Maximum-order Complexity and Correlation Measures

TL;DR

This paper investigates the relationship between the maximum-order complexity of binary sequences and their correlation measures, showing that low correlation measures up to a certain order imply a lower bound on complexity.

Contribution

It establishes a new connection between correlation measures and maximum-order complexity, providing bounds that link sequence correlation properties to complexity measures.

Findings

Sequences with small correlation measures up to order k cannot have very low maximum-order complexity.

The paper provides bounds relating correlation measures to complexity, enhancing understanding of sequence unpredictability.

The results have implications for analyzing the randomness and security of binary sequences.

Abstract

We estimate the maximum-order complexity of a binary sequence in terms of its correlation measures. Roughly speaking, we show that any sequence with small correlation measure up to a sufficiently large order $k$ cannot have very small maximum-order complexity.

Equations

$$s_{i+L}=c_{L-1}{s}_{i+L-1}+...+c_0{s}_i,0\le i\le N-L-1.$$

$$C_k(\mathcal{S},N)=\underset{U,D}{\max }\left|\sum _{i=0}^{U-1}(-1{)}^{s_{i+d_1}+s_{i+d_2}+...+s_{i+d_k}}\right|,$$

$$L(\mathcal{S},N)\ge N-\underset{1\le k\le L(S,N)+1}{\max }{C}_k(\mathcal{S},N),N\ge 1.$$

$$\ell_{i}=\left\{\begin{array}[]{cl}1,&\mbox{if $i$ is a quadratic non-residue modulo $p$},\\ 0,&\mbox{otherwise},\end{array}\right.$$

$$C_k(\mathcal{L},N)\ll k{p}^{1/2}\log p,1\le N\le p,$$

$$L(\mathcal{L},N)\gg \frac{\min \{N,p\}}{p^{1/2}\log p},N\ge 1,$$

$$s_{i+M}=f(s_i,s_{i+1},\dots ,s_{i+M-1}),0\le i\le N-M-1,$$

$$M(\mathcal{S},N)\le L(\mathcal{S},N)$$

$$M(\mathcal{S},N)\ge N-2^{M(\mathcal{S},N)+1}\underset{1\le k\le M(\mathcal{S},N)+1}{\max }{C}_k(\mathcal{S},N),N\ge 1.$$

$$M(\mathcal{S},N)\ge \log (\min \{N,p\}/p^{1/2})+O(\log \log p),$$

$$\Big{(}(-1)^{s_{i+M}}-(-1)^{f(0,\ldots,0)}\Big{)}\prod_{j=0}^{M-1}\Big{(}(-1)^{s_{i+j}}+1\Big{)}=0.$$

$$\sum_{i=0}^{N-M-1}\Big{(}(-1)^{s_{i+M}}-(-1)^{f(0,\ldots,0)}\Big{)}\prod_{j=0}^{M-1}\Big{(}(-1)^{s_{i+j}}+1\Big{)}=0.$$

$$\pm \sum _{i=0}^{N-M-1}(-1{)}^{s_{i+j_1}+s_{i+j_2}+\dots +s_{i+j_k}}$$

$$N-M\le 2^{M+1}\underset{1\le k\le M+1}{\max }\left|\sum _{i=0}^{N-M-1}(-1{)}^{s_{i+j_1}+s_{i+j_2}+\dots +s_{i+j_k}}\right|$$

$$\sum _{h=0}^{m-1}{\xi }^{hx}=0\text{mbox}ifandonlyifx\not\equiv 0\mathrm{mod}m.$$

$$\sum _{i=0}^{N-M-1}({\xi }^{s_{i+M}}-{\xi }^{f(0,\dots ,0)})\prod _{j=0}^{M-1}\sum _{h=0}^{m-1}{\xi }^{h{s}_{i+j}}=0.$$

$$\alpha \sum _{i=0}^{N-M-1}{\xi }^{h_1{s}_{i+j_1}+h_2{s}_{i+j_2}+\dots +h_k{s}_{i+j_k}}$$

