Pseudorandom Numbers and Hash Functions from Iterations of Multivariate Polynomials

TL;DR

This paper explores the use of polynomial iterations with slow degree growth to generate pseudorandom vectors and hash functions, providing new theoretical bounds and constructions for their mixing properties.

Contribution

It introduces new methods and extends previous results to more general polynomial orbits, leading to novel hash functions with proven mixing properties.

Findings

Good estimates of exponential sums along polynomial orbits

Stronger bounds on discrepancy for pseudorandom vectors

Design of new hash functions with mixing properties

Abstract

Dynamical systems generated by iterations of multivariate polynomials with slow degree growth have proved to admit good estimates of exponential sums along their orbits which in turn lead to rather stronger bounds on the discrepancy for pseudorandom vectors generated by these iterations. Here we add new arguments to our original approach and also extend some of our recent constructions and results to more general orbits of polynomial iterations which may involve distinct polynomials as well. Using this construction we design a new class of hash functions from iterations of polynomials and use our estimates to motivate their "mixing" properties.

Equations

$$f_i^{(0)}=f_i,f_i^{(k)}=f_i^{(k-1)}(f_0,\dots ,f_m),k=1,2\dots ,$$

$$\begin{array}{rl}{F}_0(X_0,\dots ,X_m)& =X_0{G}_0(X_1,\dots ,X_m)+H_0(X_1,\dots ,X_m),\\ F_1(X_0,\dots ,X_m)& =X_1{G}_1(X_2,\dots ,X_m)+H_1(X_2,\dots ,X_m),\\ & \dots \\ F_{m-1}(X_0,\dots ,X_m)& =X_{m-1}{G}_{m-1}(X_m)+H_{m-1}(X_m),\\ F_m(X_0,\dots ,X_m)& =g_m{X}_m+h_m,\end{array}$$

$$g_m,h_m\in \mathbb{F},g_m\ne 0,G_i,H_i\in \mathbb{F}[X_{i+1},\dots ,X_m],i=0,\dots ,m-1.$$

$$G_i(X_{i+1},\dots ,X_m)=g_i{X}_{i+1}^{s_{i,i+1}}\dots X_m^{s_{i,m}}+\widetilde{G_i}(X_{i+1},\dots ,X_m),$$

$$g_i\in {\mathbb{F}}^{\ast },{\mathrm{deg}}_{X_j}\widetilde{G_i}<s_{i,j},{\mathrm{deg}}_{X_j}{H}_i\le s_{i,j},$$

$$S=\left(\begin{array}{ccccc}1& s_{0,1}& s_{0,2}& \dots & s_{0,m}\\ 0& 1& s_{1,2}& \dots & s_{1,m}\\ & & \dots & & \\ 0& 0& 0& \dots & 1\end{array}\right)$$

$${\mathcal{F}}_k=\{F_{k,0},\dots ,F_{k,m}\}\in \mathfrak{F}(S,m),k=1,2,\dots .$$

$$F_i^{(0)}=X_i,F_i^{(k)}=F_{k,i}(F_0^{(k-1)},\dots ,F_m^{(k-1)}),k=1,2,\dots .$$

$$F_i^{(k)}=X_i{\tilde{G}}_{k,i}(X_{i+1},\dots ,X_m)+{\tilde{H}}_{k,i}(X_{i+1},\dots ,X_m),$$

$$\mathrm{deg}{\tilde{G}}_{k,i}$$

$$\mathrm{deg}{\tilde{G}}_{k,m}$$

$$F_i^{(k)}=F_i^{(k-1)}{G}_{k,i}\left(F_{i+1}^{(k-1)},\dots ,F_m^{(k-1)}\right)+H_{k,i}\left(F_{i+1}^{(k-1)},\dots ,F_m^{(k-1)}\right).$$

$$F_i^{(k)}=X_i{\tilde{G}}_{k,i}(X_{i+1},\dots ,X_m)+{\tilde{H}}_{k,i}(X_{i+1},\dots ,X_m)$$

$$d_{k,i}=\mathrm{deg}(X_i{\tilde{G}}_{k,i})=1+\mathrm{deg}{\tilde{G}}_{k,i},i=0,\dots ,m,k=1,2\dots .$$

$$(d_{k,0},\dots ,d_{k,m}{)}^t=S^k(1,\dots ,1)$$

$$S=\left(\begin{array}{ccccc}1& s_{0,1}& s_{0,2}& \dots & s_{0,m}\\ 0& 1& s_{1,2}& \dots & s_{1,m}\\ & & \dots & & \\ 0& 0& 0& \dots & 1\end{array}\right),$$

$$u_{n+1,i}\equiv F_{n+1,i}(u_{n,0},\dots ,u_{n,m})(\mathrm{mod}p),n=0,1,\dots ,$$

