Note about the linear complexity of new generalized cyclotomic binary sequences of period $2p^n$

TL;DR

This paper investigates the linear complexity of newly proposed generalized cyclotomic binary sequences with period 2p^n, extending previous results and discussing related conjectures to understand their cryptographic strength.

Contribution

It generalizes prior findings on the linear complexity of these sequences and explores the validity of the author's conjecture.

Findings

Extended the analysis of linear complexity to broader classes of sequences.

Provided evidence supporting or refuting the conjecture.

Enhanced understanding of the sequences' cryptographic properties.

Abstract

This paper examines the linear complexity of new generalized cyclotomic binary sequences of period $2p^n$ recently proposed by Yi Ouang et al. (arXiv:1808.08019v1 [cs.IT] 24 Aug 2018). We generalize results obtained by them and discuss author's conjecture of this paper.

Equations

$$L(s^{\infty})=N-\deg\Big{(}\gcd\big{(}x^{N}-1,S(x)\big{)}\Big{)}.$$

$$L(s^{\infty})=2p^{n}-\deg\Big{(}\gcd\big{(}(x^{p^{n}}-1)^{2},S(x)\big{)}\Big{)}.$$

$$\begin{array}{rl}& D_0^{(p^j)}=\left\{g^{t\cdot d_j}(\mathrm{mod}{p}^j)|0\le t<e\right\},\text{ and }\\ & D_i^{(p^j)}=g^i{D}_0^{(p^j)}=\left\{g^{i}x(\mathrm{mod}{p}^j):x\in D_0^{(p^j)}\right\},1\le i<d_j,\\ & D_0^{(2p^j)}=\left\{g^{t\cdot d_j}(\mathrm{mod}2p^j)|0\le t<e\right\},\text{ and }\\ & D_i^{(2p^j)}=g^i{D}_0^{(p^j)}=\left\{g^{i}x(\mathrm{mod}2p^j):x\in D_0^{(2p^j)}\right\},1\le i<d_j.\end{array}$$

$${\mathbb{Z}}_{p^m}=\bigcup _{j=1}^m\bigcup _{i=0}^{d_j-1}{p}^{m-j}{D}_i^{(p^j)}\cup \{0\}.$$

$$\mathbb{Z}_{2p^{m}}=\bigcup_{j=1}^{m}p^{m-j}\Bigl{(}\bigcup_{i=0}^{d_{j}-1}D^{(p^{j})}_{i}\cup 2D^{(p^{j})}_{i}\Bigr{)}\cup\{0\}\cup\{p^{m}\}.$$

$$\mathcal{C}_{0}^{(2p^{n})}=\bigcup_{j=1}^{n}\bigcup_{i=d_{j}/2}^{d_{j}-1}p^{n-j}\Bigl{(}D^{(2p^{j})}_{(i+b)\pmod{d_{j}}}\cup 2D^{(2p^{j})}_{(i+b)\pmod{d_{j}}}\Bigr{)}\cup\{p^{n}\},\text{ and }\\ \mathcal{C}_{1}^{(2p^{n})}=\bigcup_{j=1}^{n}\bigcup_{i=0}^{d_{j}/2-1}p^{n-j}\Bigl{(}D^{(2p^{j})}_{(i+b)\pmod{d_{j}}}\cup 2D^{(2p^{j})}_{(i+b)\pmod{d_{j}}}\Bigr{)}\cup\{0\},\\ \mathcal{\widetilde{C}}_{0}^{(2p^{n})}=\bigcup_{j=1}^{n}p^{n-j}\Bigl{(}\bigcup_{i=0}^{d_{j}/2-1}2D^{(2p^{j})}_{(i+b)\pmod{d_{j}}}\cup\bigcup_{i=d_{j}/2}^{d_{j}-1}D^{(2p^{j})}_{(i+b)\pmod{d_{j}}}\Bigr{)}\cup\{p^{n}\},\text{ and }$$

$$\mathcal{\widetilde{C}}_{1}^{(2p^{n})}=\bigcup_{j=1}^{n}p^{n-j}\Bigl{(}\bigcup_{i=0}^{d_{j}/2-1}D^{(2p^{j})}_{(i+b)\pmod{d_{j}}}\cup\bigcup_{i=d_{j}/2}^{d_{j}-1}2D^{(2p^{j})}_{(i+b)\pmod{d_{j}}}\Bigr{)}\cup\{0\}.$$