$$M(\mathcal{S},N)\ge N-2m^{M(\mathcal{S},N)}\underset{1\le k\le M(\mathcal{S},N)+1}{\max }{C}_k(\mathcal{S},N),N\ge 1.$$

$$t_i+t_{i+p}+t_{i+q}+t_{i+p+q}=0$$

Full text

1 Salzburg University, Hellbrunnerstr. 34, 5020 Salzburg, Austria

E-mail: leyla.isik@sbg.ac.at

2 Johann Radon Institute for Computational and Applied Mathematics

Austrian Academy of Sciences, Altenbergerstr. 69, 4040 Linz, Austria

E-mail: arne.winterhof@oeaw.ac.at

Keywords: maximum-order complexity, correlation measure of order $k$, measures of pseudorandomness, cryptography.

Mathematical Subject Classification: 11K36, 11T71, 94A55, 94A60.

1 Introduction

For a positive integer $N$, the $N$th linear complexity $L({\cal S},N)$ of a binary sequence ${\cal S}=(s_{i})^{\infty}_{i=0}$ is the smallest positive integer $L$ such that there are constants $c_{0},c_{1},...,c_{L-1}\in\mathbb{F}_{2}$ with

[TABLE]

(We use the convention $L({\cal S},N)=0$ if $s_{0}=\ldots=s_{N-1}=0$ and $L({\cal S},N)=N$ if $s_{0}=\ldots=s_{N-2}=0\neq s_{N-1}$.) The $N$th linear complexity is a measure for the predictability of a sequence and thus its unsuitability in cryptography. For surveys on linear complexity and related measures of pseudorandomness see [6, 13, 14, 17, 20, 21].

Let $k$ be a positive integer. Mauduit and Sárközy introduced the ($N$th) correlation measure of order $k$ of a binary sequence ${\cal S}=(s_{i})_{i=0}^{\infty}$ in [10] as

[TABLE]

where the maximum is taken over all $D=(d_{1},d_{2},...,d_{k})$ with non-negative integers $0\leq d_{1}<d_{2}<...<d_{k}$ and $U$ such that $U+d_{k}\leq N$. (Actually, [10] deals with finite sequences $((-1)^{s_{i}})_{i=0}^{N-1}$ of length $N$ over $\{-1,+1\}$.)

Brandstätter and the second author [2] proved the following relation between the $N$th linear complexity and the correlation measures of order $k$:

[TABLE]

Roughly speaking, any sequence with small correlation measure up to a sufficiently large order $k$ must have a high $N$th linear complexity as well.

For example, the Legendre sequence ${\cal L}=(\ell_{i})_{i=0}^{\infty}$ defined by

[TABLE]

where $p>2$ is a prime, satisfies

[TABLE]

and thus $(\ref{lincorr})$ implies

[TABLE]

see [10] and [19, Theorem 9.2]. ($f(N)\ll g(N)$ is equivalent to $|f(N)|\leq cg(N)$ for some absolute constant $c$.)

The $N$th maximum-order complexity $M({\cal S},N)$ of a binary sequence ${\cal S}=(s_{i})_{i=0}^{\infty}$ is the smallest positive integer $M$ such that there is a polynomial $f(x_{1},\ldots,x_{M})\in\mathbb{F}_{2}[x_{1},\ldots,x_{M}]$ with

[TABLE]

see [8, 9, 15]. Obviously we have

[TABLE]

and the maximum-order complexity is a finer measure of pseudorandomness than the linear complexity.

In this paper we analyze the relationship between maximum-order complexity $M({\cal S},N)$ and the correlation measures $C_{k}({\cal S},N)$ of order $k$. Our main result is the following theorem:

Theorem 1**.**

For any binary sequence ${\cal S}$ we have

[TABLE]

Again, any nontrivial bound on $C_{k}({\cal S},N)$ for all $k$ up to a sufficiently large order provides a nontrivial bound on $M({\cal S},N)$. For example, for the Legendre sequence we get immediately

[TABLE]

see also [19, Theorem 9.3]. ($f(N)=O(g(N))$ is equivalent to $f(N)\ll g(N)$.)

We prove Theorem 1 in the next section.

