Using rational functions to generate pseudorandom number sequences is a popular research topic. In this paper, we study bounds on additive character sums of a new explicit generator based on rational functions with small p-weight degree. This extends the class of functions where a nontrivial character sum bound is known

Díaz Cardell, Sara

Gutiérrez Gutiérrez, Jaime

Gómez Pérez, Domingo

Finite Fields and Their Applications

English

UCrea

GENERALIZED EXPLICIT INVERSIVE GENERATORS OFSMALL p -WEIGHT DEGREESARA D. CARDELL, DOMINGO GOMEZ, AND JAIME GUTIERREZAbstract. Using rational functions to generate pseudorandom number se-quences is a popular research topic. In this paper, we study bounds on additivecharacter sums of a new explicit generator based on rational functions withsmall p weight degree. This extends the class of functions where a nontrivialcharacter sum bound is known.1. IntroductionLet p be a prime, n an integer with n   2, q = pn and denote by Fqthe finitefield of q = pn elements. Let { 1, . . . ,  n} be an ordered basis of Fq over Fp. Forany 0  i  q   1 we define the sequence (⇠i) by(1) ⇠i= i1 1 + · · ·+ in nwherei = i1 + i2p+ · · ·+ inpn 1, i1, . . . , in 2 {0, . . . , p  1}.This sequence is extended using the relation ⇠i= ⇠i mod q for any integer i, and itis called the additive order. For any function A(X) from Fqto Fq, we define the p-ary sequence (si) by(2) si= TrFq/Fp(A(⇠i)), i = 0, 1, 2 . . .where TrFq/Fp(A(⇠i)) is the trace of A(⇠i) 2 Fq over Fp. (si) is called a sequencegenerated by TrFq/Fp(A(X)) via the additive order and the pseudorandom numbergenerator. (A(⇠i)).The additive order is related with the Counter (CTR) mode encryption of blockciphers, see [8]. The additive order is di↵erent from the conventional order insequence design, and the randomness properties of the sequences from this orderare hard to determine. On the other hand, not any A(X) generates a sequence (si)with good pseudorandom properties, see [5].For A(X) defined for x 2 Fq,A(x) =((↵x+  ) 1 if ↵x+   6= 0,0 otherwise.(A(⇠i)) is the digital explicit inversive pseudorandom number generator of periodq for some ↵,   2 Fq, and ↵ 6= 0. In [11], Niederreiter and Winterhof introducedThe work of Sara D. Cardell was supported by a grant for research students from the GeneralitatValenciana with reference BFPI/2008/138 and by Spanish grant MTM2008-06674-C02-01.The work of J. Gutierrez is partially supported in part by the Spanish Ministry of Science,project MTM2011-24678 .1*ManuscriptClick here to view linked References2 SARA D. CARDELL, DOMINGO GOMEZ, AND JAIME GUTIERREZthis generator and studied exponential sums(3)q 1Xi=0   s 1Xj=0µjA(⇠i+ ⇠j) ,where s is a positive integer, (µ0, . . . , µs 1) 2 Fsq  (0, . . . , 0) and  is a non trivialadditive character of Fq. Chen in [1] provided a bound on character sums with twoarbitrary lags 0  d0 < d1 < q, i. e.q 1Xi=0  µ0A(⇠i+d0) + µ1A(⇠i+d1) , where µ0, µ1 2 Fq, and not both zeroand later this result was generalized in [2] for any number of lags. In the same arti-cle, the authors proved bounds on linear complexity profile and correlation measureof order k of binary