$$s_i=\{\begin{array}{ll}0,& \text{ if }i(\mathrm{mod}{p}^n)\in {\mathcal{C}}_0^{(2p^n)},\\ 1,& \text{ if }i(\mathrm{mod}{p}^n)\in {\mathcal{C}}_1^{(2p^n)}.\end{array}$$

$${\tilde{s}}_i=\{\begin{array}{ll}0,& \text{ if }i(\mathrm{mod}{p}^n)\in {\tilde{\mathcal{C}}}_0^{(2p^n)},\\ 1,& \text{ if }i(\mathrm{mod}{p}^n)\in {\tilde{\mathcal{C}}}_1^{(2p^n)}.\end{array}$$

$$\begin{array}[]{c}L(s^{\infty})=2p^{n}-r\cdot{\rm ord}_{p}(2),\quad 0\leq r\leq\frac{p-1}{{\rm ord}_{p}(2)}.\end{array}$$

$$L(s^{\infty })=\{\begin{array}{ll}2p^n-p+1,& \text{ if }v=f/2;\\ 2p^n,& \text{ if }v=1\text{ or }2v|\frac{f}{2},\text{ or }f=v.\end{array}$$

$$\begin{array}[]{c}2p^{n}-2r\cdot{\rm ord}_{p}(2)\leq L(\widetilde{s}^{\infty})\leq 2p^{n}-r\cdot{\rm ord}_{p}(2),\quad 0\leq r\leq\frac{p-1}{{\rm ord}_{p}(2)}.\end{array}$$

$$L({\tilde{s}}^{\infty })=\{\begin{array}{ll}2p^n-3(p-1)/2& \text{ if }v=f;\\ 2p^n,& \text{ if }v|\frac{f}{2},\text{ or }v=2,v\ne f.\end{array}$$

$$L(s^{\infty })=\{\begin{array}{ll}2p^n-p+1,& \text{ if }v=f/2;\\ 2p^n,& \text{ otherwise }.\end{array}$$

$$L({\tilde{s}}^{\infty })=\{\begin{array}{ll}2p^n-3(p-1)/2,& \text{ if }v=f;\\ 2p^n,& \text{ otherwise }.\end{array}$$

$$S(x)=\sum\limits_{t\in\mathcal{C}_{1}^{(p^{n})}}x^{t}=1+\sum\limits_{j=1}^{n}\sum\limits_{i=0}^{d_{j}/2-1}\Bigl{(}\sum_{t\in D^{(2p^{j})}_{i+b\pmod{d_{j}}}}x^{p^{n-j}t}+\sum_{t\in 2D^{(2p^{j})}_{i+b\pmod{d_{j}}}}x^{p^{n-j}t}\Bigr{)},\text{and}\\ \widetilde{S}(x)=\sum\limits_{t\in\mathcal{\widetilde{C}}_{1}^{(p^{n})}}x^{t}=1+\sum\limits_{j=1}^{n}\sum\limits_{i=0}^{d_{j}/2-1}\sum_{t\in D^{(2p^{j})}_{i+b\pmod{d_{j}}}}x^{p^{n-j}t}+\sum\limits_{j=1}^{n}\sum\limits_{i=d_{j}/2}^{d_{j}}\sum_{t\in 2D^{(2p^{j})}_{i+b\pmod{d_{j}}}}x^{p^{n-j}t}.$$

$$E_i^{(p^j)}(x)=\sum _{t\in D_i^{(p^j)}}{x}^t,1\le j\le n,0\le i<d_j,$$

$$\begin{array}{rl}{H}_k^{(p^j)}(x)& =\sum _{i=0}^{d_j/2-1}{E}_{i+k(\mathrm{mod}{d}_j)}^{(p^j)}(x),0\le k<d_j,\\ T_k^{(p^m)}(x)& =\sum _{j=1}^m{H}_k^{(p^j)}(x^{p^{m-j}}),m=1,2,\cdots ,n.\end{array}$$