$$(u_{0,0},\dots ,u_{0,m})=\mathbf{v}.$$

$${\mathbf{w}}_n=(u_{n,0},\dots ,u_{n,m})$$

$${\mathbf{w}}_n={\mathcal{F}}_n({\mathbf{w}}_{n-1}),n=1,2,\dots .$$

$$u_{n+k,i}=F_i^{(k)}(u_{n,0},\dots ,u_{n,m}),$$

$${\mathbf{w}}_{n+\tau }={\mathbf{w}}_n,n=0,1,\dots .$$

$${\mathbf{u}}_n=(u_{n,0},\dots ,u_{n,m-1})$$

$$S_{\mathbf{a}}(N)=\sum _{n=0}^{N-1}{\mathbf{e}}_p\left(\sum _{i=0}^{m-1}{a}_i{u}_{n,i}\right)\text{and}{T}_{\mathbf{b}}(N)=\sum _{n=0}^{N-1}{\mathbf{e}}_p\left(\sum _{i=0}^m{b}_i{u}_{n,i}\right),$$

$${\mathbf{e}}_p(z)=\exp (2\pi iz/p).$$

$$\Gamma =\left\{({\gamma }_{n,1},\dots ,{\gamma }_{n,s}{)}_{n=0}^{N-1}\right\}$$

$$\Delta (\Gamma )=\underset{B\subseteq [0,1{)}^s}{\sup }\left|\frac{T_{\Gamma }(B)}{N}-|B|\right|,$$

$$B=[{\alpha }_1,{\beta }_1)\times \dots \times [{\alpha }_s,{\beta }_s)\subseteq [0,1{)}^s$$

$$\Delta (\Gamma )\le C_s\left(\frac{1}{H}+\frac{1}{N}\sum _{0<|\mathbf{h}|\le H}\prod _{j=1}^s\frac{1}{|h_j|+1}\left|\sum _{n=0}^{N-1}\exp \left(2\pi i\sum _{j=1}^s{h}_j{\gamma }_{n,j}\right)\right|\right)$$

$$\mathbf{k}=(k_1,\dots ,k_{\nu }),\mathbf{l}=(l_1,\dots ,l_{\nu }),\min \{k_1,\dots ,k_{\nu },l_1,\dots ,l_{\nu }\}\ge k_0$$

$$\gcd (a_0,\dots ,a_{m-1},p)=1,$$

Full text

Subject Classification (2000)

11K45; 11T23; 11T71; 94A60

1. Introduction

1.1. Background

For a system of $m+1$ polynomials ${\mathcal{F}}=\{f_{0},\ldots,f_{m}\}$ in $m+1$ variables over a ring ${\mathcal{R}}$ one can naturally define a dynamical system generated by its iterations:

[TABLE]

for each $i=0,\ldots,m$, see [11, 12, 20, 41, 43, 44] and references therein for various aspects of such dynamical systems. In particular, the length and the distribution of elements in the orbits of such dynamical systems, starting from an initial value $\left(u_{0,0},\ldots,u_{0,m}\right)\in{\mathcal{R}}^{m+1}$, have been of primal interest.

In the special case of one linear univariate polynomial over a residue ring or a finite field such iterations are known as linear congruential generators, which have been successully used for decades in Quasi-Monte Carlo methods, see [31, 32]. On the other hand, in cryptographic settings, such linear generators have been the subject of various attacks [8, 13, 21, 25, 27] and thus are not recommended for cryptographic purposes. It should be noted that nonlinear generators have also been attacked [1, 2, 14, 17], but the attacks are much weaker and do not rule out their use for cryptographic purposes (provided reasonable precautions are made). Although linear congruential generators have been used quite sucessfully for Quasi-Monte Carlo methods, their linear structure shows in these applications too and often limits their applicability, see [31, 32].

Motivated by these potential applications, the statistical uniformity of the distribution (measured by the discrepancy) of one and multidimensional nonlinear polynomial generators have been intensively studied in [15, 16, 33, 34, 35, 45]. However, all previously known results are nontrivial only for those polynomial generators that produce sequences of extremely large period, which could be hard to achieve in practice. The reason behind this is that the degree of iterated polynomial systems grows exponentially, and that in all previous results on the general case the saving over the trivial bound has been logarithmic. Moreover, it is easy to see that in the one dimensional case (that is, for $m=0$) the exponential growth of the degree of iterations of a nonlinear polynomial is unavoidable. One also expects the same behaviour in the mulitidimensional case for “random” polynomials $f_{0},\ldots,f_{m}$. However, as it has been shown in [37] for some specially selected polynomials $f_{0},\ldots,f_{m}$ the degree may grow significantly slower, a result that leads to much better estimates of exponential sums, and thus of discrepancy, for vectors generated by these iterations.

Furthermore, it is shown in [36], that in the case when such a polynomial map generates a permutation of the corresponding vector space, one can get better results “on average” over all initial values. It is also noticed in [36] that in fact one can avoid the use of the Weil bound (see [29, Chapter 5]) of exponential sums and achieve a better result with a more elementary argument.

1.2. Our results

Here, as in [36], we continue to study the polynomial systems of [37] and exploit the linearity with respect to one variable and polynomial degree growth with respect to the other variables. This leads to a direct improvement of the results of [37]. This new approach also allows us to consider a slightly more general polynomial dynamical systems, where at each step a different polynomial map can be used, thus extending those of [37]. The argument is based on an elementary identity for exponential sums with linear polynomials and also on counting zeros of multivariate polynomials in finite fields.

We remark that since the Weil bound is not needed anymore, one can certainly obtain analogues of our results for residue rings (although counting the number of solutions of multivariate polynomial congruences may require more efforts than in the finite field settings).