sequences derived from this generator. For more results aboutthis class of generators see [12, 13, 14].In this paper, we obtain a bound on some additive character sums of sequencesgenerated by a class of functions A(X), which will be introduced in Section 2.The layout of the paper is the following. The first section is devoted to the pre-liminaries needed. The main theorem is presented in Section 3 where we prove abound for the discrepancy and the last part is left for conclusions.2. PreliminariesIt is clear that the properties of (si) are the translation of the properties of(A(⇠i)). One example is the Erdös-Turan-Koksma inequality, which relates thediscrepancy of a pseudorandom number sequence with character sums defined bythe pseudorandom number generator, see [4].For a non-negative integer m, we define its p -weight as the sum of the coe cientsin its p-adic expansion: p(m) = m1 + . . .+ml,where m = m1 +m2p+ . . .+mlpl 1,and 0  m1, . . . ,ml  p  1.Now, given a univariate polynomial f(X) 2 Fq[X], the p -weight degree of thepolynomial f(X), !p(f(X)), is equal to!p(f(X)) = max{ p(e1), . . . , p(er)},where f(X) =  1Xe1 + . . .+  rXer and all the coe cients are non-zero.Through the rest of the paper, the trace function TrFq/Fp will be of maximumimportance. The trace is defined by the following polynomial,TrFq/Fp(X) = X +Xp + . . .+Xpn 1.Additive characters of Fqare defined through TrFq/Fp and the additive charactersof Fpare described in the following way, ↵(x) = e2⇡iTrFq/Fp (↵x)/p,for many applications and properties of additive characters and the trace function,we recommend the reader to consult [7].For ↵ = 0, this character is called the trivial one and for ↵ = 1 the canonicalcharacter. For simplicity, we will denote this character by  1 =  .GENERALIZED EXPLICIT INVERSIVE GENERATORS OF SMALL p -WEIGHT DEGREE 3In [6], the authors studied the nonlinear recursive pseudorandom number gener-ators and proved a bound on character sums of the following form:X⇠2Fq ↵(f(⇠)), ↵ 6= 0where f(X) is a polynomial with low p -weight degree and satisfies(4) f(X) =  Xd + f(X), with   6= 0, !p(f(X)) <  p(d).We start generalizing this result for rational functions, for which a similar conditionas (4) is required for the numerator. We follow the strategy in [3, 6] and define thetraced and the normalized polynomial.Definition 1. Let f(X) 2 Fq[X], { 1, . . . ,  n} be an ordered basis of Fq over Fpand let F (X1, . . . , Xn) be the multivariate polynomialF (X1, . . . , Xn) = f(X1 1 + . . .+Xn n) mod (Xp1  X1, . . . , Xpn  Xn).We define the traced polynomial FR(X1, . . . , Xn) as the only polynomial such that:FR(X1, . . . , Xn) = TrFq/Fp(F (X1, . . . , Xn)) mod (Xp1  X1, . . . , Xpn  Xn).And, we define the normalized polynomial of f(X),FN(X1, . . . , Xn) =n 1Yi=0(F (X1, . . . , Xn))pimod (Xp1  X1, . . . , Xpn  Xn).Notice that the degree on each variable is less than p in both multivariatepolynomials FR(X1, . . . , Xn) and FN (X1, . . . , Xn). Also, it is easy to prove thatFN(X1, . . . , Xn) has coe cients over the prime field Fp. The following result showsthat its degree is n times the p -weight degree of f(X) if