On the $k$-error linear complexity of binary sequences derived from the discrete logarithm in finite fields

TL;DR

This paper investigates the linear complexity and $k$-error linear complexity of binary sequences derived from quadratic characters in finite fields, providing new bounds and insights especially for fields with extension degree 2.

Contribution

It establishes a lower bound on the linear complexity for sequences from finite fields with extension degree at least 2 and analyzes the $k$-error linear complexity specifically for quadratic extension fields.

Findings

Lower bound on linear complexity for $r extgreater 1$

Analysis of $k$-error linear complexity for $r=2$

Open problem for $r>2$ cases

Abstract

Let $q=p^r$ be a power of an odd prime $p$. We study binary sequences $\sigma=(\sigma_0,\sigma_1,\ldots)$ with entries in $\{0,1\}$ defined by using the quadratic character $\chi$ of the finite field $\mathbb{F}_q$: $$ \sigma_n=\left\{ \begin{array}{ll} 0,& \mathrm{if}\quad n= 0,\\ (1-\chi(\xi_n))/2,&\mathrm{if}\quad 1\leq n< q, \end{array} \right. $$ for the ordered elements $\xi_0,\xi_1,\ldots,\xi_{q-1}\in \mathbb{F}_q$. The $\sigma$ is Legendre sequence if $r=1$. Our first contribution is to prove a lower bound on the linear complexity of $\sigma$ for $r\geq 2$. The bound improves some results of Meidl and Winterhof. Our second contribution is to study the $k$-error linear complexity of $\sigma$ for $r=2$. It seems that we cannot settle the case when $r>2$ and leave it open.

Equations

$$\sigma_{n}=\left\{\begin{array}[]{ll}0,&\mathrm{if}\quad n=0,\\ (1-\chi(\xi_{n}))/2,&\mathrm{if}\quad 1\leq n<q,\end{array}\right.$$

$$\ell_{n}=\left\{\begin{array}[]{ll}0,&\mathrm{if}\,\ n\equiv 0\pmod{p},\\ \frac{1-\left(\frac{n}{p}\right)}{2},&\mathrm{otherwise},\end{array}\right.~{}~{}n\geq 0,$$

$${\xi }_n=n_1{\gamma }_1+n_2{\gamma }_2+\cdots +n_r{\gamma }_r,$$

$$n=n_1+n_{2}p+\cdots +n_r{p}^{r-1},0\le n_i<p,i=1,\dots ,r.$$

$$\sigma_{n}=\left\{\begin{array}[]{ll}0,&\mathrm{if}\quad n=0,\\ \mathrm{ind}_{\alpha,d}(\xi_{n}),&\mathrm{if}\quad 1\leq n<q,\end{array}\right.\mathrm{and}\quad\sigma_{n+q}=\sigma_{n},n\geq 0.$$

$$\sigma_{n}=\left\{\begin{array}[]{ll}0,&\mathrm{if}\quad n=0,\\ (1-\chi(\xi_{n}))/2,&\mathrm{if}\quad 1\leq n<q.\end{array}\right.$$

$$s_{n+L}=c_{L-1}{s}_{n+L-1}+\dots +c_1{s}_{n+1}+c_0{s}_n\mathrm{for}n\ge 0,$$

$$S(X)=s_0+s_{1}X+s_2{X}^2+\dots +s_{T-1}{X}^{T-1}\in \mathbb{F}[X],$$

$$L{C}^{\mathbb{F}}((s_n))=T-\mathrm{deg}\left(\gcd (X^T-1,S(X))\right),$$

$$T\ge L{C}_0^{\mathbb{F}}((s_n))\ge L{C}_1^{\mathbb{F}}((s_n))\ge \dots \ge L{C}_w^{\mathbb{F}}((s_n))=0$$

$$2^{\lambda p^{r-1}}=(1+ap{)}^{p^{r-1}}=1+a{p}^r+\dots$$

$$2^{\lambda p^w}=(1+ap{)}^{p^w}=1+a{p}^{w+1}+\dots ,$$

$$L{C}^{{\mathbb{F}}_2}(\sigma )\ge \lambda p^{r-1},$$

$${\Phi }^{(r)}(X)={\phi }_1^{(r)}(X){\phi }_2^{(r)}(X)\cdots {\phi }_{(p-1)/\lambda }^{(r)}(X).$$

