On the Linear Complexity of Ding-Helleseth Generalized Cyclotomic Binary Sequences of Order Four and Six

Vol. 7, No. 3, 2014, 256-266

ISSN 1307-5543 – www.ejpam.com

On the Linear Complexity of Ding-Helleseth Generalized

Cyclotomic Binary Sequences of Order Four and Six

Vladimir Edemskiy

, Olga Antonova

Department of Applied Mathematics and Informatics, Novgorod State University, Veliky Novgorod, Russia

Abstract. We propose a new computation method for the linear complexity and the minimal polyno-mial of Helleseth-generalized cyclotomic sequences. We will find the linear complexity of Ding-Helleseth-generalized cyclotomic sequences of order four and six and make the results of Tongjiang Yan

et. al[19]about the sequences of order four more specific.

2010 Mathematics Subject Classifications: 11B50, 94A55, 94A60

Key Words and Phrases: Stream ciphers, Sequences, Generalized cyclotomy, Linear complexity, Mini-mal polynomial

1. Introduction

Pseudo-random sequences are widely used in many fields, in particular in stream ciphers [3]. The linear complexity of a sequences∞ is an important characteristic of its quality. It is defined to be the length of the shortest linear feedback shift register that can generate the sequence[14]. Sequences with high linear complexity (L(s∞)>N/2, whereN denotes the period of the sequence) are important for cryptographic applications.

Using classical cyclotomic classes and generalized cyclotomic classes to construct binary sequences, which are called classical cyclotomic sequences and generalized cyclotomic se-quences respectively, is an important method for sequence design[3]. As we all know, certain classical cyclotomic sequences, such as Legendre sequences and Hall sextic residue sequences, possess good linear complexity and autocorrelation properties (see [8, 11, 13, 16]). A gen-eralized cyclotomy with respect to pq was introduced by Whiteman[17]. New generalized cyclotomic sequences (D-GCS_2k, where 2kis the order) including classical as particular, were defined by Ding and Helleseth in[7]. They predicted that they may be applied in cryptography and coding[5, 6]. Further it was shown that such sequences might have poor autocorrelation properties. It makes them difficult to use in Engineering[2, 15].

∗_{Corresponding author.}

Email address:[email protected](V. Edemskiy)

The D-GCS2 with period pq (where p and q are distinct odd primes) have high linear

complexity[1, 4]. Later, the linear complexity of the D-GCS₄with periodpqwas calculated in [19]. However there are some technical errors in[19], (Lemma 4), which led to wrong results in some parts of the Theorem 2 in[19] and casting doubt on the method of this article (see appendix). Note that in [18] T. Yan mentions his previous work[19] has an error, but does not indicate exactly where it is and how to correct it.

The purpose of this paper is to propose a new computation method for the linear complexity and the minimal polynomial of Ding-Helleseth-generalized cyclotomic sequences. We show that computation of the linear complexity of generalized cyclotomic sequences with periodpq reduces to exploration of the classical cyclotomic sequences polynomial and obtain the linear complexity of Ding-Helleseth-generalized sequences of order four and six.

We retain notation used in[19]. Letpandqbe two odd primes with gcd(p₋1,q−1) =d. DefineN=pq,e= (p−1)(q−1)/d. The Chinese Remainder Theorem guarantees that there exists a common primitive root,g, of bothpandq, and the order of gmoduloNise. Let x be an integer satisfying x ≡ g(mod p), and x ≡1(modq). Thus, we can get a subgroup of the residue ring,Z_N, with its multiplication[17], as the following:

Z_N∗ ={gixj:i=0, 1, . . .e−1;j=0, 1, . . . ,d−1_}.

Ding-Helleseth generalized cyclotomic classes of orderdwith respect topandqare defined as

D_i ={gi+d txj:t=0, 1, . . .e/d−1;j=0, 1, . . . ,d−1},

wherei=0, 1, . . .d−1[7]. ThenZ_N∗ =Sd_i=−₀1D_i, D_i∩D_j =∅fori6= j, where∅denotes the

empty set.

By definition, put

D_i(p)={gd t+i:t =0, 1, . . .(p₋1)/d−1_},D_i(q)={gd t+i :t=0, 1, . . .(q₋1)/d−1_} andPi=pD(

q)

i ,Qi=qD

(p)

i , wherei=0, 1, . . .d−1.