Furthermore, in [36, 37] only the truncated vectors (consisting of $m$ components of the total output $(m+1)$-dimensional vectors) are investigated. Here we show that in fact the whole output vectors can be studied, however for this we require a very deep result of Bourgain, Glibichuk and Konyagin [6] (for generalisation to residue rings one can also use the results of [3, 4]).

Finally, we propose a construction of a hash function from polynomial maps. Although we make no claims of security or efficiency, we note that our results show that this hash function has “random-like” behaviour.

Hash functions from walks on the set of isogenous elliptic curves generated by low degree isogenies, and their cryptographic applications, are considered in [7, 19]. Alternatively these walks can be described as sequences of rational function transformations on the coefficients of Weierstrass equations on elliptic curves, see [42] for a background. We hope that our results maybe useful for studying further properties of such walks, for example, in showing that the hash function of [7, 19] has sufficiently uniformly distributed outputs and maybe used as a secure pseudorandom number generator.

2. Construction

2.1. Polynomial systems

Let $\mathbb{F}$ be an arbitrary field. As in [37], we consider a system ${\mathcal{F}}=\{F_{0},\ldots,F_{m}\}$ of $m+1$ polynomials in $\mathbb{F}[X_{0},\ldots,X_{m}]$ satisfying the following conditions

[TABLE]

where

[TABLE]

We also impose the condition that each polynomial $G_{i}$, $i=0,\ldots,m-1$, has the unique leading monomial $X_{i+1}^{s_{i,i+1}}\ldots X_{m}^{s_{i,m}}$, that is,

[TABLE]

where

[TABLE]

for $i=0,\ldots,m-1$, $j=i+1,\ldots,m$.

Given an integral upper triangular matrix

[TABLE]

define $\mathfrak{F}(S,m)$ the set of all such polynomial systems of the form (1) satisfying the conditions (2) and (3).

For an integer $m\geq 1$ and an integral matrix $S$ of the form (4), we consider a sequence of, not necessarily distinct, polynomial systems

[TABLE]

We consider the sequence of polynomials $F_{i}^{(j)}$ defined by the recurrence relation

[TABLE]

In particular, ${\mathcal{F}}_{0}$ denotes the identity map.

As in [36, Lemma 1], we have the following characterization of the polynomials $F_{i}^{(k)}$, which in turn generalises and refines [37, Lemma 1]. We note that unfortunately in [37] the unique leading monomial condition (3) is given in the form $\deg\widetilde{G_{i}}<\deg G_{i}$ instead of the required $\deg_{X_{j}}\widetilde{G_{i}}<\deg_{X_{j}}G_{i}$, $0\leq i<j\leq m$, that is actually used in the proof of [37, Lemma 1].

Lemma 1**.**

Let ${\mathcal{F}}_{k}\in\mathfrak{F}(S,m)$ be a sequence of polynomial systems (5). Then for the polynomials $F_{i}^{(k)}$ given by (6) we have

[TABLE]

where $\widetilde{G}_{k,i},\widetilde{H}_{k,i}\in\mathbb{F}[X_{i+1},\ldots,X_{m}]$ and

[TABLE]

with some polynomials $\psi_{i}(T)\in\mathbb{Q}[T]$ of degree $\deg\psi_{i}<m-i$.

Proof.

Writing $F_{k,i}=X_{i}G_{k,i}+H_{k,i}$ we get

[TABLE]

Thus an easy inductive argument implies that

[TABLE]

for some polynomials $\widetilde{G}_{k,i},\widetilde{H}_{k,i}\in\mathbb{F}[X_{i+1},\ldots,X_{m}]$, where $i=0,\ldots,m$, $k=1,2,\ldots$.

For the asymptotic formulas for the degrees of the polynomials $\widetilde{G}_{k,i}$ see [37, Lemma 1] where it is given for $\deg F_{i}^{(k)}$. We note that in [37] only the case when at each step the same polynomial system ${\mathcal{F}}_{k}={\mathcal{F}}$ is applied but the proof holds for distinct systems ${\mathcal{F}}_{k}\in\mathfrak{F}(S,m)$ without any changes. Indeed, let

[TABLE]

Then the result follows immediately from the recursive formula

[TABLE]

implied by (2) and (3), where

[TABLE]

and $\mathbf{d}^{T}$ means the transposition of the vector $\mathbf{d}$, see the proof of [37, Lemma 1] for more details.     \sqcap$$\sqcup

2.2. Vector sequences

Given a sequence of polynomial systems (5), we fix a vector $\mathbf{v}\in\mathbb{F}_{p}^{m+1}$ and consider the sequence defined by a recurrence congruence modulo a prime $p$ of the form

[TABLE]

with some initial values

[TABLE]

We also assume that $0\leq u_{n,i}<p$, $i=0,\ldots,m$, $n=0,1,\ldots$.

Using the following vector notation

[TABLE]

we have the recurrence relation

[TABLE]

In particular, for any $n,k\geq 0$ and $i=0,\ldots,m$ we have

[TABLE]

where the polynomials $F_{i}^{(k)}$, $i=0,\ldots,m$, $k=1,2,\ldots$, are given by (6). Clearly the sequence of vectors $\mathbf{w}_{n}$ is eventually periodic with some period $\tau\leq p^{m+1}$. We always assume that the sequence is purely periodic, that is,

[TABLE]

As in [36, 37], we sometimes discard the last component and define the truncated vectors

[TABLE]

However, here we introduce a new argument which allows us sometimes to study full vectors $\mathbf{w}_{n}$.