$$\sigma_{i}=\sigma_{i+p^{r-1}}=\ldots=\sigma_{i+(p-1)p^{r-1}}=\left\{\begin{array}[]{ll}0,&\mathrm{if}\quad h_{i}=0,\\ 1,&\mathrm{if}\quad h_{i}=1,\end{array}\right.$$

$$L{C}^{{\mathbb{F}}_2}(\sigma )\ge \mathrm{deg}({\phi }_{i_0}^{(r)}(X))=\lambda p^{r-1}.$$

$$i\cdot T_1:=\{i(1+j\gamma ):0\le j<p\}=T_i,i=1,2,\dots ,p-1.$$

$$\chi (i)=\eta (i^{(p^2-1)/2})=\eta (1)=1.$$

$$V_i(X)=\sum _{j=0}^{p-1}{\sigma }_{i+jp}{X}^{i+jp}$$

$$L{C}_k^{{\mathbb{F}}_2}(\sigma )\ge \lambda p,$$

$$0\leq k<\left\{\begin{array}[]{ll}(p-1)^{2}/2,&\mathrm{if}\quad\chi(\gamma)=1,\\ 1+(p-1)^{2}/2,&\mathrm{if}\quad\chi(\gamma)=-1.\end{array}\right.$$

$${\Phi }^{(2)}(X)={\phi }_1^{(2)}(X){\phi }_2^{(2)}(X)\cdots {\phi }_{(p-1)/\lambda }^{(2)}(X).$$

$$S_k(X)=S(X)+E(X)\in {\mathbb{F}}_2[X],$$

$$E(X)=\sum _{0\le i<p}\left(h_i{X}^i{\Phi }^{(2)}(X)-V_i(X)\right).$$

$$E(X)=\sum _{1\le i<p}\left(X^i{\Phi }^{(2)}(X)-V_i(X)\right)$$

$$E(X)={\Phi }^{(2)}(X)-V_0(X)+\sum _{1\le i<p}{V}_i(X)=1+\sum _{1\le i<p}{V}_i(X)$$

$$V_0(X)\equiv 0(\mathrm{mod}{X}^p-1),V_i(X)\equiv w{X}^i(\mathrm{mod}{X}^p-1),$$

$$w=\left\{\begin{array}[]{ll}(p+1)/2,&\mathrm{if}\quad\chi(\gamma)=1,\\ (p-1)/2,&\mathrm{if}\quad\chi(\gamma)=-1.\end{array}\right.$$

$$LC^{\mathbb{F}_{2}}_{k}(\sigma)=\left\{\begin{array}[]{cl}p^{2}-1,&\mathrm{if}\,\ k=0,\\ p^{2}-p+1,&\mathrm{if}\,\ 1\leq k<p-1,\\ p^{2}-p,&\mathrm{if}\,\ p-1\leq k<(p-1)^{2}/2,\\ p-1,&\mathrm{if}\,\ k=(p-1)^{2}/2,\\ 0,&\mathrm{if}\,\ k\geq(p^{2}-1)/2,\end{array}\right.\\$$

$$LC^{\mathbb{F}_{2}}_{k}(\sigma)=\left\{\begin{array}[]{cl}p^{2}-p,&\mathrm{if}\,\ 0\leq k<(p-1)^{2}/2,\\ p-1,&\mathrm{if}\,\ k=(p-1)^{2}/2,\\ 0,&\mathrm{if}\,\ k\geq(p^{2}-1)/2,\end{array}\right.\\$$

Full text

[TABLE]

for the ordered elements $\xi_{0},\xi_{1},\ldots,\xi_{q-1}\in\mathbb{F}_{q}$. The $\sigma$ is Legendre sequence if $r=1$.

Our first contribution is to prove a lower bound on the linear complexity of $\sigma$ for $r\geq 2$. The bound improves some results of Meidl and Winterhof. Our second contribution is to study the $k$-error linear complexity of $\sigma$ for $r=2$. It seems that we cannot settle the case when $r>2$ and leave it open.

keyword: stream cipher; pseudorandom binary sequences; linear complexity; $k$-error linear complexity; discrete logarithm; finite field

1 Introduction

Pseudorandom sequences play an important role in cryptography. In particular in symmetric cryptography they serve as the secret key. So pseudorandom sequences are widely concerned. In this work, we begin with the Legendre sequence which has good behavior.