Let C0 =

Sd/2−1

i=0 Di∪Pi∪Qi

∪ {0_}, C1 = Sd−1

i=d/2 Di∪Pi∪Qi

then Zpq =C0∪C1 and

C0∩C1=∅.

Ding-Helleseth-generalized cyclotomic sequence of orderd(D-GCS_d), with s∞={s0,s1, . . . ,si, . . .}is defined as

s_i=

¨

1, if imodN∈C1,

0, otherwise. .

Thens∞possesses the minimum periodpq, and the almost balance of the symbols 1sand 0s.

2. A Computation Method for Linear Complexity of Ding-Helleseth-Generalized

Cyclotomic Sequences with Period

pq

For a binary sequence,s∞, with period N, ifSN(x) =s0+s1x+. . .+sN−1xN−1, then its

L(s∞_{) =N−deg[gcd(x}N

−1,SN(x))]. (2)

Letαbe a primitiveN-th root of unity over the fieldG F(2m)that is the splitting field ofxN₋1. Then, by (2), we have

L(s∞_{) =N−} {j

S(αj) =0,j=0, 1, . . . ,N−1}

. (3)

whereS(x)is defined byS(x) = P

i∈C1

xi. So, the computation of the linear complexity and the minimal polynomial of the sequences∞turns into the computation of roots of its polynomial. Let β = αq and γ = αp, then β andγ are primitive p-th andq-th roots of unity in the extension of fieldG F(2). There exist integersa,b[12], such that

aq+bp=1. (4)

Then

α=βa_γb_{. (5)}

Letindg(q)c be discrete logarithm of c in the fieldG F(q)relative to the basis g. By definition

of the discrete logarithmp_≡gind(gq)p(_modq)_{, hence from (4) we have}

b≡g−ind(gq)p(modq)_{. (6)}

To explore the properties of the polynomialS(x), let us introduce auxiliary polynomials Sd(x) =

P

u∈D₀(p)

xu and Td(x) =

P

v∈D₀(q)

xv. Properties of polynomials Sd(x) and Td(x) are

ob-tained in[9, 10](see also[8, 13]). In particular from[9]we have

X

u∈D(_jp)

βu_=S d(βg

j ), X

v∈D(_iq)

γv_=T d(γg

i

) (7)

and

Sd(β) +Sd(βg) +. . .+Sd(βg

d−1

) =1,Td(γ) +Td(γg) +. . .+Td(γg

d−1

) =1. (8)

The following Lemmas 1 - 3 are needed to prove Theorem 1.

By definition, put D_j,i={gi+t dxj−i:t=0, 1, . . .e/d−1}, where j,i=0, 1, . . . ,d−1.

Lemma 1. Let the symbols be the same as before.

For i,j=0, 1, . . . ,d−1and k=1, 2, . . . ,pq−1we have

X

u∈Dj,i

αku_=S d(βak g

j

)Td(γbk g

i ).

Proof. By (5), definitions of Dj,i and x we have

P

u∈Dj,i

αku ₌ e/Pd−1

t=0

βak gj+d t γbk gi+d t

. By definition gcd(p₋1,q₋1) = d, then Z_e/d ∼₌ Z_{(p−1)/d ×}Z_(q−1)/d relatively to isomorphism ϕ(a) = (amod(p₋1)/d),amod(q₋1)/d) [12]. Hence P

u∈Dj,i

αku ₌ P

v∈D(_jp)

βakv P

w∈D_i(q)

γbkw_.

Lemma 2. Let the symbols be the same as before.

For i=0, 1, . . . ,d−1and k=1, 2, . . . ,pq−1we have

X

u∈Pi

αku_=T d(γk g

i ).

Proof. By definition ofP_i we have P

u∈Pi

αku₌ P

v∈D_i(q)

αkpv_{. Using (7) and definitionγ=α}p_,

we obtain P

v∈D_i(q)

αkpv_=T d(γk g

i

). Lemma 2 is proved.

Lemma 3 can be shown in a similar way. Lemma 3. Let the symbols be the same as before.

