Folláth, János

Periodica Mathematica Hungarica

DEA University of Debrecen Electronic Archive

Construction of Pseudorandom Binary Sequencesusing Additive Characters over GF(2k) II.JA´NOS FOLLA´TH 1University of Debrecen - Department of Informatics4032 Debrecen, Egyetem te´r 1.e-mail: follath.janos@inf.unideb.huIn a series of papers Mauduit and Sa´rko¨zy introduced measures of pseudorandomness and theyconstructed large families of sequences with strong pseudorandom properties. In later papers thestructure of families of binary sequences was also studied. In these constructions fields with primeorder were used. Throughout this paper the structure of a family of binary sequences based onGF(2k) will be studied.Categories and Subject Descriptors: E.3 [Data]: Data Encryption; G.2.0 [Mathematics ofComputing]: Discrete Mathematics—General; G.3 [Mathematics of Computing]: Probabil-ity and StatisticsGeneral Terms: Security,DesignAdditional Key Words and Phrases: Binary sequence, Character sums, Normality measure, Pseu-dorandom1. INTRODUCTIONGoubin, Mauduit and Sa´rko¨zy presented a new, large family of pseudorandom bi-nary sequences based on the Legende-symbol [Goubin et al. 2004]. This constructionwas an extension of the sequence studied in [Mauduit and Sa´rko¨zy 1997]. Althoughits security cannot be proved by reduction, many mathematical arguments substan-tiate it: it possesses the strict avalanche property [To´th 2007], has a high familycomplexity [Ahlswede et al. 2003] and a subfamily having small f -correlation wasalso found [Gyarmati 2009], the computational complexity of the best known at-tacks is high and it has an extremly fast implementation [Hoffstein and Lieman2001] and the bound on its correlation measure enables one to estimate its linearcomplexity profile [Brandsta¨tter and Winterhof 2006][Andics 2005]. Accordinglythis generator has mathematically substantiated security and still is faster thanmost provable secure pseudorandom sequence generators.The above mentioned construction is based on a multiplicative character overprime fields. In [Folla´th ] a similar construction based on additive characters overfields of characteristic 2 was presented and its pseudorandom measures were stud-ied. Throughout this paper the avalanche property, family complexity and linearcomplexity of this generator will be studied.Let us define the Eq−1 sequence as follows:1The research was partially supported by the TARIPAR3 project (grant Nr. TECH 08-A2/2-2008-0086), the hungarian-slovakian project SK-8/2008 and the hungarian-croatian project HR-6/2008Mathematics subject classification number: 68P25, 11T23.2 · Ja´nos Folla´thDefinition 1. Let Fq be a finite field of characteristic 2 and its multiplicativegroup of prime order. Let χ be a non principal additive character, and α a primitiveelement of Fq and let f(x) ∈ Fq[x] of odd degree d ≥ log q and let the coefficientsof its terms be zero if and only if the term has an even exponent. Then let (en) bethe trace sequence ([Folla´th ]) defined asEq−1 = {χ(f(α1)), χ(f(α2)), . . . , χ(f(αq−1))} ∈ {−1,+1}q−1, (1.1)In [To´th 2007] the notion of the avalanche property was adopted for pseudoran-dom binary sequences. In section 2 it will be proved that the generator in