Let $p$ be an odd prime. The Legendre sequence $\ell=\{\ell_{0},\ell_{1},\ldots\}$ with entries in $\{0,1\}$ is defined as

[TABLE]

where $\left(\frac{\cdot}{p}\right)$ is the Legendre symbol, that is for $n$ with $p\nmid n$, $\left(\frac{n}{p}\right)=1$ if $n\equiv a^{2}\pmod{p}$ for some integer $a$ and otherwise $\left(\frac{n}{p}\right)=-1$. The Legendre sequence is extensively paid attention by many researchers. From the viewpoint of cryptography, the linear complexity (see the notion below) of it is studied in [7], the $k$-error linear complexity of it is studied in [2]111We remark that the Legendre sequence is treated as a $p$-ary sequence over $\mathbb{F}_{p}$., and other feathers are studied in the literature, see e.g., [5, 13].

It is natural to extend the Legendre symbol construction to define binary sequences from the extension field $\mathbb{F}_{q}$ of $q$ elements with $q=p^{r}$. We order the elements of $\mathbb{F}_{q}=\{\xi_{0},\xi_{1},\ldots,\xi_{q-1}\}$ as follows.

Fixing a basis $\{\gamma_{1}=1,\gamma_{2},\ldots,\gamma_{r}\}$ of $\mathbb{F}_{q}$ over $\mathbb{F}_{p}=\{0,1,\ldots,p-1\}$, we define for $0\leq n<q$,

[TABLE]

if

[TABLE]

Let $\alpha$ be a primitive element of $\mathbb{F}_{q}$ and $\mathrm{ind}_{\alpha}(\xi)\in\mathbb{Z}_{q-1}=\{0,1,\ldots,q-2\}$ the discrete logarithm of $0\neq\xi\in\mathbb{F}_{q}$ with respect to $\alpha$, i.e., $\xi=\alpha^{\mathrm{ind}_{\alpha}(\xi)}$. For any integer $d>1$, we use the notation $\mathrm{ind}_{\alpha,d}(\xi):=\mathrm{ind}_{\alpha}(\xi)\pmod{d}$. The importance of the discrete logarithm for modern cryptography is well known. The security of many public-key cryptosystems depends on the intractability of the discrete logarithm problem.

The $q$-periodic sequence $\sigma=\{\sigma_{0},\sigma_{1},\ldots\}$ with entries in $\mathbb{Z}_{d}=\{0,1,\ldots,d-1\}$ defined below has been concerned in the literature:

[TABLE]

It is clear $\sigma$ is the Legendre sequence if $r=1$ and $d=2$. The (aperiodic) autocorrelation of $\sigma$ was analyzed in [15] and the linear complexity of $\sigma$ was studied in [14, 18]. In particular, in [1, 2] the $k$-error linear complexity over $\mathbb{F}_{p}$ of $\sigma$ was investigated for $r=1$. One might ask whether it can be extended to the case $r\geq 2$ for the $k$-error linear complexity. Indeed, [4, Proposition 2] tells us that we have to change a lot of elements to get a smaller periodic sequence with small linear complexity. So this might be the reason why the authors of [1, 2] not study $\sigma$ over $\mathbb{F}_{p}$ furtherly for the case $r\geq 2$.

In this work, we pay attention to the case when $d=2$. The $\sigma$ with entries in $\{0,1\}$ in Eq.(1) can be defined equivalently by using the quadratic character $\chi$ of $\mathbb{F}_{q}$:

[TABLE]

It is easy to see that $\chi(\xi_{n})=(-1)^{\sigma_{n}}$ for $1\leq n<q$. The measures of pseudorandomness of the binary $\sigma$ was studied in [16] for more general setting. Some related problems were considered in [10, 11, 12]. In the sequel, we first prove a lower bound on the linear complexity of of $\sigma$ in Eq.(2) for $q=p^{r}$ with $r\geq 2$ in Sect.2. The bound improves some results of Meidl and Winterhof in [14, 18]. Then in Sect.3 we study its $k$-error linear complexity (over $\mathbb{F}_{2}$) of $\sigma$ for $r=2$. This is different from [1, 2], in which we remark again that the $\sigma$ is treated over $\mathbb{F}_{p}$. It seems that we cannot settle the case when $r>2$ and leave it open.

