Linear complexity of Ding-Helleseth generalized cyclotomic sequences of order eight

TL;DR

This paper precisely determines the linear complexity of Ding-Helleseth generalized cyclotomic sequences of order eight, demonstrating their high unpredictability and security suitability for cryptographic applications.

Contribution

It provides an explicit calculation of the linear complexity for DH-GCS$_{8}$ sequences using cyclotomic numbers, extending understanding of their cryptographic strength.

Findings

Linear complexity of DH-GCS$_{8}$ sequences is explicitly computed.

Results align with the lower bound $(pq-1)/2$, indicating high security.

SageMath code examples validate the theoretical findings.

Abstract

During the last two decades, many kinds of periodic sequences with good pseudo-random properties have been constructed from classical and generalized cyclotomic classes, and used as keystreams for stream ciphers and secure communications. Among them are a family DH-GCS$_{d}$ of generalized cyclotomic sequences on the basis of Ding and Helleseth's generalized cyclotomy, of length $pq$ and order $d=\mathrm{gcd}(p-1,q-1)$ for distinct odd primes $p$ and $q$. The linear complexity (or linear span), as a valuable measure of unpredictability, is precisely determined for DH-GCS$_{8}$ in this paper. Our approach is based on Edemskiy and Antonova's computation method with the help of explicit expressions of Gaussian classical cyclotomic numbers of order $8$. Our result for $d=8$ is compatible with Yan's low bound $(pq-1)/2$ of the linear complexity for any order $d$, which means high enough to resist security attacks of the Berlekamp-Massey algorithm. Finally, we include SageMath codes to illustrate the validity of our result by examples.

Tables

Table 1. Table 1: 64 ​ ( 4 , j ) 8 64 subscript 4 𝑗 8 64(4,j)_{8} for 0 ⩽ j ⩽ 3 0 𝑗 3 0\leqslant j\leqslant 3

	${\left(\frac{2}{p}\right)}_4=1$		${\left(\frac{2}{p}\right)}_4\ne 1$
	$p\equiv 1\left(\mathrm{mod}16\right)$	$p\equiv 9\left(\mathrm{mod}16\right)$	$p\equiv 1\left(\mathrm{mod}16\right)$	$p\equiv 9\left(\mathrm{mod}16\right)$
$64{(4,0)}_8$	$p-7-2x+8a$	$p-15-2x$	$p-7-10x$	$p-15-10x-8a$
$64{(4,1)}_8$	$p+1+2x-4a$	$p-7+2x+4a$	$p+1+2x-4a+16y$	$p-7+2x+4a+16y$
$64{(4,2)}_8$	$p+1-2x$	$p-7-2x-8a$	$p+1+6x+8a$	$p-7+6x$
$64{(4,3)}_8$	$p+1+2x-4a$	$p-7+2x+4a$	$p+1+2x-4a-16y$	$p-7+2x+4a-16y$

Table 2. Table 2: { X , Y } 𝑋 𝑌 \{X,Y\} with X + Y 𝑋 𝑌 X+Y and X ​ Y 𝑋 𝑌 XY given in GF ​ ( 4 ) GF 4 \mathrm{GF}(4)

	$0$	$1$	$\mu$	$\mu +1$
$0$	$\left\{0\right\}$	$\left\{1\right\}$	$\left\{\mu +1\right\}$	$\left\{\mu \right\}$
$1$	$\{0,1\}$	$\{\mu ,\mu +1\}$	$\{\eta ,\eta +1\}$	$\{{\eta }^2,{\eta }^2+1\}$
$\mu$	$\{0,\mu \}$	$\{{\eta }^3+\eta ,{\eta }^3+{\eta }^2\}$	$\{{\eta }^3+\eta +1,$	$\{1,\mu +1\}$
			${\eta }^3+{\eta }^2+1\}$
$\mu +1$	$\{0,\mu +1\}$	$\{{\eta }^3,{\eta }^3+{\eta }^2+\eta +1\}$	$\{1,\mu \}$	$\{{\eta }^3+1,{\eta }^3+{\eta }^2+\eta \}$

Table 3. Table 3: B 8 → ​ ( γ ) = ( s 8 , j ) j = 0 7 → subscript 𝐵 8 𝛾 superscript subscript subscript 𝑠 8 𝑗 𝑗 0 7 \overrightarrow{B_{8}}(\gamma)=(s_{8,j})_{j=0}^{7} up to transformations σ h subscript 𝜎 ℎ \sigma_{h}

	$q\mathrm{mod}16$	$\overrightarrow{B_8}\left(\gamma \right)$
${\left(\frac{2}{q}\right)}_8=1$	$1$	$(0,0,0,0,1,1,1,1)$
	$9$	$(0,1,0,1,1,0,1,0)$
${\left(\frac{2}{q}\right)}_4=1\ne {\left(\frac{2}{q}\right)}_8$	$1$	$(\mu ,\mu ,\mu ,\mu ,\mu +1,\mu +1,\mu +1,\mu +1)$
	$9$	$(\mu ,\mu +1,\mu ,\mu +1,\mu +1,\mu ,\mu +1,\mu )$
${\left(\frac{2}{q}\right)}_4\ne 1$	$1$	$(\eta ,{\eta }^2,{\eta }^2+1,\eta ,\eta +1,{\eta }^2+1,{\eta }^2,\eta +1)$ or
		$({\eta }^2,\eta ,\eta +1,{\eta }^2,{\eta }^2+1,\eta +1,\eta ,{\eta }^2+1)$
	$9$	$(\eta ,\eta ,{\eta }^2,{\eta }^2,\eta +1,\eta +1,{\eta }^2+1,{\eta }^2+1)$ or
		$({\eta }^2,{\eta }^2,\eta ,\eta ,{\eta }^2+1,{\eta }^2+1,\eta +1,\eta +1)$

Table 4. Table 4: B 8 → ​ ( γ ) + σ − ind g ( q ) ​ p ​ ( B 8 → ​ ( γ ) ) = ( s 8 , j + s 8 , j ′ ) j = 0 7 → subscript 𝐵 8 𝛾 subscript 𝜎 superscript subscript ind 𝑔 𝑞 𝑝 → subscript 𝐵 8 𝛾 superscript subscript subscript 𝑠 8 𝑗 subscript 𝑠 8 superscript 𝑗 ′ 𝑗 0 7 \overrightarrow{B_{8}}(\gamma)+\sigma_{-\mathrm{ind}_{g}^{(q)}p}(\overrightarrow{B_{8}}(\gamma))=(s_{8,j}+s_{8,j^{\prime}})_{j=0}^{7} up to transformations σ h subscript 𝜎 ℎ \sigma_{h}

	${\left(\frac{2}{q}\right)}_4=1$	${\left(\frac{2}{q}\right)}_4\ne 1$
${\mathrm{ind}}_g^{\left(q\right)}p\equiv 0$ $\mathrm{mod}8$	$(0,0,0,0,0,0,0,0)$
${\mathrm{ind}}_g^{\left(q\right)}p\equiv 4$ $\mathrm{mod}8$	$(1,1,1,1,1,1,1,1)$
${\mathrm{ind}}_g^{\left(q\right)}p\equiv \pm 2$ $\mathrm{mod}8$	$(1,1,0,0,1,1,0,0)$	$(\mu ,\mu ,\mu +1,\mu +1,\mu ,\mu ,\mu +1,\mu +1)$
${\mathrm{ind}}_g^{\left(q\right)}p\equiv \pm 1$ $\mathrm{mod}8$, $q\equiv 1\left(\mathrm{mod}16\right)$	$(1,0,0,0,1,0,0,0)$	$(\mu ,1,\mu +1,1,\mu ,1,\mu +1,1)$
${\mathrm{ind}}_g^{\left(q\right)}p\equiv \pm 3$ $\mathrm{mod}8$, $q\equiv 9\left(\mathrm{mod}16\right)$
${\mathrm{ind}}_g^{\left(q\right)}p\equiv \pm 1$ $\mathrm{mod}8$, $q\equiv 9\left(\mathrm{mod}16\right)$	$(1,1,1,0,1,1,1,0)$	$(\mu ,0,\mu +1,0,\mu ,0,\mu +1,0)$
${\mathrm{ind}}_g^{\left(q\right)}p\equiv \pm 3$ $\mathrm{mod}8$, $q\equiv 1\left(\mathrm{mod}16\right)$

Table 5. Table 5: The value of | { 0 ⩽ i , j ⩽ 7 : s i , j = 0 } | / 64 conditional-set formulae-sequence 0 𝑖 𝑗 7 subscript 𝑠 𝑖 𝑗 0 64 |\{0\leqslant i,j\leqslant 7:s_{i,j}=0\}|/64