this number is strictlyless than p.Lemma 1. Let f(X) 2 Fq[X], then the following holds,• FR(X1, . . . , Xn) 2 Fp[X1, . . . , Xn] and the degree of the transformed poly-nomial is at most !p(f(X)),• FN(X1, . . . , Xn) 2 Fp[X1, . . . , Xn] and if n!p(f(X)) < p then the degree ofis n!p(f(X)).Proof. The first bullet of this lemma was proved in [6]. For the second part, westart noticing thatn 1Yi=0(F (X1, . . . , Xn))pi=nYi=1(F (X1, . . . , Xn))pimod (Xp1  X1, . . . , Xpn  Xn) =FN(X1, . . . , Xn)p mod (Xp1  X1, . . . , Xpn  Xn),which clearly implies that FN(X1, . . . , Xn) 2 Fp[X1, . . . , Xn]. The only thing thatremains is to calculate the degree of FN(X1, . . . , Xn). Clearly, if p > n!p(f(X)),then the degree off(X1 pi1 + · · ·+Xn pin) = F (X1, . . . , Xn)pimod (Xp1  X1, . . . , Xpn  Xn)is !p(f(X)) and the degree of FN(X1, . . . , Xn) is n!p(f(X)). ⇤4 SARA D. CARDELL, DOMINGO GOMEZ, AND JAIME GUTIERREZThe interest of the traced polynomial relies on the fact that, under certain as-sumptions, the total degree of the traced polynomial of a given one coincides withthe p -weight degree of the original polynomial f(X).We consider the following property of a positive integer D < q:(5) For all t | n with t < n, =) q   1pt   1 6 | D.This is equivalent to Fq= Fp(⇠D) for some ⇠ 2 Fq.We have introduced the necessary tools to prove bounds on the following char-acter sum,X⇠2Fq ↵✓f(⇠)g(⇠)◆, ↵ 6= 0with some restrictions on f(X), g(X) and for that we cite [6, Lemma 3], whichappeared in [3] and an additive character sum bound from [9].Lemma 2. Let f(X) 2 Fq[X] be of the form (4) with D = d < q satisfying (5).Then, the degree of the transformed polynomial FR(X1, . . . , Xn) is  p(d).Theorem 1. Let  pbe a nontrivial additive character of Fp, and let f(X)/g(X)be a rational function over Fpthat is not constant. Let v be the number of distinctroots of the polynomial g(X) in the algebraic closure of Fp, then      X⇠2Fp, g(⇠) 6=0 p✓f(⇠)g(⇠)◆       (max(deg(f), deg(g)) + v⇤   2) p1/2 +  ,where v⇤ = v and   = 1 if deg(f)  deg(g), otherwise v⇤ = v + 1 and   = 0.The following lemma is a technical result about the existence of a special trans-formation.Lemma 3. Let F (X1, . . . , Xn), G(X1, . . . , Xn) 2 Fp [X1, . . . , Xn] withdeg(F (X1, . . . , Xn)) = d < p/2 and deg(G(X1, . . . , Xn)) = d0 < p/2, there exista1, . . . , an 1 2 Fp such thatF (X1, X2 + a1X1, . . . , Xn + an 1X1) = ⇠Xd1 + F (X1, . . . , Xn),G(X1, X2 + a1X1, . . . , Xn + an 1X1) = ⇠0Xd01 +G(X1, . . . , Xn)where ⇠, ⇠0 6= 0 and the degree of F (X1, . . . , Xn) and G(X1, . . . , Xn) in X1 arestrictly smaller than d, d0respectively.Proof. We introduce the new variables Z1, . . . , Zn 1 and consider the followingpolynomials,F (X1, Z1X1 +X2, . . . , Zn 1X1 +Xn), G(X1, Z1X1 +X2, . . . , Zn 1X1 +Xn).Represented as a polynomial in the variable X1,F (X1, Z1X1 +X2, . . . , Zn 1X1 +Xn) =F1(Z1, . . . , Zn 1)Xd1 + F2(Z1, . . . , Zn 1, X1, . . . , Xn)GENERALIZED EXPLICIT INVERSIVE GENERATORS OF SMALL p -WEIGHT DEGREE 5where the degree of F1(Z1, . . . , Zn 1) is at most d and the degree in the variableX1 of F2 is strictly less than d. The same applies forG(X1, Z1X1 +X2, . . . , Zn 1X1 +Xn) =G1(Z1, . . . , Zn 1)Xd01 +G2(Z1, . . . , Zn 1, X1, . . . , Xn).Notice that the degree of the product G1(Z1, . . . , Zn 1)F1(Z1, . . . , Zn 1) is at mostd+ d0, strictly less than p. Therefore, there exists a1, . . . , an 1 2 Fp such that,G1(a1, . . . , an 1)F1(a1, . . . , an 1) 6= 0.In other words, F (X1, X2 + a1X1, . . . , Xn + an 1X1) has degree d in the variableX1. Notice also that the polynomial has total degree d, it means thatF (X1, X2 + a1X1, . . . , Xn + an 1X1) = ⇠Xd1 + F (X1, . . . , Xn),where the degree on X1 of F (X1, . . . , Xn) is strictly less than d. A similar argumentapplies to G(X1, X2 + a1X1, . . . , Xn + an 1X1) and this finishes the proof. ⇤We are ready to prove the following result.Lemma 4. Let  ↵be a nontrivial additive character of Fq, and f(X), g(X) 2 Fq[X]gcd(f(X), g(X)) = 1 with deg(f(X)), deg(g(X)) < q/2 and satisfying(6) f(X) = g(X)Xd + f(X), with !p(f(X)) <  p(d) + !p(g(X)),and d = D satisfying (5). Then,      X⇠2Fq ↵✓f(⇠)g(⇠)◆       (max( p(d),!p(g(X))) + n !p(g(X))  1) pn 1/2 + 1.Proof. Without loss of generality, we can suppose that(7) max( p(d),!p(g(X))) + n !p(g(X))  1  p1/2.The strategy to follow is to transform our initial sum in order to apply the resultin Theorem 1.We start from the definition of our sum and transform it to a sum in severalvariables,      X⇠2Fq ↵✓f(⇠)g(⇠)◆      =      Xx1,...,xn2Fp p✓TrFq/Fp✓↵F (x1, . . . , xn)G(x1, . . . , xn)◆◆      =      Xx1,...,xn2Fp p TrFq/Fp(↵F (x1, . . . , xn)G(x1, . . . , xn)p+p2+...+pn 1)GN(x1, . . . , xn)!      ,where  pis the canonical additive character of Fp.We transform this sum to the same type as the one that appears in Theorem 1for variable x1. Now, f(X) = g(X)Xd + f(X), soTrFq/Fp(↵F (X1, . . . , Xn)G(X1, . . . , Xn)p+p2+...+pn 1)GN(X1, . . . , Xn)=ER(X1, . . . , Xn) +TrFq/Fp(↵F (X1, . . . , Xn)G(X1, . . . , Xn)p+p2+...+pn 1)GN(X1, . . . , Xn),6 SARA D. CARDELL, DOMINGO GOMEZ, AND JAIME GUTIERREZwhere ER(X1, . . . , Xn) is the traced polynomial of ↵Xd. The traced polynomial isnot the zero polynomial, otherwiseER(X1, . . . , Xn)GN (X1, . . . , Xn) =  TrFq/Fp(↵F (X1, . . . , Xn)G(X1, . . . , Xn)p+p2+...+pn 1).By Lemma 2, the degree of ER(X1, . . . , Xn) is  p(d) and by Lemma 1 and Equa-tion (7), n!p(g(X)) +  p(d) is is strictly greater than the degree of the tracedpolynomial of ↵F (X1, . . . , Xn)G(X1, . . . , Xn)p+p2+...+pn 1. Let’s callFR(X1, . . . , Xn) = TrFq/Fp(↵F (X1, . . . , Xn)G(X1, . . . , Xn)p+p2+...+pn 1).Selecting a1, . . . , an 1 as in Lemma 3 and for x1, . . . , xn 2 Fp we have thatFR(x1, x2 + a1x1 . . . , xn + an 1x1) =⇠00x p(d)+n!p(g(X))1 + FR(x1, x2 + a1x1 . . . , xn + an 1x1),where ⇠00 6= 0, FRhas degree in variable X1 strictly less than  p(d) + n!p(g(X))andGN(x1, x2 + a1x1 . . . , xn + an 1x1) =⇠000xn !p(g(X))1 +GN (x1, x2 + a1x1 . . . , xn + an 1x1),where ⇠00 6= 0, GNhas degree in variable X1 strictly less than n !p(g(X)). Now,      Xx1,...,xn2Fp p TrFq/Fp(↵F (x1, . . . , xn)G(x1, . . . , xn)p+p2+...+pn 1)GN(x1, . . . , xn)!      =      Xx1,...,xn2Fp p✓FR(x1, . . . , xn)GN(x1, . . . , xn)◆      =      Xx1,...,xn2Fp p✓FR(x1, x2 + a1x1 . . . , xn + an 1x1)GN(x1, x2 + a1x1 . . . , xn + an 1x1)◆      Xx2,...,xn2Fp      Xx12Fp p✓FR(x1, x2 + a1x1 . . . , xn + an 1x1)GN(x1, x2 + a1x1 . . . , xn + an 1x1)◆      Applying Theorem 1 for all fixed selections of x2, . . . , xn, we have finished. ⇤3. Main ResultIn this Section, we give a bound on the following additive character sum,NXi=0 ↵(A(⇠i))where A(X) = f(X)/g(X), satisfying the conditions in Equation (6). Before prov-ing the main result, we recall the following result.GENERALIZED EXPLICIT INVERSIVE GENERATORS OF SMALL p -WEIGHT DEGREE 7Lemma 5. Suppose { 1, . . . ,  n} is a fixed basis of Fq over Fp and (⇠i) is thesequence defined in Equation (1), thenX 2Fq     NXi=0 ↵(  ⇠i)       n2q log p.The proof of this Lemma can be found in [1].Theorem 2. Suppose that A(X) = f(X)/g(X), satisfies the conditions in Equa-tion (6) with d satisfying (5) and  p(d)   2. The following bound     NXi=0 ↵(A(⇠i))       (n2 log p)(max( p(d),!p(g(X))) + n !p(g(X))  1)pn 1/2,holds for any 1  N  q.Proof. We start with the definition of the sum,     NXi=0 ↵(A(⇠i))      =      Xx2Fq ↵(A(x))0@1qNXi=0X 2Fq ↵( (x  ⇠i))1A      =1q      NXi=0X 2Fq ↵(  ⇠i)Xx2Fq ↵(A(x) +  x)       1qX 2Fq     NXi=0 ↵(  ⇠i)     ⇥max 2Fq      Xx2Fq ↵(A(x) +  x)      .Notice that A(X) +  X = f(X)0/g(X), wheref(X)0 = f(X) +  Xg(X) = g(X)Xd + f(X) +  Xg(X).still satisfies Equation (6). This is becausemax{!p(f(X)),!p( Xg(X))} < max{ p(d) + !p(g(X)), 2 + !p(g(X))}So, for the right term of the product, we can apply Lemma 4 and for the left termof the product, we can apply Lemma 5.Writing everything together, we have1qX 2Fq     NXi=0 ↵(  ⇠i)     ⇥max 2Fq      Xx2Fq ↵(A(x) +  x)      (n2 log p)(max( p(d),!p(g(X))) + n !p(g(X))  1)pn 1/2.This finishes the proof. ⇤Now, we estimate the discrepancy of the elements of the sequenceSi=sip2 [0, 1), i = 0, . . . , N.We recall that the discrepancy of the points S0, . . . , SN denoted by DN is definedbyDN= sup[↵, )⇢[0,1)    A([↵, ), N)N    + ↵    8 SARA D. CARDELL, DOMINGO GOMEZ, AND JAIME GUTIERREZwhere A([↵, ), N) is the number of points S0, . . . , SN which are contained in theinterval [↵, ) and the supremum is taken over all such intervals, see [10].Doing straightforward calculations (see the proof of Theorem 1 of [2]) and usingTheorem2, it is easy to prove the following theorem.Theorem 3. Let s0, . . . , sN the sequence defined by (2). The discrepancy DN canis of ordern4(log p)2(max( p(d),!p(g(X))))pn 1/2Nwhere the implied constant is absolute.4. ConclusionsIn this paper we have started the study of a new pseudorandom generator viaadditive order. We have given a non trivial bound on sequences of the type (2).Apart from that, Lemma 4 generalizes [6, Lemma 4], when g(X) = 1.It would be certainly interesting to study the following more general charactersumNXi=0 ↵(↵1A(⇠i+1) + . . .+ ↵⌧A(⇠i+⌧ )),where ↵1, . . . ,↵⌧ 2 Fq, not all equal to zero. However, in this case, it is necessary toshow that the transformed polynomial is not constant so one can apply Lemma 4.Also, the necessity of (5) for polynomials of the form (4) has been shown in [6].5. AcknowledgmentsFinally, the authors would like to thank Arne Winterhof for proposing the prob-lem and useful discussions.References[1] Zhixiong Chen. Finite binary sequences constructed by explicit inversive methods. FiniteFields Appl., 14(3):579–592, 2008.