The linear complexity is an important cryptographic characteristic of sequences and provides information on predictability and thus unsuitability for cryptography. Here we give a short introduction to the linear complexity of periodic sequences. Let $\mathbb{F}$ be a field. For a $T$-periodic sequence $(s_{n})$ over $\mathbb{F}$, recall that the linear complexity over $\mathbb{F}$, denoted by $LC^{\mathbb{F}}((s_{n}))$, is the least order $L$ of a linear recurrence relation over $\mathbb{F}$

[TABLE]

which is satisfied by $(s_{n})$ and where $c_{0}\neq 0,c_{1},\ldots,c_{L-1}\in\mathbb{F}$. Let

[TABLE]

which is called the generating polynomial of $(s_{n})$. Then the linear complexity over $\mathbb{F}$ of $(s_{n})$ can be computed as

[TABLE]

which is the degree of the characteristic polynomial, $\frac{X^{T}-1}{\mathrm{gcd}(X^{T}-1,~{}S(X))}$ , of the sequence. See, e.g., [5] for details.

For a sequence to be cryptographically strong, its linear complexity should be high, but this complexity is not significantly reduced by changing a few terms. This leads to the notion of the $k$-error linear complexity. For integers $k\geq 0$, the $k$-error linear complexity over $\mathbb{F}$ of $(s_{n})$, denoted by $LC^{\mathbb{F}}_{k}((s_{n}))$, is the lowest linear complexity (over $\mathbb{F}$) that can be obtained by changing at most $k$ terms of the sequence per period (see [17], and see [6] for the related sphere complexity that was defined even earlier). Clearly, $LC^{\mathbb{F}}_{0}((s_{n}))=LC^{\mathbb{F}}((s_{n}))$, and

[TABLE]

when $w$ equals the number of nonzero terms of $(s_{n})$ per period, i.e., the weight of $(s_{n})$.

2 A lower bound on linear complexity

In this section, we prove a lower bound on linear complexity of $\sigma$ in Eq.(2) for $q=p^{r}$ and $r\geq 2$. Some results have been given in [14, 18]. Our bound in Theorem 1 below improves that in [14, 18] greatly.

Let $\mathrm{ord}_{m}(2)$ denote the order of $2$ modulo $m$, i.e., $\mathrm{ord}_{m}(2)$ is the least positive integer such that $2^{\mathrm{ord}_{m}(2)}\equiv 1\pmod{m}$.

Lemma 1**.**

Let $\mathrm{ord}_{p}(2)=\lambda$ with $1<\lambda<p$. If $2^{p-1}\not\equiv 1\pmod{p^{2}}$, then $\mathrm{ord}_{p^{r}}(2)=\lambda{p^{r-1}}$ for $r\geq 2$.

Proof. We suppose $\mathrm{ord}_{p^{r}}(2)=\mu$ . First, we write $2^{\lambda}=1+ap$ for some integer $a$ since $2^{\lambda}\equiv 1\pmod{p}$. Then we have

[TABLE]

and hence $2^{\lambda p^{r-1}}\equiv 1\pmod{p^{r}}$. This implies that $\mu$ is a divisor of $\lambda p^{r-1}$. On the other hand, since $2^{p-1}\not\equiv 1\pmod{p^{2}}$, we see that $p\nmid a$.

Second, the assumption of $2^{p-1}\not\equiv 1\pmod{p^{2}}$ implies that $\mu\geq p$. So we can write $\mu=\lambda p^{w}$ for some positive integer $w\leq r-1$. Suppose $w<r-1$. Then we derive

[TABLE]

which contradicts to $2^{\mu}=2^{\lambda p^{w}}\equiv 1\pmod{p^{r}}$. Then $w=r-1$ and hence $\mu=\lambda p^{r-1}$. So we finish the proof. ∎

Theorem 1**.**

Let $\sigma$ be the binary sequence of period $q$ defined in Eq.(2) with $q=p^{r}$ for $r\geq 2$. If $2^{p-1}\not\equiv 1\pmod{p^{2}}$, then the linear complexity of $\sigma$ satisfies

[TABLE]

where $1<\lambda<p$ is the order of $2$ modulo $p$.