	${\left(\frac{2}{p}\right)}_8=1$	${\left(\frac{2}{p}\right)}_4=1\ne {\left(\frac{2}{p}\right)}_8$	${\left(\frac{2}{p}\right)}_4\ne 1$
${\left(\frac{2}{q}\right)}_4=1$ or ${\left(\frac{p}{q}\right)}_4=1$	$\frac{1}{2}$	$0$	$0$
${\left(\frac{2}{q}\right)}_4\ne 1$ and ${\left(\frac{p}{q}\right)}_2=1\ne {\left(\frac{p}{q}\right)}_4$	$0$	$\frac{1}{2}$
${\left(\frac{2}{q}\right)}_4\ne 1$ and ${\left(\frac{p}{q}\right)}_2\ne 1$	$\frac{1}{4}$

Table 6. Table 6: Examples of ( p , q ) 𝑝 𝑞 (p,q) for all ( Res ​ ( 2 , p ) , Res ​ ( 2 , q ) , Res ​ ( p , q ) ) Res 2 𝑝 Res 2 𝑞 Res 𝑝 𝑞 (\mathrm{Res}(2,p),\mathrm{Res}(2,q),\mathrm{Res}(p,q))

$\mathrm{Res}(2,p)$	$\mathrm{Res}(2,q)$	$\mathrm{Res}(p,q)=1$	$\mathrm{Res}(p,q)=2$	$\mathrm{Res}(p,q)=4$	$\mathrm{Res}(p,q)=8$
$2$	$2$	$(17,41)$	$(17,137)$	$(17,457)$	$(17,409)$
	$4$	$(17,617)$	$(17,281)$	$(17,1481)$	$(41,2273)$
	$8$	$(17,73)$	$(17,89)$	$(41,73)$	$(17,1721)$
$4$	$2$	$(113,137)$	$(113,521)$	$(113,41)$	$(113,313)$
	$4$	$(113,1097)$	$(113,1049)$	$(113,2473)$	$(113,1033)$
	$8$	$(113,73)$	$(113,233)$	$(113,1801)$	$(113,1721)$
$8$	$2$	$(73,17)$	$(73,41)$	$(73,809)$	$(73,137)$
	$4$	$(73,113)$	$(73,593)$	$(73,353)$	$(73,1889)$
	$8$	$(73,233)$	$(73,1217)$	$(73,89)$	$(73,2969)$

Table 7. Table 7: L ​ ( p , q ) 𝐿 𝑝 𝑞 L(p,q) for primes p , q ⩽ D = 500 𝑝 𝑞 𝐷 500 p,q\leqslant D=500 with gcd ​ ( p − 1 , q − 1 ) = 8 gcd 𝑝 1 𝑞 1 8 \mathrm{gcd}(p-1,q-1)=8

$p$	$q$	$L(p,q)$	$L(q,p)$	$p$	$q$	$L(p,q)$	$L(q,p)$	$p$	$q$	$L(p,q)$	$L(q,p)$
17	41	696	696	17	73	1204	916	17	89	1468	764
17	137	2328	2328	17	233	3844	2916	17	281	4776	2536
17	313	5320	5320	17	409	6952	6952	17	457	7768	7768
41	73	2956	2956	41	89	3604	2724	41	97	3976	3976
41	113	4632	4632	41	137	5616	5616	41	193	7912	7912
41	233	9436	7116	41	257	10408	7848	41	313	12832	12832
41	337	13648	13648	41	353	14472	14472	41	409	16768	16768
41	433	17752	17752	41	449	18408	18408	41	457	18736	18736
73	89	3248	3248	73	113	4180	8212	73	137	5068	9964
73	233	8504	8504	73	257	9380	9380	73	281	10396	20476
73	353	13060	25732	73	401	29236	29236	73	449	24676	32740
89	97	8588	8588	89	113	5084	10012	89	137	9156	12148
89	193	12908	17132	89	233	10368	10368	89	241	16124	21404
89	257	11436	11436	89	281	12644	24964	89	313	20948	27812
89	337	14996	14996	89	401	35644	35644	89	409	18404	36356
89	433	28988	38492	89	449	20204	39916	89	457	30596	40628
97	137	13288	13288	97	233	22484	16916	97	281	27256	20536
113	137	11672	15480	113	233	26212	13220	113	313	35368	35368
113	409	34792	46216	113	457	38872	51640	137	193	26440	26440
137	233	31804	23916	137	241	33016	33016	137	257	35080	35080
137	281	38496	19456	137	313	42880	42880	137	337	46000	23152
137	353	48360	36392	137	401	54936	54936	137	433	59320	59320
137	449	61512	61512	137	457	62608	62608	193	233	44852	33716
193	281	54232	40792	233	241	56036	56036	233	257	29940	29940
233	281	32876	65356	233	313	54716	72812	233	337	39260	39260
233	353	41300	82132	233	401	70116	93316	233	409	71516	95180
233	433	50660	100772	233	449	78516	104500	233	457	106364	106364
257	281	36248	72088	257	313	60344	80312	257	409	78872	104984
257	457	58952	117320	281	313	44272	87952	281	353	99192	99192
281	409	57808	114928	281	433	91432	121672	281	457	96496	128416
313	353	110488	83032	313	401	125512	125512	313	449	140536	140536
353	409	108472	144376	353	457	121192	161320	401	409	164008	164008
401	457	183256	183256	409	449	183640	183640	449	457	205192	205192

Equations

$${\mathbb{Z}}_{pq}=\mathbb{Z}/(pq\mathbb{Z})=\{[m\mathrm{mod}pq]:m\in \mathbb{Z}\},$$

$${\mathbb{Z}}_{pq}^{\ast }=\{[m\mathrm{mod}pq]:m\in \mathbb{Z},\gcd (m,pq)=1\}.$$

$$g^u{f}^v\equiv g^{u^{\prime }}{f}^{v^{\prime }}(\mathrm{mod}pq)\Rightarrow u\equiv u^{\prime }(\mathrm{mod}e)\text{ and }v\equiv v^{\prime }(\mathrm{mod}d).$$

$$D_i=\{[g^{i+dt}{f}^v\mathrm{mod}pq]:t=0,1,\dots ,\frac{e}{d}-1;v=0,1,\dots ,d-1\}\subseteq {\mathbb{Z}}_{pq}^{\ast },$$

$$D_i^{(p)}$$

$$Q_i=q{D}_i^{(p)}$$

$$D_i^{(q)}$$

$$P_i=p{D}_i^{(q)}$$

$$s_i=\{\begin{array}{ll}1,& \text{if }[i\mathrm{mod}pq]\in {\bigcup }_{j=d/2}^{d-1}(D_j\cup P_j\cup Q_j),\\ 0,& \text{otherwise}.\end{array}$$

$$\frac{d}{2}(e+\frac{q-1}{d}+\frac{p-1}{d})=\frac{1}{2}(pq-1)$$

$$L(p,q)$$

$$-(p-1)(q-1)\cdot \{\begin{array}{ll}\frac{1}{2},& \text{if }{\left(\frac{2}{p}\right)}_8=1={\left(\frac{2}{q}\right)}_4=1,\\ \frac{1}{2},& \text{if }{\left(\frac{2}{p}\right)}_8=1\ne {\left(\frac{2}{q}\right)}_4\text{ and }{\left(\frac{p}{q}\right)}_4=1,\\ \frac{1}{2},& \text{if }{\left(\frac{2}{p}\right)}_4=1\ne {\left(\frac{2}{p}\right)}_8,{\left(\frac{2}{q}\right)}_4\ne 1\text{ and }{\left(\frac{p}{q}\right)}_2=1\ne {\left(\frac{p}{q}\right)}_4,\\ \frac{1}{4},& \text{if }{\left(\frac{2}{p}\right)}_4=1\ne {\left(\frac{2}{q}\right)}_4\text{ and }{\left(\frac{p}{q}\right)}_2\ne 1,\\ 0,& \text{otherwise}.\end{array}$$

$$s_i+c_1{s}_{i-1}+c_2{s}_{i-2}+\cdots +c_L{s}_{i-L}=0,\text{ for any }i⩾L.$$

$$m(x)=1+c_{1}x+\cdots +c_L{x}^L$$

$$m(x)$$

$$L(s^{\infty })=\mathrm{deg}(m(x))$$

$$m(x)$$

$$L(s^{\infty })$$

$$S(x)=\sum _{j=d/2}^{d-1}(\sum _{u\in D_j}{x}^u+\sum _{u\in P_j}{x}^u+\sum _{u\in Q_j}{x}^u).$$