The expected value of the $N$th maximum-order complexity is of order of magnitude $\log N$, see [8] as well as [15, Remark 4] and references therein. Moreover, by [1] for a ’random’ sequence of length $N$ the correlation measure $C_{k}({\cal S},N)$ is of order of magnitude $\sqrt{kN\log N}$ and thus by Theorem 1 $M({\cal S},N)\geq\frac{1}{2}\log N+O(\log\log N)$ which is in good correspondence to the result of [8].

In Section 3 we mention some straightforward extensions.

2 Proof of Theorem 1

Proof.

Assume ${\cal S}$ satisfies $(\ref{nonrek})$. If $s_{i}=...=s_{i+M-1}=0$ for some $0\leq i\leq N-M-1$, then $s_{i+M}=f(0,...,0)$. Equivalently, $(-1)^{s_{i}}=...=(-1)^{s_{i+M-1}}=1$ implies $(-1)^{s_{i+M}}=(-1)^{f(0,\ldots,0)}$. Hence, for every $i=0,...,N-M-1$ we have

[TABLE]

Summing over $i=0,...,N-M-1$ we get

[TABLE]

The left-hand side contains one ”main” term $\pm(N-M)$ and $2^{M+1}-1$ terms of the form

[TABLE]

with $0\leq j_{1}<j_{2}<...<j_{k}\leq M$ and $1\leq k\leq M+1$. Therefore we have

[TABLE]

and the result follows. ∎

3 Further Remarks

Theorem 1 can be easily extended to $m$-ary sequences with $m>2$ along the lines of [4]:

Let $\xi$ be a primitive $m$th root of unity. Then we have

[TABLE]

As in the proof of Theorem 1 we get

[TABLE]

We have one term of absolute value $N-M$ and $2m^{M}-1$ terms of the form

[TABLE]

with $1\leq h_{1},\ldots,h_{k}<m$, $0\leq j_{1}<j_{2}<\ldots<j_{k}\leq M$, $1\leq k\leq M+1$ and $\alpha\in\{1,-\xi^{f(0,\ldots,0)}\}$.

If $m$ is a prime, then $x\mapsto hx$ is a permutation of $\mathbb{Z}_{m}$ for any $h\not\equiv 0\bmod m$ and the sums in $(\ref{sum})$ can be estimated by the correlation measure $C_{k}({\cal S},N)$ of order $k$ for $m$-ary sequences as it is defined in [11] and we get

[TABLE]

If $m$ is composite, $x\mapsto hx$ is not a permutation of $\mathbb{Z}_{m}$ if $\gcd(h,m)>1$ and we have to substitute the correlation measure of order $k$ by the power correlation measure of order $k$ introduced in [4].

Now we return to the case $m=2$.

Even if the correlation measure of order $k$ is large for some small $k$, we may be still able to derive a nontrivial lower bound on the maximum-order complexity by substituting the correlation measure of order $k$ by its analog with bounded lags, see [7] for the analog of $(\ref{lincorr})$. For example, the two-prime generator ${\cal T}=(t_{i})_{i=0}^{\infty}$, see [3], of length $pq$ with two odd primes $p<q$ satisfies

[TABLE]

if $\gcd(i,pq)=1$ and its correlation measure of order $4$ is obviously close to $pq$, see [16]. However, if we bound the lags $d_{1}<\ldots<d_{k}<p$ one can derive a nontrivial upper bound on the correlation measure of order $k$ with bounded lags including $k=4$ as well as lower bounds on the maximum-order complexity using the analog of Theorem 1 with bounded lags.

Finally, we mention that the lower bound $(\ref{legmax})$ for the Legendre sequence can be extended to Legendre sequences with polynomials using the results of [5] as well as to their generalization using squares in arbitrary finite fields (of odd characteristic) using the results of [12, 18]. For sequences defined with a character of order $m$ see [11].

4 Acknowledgement

The authors are supported by the Austrian Science Fund FWF Projects F5504 and F5511-N26, respectively, which are part of the Special Research Program ”Quasi-Monte Carlo Methods: Theory and Applications”. L.I. would like to express her sincere thanks for the hospitality during her visit to RICAM.