For j=0, 1, . . . ,d₋1and k=1, 2, . . . ,pq₋1we have

X

u∈Qj

αku_=S d(βk g

j ).

Now we can prove the basic theorem about the linkage of the linear complexity of Ding-Helleseth-generalized cyclotomic sequences with the values of the polynomials of the classical sequences.

Theorem 1. Let the symbols be the same as before. If k=1, 2, . . . ,pq−1, then

S(αk) =

d−1 X

i=d/2

T_d

γk gi−ind

(q) g p

δ+T_d(γk gi) +S_d(βk gi)

,

where

δ=

¨

1, if k6≡0(modp), 0, if k≡0(modp).. Proof. By definition of the sequences∞we have

S(αk) =

d−1 X

i=d/2 X

u∈Di

αku₊X u∈Pi

αku₊ X u∈Qi

αku

!

. (9)

We consider the first item of this sum. By definitionDi=

Sd−1

j=0 Dj,i, hence

P

u∈Di

αku₌dP−1

j=0 P

t∈Dj,i αkt

!

,

then by Lemma 1 we have P

u∈Di

αku₌dP−1

j=0

If k _6≡ 0(modp), then from (8) we obtain Pd_f−₌1₀S_d(βka gf) = 1. Yet, if k _≡ 0(modp), then

d−1 P

f=0

S_d(βka gf) = p−1 and p−1 ≡ 0(mod2). Thus, the first item of (9) is equal to δ dP−1

i=d/2

Td(γk b g

i ).

The sum of the second and the third items is

d−1 P

i=d/2 €

Td(γk g

i

) +Sd(βk g

iŠ

by Lemmas 2 and

3. Application of (6) concludes the proof of Theorem 1 .

To sum up, we can note, that by Theorem 1, the computation of the values of the sequence polynomialS(x)and, therefore, the computation of the linear complexity of the sequences∞ turns into the computation of the valuesS_d(x)andT_d(x)for cyclotomic classes members.

By Theorem 1, for fixed j andi, the values ofS(αk)are the same for allk_∈D_j,i; for fixed i, the values ofS(αk)are same for allk∈Pi; for fixedi, the values ofS(αk)are same for all

k∈Q_i. Then the matrixS= (s_{i j})of orderd+1 is well defined, wheres_ji =S(αk), ifk∈D_j,i

ands_{d j} =S(αk), ifk∈P_j ;s_id=S(αk), ifk∈Q_i;i,j=0, 1, . . . ,d−1,s_{d d} =S(1). Let us note that in order to compute the linear complexity of sequencess∞andm(x)it suffices to define the zero elements of the matrixS.

Additionally we note that Theorem 1 also allows to evaluate the linear complexity of the sequences∞as it was done in[18].

Later on, for the convenience of computations of the matrixSwe introduce the following notations:

S_d(x) =€Sd(x),Sd(xg), . . . ,Sd(xg

d−1

),Sd(1)

Š

, T_d(x) =€T_d(x),T_d(xg), . . . ,T_d(xgd−1),T_d(1)Š.

LetA_d(x) =

d−1 P

i=d/2

S_d(xgi_)andB d(x) =

d−1 P

i=d/2

T_d(xgi_).

Then immediately from Theorem 1 we obtain the following: Lemma 4. Let the symbols be the same as before. Then we have

S= 1 . . . 1 0T

B_d

γg−ind

(q) g p

+ 1 1 . . . 1T

B_d(γ) +AT_d(β) 1 . . . 1

, (10)

whereAT _{is a transposed matrixA.}

3. The Linear Complexity and the Minimal Polynomial of D-GCS

Ford =4 there is an expansion p= x2+4y2, where x,y are integers andx ≡1(mod4) [12]. In[9]the values of the polynomialS4(β) T4(γ)

are computed depending onx,y. Let€2_pŠ

4and

€₂

p

Š

2denote the symbols of the 4th residues and 2th residues ofprespectively.

The following Lemma 5 is needed to prove Theorem 2. Lemma 5. Let the symbols be the same as before.

(i) If€2_pŠ

4=1, thenA4(β) = (0, 0, 1, 1, 0)orA4(β) = (1, 1, 0, 0, 0).

(ii) If€2_pŠ

2 = 1and

€₂

p

Š

4 6= 1, thenA4(β) = (µ,µ+1,µ+1,µ, 0), where µmeets the rule

µ2_+µ+1=0.