$$S_d(x)=\sum _{u\in D_0^{(p)}}{x}^u=\sum _{t=0}^{\frac{p-1}{d}-1}{x}^{g^{dt}},T_d(x)=\sum _{u\in D_0^{(q)}}{x}^u=\sum _{t=0}^{\frac{q-1}{d}-1}{x}^{g^{dt}},$$

$$\sum _{u\in D_{i,j}}{\alpha }^{ku}=S_d({\beta }^{k{g}^{i-{\mathrm{ind}}_g^{(p)}q}})T_d({\gamma }^{k{g}^{j-{\mathrm{ind}}_g^{(q)}p}}),$$

$$S({\alpha }^k)=\sum _{t=d/2}^{d-1}(T_d({\gamma }^{k{g}^{t-{\mathrm{ind}}_g^{(q)}p}}){\delta }_p(k)+T_d({\gamma }^{k{g}^t})+S_d({\beta }^{k{g}^t})).$$

$${\sigma }_u(a_1,a_2,\dots ,a_r)=(a_{u+1},a_{u+2},\dots ,a_r,a_1,a_2,\dots ,a_u)$$

$$\overrightarrow{S_d}(x)$$

$$\overrightarrow{T_d}(x)$$

$$\overrightarrow{A_d}(x)$$

$$(s_{i,d}{)}_{i=0}^{d-1}=\overrightarrow{A_d}(\beta )=\sum _{t=d/2}^{d-1}{\sigma }_t(\overrightarrow{S_d}(\beta )),(s_{d,j}{)}_{j=0}^{d-1}=\overrightarrow{B_d}(\gamma )=\sum _{t=d/2}^{d-1}{\sigma }_t(\overrightarrow{T_d}(\gamma )),$$

$$(s_{d,j}+s_{d,j^{\prime }}{)}_{j=0}^{d-1}=\overrightarrow{B_d}(\gamma )+{\sigma }_{-{\mathrm{ind}}_g^{(q)}p}(\overrightarrow{B_d}(\gamma )).$$

$$L(s^{\infty })$$

$$-\frac{q-1}{d}\cdot |\{0⩽j⩽d-1:s_{d,j}=0\}|-\{\begin{array}{ll}1& \text{if }p\equiv q(\mathrm{mod}4),\\ 0& \text{otherwise}.\end{array}$$

$$m(x)=(x^{pq}-1)/(\mathbf{d}(x)\prod _{\begin{array}{c}0⩽i,j⩽d-1,\\ s_{i,j}=0\end{array}}{\mathbf{D}}_{i,j}(x)\prod _{\begin{array}{c}0⩽j⩽d-1,\\ s_{d,j}=0\end{array}}{\mathbf{P}}_{j-{\mathrm{ind}}_g^{(q)}p}(x)\prod _{\begin{array}{c}0⩽i⩽d-1,\\ s_{i,d}=0\end{array}}{\mathbf{Q}}_{i-{\mathrm{ind}}_g^{(p)}q}(x)).$$

$$\overrightarrow{S_d}({\beta }^{\prime })$$

$$\overrightarrow{T_d}({\gamma }^{\prime })$$

$$(i,j{)}_d$$

$$=|\{(u,v)\in {\mathbb{Z}}^2:g^{i+du}+1\equiv g^{j+dv}(\mathrm{mod}p),0⩽u,v<\frac{p-1}{d}\}|.$$

$$S_d({\beta }^{g^i})S_d({\beta }^{g^{i+d/2}})$$

Full text

1 Introduction

Pseudo-random sequences are widely used in many fields such as simulation, software testing, channel coding, ranging systems, radar systems, global positioning systems, spread-spectrum communication systems, code-division multiple-access systems, and especially in stream ciphers and secure communications. When employed for cryptography, they should possess certain unpredictable properties, especially with a high linear complexity. The definition of linear complexity (or linear span) is the length $L$ of the shortest linear feedback shift register (LFSR) that generates the sequence. Since the Berlekamp–Massey algorithm [3, 18] can deduce the whole sequence from a knowledge of just $2L$ consecutive digits, a “high” linear complexity $L$ should be at least one half of the length (or minimum period) of the sequence.

Certain cyclotomic sequences, such as Legendre sequences and Hall’s sextic residue sequences, possess good pseudo-random properties (especially with high linear complexities [8, 15]), and have been widely used as keystreams in private-key cryptosystems. Nowadays, a well-known technique to design a sequence with a high linear complexity is based on classical or generalized cyclotomy [4]. There are many kinds of generalized cyclotomic sequences, binary and non-binary, of different lengths. One family of them are based on Whiteman’s generalized cyclotomy [20], of length $pq$ for distinct odd primes $p$ and $q$, with a high linear complexity precisely determined when $\mathrm{gcd}(p-1,q-1)=2^{k}$ [6, 1, 22]. However, the imbalance (with $q-p-1$ more $1$’s than [math]’s in each period) makes them improper for applications.

Another family of generalized cyclotomic sequences of length $pq$ and order $d=\mathrm{gcd}(p-1,q-1)$, denoted by DH-GCSd in this paper, are based on Ding and Helleseth’s generalized cyclotomy [7]. (Also see [12] for a unified approach to Whiteman’s and Ding-Helleseth’s generalized cyclotomy.) The linear complexity of DH-GCSd when $d=2$, $4$, $6$ is explicitly determined in [2, 23, 11], and ensured by Yan [21] to be at least $(pq-1)/2$ for any order $d$. We contribute to this line by calculating the linear complexity of DH-GCS8, using the computation method of Edemskiy and Antonova [10, 11] with the help of Gaussian classical cyclotomic numbers.

First let us introduce the definition of the Ding-Helleseth generalized cyclotomic sequences DH-GCSd.

Let $p$ and $q$ be distinct odd primes with $d=\mathrm{gcd}(p-1,q-1)$.

• 2.

Let $e=\mathrm{lcm}(p-1,q-1)=(p-1)(q-1)/d$.

• 3.

By the Chinese remainder theorem, take a common primitive root $g$ of both $p$ and $q$, and take an integer $f$ such that $f\equiv g$ $(\mathrm{mod}\ p)$ and $f\equiv 1$ $(\mathrm{mod}\ q)$.

• 4.

Let $\mathbb{Z}_{pq}^{*}$ denote the multiplicative group consisting of all invertible elements in the residue ring

[TABLE]

where $[m\ \mathrm{mod}\ pq]$ denotes the residue class of $m$ modulo $pq$. Then

[TABLE]

Whiteman [20] proved that every element of $\mathbb{Z}_{pq}^{*}$ can be written uniquely of the form $[g^{u}f^{v}$ $\mathrm{mod}\ pq]$ with $u\in\{0,1,\dots,e-1\}$ and $v\in\{0,1,\dots,d-1\}$. Here the uniqueness means that

[TABLE]

Definition**.**

[7]* Ding-Helleseth generalized cyclotomic classes* of order $d$ with respect to $(p,q,g)$ are

[TABLE]

where $i\in\mathbb{Z}$, and let

[TABLE]

If $i\equiv j$ $(\mathrm{mod}\ d)$, then $D_{i}=D_{j}$, $P_{i}=P_{j}$ and $Q_{i}=Q_{j}$. These definitions concern only $[i\ \mathrm{mod}\ d]$.

• 2.

If $i\not\equiv j$ $(\mathrm{mod}\ d)$, then $D_{i}\cap D_{j}=P_{i}\cap P_{j}=Q_{i}\cap Q_{j}=\O$ (the empty set).

• 3.

$|D_{i}|=e$, $|P_{i}|=|D_{i}^{(q)}|=(q-1)/d$, and $|Q_{i}|=|D_{i}^{(p)}|=(p-1)/d$.

• 4.

$\mathbb{Z}_{pq}^{*}=\bigcup_{i=0}^{d-1}D_{i}$, and $\mathbb{Z}_{pq}=\{[0\ \mathrm{mod}\ pq]\}\cup\bigcup_{i=0}^{d-1}(D_{i}\cup P_{i}\cup Q_{i})$.

The Ding-Helleseth generalized cyclotomic sequence of order $d$ (DH-GCSd) with respect to $(p,q,g)$ is defined (cf. [2, 23, 11]) as the sequence $s^{\infty}=(s_{i})_{i\geqslant 0}=(s_{0},s_{1},s_{2},\dots,s_{i},\dots)$ with

[TABLE]

This sequence possesses the minimum period $pq$, and the almost balance of

[TABLE]

symbols $1$’s and $\frac{1}{2}(pq+1)$ symbols [math]’s in a period.

Our main result, an explicit expression of the linear complexity of DH-GCS8 in terms of $p$ and $q$, can be stated in the following Theorem 1, and will be proved in Section 4.