questionposesses the strong avalanche property. In [Ahlswede et al. 2003] the authors intro-duced a new measure for families of pseudorandom binary sequences. The notionof f-complexity is based on a practical attack scenario, where the sequence is usedas the keystream of a streamcipher. The main result of section 1 is that the f-complexity of the trace sequence is at least ⌊d+12 ⌋, where d is the degree of the seedpolynomial. In [Brandsta¨tter and Winterhof 2006] the authors gave a method toestimate the linear complexity profile of a pseudorandom binary sequence when itscorrelation measures are low. Since the correlation measures of larger order of atrace sequence can be high, this metod cannot be applied to it. In the rest of thispaper the linear complexity of the sequence is studied. It turns out, that it has alow linear complexity and consequently it is weak.In the followings assume that N ∈ N, S is a given set, to each s ∈ S a uniquebinary sequence is assignedEN = EN (s) = (e1, . . . , eN ) ∈ {−1, 1}N .Let F = F (S) denote the family of the binary sequences:F = F (S) = {EN (s) : s ∈ S}. (1.2)Definition 2. IfN ∈ N ,EN = (e1, . . . , eN ) ∈ {−1, 1}N andE′N = (e′1, . . . , e′N ) ∈{−1, 1}N , then the distance d(EN , E′N ) is defined byd(EN , E′N ) = |{n : 1 ≤ n ≤ N, en 6= e′n}|.Definition 3. A polynomial f(x) ∈ Fq[x] of the form f(x) =∑di=0 aix2i+1 is saidto be a comb polynomial.2. AVALANCHE PROPERTYDefinition 4. A family F (S) of binary sequences possesses the strict avalancheproperty ifm(F ) = mins,s′∈Ss 6= s′d(EN (s), EN (s′)) ≥(12+ o(1))N.Theorem 1. Let S be the set of comb polynomials f(x) ∈ Fq of degree at mostd. Define Eq−1 = Eq−1(f) = {e1, . . . , eq−1} by (1.1) and F = F (S) by (1.2). Thenif d = o(q1/2), the family F possesses the strong avalanche property.Proof. Let f1(x), f2(x) ∈ S distinct. Now f1(x)+ f2(x) is obviously of positivedegree, and therefore by the theorem of Weil (Theorem 5.38 in [Lidl and NiederreiterConstruction of Pseudorandom Binary Sequences · 31997]) we have:|q − 1− 2d(Eq−1(f1), Eq−1(f2))| =∣∣∣∣∣q−1∑i=1χ(f1(αi))χ(f2(αi))∣∣∣∣∣ ≤ (d− 1)q1/2.Now if q − 1− 2d(Eq−1(f1), Eq−1(f2)) ≥ 0 then:(12−(d− 1)q1/2q − 1)(q − 1) ≤ d(Eq−1(f1), Eq−1(f2)) ≤q − 12(2.1)holds. In the case q − 1− 2d(Eq−1(f1), Eq−1(f2)) < 0 the inequalityq − 12< d(Eq−1(f1), Eq−1(f2)) ≤(12−(d− 1)q1/2q − 1)(q − 1) (2.2)obviously follows.Now from (2.1) and (2.2)(12−(d− 1)q1/2q − 1)(q − 1) ≤ m(F ) ≤(12+(d− 1)q1/2q − 1)(q − 1)follows and this completes the proof.3. FAMILY COMPLEXITYDefinition 5. Let us define a specification of length j as an index-set (i1, . . . , ij)together with a corresponding value-set (εi1 , . . . , εij ) ∈ {+1,−1}j . We say that abinary sequence {e1, . . . , eN} satisfies the specification ifei1 = ε1, . . . , eij = εj .A specification will represent the knowledge of the adversary about the cleartext.Definition 6. The f-complexity Γ(F ) of a family F of binary sequences EN ∈{−1,+1}N is defined as the greatest integer j so that for any specification of lengthj there is at least one EN ∈ F which satisfies it.Lemma 1. The polynomial f ∈ Fq[x1, . . . , xn] is a permutation polynomial overFq if and only if ∑(c1,...,cn)∈Fnqχ(f(c1, . . . , cn)) = 0for all nontrivial additive characters χ of