$$S(\alpha_{n}^{a})=\sum\limits_{t\in\mathcal{C}_{1}^{(2p^{n})}}\alpha^{at}=\sum_{j=1}^{n}\sum_{i=0}^{d_{j}/2-1}\bigl{(}\sum_{t\in p^{n-j}D^{(2p^{j})}_{(i+b)}}\alpha^{at}+\sum_{t\in 2p^{n-j}D^{(2p^{j})}_{(i+b)}}\alpha^{at}\bigr{)}+1=\\ 1+T^{(p^{n})}_{b}(\alpha_{n}^{a})+T^{(p^{n})}_{b}(\alpha_{n}^{2a})=1+T^{(p^{n})}_{b}(\alpha_{n}^{a})+T^{(p^{n})}_{b+u}(\alpha_{n}^{a}).$$

$$\tilde{S}({\alpha }_n^a)=1+T_b^{(p^n)}({\alpha }_n^a)+T_{b+u+d_n/2}^{(p^n)}({\alpha }_n^a)=T_b^{(p^n)}({\alpha }_n^a)+T_{b+u}^{(p^n)}({\alpha }_n^a).$$

$$1={\left(T_0^{(p^m)}({\alpha }_m)+T_u^{(p^m)}({\alpha }_m)\right)}^2=T_0^{(p^m)}({\alpha }_m^2)+T_u^{(p^m)}({\alpha }_m^2)=T_u^{(p^m)}({\alpha }_m)+T_{2u}^{(p^m)}({\alpha }_m),$$

$$T_0^{(p^m)}({\alpha }_m)=T_{iw}^{(p^m)}({\alpha }_m),\text{ for any integer }i\ge 1.$$

$$T_{d_m/2+(p^{m-1}+1)/2\cdot f}^{(p^m)}({\alpha }_m)=T_{p^{m-1}f/2+(p^{m-1}+1)f/2}^{(p^m)}({\alpha }_m)=T_{f/2+d_m}^{(p^m)}({\alpha }_m)=T_{f/2}^{(p^m)}({\alpha }_m).$$

$$S({\alpha }_n^i)=1+T_b^{(p^n)}({\alpha }_n^i)+T_{b+u}^{(p^n)}({\alpha }_n^i)=1+T_b^{(p)}({\alpha }_1^a)+T_{b+u}^{(p)}({\alpha }_1^a)=1+H_k^{(p)}({\alpha }_1)+H_{k+u}^{(p)}({\alpha }_1),$$

$$H_0^{(p)}({\alpha }_1)=H_{2v}^{(p)}({\alpha }_1)=\cdots =H_{2vi}^{(p)}({\alpha }_1).$$

$$L(s^{\infty})=N-\deg\Big{(}\gcd\big{(}(x^{p^{n}}-1)^{2},S(x)\big{)}\Big{)}.$$

$$S({\alpha }_n^i)=1+T_b^{(p^n)}({\alpha }_n^i)+T_{b+u}^{(p^n)}({\alpha }_n^i)=1+T_b^{(p)}({\alpha }_1^a)+T_{b+u}^{(p)}({\alpha }_1^a)=1+H_b^{(p)}({\alpha }_1^a)+H_{b+u}^{(p)}({\alpha }_1^a)$$

$$1=(H_k^{(p)}({\alpha }_1){)}^2+H_{k+u}^{(p)}({\alpha }_1^2)=H_{k+u}^{(p)}({\alpha }_1)+H_{k+2u}^{(p)}({\alpha }_1),$$

$$|\{i:S({\alpha }_n^i)=0,i=1,2,\dots ,p^n-1\}|=r{\mathrm{ord}}_p(2).$$

$$x{S}^{\prime }(x)=\sum _{j=1}^n\sum _{i=0}^{d_j/2-1}\sum _{t\in D_{i+b(\mathrm{mod}{d}_j)}^{(2p^j)}}{x}^{p^{n-j}t}.$$

Full text

Keywords: binary sequences, linear complexity, cyclotomy

Mathematics Subject Classification (2010): 94A55, 94A60, 11B50.