Proof. From Eq.(2), it is easy to see that the least period of $\sigma$ is $q=p^{r}$, since there are $(q-1)/2$ many 1’s in the first $q$ terms of the sequence.

Let $\Phi^{(r)}(X)=1+X^{p^{r-1}}+X^{2p^{r-1}}+\ldots+X^{(p-1)p^{r-1}}\in\mathbb{F}_{2}[X]$. We see that $X^{p^{r}}-1=(X^{p^{r-1}}-1)\cdot\Phi^{(r)}(X)$ and $\Phi^{(r)}(X)$ has exactly $p^{r}-p^{r-1}$ many roots, which are $p^{r}$-th primitive elements in $\overline{\mathbb{F}}_{2}$. Then by Lemma 1, $\Phi^{(r)}(X)$ can be written as the product of $(p-1)/\lambda$ many irreduciable polynomials of degree $\lambda p^{r-1}$:

[TABLE]

We show below that there exists $i_{0}:1\leq i_{0}\leq(p-1)/\lambda$ such that $\varphi^{(r)}_{i_{0}}(X)\nmid S(X)$, where $S(X)$ is the generating polynomial of $\sigma$.

Now if we suppose $\Phi^{(r)}(X)|S(X)$ and write $S(X)=H(X)\cdot\Phi^{(r)}(X)$ for some polynomial $H(X)=h_{0}+h_{1}X+\ldots+h_{p^{r-1}-1}X^{p^{r-1}-1}\in\mathbb{F}_{2}[X]$ of degree $<p^{r-1}$. Then we derive for $0\leq i<p^{r-1}$

[TABLE]

from which we get $\sigma_{n}=\sigma_{n+p^{r-1}}$ for any integer $n$ and hence $p^{r-1}$ is the period of $\sigma$, a contradiction. Hence $\Phi^{(r)}(X)\nmid S(X)$ and there exists at least one $\varphi^{(r)}_{i_{0}}(X)$ such that $\varphi^{(r)}_{i_{0}}(X)\nmid S(X)$. Then from the notion of the characteristic polynomial of $\sigma$ or Eq.(3), we have

[TABLE]

we finish the proof. ∎

The bound is much better than that of [14, Thms.1 and 2] and [18]. We note that, Theorem 1 is indeed a general result for any $p^{r}$-periodic binary sequences over $\mathbb{F}_{2}$ and it covers almost all primes. As far as we know, the primes that satisfy $2^{p-1}\equiv 1\pmod{p^{2}}$ are very rare. It was shown that there are only two such primes222A prime $p$ satisfying $2^{p-1}\equiv 1\pmod{p^{2}}$ is called a Wieferich prime., 1093 and 3511, up to $6\times 10^{17}$ [3].

We remark again, in [4, Prop.2] for any sequences over $\mathbb{F}_{p^{m}}$ with least period $p^{r}$, the linear complexity is at least $p^{r-1}+1$. Theorem 1 is a very similar statement to [4] for binary sequences.

3 $k$-Error linear complexity

In this section we consider the $k$-error linear complexity of $\sigma$ in Eq.(2) for $q=p^{2}$.

The way in the proof of Theorem 1 can help us to give a lower bound on the $k$-error linear complexity. Below we choose $\{1,\gamma\}$ as a basis of $\mathbb{F}_{p^{2}}$ over $\mathbb{F}_{p}$ and write $\xi_{n}\in\mathbb{F}_{p^{2}}$ as $n_{1}+n_{2}\gamma$ for $n=n_{1}+n_{2}p$, where $0\leq n_{1},n_{2}<p$. We first prove two lemmas.

Lemma 2**.**

Let $T_{i}=\{i+j\gamma:0\leq j<p\}\subseteq\mathbb{F}_{p^{2}}$ for $0\leq i<p$. Then we have

[TABLE]

Proof. For each $1\leq i<p$, when $j$ runs through the set $\{0,1,\ldots,p-1\}$, so does $[ij]$, where $[ij]$ is $ij$ modulo $p$. So $i(1+j\gamma)=i+[ij]\gamma\in T_{i}$ and $i(1+j_{1}\gamma)\neq i(1+j_{2}\gamma)$ if $0\leq j_{1}\neq j_{2}<p$. We finish the proof. ∎