3. Exponential Sums and Discrepancy

3.1. Preliminaries

Assume that the sequence $\{\mathbf{u}_{n}\}$ generated by (7) is purely periodic with an arbitrary period $\tau$. For integer vectors $\mathbf{a}=(a_{0},\ldots,a_{m-1})\in\mathbb{Z}^{m}$ and $\mathbf{b}=(b_{0},\ldots,b_{m})\in\mathbb{Z}^{m+1}$ we introduce the exponential sums

[TABLE]

where

[TABLE]

Clearly, if $\mathbf{b}=(a_{0},\ldots,a_{m-1},0)$ then we simply have $S_{\mathbf{a}}(N)=T_{\mathbf{b}}(N)$, thus the sums $T_{\mathbf{b}}(N)$ are direct generalisations of the sums $S_{\mathbf{a}}(N)$ that have been treated in [36, 37]. Here we show that together with some additional arguments, one can obtain similar results for the sums $T_{\mathbf{b}}(N)$.

Bounds of these sums can be used to estimate the discrepancy of the corresponding sequences, which is a widely accepted quantitative measure of uniformity of distribution of sequences, and thus good pseudorandom sequences should (after an appropriate scaling) have a small discrepancy, see [31, 32].

Given a sequence $\Gamma$ of $N$ points

[TABLE]

in the $s$-dimensional unit cube $[0,1)^{s}$ it is natural to measure the level of its statistical uniformity in terms of the discrepancy $\Delta(\Gamma)$. More precisely,

[TABLE]

where $T_{\Gamma}(B)$ is the number of points of $\Gamma$ inside the box

[TABLE]

and the supremum is taken over all such boxes, see [9, 26].

Typically the bounds on the discrepancy of a sequence are derived from bounds of exponential sums with elements of this sequence. The relation is made explicit in the celebrated Erdős-Turan-Koksma inequality, see [9, Theorem 1.21], which we present in the following form.

Lemma 2**.**

There exists a constant $C_{s}$ depending only on $s$ such that for any integer $H>1$ and any sequence $\Gamma$ of $N$ points (8) the discrepancy $\Delta(\Gamma)$ satisfies the following bound:

[TABLE]

where the sum is taken over all integers vectors $\mathbf{h}=(h_{1},\ldots,h_{s})\in\mathbb{Z}^{s}$ with $|\mathbf{h}|=\max_{j=1,\ldots,s}|h_{j}|<H$.

We always assume that a finite field $\mathbb{F}_{p}$ of $p$ elements is represented by the set $\{0,1,\ldots,p-1\}$. So for $u\in\mathbb{F}_{p}$ we always have $u/p\in[0,1)$ and thus we can talk about the discrepancy of vectors over $\mathbb{F}_{p}$ after scaling them by $1/p$.

Throughout the paper, the implied constants in the symbols ‘$O$’ and ‘$\ll$’ may occasionally, where obvious, depend on the matrix $S$ and the integer $m\geq 1$ (and are absolute otherwise). We recall that the notations $A=O(B)$ and $A\ll B$ are all equivalent to the assertion that the inequality $|A|\leq cB$ holds for some constant $c>0$.

3.2. Arbitrary Systems

Here we assume, exactly as in [37], that all polynomial systems (5) are the same, that is ${\mathcal{F}}_{k}={\mathcal{F}}$. Our next results are a direct improvement of the estimate of [37, Theorem 4] for the sums $S_{\mathbf{a}}(N)$ and also an extension of such bound to more general sums $T_{\mathbf{b}}(N)$.

We need the following generalisation of the bound on exponential sums of [36, Lemma 2], which avoids using the Weil bound (see [29, Chapter 5]) and which is our main tool in improving the result of [37].

Lemma 3**.**

Let ${\mathcal{F}}\in\mathfrak{F}(S,m)$ with $s_{0,1}\ldots s_{m-1,m}\neq 0$, then there is a positive integer $k_{0}$ depending only on $S$ and $m$ such that for any integer vectors

[TABLE]

with components that are not permutations of each other and integer vector $\mathbf{a}=(a_{0},\ldots,a_{m-1})$ with

[TABLE]

for the polynomial

[TABLE]

where the polynomials $F_{i}^{(k)}$ are given by (6), we have

[TABLE]

where

[TABLE]

Proof.

Let $s<m-1$ be the smallest integer such that $a_{s}\neq 0$. By Lemma 1 we have

[TABLE]

for a certain polynomial $\Psi_{\mathbf{a},\mathbf{k},\mathbf{l}}(x_{s+1},\ldots,x_{m})\in\mathbb{F}_{p}[x_{s+1},\ldots,x_{m}]$.

Therefore,

[TABLE]

Recalling the identity

[TABLE]

see [30, Equation (5.9)], we conclude that the sum over the variable $x_{s}$ is nonzero only if the polynomial

[TABLE]

is zero modulo $p$ at $(x_{s+1},\ldots,x_{m})$.