1 Introduction

The cyclotomic classes and the generalized cyclotomic classes are often used for design sequences with high linear complexity, which is an important characteristic of sequence for the cryptography applications [2]. Recently, new generalized cyclotomic classes were presented in [8]. The linear complexity of new generalized cyclotomic binary sequences with period $p^{n}$ was studied in [9, 4, 7]. A new family of binary sequences with period $2p^{n}$ based on the generalized cyclotomic classes from [8] was presented in [6]. Yi Ouang et al. examined the linear complexity of these sequences for $f=2^{r}$, where $p=1+ef$ and $r$ is a positive integer. They offered new studying method of the linear complexity of these sequences. Their method based on ideas from [4].

In this paper we show that for study of the linear complexity of new sequence family from [6] we can use only old the method from [4]. Furthermore, it will be enough for obtaining more generalized results than in [6] and for the proof and the correction of the conjecture of the authors of this paper. Here we keep the notation and the structure of [4], i.e., in Sect. 2 we introduce some basics and recall the definition of a generalized cyclotomic sequence and the conjecture from [6]. Section 3 is dedicated to the study of the linear complexity of this family of cyclotomic sequences. Section 4 concludes the work in this paper.

2 Preliminaries

Throughout this paper, we will denote by $\mathbb{Z}_{N}$ the ring of integers modulo $N$ for a positive integer $N$, and by $\mathbb{Z}_{N}^{*}$ the multiplicative group of $\mathbb{Z}_{N}$.

First of all we will recall some basics of the linear complexity of a periodic sequence and introduce the generalized cyclotomic sequences proposed in [6].

2.1 Linear Complexity

Let $s^{\infty}=(s_{0},s_{1},s_{2},\dots)$ be a binary sequence of period $N$ and $S(x)=s_{0}+s_{1}x+\cdots+s_{N-1}x^{N-1}$. It is well known (see, for instance, [2, Page 171]) that the linear complexity of $s^{\infty}$ is given by

[TABLE]

So, if $N=2p^{n}$ then we see that

[TABLE]

Thus, if $\alpha_{n}$ is a primitive root of order $p^{n}$ of unity in the extension of the field $\mathbb{F}_{2}$ (the finite field of two elements) then in order to find the linear complexity of a sequence it is sufficient to find the zeros of $S(x)$ in the set $\{\alpha_{n}^{i},i=0,1,\ldots,p^{n}-1\}$ and determine their multiplicity.

2.2 New Generalized Cyclotomic Sequences Length $2p^{n}$

Let $p$ be an odd prime and $p=ef+1$, where $e,f$ are positive integers. Let $g$ be a primitive root modulo $p^{n}$. It is well known [5] that an odd number from $g$ or $g+p^{n}$ is also a primitive root modulo $2p^{j}$ for each integer $j\geq 1$. Hence, we can assume that $g$ is an odd number. Further, the order of $g$ modulo $2p^{j}$ is equal to $\varphi(2p^{j})=p^{j-1}(p-1)$, where $\varphi(\cdot)$ is the Euler’s totient function. Below we recall the definitions of generalized cyclotomic classes introduced in [8] and [6].

Let $n$ be a positive integer. For $j=1,2,\cdots,n$, denote $d_{j}=p^{j-1}f$ and define

[TABLE]

The cosets $D^{(p^{j})}_{i}$, $i=0,1,\cdots,d_{j}-1$, are called generalized cyclotomic classes of order $d_{j}$ with respect to $p^{j}$. It was shown in [8] that $\left\{D^{(p^{j})}_{0},D^{(p^{j})}_{1},\dots,D^{(p^{j})}_{d_{j}-1}\right\}$ forms a partition of $\mathbb{Z}^{*}_{p^{j}}$ for each integer $j\geq 1$ and for an integer $m\geq 1$,

[TABLE]

Also $\left\{D^{(2p^{j})}_{0},D^{(2p^{j})}_{1},\dots,D^{(2p^{j})}_{d_{j}-1}\right\}$ forms a partition of $\mathbb{Z}^{*}_{2p^{j}}$ for each integer $j\geq 1$ and for an integer $m\geq 1$,

[TABLE]

Let $f$ be a positive even integer and $b$ an integer with $0\leq b<p^{n-1}f$. Define four sets

[TABLE]