Fq.Proof. This is Corollary 7.38 in [Lidl and Niederreiter 1997].Lemma 2. Suppose f ∈ Fq[x1, . . . , xn] is of the formf(x1, . . . , xn) = g(x1, . . . , xm) + h(xm+1, . . . , xn), 1 ≤ m < n.If at least one of g and h is a permutation polynomial over Fq, then f is a permu-tation polynomial over Fq.Proof. This is a part of Theorem 7.42 in [Lidl and Niederreiter 1997].4 · Ja´nos Folla´thLemma 3. Suppose f ∈ Fq[x1, . . . , xn] is of the formf(x1, . . . , xn) =n∑i=0αix1.If at least one αi is nonzero, then f is a permutation polynomial over Fq.Proof. The statement follows from the fact, that g(x) = αx is a permutationpolynomial over Fq and Lemma 2 by induction.Theorem 2. Let us define the binary sequence family as in Theorem 1. If Ais a specification of t ≤ ⌊d+12 ⌋ terms and G(A) denotes the subset of the familyF = F (S) consisting the sequences satisfying A, then|G(A)| =|F |2tholds.Proof. Let A be a specification of t terms (ε1, . . . , εt) ∈ {+1,−1}t togetherwith an index set (i1, . . . , it) where 1 ≤ i1, < . . . < it ≤ q − 1. Then|G(A)| =∑E(f)∈Ft∏j=1(eij + εj)εj2=ε1 . . . εt2t∑E(f)∈Ft∏j=1(eij + εj)=ε1 . . . εt2t∑E(f)∈Ft−1∑r=0∑1≤j1<...<jr≤tεj1 . . . εjr∏1≤s≤ts 6∈{j1,...,jr}eis + ε1 . . . εt=|F |2t+ε1 . . . εt2t∑E(f)∈Ft−1∑r=0∑1≤j1<...<jr≤tεj1 . . . εjr∏1≤s≤ts 6∈{j1,...,jr}eis=|F |2t+12tt∑r=1∑1≤j1<...<jr≤tεj1 . . . εjr∑E(f)∈F∏1≤s≤ts∈{j1,...,jr}eis .where E(f) = (e1, . . . , eq−1). Thus|G(A)| −|F |2t=12tt∑u=1∑1≤v1<...<vu≤t∑E(f)∈Fu∏z=1eivz . (3.1)Consequently it suffices to show that∑E(f)∈Fu∏z=1eivz = 0. By (1.1) it follows, that:∑E(f)∈Fu∏z=1eivz =∑E(f)∈Fu∏z=1χ(f(αivz )) =∑E(f)∈Fχ(f(αiv1 ) + . . .+ f(αivz )) (3.2)Construction of Pseudorandom Binary Sequences · 5With the notation αi =∑uz=1 α(2i+1)ivz and since f(x) =∑di=0 aix2i+1:∑E(f)∈Fχ(f(αiv1 ) + . . .+ f(αivz )) =∑E(f)∈Fχ(d∑i=0aiu∑z=1α(2i+1)ivz )=∑E(f)∈Fχ(d∑i=0aiαi) =∑(a0,...,ad)∈Fdqai 6=0χ(d∑i=0aiαi)=∑(a0,...,ad)∈Fdqχ(d∑i=0aiαi)−d∑j=0∑ai∈Fqi6=jχ(∑0≤i≤di6=jaiαi)If f(x0, . . . , xd) =d∑i=0xiαi and each fj(x0, . . . , xd) =∑0≤i≤di6=jxiαi, 0 ≤ j ≤ d arenonzero polynomials, then by Lemma 3 they are permutation polynomials, so from(3.1), (3.2), (3.3) and Lemma 1|G(A)| =|F |2tfollows.If f or any fj is a zero polynomial, then k, l ∈ Z exist such that αi = 0 fori ∈ I = {k, . . . , k + l − 1} where l ≥ ⌊d+12 ⌋. And since αi =∑uz=1 α(2i+1)ivz , thismeans that βi = α2i+1 is a root of the polynomial g(x) =∑uz=1 xivz , g(x) ∈ F2[x]for every i ∈ I. Consequently, if mi(x) denotes the minimal polynomial of βiover F2, then each βi divides g(x). Since the minimal polynomials are irreducibleand because of the unique factorization, g(x) is a codeword in the BCH code Cgenerated by the product h(x) =∏k+li=k mi(x). Due to the BCH bound (Theorem8 on page 201 in [MacWilliams and Sloane 1977]) the minimal distance of C is atleast l+1. It follows that the weight of g(x) is at least ⌊d+12 ⌋+1. This contradictsthe assumption that the specification A has at most ⌊d+12 ⌋ terms.Corollary 1. The f-complexity of the family F is at least ⌊d+12 ⌋.4. LINEAR RECURRING SEQUENCESTo determine the linear complexity of our sequences we will need the followingresults:Lemma 4. Let s0, s1, . . . be a kth-order homogeneous linear recurring sequencein K = Fq whose characteristic polynomial f(x) is