Theorem 1**.**

Given primes $p,q$ with $\mathrm{gcd}(p-1,q-1)=8$, regardless of the choice of a common primitive root $g$ of theirs, the linear complexity of the Ding-Helleseth generalized cyclotomic sequence with respect $(p,q,g)$ is

[TABLE]

Here $\left(\frac{c}{p}\right)_{k}$ denotes the $k$-th power symbol. Namely, $\left(\frac{c}{p}\right)_{k}=1\Leftrightarrow$ there exists an integer $u$ such that $u^{k}\equiv c\not\equiv 0$ $(\mathrm{mod}\ p)$.

2 Computation methods

For a sequence $s^{\infty}=(s_{i})_{i\geqslant 0}=(s_{0},s_{1},s_{2},\dots,s_{i},\dots)$ over a field $F$, its linear complexity (or linear span) $L(s^{\infty})$ is defined as the least positive integer $L$ such that there exists constants $c_{1},c_{2},\dots,c_{L}\in F$ satisfying

[TABLE]

If such $L$ do not exist, let $L(s^{\infty})=\infty$. For a ultimately periodic sequence, such $L$ exists. A corresponding polynomial

[TABLE]

with $L=L(s^{\infty})<\infty$ is called the minimal polynomial of the sequence $s^{\infty}$.

For a periodic sequence $s^{\infty}=(s_{i})_{i\geqslant 0}$ of period $N$, let $S(x)=s_{0}+s_{1}x+s_{2}x^{2}+\cdots s_{N-1}x^{N-1}$. Then the minimal polynomial and linear complexity of $s^{\infty}$ can be given by [17]:

[TABLE]

Moreover, assume that $s^{\infty}$ is binary (i.e., $F=\mathrm{GF}(2)$) and $N$ is odd. Let $\alpha$ be a primitive $N$-th root of unity in an extension field of $\mathrm{GF}(2)$. Then $X^{N}-1=\prod_{k=0}^{N-1}(X-\alpha^{k})$, and

[TABLE]

For the Ding-Helleseth generalized cyclotomic sequence DH-GCSd with minimum period $N=pq$,

[TABLE]

Let us recall a method of Edemskiy and Antonova [10, 11] to compute the linear complexity of DH-GCSd.

Let $\alpha$ be a primitive $pq$-th root of unity in an extension field of $\mathrm{GF}(2)$.

• 2.

Let $\beta=\alpha^{q}$ and $\gamma=\alpha^{p}$. Then $\beta$ (resp. $\gamma$) is a primitive $p$-th (resp. $q$-th) root of unity.

Definition**.**

Let us introduce the cyclotomic polynomials

[TABLE]

and quote from [9, 11] the following properties for $i,j\in\{0,1,\dots,d-1\}$ and $k\in\mathbb{Z}$:

$\sum_{u\in D_{i}^{(p)}}\beta^{u}=S_{d}(\beta^{g^{i}})=S_{d}(\beta^{g^{i+dk}})$, and $\sum_{u\in D_{i}^{(q)}}\gamma^{u}=T_{d}(\gamma^{g^{i}})=T_{d}(\gamma^{g^{i+dk}})$.

• 2.

$\sum_{i=0}^{d-1}S_{d}(\beta^{g^{i}})=\sum_{i=0}^{d-1}T_{d}(\gamma^{g^{i}})=1$.

• 3.

$\sum_{u\in Q_{i}}\alpha^{ku}=S_{d}(\beta^{kg^{i}})$, and $\sum_{u\in P_{i}}\alpha^{ku}=T_{d}(\gamma^{kg^{i}})$.

• 4.

Let $D_{i,j}=\{[g^{j+dt}f^{i-j}\ \mathrm{mod}\ pq]:t=0,1,\dots,\frac{e}{d}-1\}\subseteq D_{j}$. Then $\bigcup_{i=0}^{d-1}D_{i,j}=D_{j}$, $[D_{i,j}\ \mathrm{mod}\ p]\subseteq D_{i}^{(p)}$, $[D_{i,j}\ \mathrm{mod}\ q]\subseteq D_{j}^{(q)}$, and

[TABLE]

where $\mathrm{ind}_{g}^{(q)}p$ denotes the discrete logarithm of $p$ in the field $\mathrm{GF}(q)$ relative to the basis $g$, i.e., $p\equiv g^{\mathrm{ind}_{g}^{(q)}p}$ $(\mathrm{mod}\ q)$, and similarly $q\equiv g^{\mathrm{ind}_{g}^{(p)}q}(\mathrm{mod}\ p)$.

Lemma 2** ([11, Theorem 1]).**

Let $k\in\mathbb{Z}$ and $\delta_{p}(k)=\begin{cases}1,&\text{if }k\not\equiv 0\ (\mathrm{mod}\ p),\\ 0&\text{if }k\equiv 0\ (\mathrm{mod}\ p).\end{cases}$ Then

[TABLE]

Definition**.**

For $s^{\infty}=$ DH-GCSd, define a matrix $\mathbb{S}=(s_{i,j})_{i,j=0}^{d}$ of order $d+1$ as follows.

Let $s_{i,j}=S(\alpha^{k})$ if $[k\ \mathrm{mod}\ pq]\in D_{i,j}$ with $0\leqslant i,j\leqslant d-1$. As $[k\ \mathrm{mod}\ p]\in D_{i}^{(p)}$ and $[k\ \mathrm{mod}\ q]\in D_{j}^{(q)}$, $s_{i,j}=\sum_{t=d/2}^{d-1}(T_{d}(\gamma^{g^{j+t-\mathrm{ind}_{g}^{(q)}p}})\delta+T_{d}(\gamma^{g^{j+t}})+S_{d}(\beta^{g^{i+t}}))$.

• 2.

Let $s_{i,d}=S(\alpha^{k})$ if $[k\ \mathrm{mod}\ pq]\in Q_{i-\mathrm{ind}_{g}^{(p)}q}$ with $0\leqslant i\leqslant d-1$. As $[k\ \mathrm{mod}\ p]\in D_{i}^{(p)}$ and $k\equiv 0$ $(\mathrm{mod}\ q)$, $s_{i,d}=\sum_{t=d/2}^{d-1}(T_{d}(1)+T_{d}(1)+S_{d}(\beta^{g^{i+t}}))=\sum_{t=\frac{d}{2}}^{d-1}S_{d}(\beta^{g^{i+t}})$.

• 3.

Let $s_{d,j}=S(\alpha^{k})$ if $[k\ \mathrm{mod}\ pq]\in P_{j-\mathrm{ind}_{g}^{(q)}p}$ with $0\leqslant j\leqslant d-1$. As $[k\ \mathrm{mod}\ q]\in D_{j}^{(q)}$ and $k\equiv 0$ $(\mathrm{mod}\ p)$, $S_{d}(1)=|D_{0}^{(p)}|=\frac{p-1}{d}$ and $s_{d,j}=\sum_{t=d/2}^{d-1}T_{d}(\gamma^{g^{j+t}})+\frac{p-1}{2}$.

• 4.

Let $s_{d,d}=S(\alpha^{0})=S(1)=\sum_{t=d/2}^{d-1}(T_{d}(1)+S_{d}(1))=\frac{p-1}{2}+\frac{q-1}{2}=\begin{cases}0&\text{if }p\equiv q\ (\mathrm{mod}\ 4),\\ 1&\text{otherwise}.\end{cases}$

Definition 3**.**

For a vector $(a_{1},a_{2},\dots,a_{r})$, define a transformation $\sigma_{u}$ by

[TABLE]

for an integer $0\leqslant u<r$. For any $u^{\prime}\in\mathbb{Z}$ with $u^{\prime}\equiv u$ $(\mathrm{mod}\ r)$, define $\sigma_{u^{\prime}}=\sigma_{u}$. Let

[TABLE]

Proposition 4**.**

If $4\mid d=\mathrm{gcd}(p-1,q-1)$, then we have $s_{d,d}=0$,

[TABLE]

and $s_{i,j}=s_{i,d}+s_{d,j}+s_{d,j^{\prime}}$ for $0\leqslant i,j,j^{\prime}\leqslant d-1$ with $j^{\prime}\equiv j-\mathrm{ind}_{g}^{(q)}p$ $(\mathrm{mod}\ d)$. Note that

[TABLE]

Lemma 5**.**

To calculate the linear complexity and minimal polynomial of $s^{\infty}=$ DH-GCSd*, it suffices to determine the zero elements of the matrix $\mathbb{S}$. As $|D_{i,j}|=e/d$, $|Q_{i}|=(p-1)/d$, $|P_{j}|=(q-1)/d$, we have*

[TABLE]

Let $\mathbf{d}(x)=\begin{cases}x-1&\text{if }p\equiv q\ (\mathrm{mod}\ 4),\\ 1&\text{otherwise},\end{cases}$ $\mathbf{D}_{i,j}(x)={\displaystyle\prod_{k\in D_{i,j}}(x-\alpha^{k})}$, $\mathbf{P}_{j}(x)={\displaystyle\prod_{k\in P_{j}}}(x-\alpha^{k})$, and $\mathbf{Q}_{i}(x)={\displaystyle\prod_{k\in Q_{i}}}(x-\alpha^{k})$, then the minimal polynomial of DH-GCSd* is*

[TABLE]

The choice of a primitive $pq$-th root $\alpha$ of unity gives some flexibility for our computation.