Performing all trivial cancelations, without loss of generality we can also assume that the vectors $\mathbf{k}$ and $\mathbf{l}$ have no common elements. Thus, by Lemma 1, we see that if $\min\{k_{1},\ldots,k_{\nu},l_{1},\ldots,l_{\nu}\}\geq k_{0}$ for a sufficiently large $k_{0}$ then the polynomial $\Phi_{s,\mathbf{k},\mathbf{l}}$ is a nontrivial polynomial modulo $p$ of degree $O(K^{m-s})=O(K^{m})$. Also, a simple inductive argument shows that a modulo $p$ nontrivial polynomial in $r$ variables of degree $D$ may have only $O(Dp^{r-1})$ zeros modulo $p$, which concludes the proof.     \sqcap$$\sqcup

Theorem 4**.**

Let the sequence $\{\mathbf{u}_{n}\}$ be given by (7) for ${\mathcal{F}}_{k}={\mathcal{F}}$, $k=1,2,\ldots$, with a polynomial system ${\mathcal{F}}\in\mathfrak{F}(S,m)$ of the form (1) of total degree $d\geq 2$ and such that $s_{0,1}\ldots s_{m-1,m}\neq 0$. Assume that $\{\mathbf{w}_{n}\}$ is purely periodic with period $\tau$. Then for any fixed integer $\nu\geq 1$, positive integer $N\leq\tau$ and nonzero vector $\mathbf{a}\in\mathbb{F}_{p}^{m}$ the bound

[TABLE]

holds, where

[TABLE]

and the implied constant depends only on $d$, $m$ and $\nu$.

Proof.

We follow the same argument as in the proof of [37, Theorem 4], however instead of the Weil bound we use now Lemma 3 (and thus we optimise the parameters differently).

In particular, as in [37] we obtain that for any integer $K\geq k_{0}$,

[TABLE]

where $k_{0}$ is the same as in Lemma 3 and

[TABLE]

Using the Hölder inequality we derive (again exactly the same way as in [37])

[TABLE]

For $O(K^{\nu})$ vectors

[TABLE]

which are permutations of each other, we estimate the inner sum trivially as $p^{m+1}$.

For the other $O(K^{2\nu})$ vectors, we apply Lemma 3 getting the upper bound $K^{m}p^{m}$ for the inner sum. Hence,

[TABLE]

Inserting this bound in (12), we derive

[TABLE]

Choosing

[TABLE]

(and assuming that $p$ is large enough, so $K\geq k_{0}$), after simple calculations we obtain the desired result.     \sqcap$$\sqcup

Using Lemma 2, we derive the following improvement of [37, Theorem 6].

Corollary 5**.**

Let the sequence $\{\mathbf{u}_{n}\}$ be given by (7) for ${\mathcal{F}}_{k}={\mathcal{F}}$, $k=1,2,\ldots$, with a polynomial system ${\mathcal{F}}\in\mathfrak{F}(S,m)$ of the form (1) of total degree $d\geq 2$ and such that $s_{0,1}\ldots s_{m-1,m}\neq 0$. Assume that $\{\mathbf{w}_{n}\}$ is purely periodic with period $\tau$. Then for any fixed integer $\nu\geq 1$, and any positive integer $N\leq\tau$, the discrepancy of the sequence

[TABLE]

satisfies the bound $O\left(p^{\alpha_{m,\nu}}N^{-\beta_{m,\nu}}(\log p)^{m}\right)$, where

[TABLE]

and the implied constant depends only on $d$, $m$ and $\nu$.

We note that the values of $\alpha_{m,\nu}$ and $\beta_{m,\nu}$ in Theorem 6 and Corollary 5 improve on the values

[TABLE]

from [37]. In particular, both Theorem 4 and Corollary 5 are nontrivial if $\tau\geq N\geq p^{m+\varepsilon}$ with fixed $\varepsilon>0$ (while the corresponding bounds of [37] are nontrivial only if $\tau\geq N\geq p^{m+1/2+\varepsilon}$).

Theorem 6**.**

Let the sequence $\{\mathbf{u}_{n}\}$ be given by (7) for ${\mathcal{F}}_{k}={\mathcal{F}}$, $k=1,2,\ldots$, with a polynomial system ${\mathcal{F}}\in\mathfrak{F}(S,m)$ of the form (1) of total degree $d\geq 2$ and such that $s_{0,1}\ldots s_{m-1,m}\neq 0$. Assume that $\{\mathbf{w}_{n}\}$ is purely periodic with period $\tau$. Then for any fixed real $\varepsilon>0$, there exist $\delta>0$ such that for for any positive integer $N$ with $\tau\geq N\geq p^{m+\varepsilon}$ and nonzero vector $\mathbf{b}\in\mathbb{F}_{p}^{m+1}$ the bound

[TABLE]

holds and the implied constant depends only on $d$, $m$ and $\varepsilon$.

Proof.

If $\gcd(b_{0},\ldots,b_{m-1},p)=1$ then the same argument as in the proof Theorem 6 leads to a fully analogous bound

[TABLE]

Thus for $\tau\geq N\geq p^{m+\varepsilon}$, taking a sufficiently large $\nu$ we obtain the desired estimate.

