionsmentioned, the upper bound to the correlation measure becomes trivial above orderq1/2c log q ). This generator is a reasonable option for situations where computation timeis more important than the control over the large order correlations.REFERENCESMersenne primes: History, theorems and lists. http://primes.utm.edu/mersenne/.Ahlswede, R., Khachatrian, L., Mauduit, C., and Sa´rko¨zy, A. 2003. A complexity measurefor families of binary sequences. Period. Math. Hungar. 46, 2 (June), 107–118.Brandsta¨tter, N. and Winterhof, A. 2006. Linear complexity profile of binary sequences withsmall correlation measure. Period. Math. Hungar. 52, 2 (June), 1–8.Cassaigne, J., Mauduit, C., and Sa´rko¨zy, A. 2002. On finite pseudorandom binary sequencesVII: The measures of pseudorandomness. Acta Arith. 103, 2, 97–118.Friedlander, J. and Iwaniec, H. 1993. Estimates for character sums. Proc. Amer. Math.Soc. 119, 365–372.Goubin, L.,Mauduit, C., and Sa´rko¨zy, A. 2004. Construction of large families of pseudorandombinary sequences. Journal of Number Theory 106, 1, 56–69.Gyarmati, K., Sa´rko¨zy, A., and Petho˝, A. 2005. On linear recursion and pseudorandomness.Acta Arith. 118, 4, 359–374.Hoffstein, J. and Lieman, D. 2001. Cryptography and Computational Number Theory. Progressin Computer Science and Applied Logic, vol. 20. Birkha¨user Verlag, Chapter The Distributionof the Quadratic Symbol in Function Fields and a Faster Mathematical Stream Cipher, 59–68.Lidl, R. and Niederreiter, H. 1997. Finite Fields. Encyclopedia of Mathematics, vol. 20.Cambridge University Press.MacWilliams, F. J. C. and Sloane, N. J. A. 1977. The Theory of Error-Correcting Codes.North-Holland Mathematical Library, vol. 16. North-Holland Publishing Company.Mauduit, C., Rivat, J., and Sa´rko¨zy, A. 2004. Construction of pseudorandom binary sequencesusing additive characters. Monatsh. Math. 141, 3, 197–208.Mauduit, C. and Sa´rko¨zy, A. 1997. On finite pseudorandom binary sequences I: Measure ofpseudorandomness, the Legendre symbol. Acta Arith. 82, 4, 365–377.Reyhani-Masoleh, A. and Hasan, A. 2003. Fast normal basis multiplication general purposeprocessors. IEE transactions on computers 52, 11, 1379–1390.Sa´rko¨zy, A. 2001. A finite pseudorandom binary sequence. Studia Sci. Math. Hungar. 38,377–384.Schmidt, W. 1976. Equations over Finite Fields. An Elementary Approach. Lecture Notes inMathematics, vol. 536. Springer-Verlag.Tieta¨va¨inen. 1988. Algebra, some current trends. Lecture Notes in Math., vol. 1352. SpringerVerlag, New York, Chapter Incomplete sums and two applications of Deligne’s result, 190–205.To´th, V. 2007. Collision and avalanche effect in families of pseudorandom binary sequences.Period. Math. Hungar. 55, 2 (November), 185–196.Vinogradov, I. M. 2003. Elements of Number Theory. Dover Publications.

Construction of pseudorandom binary sequences using additive characters over GF(2k)

https://dea.lib.unideb.hu/dea/bitstream/handle/2437/96049/postfile_up_traceprng.pdf?sequence=1&isAllowed=y

Construction of pseudorandom binary sequences using additive characters over GF(2k)

Abstract

Similar works

Full text

Available Versions

DEA University of Debrecen Electronic Archive