Lemma 6**.**

For any $h,l\in\{0,1,2,\dots,d-1\}$, take any $k\in D_{h,l}$, and let $\alpha^{\prime}=\alpha^{k}$, $\beta^{\prime}=(\alpha^{\prime})^{q}=\beta^{g^{h}}$, $\gamma^{\prime}=(\alpha^{\prime})^{p}=\gamma^{g^{l}}$. Then $\alpha^{\prime}$, $\beta^{\prime}$, $\gamma^{\prime}$ are primitive $pq$-th, $p$-th, $q$-th root of unity respectively. Note that $S_{d}((\beta^{\prime})^{g^{i}})=S_{d}(\beta^{g^{i+h}})$, and $T_{d}((\gamma^{\prime})^{g^{i}})=T_{d}(\gamma^{g^{i+l}})$ for $0\leqslant i\leqslant d-1$. Therefore,

[TABLE]

In the following computation, $\overrightarrow{S_{d}}(\beta)$, $\overrightarrow{A_{d}}(\beta)$, $\overrightarrow{T_{d}}(\gamma)$ and $\overrightarrow{B_{d}}(\gamma)$ can be written freely up to transformations of the form $\sigma_{h}$, by some good choice of $\alpha$.

For an even divisor $d$ of $p-1$, the values of $S_{d}(\beta^{g^{i}})=\sum_{t=0}^{\frac{p-1}{d}-1}\beta^{g^{i+dt}}$ (with $0\leqslant i\leqslant d-1$) can be deduced from the values of $S_{d/2}(\beta^{g^{j}})=\sum_{t=0}^{\frac{p-1}{d/2}-1}\beta^{g^{j+\frac{d}{2}t}}$ (with $0\leqslant j\leqslant d/2-1$) by the following lemma read off from [9, §3], with the help of classical cyclotomic numbers of order $d$, introduced by Gauss in his famous book “Disquisitiones Arithmeticae” [14], defined as

[TABLE]

For fixed $(p,g)$, note that $(i,j)_{d}$ depends only on the residue classes $[i\ \mathrm{mod}\ d]$ and $[j\ \mathrm{mod}\ d]$.

Lemma 7**.**

For $0\leqslant i\leqslant d/2-1$, we have $S_{d}(\beta^{g^{i}})+S_{d}(\beta^{g^{i+d/2}})=S_{d/2}(\beta^{g^{i}})$ and

[TABLE]

Proof.

By definition, $S_{d}(\beta^{g^{i}})+S_{d}(\beta^{g^{i+d/2}})=\sum_{t=0}^{\frac{p-1}{d}-1}(\beta^{g^{i+dt}}+\beta^{g^{i+d/2+dt}})=\sum_{t=0}^{\frac{p-1}{d/2}-1}\beta^{g^{i+\frac{d}{2}t}}=S_{d/2}(\beta^{g^{i}})$, and $S_{d}(\beta^{g^{i}})S_{d}(\beta^{g^{i+d/2}})=\sum_{u,v=0}^{\frac{p-1}{d}-1}\beta^{g^{i+du}+g^{i+d/2+dv}}$. For fixed integers $0\leqslant j<d$ and $0\leqslant t<\frac{p-1}{d}$, as $g^{i+du}+g^{i+d/2+dv}\equiv g^{j+dt}$ $(\mathrm{mod}\ p)$ $\Leftrightarrow$ $1+g^{d/2+d(v-u)}\equiv g^{j-i+d(t-u)}$ $(\mathrm{mod}\ p)$, we see that

[TABLE]

As $g^{i+du}+g^{i+d/2+dv}\equiv 0$ $(\mathrm{mod}\ p)$ $\Leftrightarrow$ $g^{d/2+d(v-u)}\equiv-1\equiv g^{\frac{p-1}{2}}$ $(\mathrm{mod}\ p)$ $\Leftrightarrow$ $d/2+d(v-u)\equiv\frac{p-1}{2}$ $(\mathrm{mod}\ p-1)$ $\Leftrightarrow$ $v-u\equiv\frac{1}{2}(\frac{p-1}{d}-1)$ $(\mathrm{mod}\ \frac{p-1}{d})$, we see that

[TABLE]

Also note that $1+g^{d/2+du}\equiv g^{k+dv}\ (\mathrm{mod}\ p)\Leftrightarrow g^{-d/2-du}+1\equiv g^{k-d/2+d(v-u)}\ (\mathrm{mod}\ p)$, so $(d/2,k)_{d}=(-d/2,k-d/2)_{d}=(d/2,k+d/2)_{d}$, and in particular $(d/2,j-i)_{d}=(d/2,j+d/2-i)_{d}$. In all, we have

[TABLE]

Corollary 8**.**

Suppose that $\overrightarrow{A_{d}}(\beta)=(c_{0},c_{1},c_{2}\dots,c_{d-1})$. Then $c_{0}=\sum_{t=d/2}^{d-1}S_{d}(\beta^{g^{t}})$, and

[TABLE]

Proof.

By definition, $c_{i}=\sum_{t=d/2}^{d-1}S_{d}(\beta^{g^{i+t}})$ for $0\leqslant i\leqslant d-1$. So $c_{i+1}-c_{i}=S_{d}(\beta^{i+d})-S_{d}(\beta^{i+d/2})=S_{d}(\beta^{i})+S_{d}(\beta^{i+d/2})=S_{d/2}(\beta^{g^{i}})$ for $0\leqslant i\leqslant d-2$. Then the last expression for $c_{j}$ is clear. ∎

3 Calculation of $\overrightarrow{A_{8}}(\beta)$

In this section we calculate $\overrightarrow{A_{8}}(\beta)$ (up to transformations $\sigma_{h}$), by Lemma 7 and Corollary 8, from the values of $S_{4}(\beta^{g^{j}})$ and the Gaussian classical cyclotomic numbers $(4,j)_{8}$ for $0\leqslant j\leqslant 3$.

Let $p=x^{2}+4y^{2}=a^{2}+2b^{2}\equiv 1$ $(\mathrm{mod}\ 8)$ be a prime for integers $x$, $y$, $a$, $b$ with $x\equiv a\equiv 1$ $(\mathrm{mod}\ 4)$.

• 2.

As $x^{2}\equiv a^{2}\equiv 1\equiv p$ $(\mathrm{mod}\ 8)$, we have $y\equiv b\equiv 0$ $(\mathrm{mod}\ 2)$.

• 3.

As $p\equiv x^{2}$ $(\mathrm{mod}\ 16)$, we have $p\equiv 1$ $(\mathrm{mod}\ 16)$ $\Leftrightarrow x\equiv 1$ $(\mathrm{mod}\ 8)$; $p\equiv 9$ $(\mathrm{mod}\ 16)$ $\Leftrightarrow x\equiv 5$ $(\mathrm{mod}\ 8)$.

Gauss proved in 1828 that (see his Werke Vol II [13]):

$\left(\frac{2}{p}\right)_{4}=1$ $\Leftrightarrow$ $y\equiv 0$ $(\mathrm{mod}\ 4)$ $\Leftrightarrow$ $a\equiv 1$ $(\mathrm{mod}\ 8)$; $\left(\frac{2}{p}\right)_{4}\neq 1$ $\Leftrightarrow$ $y\equiv 2$ $(\mathrm{mod}\ 4)$ $\Leftrightarrow$ $a\equiv 5$ $(\mathrm{mod}\ 8)$.

As $p\equiv 1$ $(\mathrm{mod}\ 8)$, $2$ is a quadratic residue modulo $p$. Let $2\equiv g^{2u}$ $(\mathrm{mod}\ p)$ with $u\in\mathbb{Z}$. As

[TABLE]

$S_{2}(\beta^{g^{i}})\in\{0,1\}$ for $i\in\{0,1\}$. Moreover, $S_{2}(\beta)+S_{2}(\beta^{g})=1$. So $(S_{2}(\beta),S_{2}(\beta^{g}))=(1,0)$ or $(0,1)$. As

[TABLE]

(see [5, §11]), by Lemma 7, we can solve $\overrightarrow{S_{4}}(\beta)$ as follows.