So it remains to consider the case

[TABLE]

in which case we simply obtain

[TABLE]

A trivial inductive argument shows that

[TABLE]

if $g_{m}\neq 1$ and

[TABLE]

if $g_{m}=1$ (where $g_{m}$ and $h_{m}$ are as in (1)).

We consider the case $g_{m}\neq 1$ first in which we obtain

[TABLE]

Clearly, if $t$ is the multiplicative order of $g_{m}$ then we see from (13) that $u_{n,m}$, $n=0,1,\ldots,$ takes exactly $t$ distinct values. Since the truncated vector $\mathbf{u}_{n}$ takes at most $p^{m}$ values we see that the full vector $\mathbf{w}_{n}$ takes at most $tp^{m}$ values. Thus

[TABLE]

Using the condition $\tau\geq N\geq p^{m+\varepsilon}$ we obtain

[TABLE]

In particular (15) implies that

[TABLE]

as otherwise

[TABLE]

and $t=1$.

We now recall that by the result of [6], for any $\varepsilon>0$ there exists $\eta>0$ such that under the condition (15) we have

[TABLE]

which concludes the proof in the case of $g_{m}>1$.

For $g_{m}=1$ we recall (14) and then using (11) we derive the result.     \sqcap$$\sqcup

Using again Lemma 2, we derive the following generalisation of [37, Theorem 6] (the bound is $\log p$ weaker as we work in the dimension $m+1$ instead of $m$).

Corollary 7**.**

Let the sequence $\{\mathbf{u}_{n}\}$ be given by (7) for ${\mathcal{F}}_{k}={\mathcal{F}}$, $k=1,2,\ldots$, with a polynomial system ${\mathcal{F}}\in\mathfrak{F}(S,m)$ of the form (1) of total degree $d\geq 2$ and such that $s_{0,1}\ldots s_{m-1,m}\neq 0$. Assume that $\{\mathbf{w}_{n}\}$ is purely periodic with period $\tau$. Then for any fixed real $\varepsilon>0$, there exist $\gamma>0$ such that for any positive integer $N$ with $\tau\geq N\geq p^{m+\varepsilon}$ the discrepancy of the sequence

[TABLE]

satisfies the bound $O\left(p^{-\gamma}\right)$, where the implied constant depends only on $d$, $m$ and $\varepsilon$.

Certainly one can get stronger and more explicit statements in both Theorem 6 and Corollary 7 if more information about the multiplicative order $t$ modulo $p$ is available. For example, if it is know that $t\geq p^{1/3+\varepsilon}$ then one can use the bound of Heath-Brown and Konyagin [22] (see also [24, Theorem 3.4])

[TABLE]

For smaller values of $t$, but with $t\geq p^{1/4}$ one can use the bound of Bourgain and Garaev [5], see also [23].

We remark that it is easy to see that a randomly chosen element $g\in\mathbb{F}_{p}^{*}$ is of order $t=p^{1+o(1)}$ with probability $1+o(1)$ as $p\to\infty$.

Furthermore, it is also well-known that any fixed integer $g\neq 0,\pm 1$ is of multiplicative order

[TABLE]

for all but $o(x/\log x)$ primes $p\leq x$, see [10, 18, 39] for various improvements of this result.

3.3. Permutation Systems

We now consider polynomial systems of the form (5) which permute the elements of $\mathbb{F}_{p}^{m+1}$. Lidl and Niederreiter [29, 30] call such systems orthogonal polynomial systems, but we here refer to them as permutation polynomial systems.

We fix a sequence ${\mathcal{F}}_{k}$, $k=1,2,\ldots$, of polynomial systems (5). For integer vectors $\mathbf{b}=(b_{0},\ldots,b_{m-1})\in\mathbb{F}_{p}^{m}$ and $\mathbf{a}=(a_{0},\ldots,a_{m})\in\mathbb{F}_{p}^{m+1}$ and integers $c,M,N$ with $M\geq 1$ and $N\geq 1$, we consider the average values of exponential sums

[TABLE]

where, as before, the polynomials $F_{i}^{(k)}$, $i=0,\ldots,m$, $k=1,2,\ldots$ are given by (6).

Then using Lemma 1 in the argument of [36] one immediately obtains the following generalisation of the bound of exponential sums from [36].

Theorem 8**.**

Assume that ${\mathcal{F}}_{k}\in\mathfrak{F}(S,m)$, $k=1,2,\ldots$, are permutation polynomial systems (5), and such that $s_{0,1}\ldots s_{m-1,m}\neq 0$. Then for any positive integers $c$, $M$, $N$ and any nonzero vector $\mathbf{b}\in\mathbb{F}_{p}^{m}$ we have

[TABLE]

where

[TABLE]

Exactly as in [36], this immediately implies a discrepancy bound which holds for almost all initial values $\mathbf{v}\in\mathbb{F}_{p}^{m+1}$. We note that in [36] only the case of when at each step the same polynomial system ${\mathcal{F}}_{k}={\mathcal{F}}$ is applied but the proof, based only on the bound of the sums $U_{\mathbf{a},c}(M,N)$, holds for distinct polynomial systems ${\mathcal{F}}_{k}\in\mathfrak{F}(S,m)$ without any changes.