Lemma 3**.**

Let the vector $\overrightarrow{v_{i}}:=(\sigma_{i},\sigma_{i+p},\ldots,\sigma_{i+(p-1)p})$ for $0\leq i<p$, where the $\sigma_{n}$ is defined by Eq.(2) with $q=p^{2}$. Let $\xi_{n_{1}+n_{2}p}=n_{1}+n_{2}\gamma\in\mathbb{F}_{p^{2}}$ in Eq.(2) be defined by using a basis $\{1,\gamma\}$ over $\mathbb{F}_{p}$ for $0\leq n_{1},n_{2}<p$. Let $wt(\overrightarrow{v_{i}})$, i.e. the weight of $\overrightarrow{v_{i}}$, denote the number of 1’s in $\overrightarrow{v}_{i}$.

(1). If $\chi(\gamma)=-1$, we have $wt(\overrightarrow{v_{0}})=p-1$ and $wt(\overrightarrow{v_{i}})=(p-1)/2$ for $1\leq i<p$;

(2). If $\chi(\gamma)=1$, we have $wt(\overrightarrow{v_{0}})=0$ and $wt(\overrightarrow{v_{i}})=(p+1)/2$ for $1\leq i<p$.

Proof. We first show $\chi(i)=1$ for any $i\in\{1,2,\ldots,p-1\}\subseteq\mathbb{F}_{p^{2}}$. Since $\chi$ is the quadratic character of $\mathbb{F}_{p^{2}}$, we can write $\chi=\eta^{(p^{2}-1)/2}$, where $\eta$ is a character of order $p^{2}-1$ of $\mathbb{F}_{p^{2}}$. Then from $i^{(p^{2}-1)/2}=(i^{p-1})^{(p+1)/2}=1+ap$ for some integer $a$, we have

[TABLE]

Now from Eq.(2), we see that $\chi(\xi_{n})=(-1)^{\sigma_{n}}$ for any $0\neq\xi_{n}\in\mathbb{F}_{p^{2}}$. Hence for $1\leq i\neq j<p$, $wt(\overrightarrow{v_{i}})=wt(\overrightarrow{v_{j}})$ by Lemma 2. While from $\chi(\xi_{jp})=\chi(j\gamma)=\chi(j)\chi(\gamma)=\chi(\gamma)$ for $1\leq j<p$, we derive $wt(\overrightarrow{v_{0}})=p-1$ if $\chi(\gamma)=-1$ and otherwise $wt(\overrightarrow{v_{0}})=0$.

Finally, since there are $(p^{2}-1)/2$ many $\xi_{n}\in\mathbb{F}_{p^{2}}$ such that $\chi(\xi_{n})=1$, we have $\sum\limits_{0\leq i<p}wt(\overrightarrow{v_{i}})=(p^{2}-1)/2$ and hence $wt(\overrightarrow{v_{i}})=(p-1)/2$ for $1\leq i<p$ if $\chi(\gamma)=-1$, and otherwise $wt(\overrightarrow{v_{i}})=(p+1)/2$ for $1\leq i<p$. ∎

For $\sigma$ defined in Eq.(2) with $q=p^{2}$, write

[TABLE]

for $0\leq i<p$. Then clearly the generating polynomial $S(X)$ of $\sigma$ is $S(X)=\sum\limits_{i=0}^{p-1}V_{i}(X)$.

Theorem 2**.**

Let $\sigma$ be the binary sequence of period $q$ defined in Eq.(2) with $q=p^{2}$. Let $\xi_{n_{1}+n_{2}p}=n_{1}+n_{2}\gamma\in\mathbb{F}_{p^{2}}$ in Eq.(2) be defined by using a basis $\{1,\gamma\}$ over $\mathbb{F}_{p}$ for $0\leq n_{1},n_{2}<p$. If $2^{p-1}\not\equiv 1\pmod{p^{2}}$, then the $k$-error linear complexity of $\sigma$ satisfies

[TABLE]

where $1<\lambda<p$ is the order of $2$ modulo $p$ and

[TABLE]

Proof. By Lemma 1, $\Phi^{(2)}(X)=1+X^{p}+X^{2p}+\ldots+X^{(p-1)p}\in\mathbb{F}_{2}[X]$ is the product of $(p-1)/\lambda$ many irreduciable polynomials of degree $\lambda p$:

[TABLE]

Let $S_{k}(X)$ be a polynomial of degree smaller than $p^{2}$ over $\mathbb{F}_{2}$. We restrict that $S_{k}(X)$ has $k$ many different terms from $S(X)$, the generating polynomial of $\sigma$, that is, if we write

[TABLE]

then $E(X)$, a polynomial of degree smaller than $p^{2}$, has exactly $k$ many monomials. We want to find an $E(X)$ with smallest $k$ such that $\Phi^{(2)}(X)|S_{k}(X)$.