Lemma 9** ([9, §3.1]).**

Up to transformations $\sigma_{h}$ (by a good choice of $\alpha$ as in Lemma 6), we have

[TABLE]

Here $\mu$ is a root of the equation $\mu^{2}+\mu+1=0$ in $\mathrm{GF}(2^{2})=\{0,1,\mu,\mu+1\}$.

From [16, Appendix] we read off Gaussian classical cyclotomic numbers $(4,j)_{8}$ for $0\leqslant j\leqslant 3$ as in Table 1. This table uses a particular choice for the sign of $y=\pm\sqrt{\frac{p-x^{2}}{4}}$ (determined by the choice of the primitive root $g$ modulo $p$), which makes no difference for our result of $\overrightarrow{A_{8}}(\beta)$.

From values of $S_{4}(\beta^{g^{j}})$ and $(4,j)_{8}$ for $0\leqslant j\leqslant 3$ as above, Lemma 7 gives the values of $S_{8}(\beta^{i})+S_{8}(\beta^{i+4})$ and $S_{8}(\beta^{i})S_{8}(\beta^{i+4})$ for $0\leqslant i\leqslant 3$ in $\mathrm{GF}(4)=\{0,1,\mu,\mu+1\}$. So the sets $\{S_{8}(\beta^{i}),S_{8}(\beta^{i+4})\}$ lie in Table 2, a list the sets $\{X,Y\}$ with values of $X+Y$ and $XY$ given in $\mathrm{GF}(4)$.

Here $\eta$ is a root of the equation $\eta^{2}+\eta=\mu$ in $\mathrm{GF}(2^{4})$. Note that $\eta$ is also a root of the equation $\eta^{4}+\eta+1=0$, and $\mathrm{GF}(2^{4})=\{\sum_{i=0}^{3}\lambda_{i}\eta^{i}:\lambda_{i}=0,1\}$.

Now we calculate $\overrightarrow{A_{8}}(\beta)$ in four cases according to $[p$ $\mathrm{mod}\ 16]$ and $\left(\frac{2}{p}\right)_{4}$.

3.1 Case: $p\equiv 1$ $(\mathrm{mod}\ 16)$ and $\left(\frac{2}{p}\right)_{4}=1$

$p\equiv 1$ $(\mathrm{mod}\ 16)$ $\Leftrightarrow$ $x\equiv 1$ $(\mathrm{mod}\ 8)$.

• 2.

$\left(\frac{2}{p}\right)_{4}=1$ $\Leftrightarrow$ $y\equiv 0$ $(\mathrm{mod}\ 4)$ $\Leftrightarrow$ $a\equiv 1$ $(\mathrm{mod}\ 8)$.

• 3.

$a^{2}\equiv 1$ $(\mathrm{mod}\ 16)$ $\Rightarrow 2b^{2}\equiv 0$ $(\mathrm{mod}\ 16)$ $\Rightarrow b\equiv 0$ $(\mathrm{mod}\ 4)$.

Let $x=8x_{1}+1$, $y=4y_{1}$, $a=8a_{1}+1$, and $b=4b_{1}$, with integers $x_{1}$, $y_{1}$, $a_{1}$ and $b_{1}$. Note that $p=(8x_{1}+1)^{2}+4(4y_{1})^{2}=(8a_{1}+1)^{2}+2(4b_{1})^{2}$ $\Rightarrow$ $16(x_{1}-a_{1})\equiv 32b_{1}^{2}$ $(\mathrm{mod}\ 64)$ $\Rightarrow$ $(x_{1}-a_{1})\equiv 2b_{1}^{2}$ $(\mathrm{mod}\ 4)$. So $x_{1}\equiv a_{1}$ $(\mathrm{mod}\ 2)$. Therefore,

[TABLE]

By a good choice of $\alpha$, we may assume

[TABLE]

Note that $S_{8}(\beta)+S_{8}(\beta^{g^{4}})=1$, and $S_{8}(\beta)S_{8}(\beta^{g^{4}})=(4,0)_{8}=y_{1}$. So

[TABLE]

• 2.

For $i\in\{1,3\}$, $S_{8}(\beta^{g^{i}})+S_{8}(\beta^{g^{i+4}})=0$, and $S_{8}(\beta^{g^{i}})S_{8}(\beta^{g^{i+4}})=(4,1)_{8}=(4,3)_{8}$. So

[TABLE]

• 3.

Note that $S_{8}(\beta^{g^{2}})+S_{8}(\beta^{g^{6}})=0$. So

[TABLE]

Let $c_{0}=\sum_{t=4}^{7}S_{8}(\beta^{g^{t}}).$ Always we have $c_{0}=y_{1}\mu$ or $y_{1}\mu+1$. By Corollary 8,

[TABLE]

Therefore, up to transformations $\sigma_{h}$, we have

[TABLE]

3.2 Case: $p\equiv 9$ $(\mathrm{mod}\ 16)$ and $\left(\frac{2}{p}\right)_{4}=1$

$p\equiv 9$ $(\mathrm{mod}\ 16)$ $\Leftrightarrow$ $x\equiv 5$ $(\mathrm{mod}\ 8)$.

• 2.

$\left(\frac{2}{p}\right)_{4}=1$ $\Leftrightarrow$ $y\equiv 0$ $(\mathrm{mod}\ 4)$ $\Leftrightarrow$ $a\equiv 1$ $(\mathrm{mod}\ 8)$.

• 3.

$a^{2}\equiv 1$ $(\mathrm{mod}\ 16)$ $\Rightarrow 2b^{2}\equiv 8$ $(\mathrm{mod}\ 16)$ $\Rightarrow b\equiv 2$ $(\mathrm{mod}\ 4)$.

Let $x=8x_{1}+5$, $y=4y_{1}$, $a=8a_{1}+1$, and $b=4b_{1}+2$, with integers $x_{1}$, $y_{1}$, $a_{1}$ and $b_{1}$. Note that $p=(8x_{1}+5)^{2}+4(4y_{1})^{2}=(8a_{1}+1)^{2}+2(4b_{1}+2)^{2}$ $\Rightarrow$ $16x_{1}+25\equiv 16a_{1}+32b_{1}(b_{1}+1)+9$ $(\mathrm{mod}\ 64)$ $\Rightarrow$ $a_{1}\equiv x_{1}+1$ $(\mathrm{mod}\ 4)$.

Note that $(4,1)_{8}-(4,2)_{8}=4x+12a=(32x_{1}+96a_{1}+32)/64\equiv(32+96)a_{1}/64\equiv 0$ $(\mathrm{mod}\ 2)$, and

[TABLE]

By a good choice of $\alpha$, we may assume

[TABLE]

Note that $S_{8}(\beta)+S_{8}(\beta^{g^{4}})=0$, and

[TABLE]

• 2.

For $i\in\{1,2,3\}$, $S_{8}(\beta^{g^{i}})+S_{8}(\beta^{g^{i+4}})=1$, and

[TABLE]

Let $c_{0}=\sum_{t=4}^{7}S_{8}(\beta^{g^{t}})$. Always we have $c_{0}=(y_{1}+1)\mu$ or $(y_{1}+1)\mu+1$. By Corollary 8,

[TABLE]

Therefore, up to transformations $\sigma_{h}$, we have

[TABLE]

3.3 Case: $p\equiv 1$ $(\mathrm{mod}\ 16)$ and $\left(\frac{2}{p}\right)_{4}\neq 1$

$p\equiv 1$ $(\mathrm{mod}\ 16)$ $\Leftrightarrow$ $x\equiv 1$ $(\mathrm{mod}\ 8)$.

• 2.

$\left(\frac{2}{p}\right)_{4}\neq 1$ $\Leftrightarrow$ $y\equiv 2$ $(\mathrm{mod}\ 4)$ $\Leftrightarrow$ $a\equiv 5$ $(\mathrm{mod}\ 8)$.

• 3.

$a^{2}\equiv 9$ $(\mathrm{mod}\ 16)$ $\Rightarrow 2b^{2}\equiv 8$ $(\mathrm{mod}\ 16)$ $\Rightarrow b\equiv 2$ $(\mathrm{mod}\ 4)$.