[TABLE]

It is obvious that $\mathbb{Z}_{2p^{n}}=\mathcal{C}_{0}^{(2p^{n})}\cup\mathcal{C}_{1}^{(2p^{n})}=\mathcal{\widetilde{C}}_{0}^{(2p^{n})}\cup\mathcal{\widetilde{C}}_{1}^{(2p^{n})}$ and $|\mathcal{C}_{i}^{(2p^{n})}|=|\mathcal{\tilde{C}}_{i}^{(2p^{n})}|=p^{n},\;\ i=0,1$. Families of balanced binary sequences $s^{\infty}=(s_{0},s_{1},s_{2},\dots)$ and $\tilde{s}^{\infty}=(\tilde{s}_{0},\tilde{s}_{1},\tilde{s}_{2},\dots)$ of period $p^{n}$ can thus be defined as in [6], i.e.,

[TABLE]

and

[TABLE]

In the case of $f=2^{r}$, the linear complexity of $s^{\infty},\tilde{s}^{\infty}$ was estimated in [6], where a conjecture about the linear complexity of these sequences was also made as follows.

Conjecture. (1) If $2^{e}\equiv-1\pmod{p}$ but $2^{e}\not\equiv-1\pmod{p^{2}}$, then the linear complexity $L(s^{\infty})=2p^{n}-(p-1).$

(2) If $2^{e}\equiv 1\pmod{p}$ but $2^{e}\not\equiv 1\pmod{p^{2}}$, then the linear complexity $L(\tilde{s}^{\infty})=2p^{n}-(p-1)-e$.

2.3 Main Result

This subsection will study the linear complexity of $s^{\infty}$, $\tilde{s}^{\infty}$ in (3) and (4) for some even integers $f$ and when $p$ is not a Wieferich prime, i.e. $2^{p-1}\not\equiv 1\pmod{p^{2}}$. It was shown that there are only two such primes, 1093 and 3511, up to $6\times 10^{17}$ [1, 3]. The main result in this paper is given as follows.

Theorem 1**.**

Let $p=ef+1$ be an odd prime with $2^{p-1}\not\equiv 1\pmod{p^{2}}$ and $f$ is an even positive integer. Let $\operatorname{ord}_{p}(2)$ denote the order of $2$ modulo $p$ and v=\gcd\big{(}\frac{p-1}{{\rm ord}_{p}(2)},f\big{)}.

(i) Let $s^{\infty}$ be a generalized cyclotomic binary sequence of period $p^{n}$ defined in (3). Then the linear complexity of $s^{\infty}$ is given by

[TABLE]

Furthermore, the linear complexity

[TABLE]

(ii) Let $\tilde{s}^{\infty}$ be a generalized cyclotomic binary sequence of period $p^{n}$ defined in (4). Then for the linear complexity of $\widetilde{s}^{\infty}$ we have

[TABLE]

Furthermore, the linear complexity

[TABLE]

Corollary 2**.**

Let $f=2^{r}$. Then:

(i) The linear complexity of $s^{\infty}$ is given by

[TABLE]

(ii) The linear complexity of $\widetilde{s}^{\infty}$ is given by

[TABLE]

Remark 1**.**

Suppose $2\equiv g^{u}\pmod{p}$ for some integer $u$. It is easily seen that \gcd\big{(}\frac{p-1}{{\rm ord}_{p}(2)},f\big{)}=\gcd(u,f). Thus the condition $2^{e}\equiv 1\pmod{p}$ in Conjecture from [6] is equivalent to v=\gcd\big{(}\frac{p-1}{{\rm ord}_{p}(2)},f\big{)}=f and the condition $2^{e}\equiv-1\pmod{p}$ is equivalent to $v=f/2$. In the case that $f=2^{r}$ for a positive integer $r$, the integer $v$ is also a power of $2$, which either equals $f$ or $f/2$ or divides $f/4$. Hence Conjecture from [6] is included in Theorem 1 as a special case. Here we make the correction of Conjecture (ii).

If $2$ is a primitive roots modulo $p$ then $v=1$.

For the proof of Theorem 1 we will use the same definitions and same method that as [4].