irreducible over K. Let α be aroot of f(x) in the extension field F = Fqk . Then there exists a uniquely determinedθ ∈ F such thatsn = TrF/K(θαn) for n = 0, 1, . . . .6 · Ja´nos Folla´thProof. This is Theorem 8.24. in [Lidl and Niederreiter 1997].Lemma 5. Let f(x) be a kth degree, irreducible polynomial over K = Fq, α oneof its roots in the extension field F = Fqk and θ an element in F . Then thereexists a uniquely determined s0, s1, . . . homogeneous linear recurring sequence overF which has f(x) as its characteristic polynomial andsn = TrF/K(θαn) for n = 0, 1, . . . .Proof. This follows from Lemma 4 and the fact that there are exactly qk el-ements in F as well as homogeneous linear recurring sequences over K with thecharacteristic polynomial f(x).Lemma 6. Let f(x) ∈ Fq[x] be monic and irreducible over Fq, and let s0, s1, . . .be a homogeneous linear recurring sequence in Fq not all of whose terms are 0. Ifthe sequence has f(x) as characteristic polynomial, then the minimal polynomial ofthe sequence is equal to f(x).Proof. This is Theorem 8.50. in [Lidl and Niederreiter 1997].Let us define the addition operation for sequences termwise.Lemma 7. For each i = 1, 2, . . . , h, let σi be a homogeneous linear recurring se-quence in Fq with minimal polynomialmi ∈ Fq. If the polynomialsm1(x), . . . ,mh(x)are pairwise relatively prime, then the minimal polynomial of the sum σ1 + . . .+σhis equal to the product m1(x) . . .mh(x).Proof. This is Theorem 8.57. in [Lidl and Niederreiter 1997].5. THE LINEAR COMPLEXITY OF THE TRACE-GENERATORDefinition 7. Let us define the following sequence for each Trace-sequence:en ={1, if χ(f(αn)) = −1,0, otherwise.(5.1)Remark 1. It is easy to see, that this sequence is exactlyen = Tr(f(αn)),where Tr(x) denotes the absolute trace function.Definition 8. The linear complexity (LC) of a sequence is the size in bits of theshortest linear feedback shift register (LFSR) which can produce that sequence.Theorem 3. The linear complexity of the binary sequence defined by (5.1) isk(d+1)2 .Proof. Let f(x) =∑li=0 θix2i+1 where l = d−12 . Then with the notation αi =α2i+1 we geten = TrF/K(f(αn)) =l∑i=0TrF/K(θiαn(2i+1)) =l∑i=0TrF/K(θiαni ).Construction of Pseudorandom Binary Sequences · 7For the minimal polynomial of αi over F2 write mi(x). By applying Lemma 1 weobtain:(en) = σ0 + . . .+ σl,where σi is a homogeneous linear recurring sequence in F2 with mi(x) as its char-acteristic polynomial. According to Lemma 6 the polynomial mi(x) is not only acharacteristic polynomial but the minimal polynomial of σi. Then by Lemma 7the sequence (en) itself is a homogeneous linear recurring sequence over F2 withminimal polynomial M(x) =∏li=0 mi(x). Since each of mi(x) is of degree k, thedegree of M(x) and the order of (en) = σ0 + . . .