Let $x=8x_{1}+1$, $y=4y_{1}+2$, $a=8a_{1}+5$ and $b=4b_{1}+2$, with integers $x_{1}$, $y_{1}$, $a_{1}$ and $b_{1}$. Note that $p=(8x_{1}+1)^{2}+4(4y_{1}+2)^{2}=(8a_{1}+5)^{2}+2(4b_{1}+2)^{2}$ $\Rightarrow x_{1}-a_{1}\equiv 1$ $(\mathrm{mod}\ 4)$. Also note that

[TABLE]

By a good choice of $\alpha$, we may assume

[TABLE]

Note that $S_{8}(\beta)+S_{8}(\beta^{g^{4}})=\mu$, and

[TABLE]

• 2.

Note that $S_{8}(\beta^{g^{2}})+S_{8}(\beta^{g^{6}})=\mu+1$, and

[TABLE]

• 3.

Note that $S_{8}(\beta^{g})+S_{8}(\beta^{g^{5}})=1$, and

[TABLE]

• 4.

Note that $S_{8}(\beta^{g^{3}})+S_{8}(\beta^{g^{7}})=1$, and

[TABLE]

Note that $S_{8}(\beta^{g^{4}})+S_{8}(\beta^{g^{6}})\in\{\eta,\eta+1,\eta^{2},\eta^{2}+1\}$, and $S_{8}(\beta^{g^{5}})+S_{8}(\beta^{g^{7}})\in\{\mu,\mu+1\}$. Let $c_{0}=\sum_{t=4}^{7}S_{8}(\beta^{g^{t}})$. Always we have $c_{0}\in\{\eta,\eta+1,\eta^{2},\eta^{2}+1\}$. By Corollary 8,

[TABLE]

Therefore, when $p\equiv 1$ $(\mathrm{mod}\ 16)$ and $\left(\frac{2}{p}\right)_{4}\neq 1$, up to transformations $\sigma_{h}$, we have

[TABLE]

3.4 Case: $p\equiv 9$ $(\mathrm{mod}\ 16)$ and $\left(\frac{2}{p}\right)_{4}\neq 1$

$p\equiv 9$ $(\mathrm{mod}\ 16)$ $\Leftrightarrow$ $x\equiv 5$ $(\mathrm{mod}\ 8)$.

• 2.

$\left(\frac{2}{p}\right)_{4}\neq 1$ $\Leftrightarrow$ $y\equiv 2$ $(\mathrm{mod}\ 4)$ $\Leftrightarrow$ $a\equiv 5$ $(\mathrm{mod}\ 8)$.

• 3.

$a^{2}\equiv 9$ $(\mathrm{mod}\ 16)$ $\Rightarrow 2b^{2}\equiv 0$ $(\mathrm{mod}\ 16)$ $\Rightarrow b\equiv 0$ $(\mathrm{mod}\ 4)$.

Let $x=8x_{1}+5$, $y=4y_{1}+2$, $a=8a_{1}+5$ and $b=4b_{1}$, with integers $x_{1}$, $y_{1}$, $a_{1}$ and $b_{1}$. Note that $p=(8x_{1}+5)^{2}+4(4y_{1}+2)^{2}=(8a_{1}+5)^{2}+2(4b_{1})^{2}$ $\Rightarrow x_{1}-a_{1}+1\equiv 2b_{2}^{2}$ $(\mathrm{mod}\ 4)$. Also note that

[TABLE]

By a good choice of $\alpha$, we may assume

[TABLE]

Note that $S_{8}(\beta)+S_{8}(\beta^{g^{4}})=\mu$, and

[TABLE]

• 2.

Note that $S_{8}(\beta^{g^{2}})+S_{8}(\beta^{g^{6}})=\mu+1$, and

[TABLE]

• 3.

Note that $S_{8}(\beta^{g})+S_{8}(\beta^{g^{5}})=0$, so

[TABLE]

• 4.

Note that $S_{8}(\beta^{g^{3}})+S_{8}(\beta^{g^{7}})=0$, so

[TABLE]

Note that $S_{8}(\beta^{g^{4}})+S_{8}(\beta^{g^{6}})\in\{\eta,\eta+1,\eta^{2},\eta^{2}+1\}$, and $S_{8}(\beta^{g^{5}})+S_{8}(\beta^{g^{7}})=1$. Let $c_{0}=\sum_{t=4}^{7}S_{8}(\beta^{g^{t}})$. Always we have $c_{0}\in\{\eta,\eta+1,\eta^{2},\eta^{2}+1\}$. By Corollary 8,

[TABLE]

Therefore, when $p\equiv 9$ $(\mathrm{mod}\ 16)$ and $\left(\frac{2}{p}\right)_{4}\neq 1$, up to transformations $\sigma_{h}$, we have

[TABLE]

In view of the above four cases, we get the following criterion for $\left(\frac{2}{p}\right)_{8}=1$.

Proposition 10**.**

Let $p=x^{2}+4y^{2}$ be an odd prime with $p\equiv 1$ $(\mathrm{mod}\ 8)$ and integers $x$,$y$. Let $g$ be a primitive root modulo $p$, $\beta$ be a primitive $p$-th roots of unity in an extension field of $\mathrm{GF}(2)$, $S_{8}(\beta^{g^{i}})=\sum_{t=0}^{\frac{p-1}{8}-1}\beta^{g^{i+8t}}$ and $s_{i,8}=\sum_{v=4}^{7}S_{8}(\beta^{g^{i+v}})$ for $0\leqslant i\leqslant 7$. Then the following conditions are equivalent.

(1)$$\left(\frac{2}{p}\right)_{8}=1, i.e., $2$ is an octic residue modulo $p$.

$(2)$* $S_{8}(\beta^{g^{i}})\in\{0,1\}$ for any $0\leqslant i\leqslant 7$.*

$(3)$* $s_{i,8}\in\{0,1\}$ for any $0\leqslant i\leqslant 7$.*

$(4)$* Either $p\equiv 1$ $(\mathrm{mod}\ 16)$ and $y\equiv 0$ $(\mathrm{mod}\ 8)$, or $p\equiv 9$ $(\mathrm{mod}\ 16)$ and $y\equiv 4$ $(\mathrm{mod}\ 8)$.*

Proof.

$(1)\Rightarrow(2)$: As $\left(\frac{2}{p}\right)_{8}=1$, let $2\equiv g^{8u}$ $(\mathrm{mod}\ p)$ with $u\in\mathbb{Z}$. For $0\leqslant i\leqslant 7$. $S_{8}(\beta^{g^{i}})^{2}=S_{8}(\beta^{2g^{i}})=S_{8}(\beta^{g^{i+8u}})=S_{8}(\beta^{g^{i}})$, so $S_{8}(\beta^{i})\in\{0,1\}$.

$(2)\Rightarrow(3)$ is obvious. $(3)\Leftrightarrow(4)$ by the above expressions of $\overrightarrow{A_{8}}(\beta)=(s_{0,8},s_{1,8},\dots,s_{7,8})$ in four cases.

$(4)\Rightarrow(1)$: Let $2\equiv g^{l}$ $(\mathrm{mod}\ p)$ with $l\in\mathbb{Z}$. Note that

[TABLE]

When $(4)$ holds, we may assume $(s_{i,8})_{i=0}^{7}=(0,0,0,0,1,1,1,1)$ or $(0,1,0,1,1,0,1,0)$, which should be invariant under the action of $\sigma_{l}$. So $l\equiv 0$ $(\mathrm{mod}\ 8)$, and thus $\left(\frac{2}{p}\right)_{8}=1$. ∎

4 Linear complexity of DH-GCS8

This section is a proof of Theorem 1. Let $s^{\infty}$ be the Ding-Helleseth generalized cyclotomic sequence DH-GCS8, with the matrix $\mathbb{S}=(s_{i,j})_{0\leqslant i,j\leqslant 8}$. Note that $s_{8,8}=0$ as $p\equiv q\equiv 1$ $(\mathrm{mod}\ 8)$, by Lemma 5,

[TABLE]

where $s_{i,j}=s_{i,8}+s_{8,j}+s_{8,j^{\prime}}$ for $j^{\prime}\in\{0,1,\dots,7\}$ with $j^{\prime}\equiv j-\mathrm{ind}_{g}^{(q)}p$ $(\mathrm{mod}\ 8)$.

Section 3 gives explicit expressions of $\overrightarrow{A_{8}}(\beta)=(s_{i,8})_{i=0}^{7}$. Clearly, if we replace $p$ by $q$, and replace $\beta$ by $\gamma$, then we get $\overrightarrow{B_{8}}(\gamma)=(s_{8,j})_{j=0}^{7}$ as in Table 3.