We suppose $S_{k}(X)=S(X)+E(X)=h(X)\Phi^{(2)}(X)$ for some $h(X)=h_{0}+h_{1}X+\ldots+h_{p-1}X^{p-1}$ of degree smaller than $p$ over $\mathbb{F}_{2}$. We derive

[TABLE]

We see that $E(X)$ contains a summation $V_{i}(X)$ if $h_{i}=0$ and $X^{i}\Phi^{(2)}(X)-V_{i}(X)$ otherwise for $0\leq i<p$ from Eq.(4) above.

If $\chi(\gamma)=1$, we have $wt(\overrightarrow{v_{0}})=0$ and $wt(\overrightarrow{v_{i}})=(p+1)/2$ for $1\leq i<p$ by Lemma 3, that is, $V_{0}(X)=0$ and $V_{i}(X)$ has $(p+1)/2$ many terms for $1\leq i<p$. So we can verify that the $E(X)$ below

[TABLE]

is with smallest $k=(p-1)^{2}/2$ terms (such that $\Phi^{(2)}(X)|S_{k}(X)$). The argument tells us that if $k<(p-1)^{2}/2$, no $E(X)$ with $k$ terms can guarantee $\Phi^{(2)}(X)|S_{k}(X)$. Then for such $k$, at least one of $\varphi^{(2)}_{1}(X),\varphi^{(2)}_{2}(X),\cdots,\varphi^{(2)}_{(p-1)/\lambda}(X)$ is not a divisor of $S_{k}(X)$, and hence $LC^{\mathbb{F}_{2}}_{k}(\sigma)\geq\lambda p$ by Eq.(3).

If $\chi(\gamma)=-1$, Lemma 3 helps us to verify that the $E(X)$ below

[TABLE]

is with smallest $k=1+(p-1)^{2}/2$ terms such that $\Phi^{(2)}(X)|S_{k}(X)$. Then following the way above, we finish the proof. ∎

Now we consider the case when $2$ is primitive modulo $p^{2}$. We need the following lemma.

Lemma 4**.**

Let $V_{i}(X)=\sum\limits_{0\leq j<p}\sigma_{i+jp}X^{i+jp}\in\mathbb{F}_{2}[X]$ for $0\leq i<p$, where the $\sigma_{n}$ is defined by Eq.(2) with $q=p^{2}$. Let $\xi_{n_{1}+n_{2}p}=n_{1}+n_{2}\gamma\in\mathbb{F}_{p^{2}}$ in Eq.(2) be defined by using a basis $\{1,\gamma\}$ over $\mathbb{F}_{p}$ for $0\leq n_{1},n_{2}<p$. We have

[TABLE]

where

[TABLE]

Proof. It is clear from Lemma 3. ∎

Theorem 3**.**

Let $\sigma$ be the binary sequence of period $q$ defined in Eq.(2) with $q=p^{2}$. Let $\xi_{n_{1}+n_{2}p}=n_{1}+n_{2}\gamma\in\mathbb{F}_{p^{2}}$ in Eq.(2) be defined by using a basis $\{1,\gamma\}$ over $\mathbb{F}_{p}$ for $0\leq n_{1},n_{2}<p$. If $\chi(\gamma)=1$ and $2$ is primitive modulo $p^{2}$, then the $k$-error linear complexity of $\sigma$ satisfies

[TABLE]

if $p\equiv 5\pmod{8}$, and

[TABLE]

if $p\equiv 3\pmod{8}$.

Proof. As before let $S(X)$ be the generating polynomial of $\sigma$. We mention that both $\Phi^{(2)}(X)=1+X^{p}+\ldots+X^{(p-1)p}$ and $1+X+\ldots+X^{p-1}$ are irreduciable, since $2$ is primitive modulo $p^{2}$.