(iii) If€2_pŠ

2 6=1, thenA4(β) = (η,η

2_,η4_,η8_{, 0)orA}

4(β) = (η,η8,η4,η2, 0), whereη meets

the conditionη4+η+1=0.

Proof. By definition A₄(β) = S₄(βg2) +S₄(βg3). Consequently, to prove Lemma 5 it is sufficient to give the values ofS₄(β)for each option.

(i) If€2_pŠ

4=1, then y ≡0(mod4)[12]. In this case, by[9]we haveS4(β) = (1, 1, 0, 1, 0)

forx ≡5(mod8)orS₄(β) = (1, 0, 0, 0, 0)forx≡1(mod8). (ii) If€2_pŠ

2=1 and €₂

p

Š

46=1, thenS4(β) = (µ, 0,µ+1, 0, 0)forx≡5(mod8)or

S₄(β) = (µ, 1,µ+1, 1, 0)forx≡1(mod8), whereµmeets the ruleµ2+µ+1=0[9]. (iii) If€2_pŠ

2 6=1, then S4(β) = (ζ,ζ

2_,ζ4_,ζ8_{, 1)or S}

4(β) = (ζ,ζ8,ζ4,ζ2, 1), whereζ meets

the conditionζ8+ζ4+ζ2+ζ+1=0. In this caseη=ζ4+ζ8 orη=ζ4+ζ2 [9]. After summing of we obtain the statement of Lemma 5 for all cases.

If€2_pŠ

4 =1 or

€₂

q

Š

4 =1, then by Lemmas 2, 3S(α

q₎

∈ {0, 1_},S(αp)_{∈ {}0, 1_}[9]. We can changeα and without loss of generality assume that S(αq) = S(αq g) = 0, if €2_pŠ

4 = 1 and

S(αp) =S(αp g) =0, if€2_qŠ

4=1.

LetDi(x) =

Q

i∈Di(x−α

i_),P i(x) =

Q

i∈Pi(x−α

i_)andQ i(x) =

Q

i∈Qi(x−α

i_{);i=0, 1, 2, 3.}

Theorem 2. Let the symbols be the same as before. (i) If€p_qŠ

2=1and

€₂

p

Š

4=1, then L(s

∞_{) =q(p+1)/2−1,}

m(x) = (xpq−1)/ (x−1)D₀(x)D₁(x)Q₀(x)Q₁(x). (ii) If€p_qŠ

26=1and

€₂

p

Š

4=1, then L(s

∞_{) =pq−(p+1)/2,}

(iii) If€2_qŠ

4=1, then L(s

∞_{) =pq−(q+1)/2, m(x) = (x}pq_{−1) (x−1)P}

0(x)P1(x)

.

(iv) If€2_pŠ

46=1and

€₂

q

Š

46=1, then L(s

∞_{) =pq−1, m(x) = (x}pq

Proof. We will employ Theorem 2 to determine the values of the matrixS. (i) By assumption gcd(p₋1,q−1) =4, consequently€2_qŠ

2 6=1 for €₂

p

Š

4=1[12]. In this

case by Lemma 6 we haveA₄(β) = (0, 0, 1, 1, 0)orA₄(β) = (1, 1, 0, 0, 0)and B4(γ) = (η,η2,η4,η8, 0)orB4(γ) = (η,η8,η4,η2, 0).

Now, if €p_qŠ

2 = 1, then ind

(q)

g p ≡ 0(mod4) or ind( q)

g p ≡ 2(mod4). In the first case

B_d

γg−ind(

q) g p

+B_d(γ) = (0, 0, 0, 0, 0, 0)and in the second case

B_d

γg−ind(

q) g p

+B_d(γ) = (1, 1, 1, 1, 0). Thus, by Lemma 5 we can deduce that the first two rows of the matrixSconsist of zeros, alsos44=0, and all other entries are non-zero.

Hence,

{j

S(αj) =0,j=0, 1, . . . ,N−1} =2

D_i

+2

Q_i

+1=q(p−1)/2+1

and by (3)L(s∞) =q(p+1)/2₋1. From (1) we have

m(x) = (xpq₋1)/ (x₋1)D₀(x)D₁(x)Q₀(x)Q₁(x) by the choice ofα.