Therefore, $\overrightarrow{B_{8}}(\gamma)+\sigma_{-\mathrm{ind}_{g}^{(q)}p}(\overrightarrow{B_{8}}(\gamma))=(s_{8,j}+s_{8,j^{\prime}})_{j=0}^{7}$ are as in Table 4, with

[TABLE]

Note that $|\{0\leqslant i\leqslant 7:s_{i,8}=0\}|=\begin{cases}4,&\text{if }\left(\frac{2}{p}\right)_{8}=1,\\ 0,&\text{otherwise},\end{cases}$ and $|\{0\leqslant j\leqslant 7:s_{8,j}=0\}|=\begin{cases}4,&\text{if }\left(\frac{2}{q}\right)_{8}=1,\\ 0,&\text{otherwise}.\end{cases}$

For $0\leqslant i\leqslant 7$,

[TABLE]

• 2.

For $0\leqslant j,j^{\prime}\leqslant 7$ with $j^{\prime}\equiv j-\mathrm{ind}_{g}^{(q)}p$ $(\mathrm{mod}\ 8)$,

[TABLE]

Especially when $\left(\frac{2}{q}\right)_{4}\neq 1$ and $\left(\frac{p}{q}\right)_{2}\neq 1$,

[TABLE]

Therefore, we count pairs $(i,j)$ in $\{0,1,\dots,7\}^{2}$ satisfying $0=s_{i,j}=s_{i,8}+s_{8,j}+s_{8,j^{\prime}}$ as in Table 5.

In fact, the above argument gives an accounting of the zeros in the matrix $\mathbb{S}=(s_{i,j})_{i,j=0}^{8}$, and can be easily translated into the statement of Theorem 1. Moreover, the result can be rewritten more precisely as the following Theorem 11.

Theorem 11**.**

The linear complexity of the Ding-Helleseth generalized cyclotomic sequence of length $pq$ and order $\mathrm{gcd}(p-1,q-1)=8$ for primes $p$ and $q$ is

[TABLE]

Remark*.*

The twelve cases in Theorem 11 all happen for some primes $p$ and $q$ with $\mathrm{gcd}(p-1,q-1)=8$. Indeed, if we define a function

[TABLE]

for $c\in\mathbb{Z}$ and a prime $p\equiv 1$ $(\mathrm{mod}\ 8)$, then the three values of $\mathrm{Res}(2,p)\in\{2,4,8\}$, $\mathrm{Res}(2,q)\in\{2,4,8\}$ and $\mathrm{Res}(p,q)\in\{1,2,4,8\}$ are independent, with examples in Table 6. Note here that $\left(\frac{2}{p}\right)_{2}=\left(\frac{2}{q}\right)_{2}=1$ as $p\equiv q\equiv 1$ $(\mathrm{mod}\ 8)$.

5 Verifying examples by SageMath

This section illustrates the validity of Theorem 1 by testing examples, with the help of SageMath [19], a free open-source mathematics software system based on Python and many open-source packages. Let us write down SageMath codes to compute two things:

The linear complexity as $LC(p,q,g)=pq-\mathrm{deg}(\mathrm{gcd}(x^{pq}-1,\sum_{i=0}^{pq-1}s_{i}x^{i}))$, for the Ding-Helleseth generalized cyclotomic sequence DH-GCS${}_{d}=(s_{i})_{i=0}^{\infty}$ with respect to odd primes $p,q$ and a common primitive root $g$ of theirs, where $d=\mathrm{gcd}(p-1,q-1)$.

⬇

def LC(p,q,g):

f = mod(g,p).crt(mod(1,q)); K.<x> = GF(2)[]

d = gcd(p-1,q-1); e = (p-1)*(q-1)/d; S = 0

**for** i **in** **range**(d/2,d):

    **for** t **in** **range**(e/d):

        gidt = g^(i+d*t)

        **for** v **in** **range**(d): S = S + x^((gidt * f^v)%(p*q))

    **for** t **in** **range**((p-1)/d): S = S + x^(q * (g^(i+d*t)%p))

    **for** t **in** **range**((q-1)/d): S = S + x^(p * (g^(i+d*t)%q))

**return** p*q - gcd(x^(p*q)-1,S).degree()

• 1.

The result $L(p,q)$ in Theorem 1 for odd primes $p$ and $q$ with $8=d=\mathrm{gcd}(p-1,q-1)$.

⬇

def L(p,q):

rp = mod(2,p).log(); rq = mod(2,q).log(); rpq = mod(p,q).log();

L = p*q - 1

**if** rq%8==0: L = L - (q-1)/2

**if** rp%8==0:

    L = L - (p-1)/2

    **if** rq%4==0 **or** rpq%4==0: L = L - (p-1)*(q-1)/2

**if** rp%8==4 **and** rq%4!=0 **and** rpq%4==2: L = L - (p-1)*(q-1)/2

**if** rp%4==0 **and** rq%4!=0 **and** rpq%2==1: L = L - (p-1)*(q-1)/4

**return** L

The following SageMath codes verify Theorem 1 for odd primes $p,q\leqslant D$ with a common primitive root $g$ given randomly.

⬇

D = 500; import random

for p in prime_range(D):

**for** q **in** prime_range(p,D):

    **if** gcd(p-1,q-1) != 8: **continue**

    Lpq = L(p,q); Lqp = L(q,p)

    R = random.randint(0,p*q)

    **for** g **in** **range**(R,R+p*q):

        mp = mod(g,p).is_primitive_root()

        mq = mod(g,q).is_primitive_root()

        **if** mp == mq == True: **break**

    **if** LC(p,q,g) != Lpq:

        **print** ("Wrong␣for␣p␣=␣%s,␣q␣=␣%s,␣g␣=␣%s" % (p,q,g))

    **if** LC(q,p,g) != Lqp:

        **print** ("Wrong␣for␣p␣=␣%s,␣q␣=␣%s,␣g␣=␣%s" % (q,p,g))

    **else**:

        **print** ("p=%3s,␣q=%3s,␣g=%6s,␣L(p,q)=%6s,␣L(q,p)=%6s" %

               (p,q,g,Lpq,Lqp))

Without installation of SageMath, one can simply run the above codes online in SageMathCell or CoCalc. There is a shared web page of the codes and the output of a run on CoCalc:

https://cocalc.com/share/6ac1f09c-5057-4be6-bd80-8bd567792ee9/Pub.sagews?viewer=share

6 Conclusion

This paper precisely determines the linear complexity of the Ding-Helleseth generalized cyclotomic sequence DH-GCS8 of length $pq$, explicit in terms of $p$ and $q$, as in Theorem 1 or Theorem 11. Especially we obtain the following facts.

The linear complexity is independent of the choice of a common primitive root $g$ of $p$ and $q$.

• 2.

The linear complexity has an expression

[TABLE]

with $\varepsilon,\kappa\in\{\frac{1}{2},0\}$ and $\eta\in\{\frac{1}{2},\frac{1}{4},0\}$ depending only on the values of $\mathrm{Res}(2,p),\mathrm{Res}(2,q)\in\{2,4,8\}$ and $\mathrm{Res}(p,q)\in\{1,2,4,8\}$.

• 3.

The linear complexity is no less than $pq-1-\frac{1}{2}(p-1+q-1+(p-1)(q-1))=\frac{pq-1}{2}$, which confirms the low bound in Yan [21]. This is a high linear complexity to resist security attacks of the Berlekamp–Massey algorithm.

We can also read off the minimal polynomial $m(x)$ of DH-GCS8 from our calculation. For given primes $p$ and $q$ with $\mathrm{gcd}(p-1,q-1)=8$, by a good choice of a primitive $pq$-th root $\alpha$ of unity in an extension field of $\mathrm{GF}(2)$, the matrix $\mathbb{S}=(s_{i,j})_{i,j=0}^{8}$ can be precisely determined by the expressions of $\overrightarrow{A_{8}}(\beta)=(s_{i,8})_{i=0}^{7}$ in Section 3, $\overrightarrow{B_{8}}(\gamma)=(s_{8,j})_{j=0}^{7}$ in Table 3, and $\overrightarrow{B_{8}}(\gamma)+\sigma_{-\mathrm{ind}_{g}^{(q)}p}(\overrightarrow{B_{8}}(\gamma))=(s_{8,j}+s_{8,j^{\prime}})_{j=0}^{7}$ in Table 4. Then

[TABLE]

where $\mathbf{D}_{i,j}(x)=\prod_{k\in D_{i,j}}(x-\alpha^{k})$, $\mathbf{P}_{j}(x)=\prod_{k\in P_{j}}(x-\alpha^{k})$, and $\mathbf{Q}_{i}(x)=\prod_{k\in Q_{i}}(x-\alpha^{k})$.

In the end, let us list the linear complexity $L(p,q)$ for all primes $p,q\leqslant D=500$ with $\mathrm{gcd}(p-1,q-1)=8$, given by SageMath. This list can extend to much larger $D$, but we choose $D=500$ just because of the limitation of space to write here.