[2] Zhixiong Chen, Domingo Gomez, and Arne Winterhof. Distribution of explicit digital in-versive pseudorandom numbers and applications to some binary sequences. Accepted in pro-ceedings of The Eighth International Conference on Monte Carlo and Quasi-Monte CarloMethods in Scientific Computing, 2008.[3] Valérie Gillot. Bounds for exponential sums over finite fields. Finite Fields Appl., 1(4):421–436, 1995.[4] Peter Hellekalek. General discrepancy estimates: the walsh function system. Acta Aritmetica,67:209–218, 1994.[5] Honggang Hu and Guang Gong. A study on the pseudorandom properties of sequences gen-erated via the additive order. SETA 2008, Lecture Notes on Computer Science, 5203:51–59,2008.[6] Alvar Ibeas and Arne Winterhof. Exponential sums and linear complexity of nonlinear pse-duorandom number generators with polynomials of small p-degree. Unif. Distrib. Theory,5(1):79–93, 2010.[7] Rudolf Lidl and Harald Niederreiter. Finite fields, volume 20 of Encyclopedia of Mathematicsand its Applications. Cambridge University Press, Cambridge, second edition, 1997. With aforeword by P. M. Cohn.[8] Helger Lipmaa, Phillip Rogaway, and David Wagner. Comments to nist concerning aes modesof operation: Ctr-mode encryption. In Symmetric Key Block Cipher Modes of OperationWorkshop, 2000.[9] Carlos Moreno and Oscar Moreno. Exponential sums and goppa codes. Proceedings of theAmerican Mathematical Monthly, 111:523–531, 1991.GENERALIZED EXPLICIT INVERSIVE GENERATORS OF SMALL p -WEIGHT DEGREE 9[10] Harald Niederreiter. Random number generation and quasi-Monte Carlo methods, volume 63of CBMS-NSF Regional Conference Series in Applied Mathematics. Society for Industrialand Applied Mathematics (SIAM), Philadelphia, PA, 1992.[11] Harald Niederreiter and Arne Winterhof. Incomprete exponential sums over finite fields andtheir applications to new inversive pseudorandom number generatos. Acta Aritmetica, 93:387–399, 2000.[12] Harald Niederreiter and Arne Winterhof. On a new class of inversive pseudorandom numbersfor parallelized simulation methods. Periodica Mathematica Hungarica, 42(1–2):77–87, 2001.[13] Harald Niederreiter and Arne Winterhof. On the lattice structure of pseudorandom numbersgenerated over arbitrary finite fields. Appl. Algebra Eng. Commun. Comput., 12(3):265–272,2001.[14] Gottlieb Pirsic and ArneWinterhof. On the structure of digital explicit nonlinear and inversivepseudorandom number generators. J. Complexity, 26(1):43–50, 2010.Departamento de Estad́ıstica e Investigación Operativa. Universidad de Alicante.E-mail address: s.diaz@ua.esDepartamento de Estad́ıstica, Matemáticas y Computación. Universidad de Cantabria.E-mail address: domingo.gomez@unican.esDepartamento de Matemática Aplicada y Ciencias de la Computación. Estad́ıstica.Universidad de Cantabria.E-mail address: jaime.gutierrez@unican.es

Generalized explicit inversive generators of small p-weight degree

Abstract

Similar works

Full text

Available Versions

UCrea