Corollary 9**.**

Let $0<\varepsilon<1$ and let the sequence $\{\mathbf{u}_{n}(\mathbf{v})\}$ be given by (7) with the initial vector of initial values $\mathbf{v}\in\mathbb{F}_{p}^{m+1}$, where ${\mathcal{F}}_{k}\in\mathfrak{F}(S,m)$, $k=1,2,\ldots$, are permutation polynomial systems (5), and such that $s_{0,1}\ldots s_{m-1,m}\neq 0$. Then for all initial values $\mathbf{v}\in\mathbb{F}_{p}^{m+1}$ except at most $O(\varepsilon p^{m+1})$, and any positive integer $N\leq p^{m+1}$, the discrepancy $D_{N}(\mathbf{v})$ of the sequence

[TABLE]

satisfies the bound

[TABLE]

where

[TABLE]

We now show that the distribution of the full vectors $\{\mathbf{w}_{n}(\mathbf{v})\}$ can be studied as well.

Theorem 10**.**

Let ${\mathcal{F}}_{k}\in\mathfrak{F}(S,m)$ be a sequence of permutation polynomial systems (5) and such that $s_{0,1}\ldots s_{m-1,m}\neq 0$, satisfying also the additional condition that the last polynomial in all these systems has the same coefficient $g_{m}\in\mathbb{F}_{p}$ of $X_{m}$, that is,

[TABLE]

Denote by $t$ the period of $g_{m}$ if $g_{m}\neq 1$ and put $t=p$ if $g_{m}=1$. Then for any positive integers $c$, $M$, $N$ and any nonzero vector $\mathbf{b}\in\mathbb{F}_{p}^{m+1}$ we have

[TABLE]

where

[TABLE]

and $A(N,p)$ is defined as in Theorem 8.

Proof.

Note, as before, that if $\gcd(b_{0},\ldots,b_{m-1},p)=1$ then the proof of [36, Lemma 4] applies to the sums $V_{\mathbf{b},c}(M,N)$ without any changes. So it remains to consider the case

[TABLE]

in which case we simply obtain

[TABLE]

We have the follwing explicit formulas (see also (13) and (14)):

[TABLE]

if $g_{m}\neq 1$ and

[TABLE]

if $g_{m}=1$, where

[TABLE]

We treat first the case $g_{m}\neq 1$. In this case we get:

[TABLE]

Because $g_{m}^{k}-g_{m}^{n}\equiv 0\pmod{p}$ if and only if $k\equiv n\pmod{t}$, we estimate the first sum trivially as $N(Nt^{-1}+1)p^{m+1}$. Furthermore, for $k\not\equiv n\pmod{t}$, using (11) we see that the second sum simply vanishes.

Thus, for $g_{m}\neq 1$, we obtain

[TABLE]

For the case $g_{m}=1$ we recall (17) and using similar arguments easily derive the desired result.     \sqcap$$\sqcup

As above, we now get:

Corollary 11**.**

Let $0<\varepsilon<1$ and let the sequence $\{\mathbf{u}_{n}\}$ be given by (7), where ${\mathcal{F}}_{k}\in\mathfrak{F}(S,m)$ is a sequence of permutation polynomial systems (5) satisfying also the additional condition that the last polynomial in all these systems has the same coefficient $g_{m}\in\mathbb{F}_{p}$ of $X_{m}$, that is,

[TABLE]

Denote by $t$ the period of $g_{m}$ if $g_{m}\neq 1$ and put $t=p$ if $g_{m}=1$. Then for all vectors of initial values $\mathbf{v}\in\mathbb{F}_{p}^{m+1}$ except at most $O(\varepsilon p^{m+1})$, and any positive integer $N\leq p^{m+1}$, the discrepancy $D_{N}(\mathbf{v})$ of the sequence

[TABLE]

satisfies the bound

[TABLE]

where

[TABLE]

and $C(N,p)$ is defined as in Corollary 9.

It is easy to see that under the condition (16) the quantities $B(N,t,p)$ and $D(N,t,p)$ are dominated by the terms with $A(N,p)$ and $C(N,p)$, respectively:

[TABLE]

Finally, we remark that analogues of Theorem 10 and Corollary 11 can be proven also for more general permutation polynomial systems, namely for systems in which the coefficients $g_{j,m}$ of $X_{m}$ in the last polynomial of each system vary in such a way that

[TABLE]

is $k$ and $n$ are close to each. In fact, if this is guaranteed for $k$ and $n$ with $0<|k-n|<t$ then the corresponding results for such polynomial systems look identical to those of Theorem 10 and Corollary 11. For examples included such sequences of coefficient as $g_{j,m}=g_{m}^{j}$ for some element $g_{m}\in\mathbb{F}_{p}^{*}$. In this case, the condition (18) is equivalent to the quadratic congruence

[TABLE]

where $t$ is the order of $g_{m}$ which can be easily shown not to have too many solutions with $0\leq k,n\leq N-1$ (in particular, if $t$ is prime the results are again exactly the same as those of Theorem 10 and Corollary 11).

4. Hash Functions from Polynomial Iterations

4.1. General Construction

In this section we propose a new construction of hash functions based on iterations of polynomial systems studied in the previous sections. This construction is motivated by that of D. X. Charles, E. Z. Goren and K. E. Lauter [7] and in some sense it may be considered as its extension.