(ii) In this case the expressions forA4(β)andB4(γ)are the same as in (1), but when €_p

q

Š

26=

1 we haveindg(q)p≡1(mod4)orind(gq)p≡3(mod4). Hence

B_d

γg−ind(

q) g p

+B_d(γ) = (b0,b1,b2,b3, 0)andbj6=0, bj6=1 for j =1, 2, 3, 4. Then by

Lemma 4 we haves04=s14=s44=0, and all other entries ofSare non-zero. Therefore,

{j

S(αj) =0,j=0, 1, . . . ,N−1} =2

Q_i

+1= (p+1)/2. From (1) and (3), it follows

that L(s∞) =pq−(p+1)/2 andm(x) = (xpq₋1)/ (x₋1)Q₀(x)Q₁(x). Statements of (iii) and (iv) can be proved in the same way.

From Theorem 2 we can obtain that if €2_pŠ

4 = 1, then the linear complexity of D-GCS4

depends on value €p_qŠ

2. For example, if p = 73,q = 5 or p = 73,q = 101, then 73

5

2 6= 1

and ₁₀₁73_{2 6}=1, hence L(s∞) = pq−(p+1)/2=328 or L(s∞) =7336, respectively. Yet, if p=89,q=5 orp=73,q=173, then 89₅₂=1 and ₁₇₃73₂=1 hence

L(s∞_{) = q(p+1)/2−1 = 224 or L(s}∞_{) = 6400 respectively. These facts can be easily}

obtained by means of calculation of the linear complexity of D-GCS₄ using, for example, the Berlekamp-Massey algorithm[14]. Thus, Theorem 2 from[19]is not true.

4. The Linear Complexity of D-GCS

Letd =6, the values of the polynomialS6(β) T6(γ)

Theorem 3. Let the symbols be the same as before. (i) If€2_pŠ

6=1and

€₂

q

Š

6=1, then L(s

∞_{) = (pq+1)/2−∆;}

(ii) If€2_pŠ

6=1;

€₂

q

Š

66=1and

€_p

q

Š

3=1or

€₂

p

Š

6=1;

€₂

q

Š

3=1and

€₂

q

Š

26=1;

€_p

q

Š

36=1, then

L(s∞_{) = (p+1)q/2−∆, where∆ =}

¨

1, if S(1) =0, 0, otherwise ; (iii) If€2_pŠ

6=1;

€₂

q

Š

36=1and

€_p

q

Š

36=1then L(s

∞_{) =pq−(p−1)/2−∆;}

(iv) If€2_qŠ

6=1and

€₂

p

Š

66=1then L(s

∞_{) =pq−(q−1)/2−∆;}

(v) If€2_pŠ

2=1;

€₂

p

Š

36=1;

€₂

q

Š

36=1and

€_p

q

Š

36=1, then L(s

∞_{) =pq−(p−1)(q−1)/6−∆;}

(vi) If conditions (i)-(v) are not true, then L(s∞_{) =pq−∆.}

Also we can obtain the minimal polynomial of DCS₆. Additionally we can note that for the case of (ii) the linear complexity of D-GCS₆ does not depend on the value€p_qŠ

3, but for the

minimal polynomial this is not the case.

Our examples p = 31,q = 127; p = 31,q = 19 or p = 31,q = 43; p = 31,q = 7; p=7,q=31; p=7,q=79; p=13,q=7 shows that all the cases of Theorem 3 are possible.

5. Conclusion

For additive stream ciphering, the linear span of the keystream sequence must be large enough. This paper shows that almost all Ding-Helleseth-generalized cyclotomic sequences of order four or six with periodpqhave high linear complexity and almost ideal balance property. Long periods can also be obtained easily.

References

[1] E. Bai, X. Liu, and G. Xiao. Linear complexity of new generalized cyclotomic sequences of order two of length pq. IEEE Transactions on Information Theory, 51:1849–1853, 2005. [2] Z. Chen and S. Li. Some Notes on Generalized Cyclotomic Sequences of Length pq.

Journal of Computer Science and Technology, 23(5):843–850, 2008.