Let $S(x)=s_{0}+s_{1}x+\cdots+s_{2p^{n}-1}x^{2p^{n}-1}$ and $\widetilde{S}(x)=\widetilde{s}_{0}+\widetilde{s}_{1}x+\cdots+\widetilde{s}_{2p^{n}-1}x^{2p^{n}-1}$ for the generalized cyclotomic sequences $s^{\infty}$, $\widetilde{s}^{\infty}$ defined in (3) and (4), respectivly. Then,

[TABLE]

For simplicity of presentation, we define polynomials as in [4]

[TABLE]

and

[TABLE]

Notice that the subscripts $i$ in $D^{(p^{j})}_{i}$, $H^{(p^{j})}_{i}(x)$ and $T^{(p^{j})}_{i}(x)$ are all taken modulo the order $d_{j}$. In the rest of this paper the modulo operation will be omitted when no confusion can arise.

Let $\overline{\mathbb{F}}_{2}$ be an algebraic closure of $\mathbb{F}_{2}$ and $\alpha_{n}\in\overline{\mathbb{F}}_{2}$ be a primitive $p^{n}$-th root of unity. Denote $\alpha_{j}=\alpha_{n}^{p^{n-j}},\,j=1,2\dots,n-1$.

The properties of considered polynomials were studied in [4]. We have here the following statement.

Lemma 3**.**

[4]** For any $a\in D^{(p^{j})}_{k}$, we have

(i) $T^{(p^{m})}_{i}(\alpha_{m}^{p^{l}a})=T^{(p^{m-l})}_{i+k}(\alpha_{m-l})+(p^{l}-1)/2\pmod{2}$ for $0\leq l<m$; and

(ii) $T^{(p^{m})}_{i}(\alpha_{m}^{a})+T^{(p^{m})}_{i+d_{m}/2}(\alpha_{m}^{a})=1$.

(iii) Let $p$ be a non-Wieferich prime. Then $T^{(p^{m})}_{i}(\alpha_{m})\not\in\{0,1\}$ for $m>1$.

(iv) Let $p$ be a non-Wieferich prime. Then $T^{(p^{m})}_{i}(\alpha_{m})+T^{(p^{m})}_{i+f/2}(\alpha_{m})\neq 1$ for $m>1$.

Throughout this paper an integer $u$ will be such that $2\equiv g^{u}\pmod{p^{n}}$. Now we will show that the studying of linear complexity of above sequences is equivalent to the investigation of properties of $T^{(p^{m})}_{i}(x)$

Proposition 1**.**

Let $\alpha_{n}$ be a $p^{n}$-th primitive root of unity and let $2\equiv g^{u}\pmod{p^{n}}$. Given any element $a\in\mathbb{Z}_{p^{n}}$, we have

(i) $S(\alpha_{n}^{a})=1+T^{(p^{n})}_{b}(\alpha_{n}^{a})+T^{(p^{n})}_{b+u}(\alpha_{n}^{a})$; and

(ii) $S(\alpha_{n}^{a})=T^{(p^{n})}_{b}(\alpha_{n}^{a})+T^{(p^{n})}_{b+u}(\alpha_{n}^{a})$.

Proof.

(i) Since $\sum_{t\in p^{n-j}D^{(2p^{j})}_{(i+b)}}\alpha^{at}=\sum_{t\in p^{n-j}D^{(p^{j})}_{(i+b)}}\alpha^{at}$ by (1), it follows from our definitions and Lemma 3 that

[TABLE]

(ii) Similarly we have

[TABLE]

∎

We now examine the value of $T_{b}^{(p^{n})}(\alpha_{n}^{i})+T^{(p^{n})}_{b+u}(\alpha_{n}^{i})$ for some integers $i\in\mathbb{Z}_{p^{n}}$.

Proposition 2**.**

Let $p$ be a non-Wieferich prime. Then $S(\alpha_{n}^{i})\neq 0$ and $\widetilde{S}(\alpha_{n}^{a})\neq 0$ for $i\in\mathbb{Z}_{p^{n}}\setminus p^{n-1}\mathbb{Z}_{p}$.

Proof.