Let $n$ and $r$ be two nonzero integers. Choose a random $n$-bit prime $p$ and $2^{r}$ permutation polynomial systems ${\mathcal{F}}_{\ell}$, $\ell=0,\ldots,2^{r}-1$, not necessary distinct, defined by (5) and (6).

We also consider a random initial vector $\mathbf{w}_{0}\in\mathbb{F}_{p}^{m+1}$.

As in [7], the input of the hash function is used to decide what polynomial system ${\mathcal{F}}_{\ell}$ is used to iterate. More precisely, it works as follows given an input bit string $\Sigma$, we execute the following steps:

• •

pad $\Sigma$ with at most $r-1$ zeros on the left to make sure that its length $L$ is a multiple of $r$;

• •

split $\Sigma$ into blocks $\sigma_{j}$, $j=1,\ldots,J$, where $J=L/r$, of length $r$ and interpret each block as an integer $\ell\in[0,2^{r}-1]$.

• •

Starting at the vector $\mathbf{w}_{0}$, apply the polynomial systems ${\mathcal{F}}_{\ell}$ iteratively obtaining the sequence of vectors $\mathbf{w}_{j}\in\mathbb{F}_{p}^{m+1}$.

• •

Output $\mathbf{w}_{J}$ as the value of the hash function (which can also be now interpreted as a binary $(m+1)n$-bit string).

The above construction is quite similar to that of [7] where $m=1$, the vectors $\mathbf{w}_{j}$ represent the coefficients of an equation describing an elliptic curve for example, of the Weierstrass equation

[TABLE]

and polynomials maps are associated with isogenies of a fixed degree.

4.2. Collision Resistance

Our belief in collision resistance is essentially based on the same arguments as in [7].

We remark that the initial vector $\mathbf{w}_{0}$ is fixed and in particular, does not depend on the input of the hash function. Furthermore, the collision resistance does not rely on the difficulty of inverting the maps generated by the polynomial systems ${\mathcal{F}}_{\ell}$, which are triangular and actually quite easy to invert. Rather, it is based on the difficulty of making the decision which system to apply at each step when one attempts to back trace from a given output to the initial vector $\mathbf{w}_{0}$ and thus produce two distinct strings $\Sigma_{1}$ and $\Sigma_{2}$ of the same length $L$, with the same output.

Note that for strings of different lengths, say of $L$ and $L+1$, a collision can easily be created. It is enough to take $\Sigma_{2}=(0,\Sigma_{1})$ (that is, $\Sigma_{2}$ is obtained from $\Sigma_{1}$ by augmenting it by [math]). If $L\not\equiv 0\pmod{r}$ then they lead to the same output. Certainly any practical implementation has to take care of things like this.

We also note that the results of Section 3.3 suggest that the above hash functions exhibit rather chaotic behaviour, which is close to the behaviour of a random function. We certainly make no claims about the cryptographic strength of our construction but we believe that there are enough reasons to investigate it (theoretically and experimentally) more closely.

5. Remarks

In the proof of Lemma 3 we use the estimate $O\left(\deg\Phi_{s,\mathbf{k},\mathbf{l}}p^{m-s-1}\right)$ on the number of zeros of the polynomial $\Phi_{s,\mathbf{k},\mathbf{l}}$. Perhaps this bound is hard to improve in general, but maybe this can be done for some specially selected polynomial systems. For example, if one can show that $\Phi_{s,\mathbf{k},\mathbf{l}}$ is absolutely irreducible then the Lang-Weil bound on the number of zeros of a polynomial in $m\geq 2$ variables, see [28, 40], can be used to derive a better result. Even the case of $\nu=1$ is already of interest.

Furthermore, although low discrepancy is a very important requirement on any pseudoramdom number generator, this is not the only one. For example, the notion of linear complexity also plays an important role in this area, see [45]. In the case of vector sequences it is natural to consider linear relations with vector coefficients. Namely, we denote by $L(N)$ the smallest $L$ such that for some $m$-dimensional vectors $\mathbf{c}_{0},\ldots,\mathbf{c}_{L}$ over $\mathbb{F}_{q}$ where $\mathbf{c}_{L}$ is a non-zero vector, we have

[TABLE]

for all $h=0,\ldots,N-L-1$, where $\mathbf{c}\cdot\mathbf{u}$ denotes the scalar product. Using the same degree argument which is used in the proof of Lemma 3, we see that (19) leads to a nontrivial polynomial equation in $m+1$ variables over $\mathbb{F}_{p}$ of degree $O(L^{m})$. Since for $N\leq\tau$, where as $\tau$ is the period of the purely periodic sequence $\{\mathbf{w}_{n}\}$, the vectors $\mathbf{w}_{n+h}$, $h=0,\ldots,N-L-1$ are pairwise distinct, this yields the estimate

[TABLE]

This can be extended to sequences over arbitrary finite fields. Several more estimates of this type have recently been given in [38]. It would be very interesting to get better bounds which rely on a more refined analysis of (19).

Acknowledgement

The authors are grateful to the Fields Institute for its support and stimulating atmosphere which led to the initiation of this work at the “Fields Cryptography Retrospective Meeting” Toronto, 2009.

During the preparation of this paper, A. O. was supported in part by the Swiss National Science Foundation Grant 121874 and I. S. by the Australian Research Council Grant DP0556431.