[3] T. W. Cusick, C. Ding, and A. Renvall.Stream Ciphers and Number Theory.North-Holland Mathematical Library, North-Holland Publishing Co., Amsterdam, 1998.

[4] C. Ding. Linear complexity of generalized cyclotomic binary sequences of order 2. Finite Fields and Their Applications, 3(2):159–174, 1997.

[6] C. Ding. New generalized cyclotomy and its applications. Finite Fields and Their Appli-cations, 4(2):140–166, 1998.

[7] C. Ding and T. Helleseth. Generalized cyclotomic codes of lengthpe1

1 . . .p

et

t . IEEE

Trans-actions on Information Theory, 45(2):467–474, 1999.

[8] C. Ding, T. Helleseth, and W. Shan. On the linear complexity of Legendre sequences. IEEE Transactions on Information Theory, 44:1276–1278, 1998.

[9] V.A. Edemskii. On the linear complexity of binary sequences on the basis of biquadratic and sextic residue classes. Discrete Mathematics and Applications, 20(1):75–84, 2010. [10] V.A. Edemskiy. Linear complexity of ternary sequences formed on the basis of power

residue classes. Problems of Information Transmission., 44(4):287–294, 2008.

[11] M. Hall. A survey of difference sets. Proceedings of the American Mathematical Society, 7:975–986, 1056.

[12] K. Ireland and M. Rosen. A Classical introduction to modern number theory. Springer-Verlag, North-Holland Publishing Co., Amsterdam, 1982.

[13] J.H. Kim and H.Y. Song. On the linear complexity of halls sextic residue sequences. IEEE Transactions on Information Theory, 47(5):2094–2096, 2001.

[14] R. Lidl and H. Niederreiter. Finite Fields. Addison-Wesley Press, Massachusetts, 1983. [15] W. Meidl. Remarks on a cyclotomic sequence. Designs, Codes, and Cryptography,

51(1):33–44, 2009.

[16] W. Meidl and A. Winterhof. On the autocorrelation of cyclotomic generators. InLecture Notes in Computer Science., volume 2948. Springer, Berlin, 2004.

[17] A.L. Whiteman. A family of difference sets. Illinois Journal of Mathematics, 6:107–121, 1962.

[18] T Yan. Linear complexity of ding-helleseth generalized cyclotomic binary sequences of any order. eprint arXiv 1108.4450, 2011.

[19] T. Yan, L. Hong, and G. Xiao. The linear complexity of new generalized cyclotomic binary sequences of order four. Information Sciences, 178(3):2094–2096, 2008.

Appendix

Let as in[19]SQ_j(j+1)=P_i∈Q j

S

Qj+1α

i _andSP D j(j+1)=

P

i∈Pj S

Pj+1SDj S

Dj+1α

i _Then

S(α) =SQ₂₃+S₂₃P Dand the values ofS(αk)are given in Table 1[19]. In particular, authors argue thatS(αk_{) =S}Q

23+S23P D+1, ifk∈D2andk(mod p)∈D(

p)

By definition we have

S(αk) = X

i∈Q2

+X

i∈Q3

+X

i∈P2

+X

i∈P3

+X

i∈D2

+X

i∈D3

!

αki

or

S(αk) = X

j∈kQ2

+ X

j∈kQ3

+ X

j∈kP2

+ X

j∈kP3

+ X

j∈kD2

+ X

j∈kD3

!

αj_.

If k ∈ D2 andk(modp) ∈ D0(p), then by Lemma 2 [19] we have kQ2 =Q2; kQ3 = Q3;

kP2=P0;kP3=P1;kD2=D0;kD3=D1, henceS(αk) =S23Q +S01P D.

By Lemma 3[19]we note that P

i∈P0

S

P1

αi₌ P

i∈P2

S

P3

αi_{+1 and} P

i∈D0

S

D1

αi₌ P

i∈D2

S

D3 αi_+1,

thenS(αk) =S₂₃Q +S₂₃P D.

The other errors in the Table can be shown in the same way. It is easy to test for p=5, q=13.

The technical errors in Lemma 4 led to wrong results in Lemma 7. If 2_∈D1and

2(modp)∈D₀(p), then 4∈D2, 4(modp)∈D0(p)andS(α4) =S4(α) =S(α). In[19]