+ σl isk(d+1)2 .6. CONCLUDING REMARKSIt turns out that despite its fair statistical attributes the Trace-generator is a purelinear feedback shift register, and as such it is vulnerable to the Berlekamp-Masseyalgorithm. Furthermore if it is used with fixed primitive element, even the linearrecurrence is known to the adversary. Another consequence of this result is, thatthe other results proved for the trace sequences hold for this narrow class of linearfeedback shift registers too.In [Mauduit and Sa´rko¨zy 1997] measures of pseudorandomness were introduced.There was also mentioned that even the combined measure can be low, as symmetricsequences show, whose first part has low combined measure. The Trace-generator isa nontrivial example for highly predictable sequences with low combined measure.In [Mauduit and Sa´rko¨zy 1997] the authors proposed the following two optionsfor the combined pseudorandom measure:Q(EN ) = maxk≤(log N)/ log 2Qk(EN )Q∗(EN ) =∞∑k=1Qk(EN )/2kwhereQk(EN ) = maxa,b,t,D∣∣∣∣∣∣t∑j=0ea+jb+d1ea+jb+d2 . . . ea+jb+dk∣∣∣∣∣∣ .As we have proved, there exist binary sequences whose Q(EN ) combined measureis small, because their combined measures of small order are small, but some oftheir other pseudorandom properties are poor. Brandsta¨tter and Winterhof, resp.Andics studied the linear complexity profile in terms of the correlation measures(the results of Brandsta¨tter and Winterhof are nontrivial only if the correlationmeasures of large order are also small). These two arguments imply, that theQ∗(EN ) combined pseudorandom measure is more convenient candidate to be thesingle measurement number of pseudorandomness than the other option.REFERENCESAhlswede, R., Khachatrian, L., Mauduit, C., and Sa´rko¨zy, A. 2003. A complexity measurefor families of binary sequences. Period. Math. Hungar. 46, 2 (June), 107–118.8 · Ja´nos Folla´thAndics, A´. 2005. On the linear complexity of binary sequences. Ann. Univ. Sci. Budapest. Eo¨tvo¨sSect. Math. 48, 173–180.Brandsta¨tter, N. and Winterhof, A. 2006. Linear complexity profile of binary sequences withsmall correlation measure. Period. Math. Hungar. 52, 2 (June), 1–8.Folla´th, J. Construction of pseudorandom binary sequences I. Period. Math. Hungar. 57, 1,73–81.Goubin, L.,Mauduit, C., and Sa´rko¨zy, A. 2004. Construction of large families of pseudorandombinary sequences. Journal of Number Theory 106, 1, 56–69.Gyarmati, K. 2009. Concatenation of pseudorandom binary sequences. Period. Math. Hun-gar. 58, 1, 99–120.Hoffstein, J. and Lieman, D. 2001. Cryptography and Computational Number Theory. Progressin Computer Science and Applied Logic, vol. 20. Birkha¨user Verlag, Chapter The Distributionof the Quadratic Symbol in Function Fields and a Faster Mathematical Stream Cipher, 59–68.Lidl, R. and Niederreiter, H. 1997. Finite Fields. Encyclopedia of Mathematics, vol. 20.Cambridge University Press.MacWilliams, F. J. C. and Sloane, N. J. A. 1977. The Theory of Error-Correcting Codes.North-Holland Mathematical Library, vol. 16. North-Holland Publishing Company.Mauduit, C. and Sa´rko¨zy, A. 1997. On finite pseudorandom binary sequences I: Measure ofpseudorandomness, the Legendre symbol. Acta Arith. 82, 4, 365–377.To´th, V. 2007. Collision and avalanche effect in families of pseudorandom binary sequences.Period. Math. Hungar. 55, 2 (November), 185–196.

Construction of pseudorandom binary sequences using additive characters over GF(2k) II

https://dea.lib.unideb.hu/dea/bitstream/handle/2437/100144/file_up_traceanal.pdf?sequence=1&isAllowed=y

Construction of pseudorandom binary sequences using additive characters over GF(2k) II

Abstract

Similar works

Full text

Available Versions

DEA University of Debrecen Electronic Archive