From the proof of Theorem 2, we see that $\Phi^{(2)}(X)\nmid S(X)$ and for any $E(X)$ with $k<(p-1)^{2}/2$ many terms, $\Phi^{(2)}(X)\nmid S_{k}(X)$ for $S_{k}(X)=S(X)+E(X)$. We now consider $S(X)$ modulo $(X^{p}-1$). By Lemma 4, we have

[TABLE]

We consider the case when $p\equiv 5\pmod{8}$. From Eq.(5) we derive

(i). $S(1)=0$ and $\gcd(S(X),(X^{p^{2}}-1)/(X-1))=1$, then we have $LC^{\mathbb{F}_{2}}_{0}(\sigma)=p^{2}-1$.

(ii). $S(X)+1\equiv 1+X+\ldots+X^{p-1}\pmod{X^{p}-1}$, which indicates that $LC^{\mathbb{F}_{2}}_{1}(\sigma)=p^{2}-p+1$.

(iii). $S(X)+X+\ldots+X^{p-1}\equiv 0\pmod{X^{p}-1}$, which indicates that $LC^{\mathbb{F}_{2}}_{p-1}(\sigma)=p^{2}-p$.

Putting everything together, we prove the first statement. For the case when $p\equiv 3\pmod{8}$, we get easily that $LC^{\mathbb{F}_{2}}_{0}(\sigma)=p^{2}-p$ and then from arguments above, we prove the second statement. ∎

Similarly, we have following theorem for $\chi(\gamma)=-1$.

Theorem 4**.**

Let $\sigma$ be the binary sequence of period $q$ defined in Eq.(2) with $q=p^{2}$. Let $\xi_{n_{1}+n_{2}p}=n_{1}+n_{2}\gamma\in\mathbb{F}_{p^{2}}$ in Eq.(2) be defined by using a basis $\{1,\gamma\}$ over $\mathbb{F}_{p}$ for $0\leq n_{1},n_{2}<p$. If $\chi(\gamma)=-1$ and $2$ is primitive modulo $p^{2}$, then the $k$-error linear complexity of $\sigma$ satisfies

[TABLE]

if $p\equiv 5\pmod{8}$, and

[TABLE]

if $p\equiv 3\pmod{8}$.

Theorems 3 and 4 indicate that the sequence we considered has good stability, or in other words, its linear complexity is not significantly decreased by changing only a few (but not many) terms.

4 Final remarks

We study the linear complexity of binary sequences defined by using the quadratic character of the finite field $\mathbb{F}_{p^{r}}$ with $r\geq 2$ and its $k$-error linear complexity for $r=2$. Such sequences are an extension of Legendre sequences. It is interesting to consider the $k$-error linear complexity for $r>2$.

From the construction, we find by Lemma 3 that $\sigma_{1}=\sigma_{2}=\cdots=\sigma_{p-1}$ and $\sigma_{p}=\sigma_{2p}=\cdots=\sigma_{(p-1)p}$. This sacrifices some pseudorandomness of the sequence. So we can modify the construction as follows

[TABLE]

Then the way in this work can be used to consider the linear complexity and $k$-error linear complexity.

Finally we remark that, there is another way to order the elements in $\mathbb{F}_{q}$. Write $\mathbb{F}_{q}=\{0,1,\alpha,\alpha^{2},\ldots,\alpha^{q-2}\}$, where $\alpha$ is a primitive element of $\mathbb{F}_{q}$. The sequence $\rho=(\rho_{0},\rho_{1},\ldots)$ is defined by

[TABLE]

$\rho$ is referred to as a generalized Sidelnikov sequence, see e.g. [2], in which the $k$-error linear complexity (over $\mathbb{F}_{p}$) of $\rho$ was determined when $r=1$. So it is interesting to consider the $k$-error linear complexity (over $\mathbb{F}_{2}$) of $\rho$.

Acknowledgment

The authors wish to thank Prof. Arne Winterhof for helpful suggestions and some corrections of the proof.

The work was partially supported by the National Natural Science Foundation of China under grant No. 61772292, by the Projects of International Cooperation and Exchanges NSFC No. 6181101289, by the Provincial Natural Science Foundation of Fujian under grant No. 2018J01425 and by the Program for Innovative Research Team in Science and Technology in Fujian Province University under grant No. 2018-49.