This is sufficient to prove that $T^{(p^{n})}_{b}(\alpha_{n}^{i})+T^{(p^{n})}_{b+u}(\alpha_{n}^{i})\not\in\{0,1\}$ for $i\in\mathbb{Z}_{p^{n}}\setminus p^{n-1}\mathbb{Z}_{p}$ and $b=0,1,\cdots,d_{n}-1.$ As it was shown in [4] that without loss of generality it is enough proof, $T^{(p^{m})}_{0}(\alpha_{m})+T^{(p^{m})}_{u}(\alpha_{m})\not\in\{0,1\}$ for $m>1$.

We consider two cases.

1. Let $T^{(p^{m})}_{0}(\alpha_{m})+T^{(p^{m})}_{u}(\alpha_{m})=0$. Since $(T^{(p^{m})}_{0}(\alpha_{m}))^{2}=T^{(p^{m})}_{u}(\alpha_{m})=0$, we see that in this case $T^{(p^{m})}_{0}(\alpha_{m})\in\{0,1\}$. We obtain a contradiction with Lemma 3 (iii).

2. Let $T^{(p^{m})}_{0}(\alpha_{m})+T^{(p^{m})}_{u}(\alpha_{m})=1$.

It then follows from Lemma 3 (i) that

[TABLE]

which implies $T^{(p^{m})}_{iu}(\alpha_{m})+T^{(p^{m})}_{(i+1)u}(\alpha_{m})=1$ for any integer $i\geq 1$. Hence $T^{(p^{m})}_{0}(\alpha_{m})=T^{(p^{m})}_{2iu}(\alpha_{m}).$

Denote $w=\gcd(2u,d_{m})$. Since $p$ is a non-Wieferich prime, it follows by [4] that $w$ divides $f$. Since the subscript of $T_{i}^{(p^{m})}(x)$ is taken modulo $d_{m}$, it is easily seen that

[TABLE]

By Lemma 3 (ii) from the last formula we have $T^{(p^{m})}_{d_{m}/2}(\alpha_{m})=T^{(p^{m})}_{d_{m}/2+iw}(\alpha_{m})$ or $T^{(p^{m})}_{d_{m}}(\alpha_{m})=T^{(p^{m})}_{d_{m}/2+jf}(\alpha_{m})$. Then we get that

[TABLE]

Hence, $T^{(p^{m})}_{d_{m}/2}(\alpha_{m})=T^{(p^{m})}_{f/2}(\alpha_{m})$. Thus, by Lemma 3 (ii) we obtain that $T^{(p^{m})}_{0}(\alpha_{m})+1=T^{(p^{m})}_{f/2}(\alpha_{m})$. But the latest equality is not possible for $m>1$ by Lemma 3 (iv). ∎

By Proposition 2, we only need to study the value of $T_{b}^{(p^{n})}(\alpha_{n}^{i})+T_{b+u}^{(p^{n})}(\alpha_{n}^{i})$ for integers $i$ in the set $p^{n-1}\mathbb{Z}_{p}$. Suppose $i=p^{n-1}a,\;\ a\in D_{i}^{(p)}$. Then, it follows from Proposition 1 and Lemma 3 that

[TABLE]

where $k\equiv b+i\pmod{f}$. The following proposition examines the value of $H_{k}^{(p)}(\alpha_{1})+H_{k+u}^{(p)}(\alpha_{1})$ according to the relation between $f$ and $\operatorname{ord}_{p}(2)$.

Proposition 3**.**

Let $p=ef+1$ be an odd prime with $f$ being an even positive integer and $v=\gcd(\frac{p-1}{\operatorname{ord}_{p}(2)},f)$. Then,

(i) \left|\Big{\{}k\in\mathbb{Z}_{f}\,|\,H_{k}^{(p)}(\alpha_{1})+H_{k+u}^{(p)}(\alpha_{1})=0\Big{\}}\right|=\begin{cases}f,&\text{if }v=f,\\ 0,&\text{if }v|f/2\text{ or }v=2,v\neq f.\end{cases}

(ii)\left|\Big{\{}k\in\mathbb{Z}_{f}\,|\,H_{k}^{(p)}(\alpha_{1})+H_{k+u}^{(p)}(\alpha_{1})=1\Big{\}}\right|=\begin{cases}f,&\text{if }v=f/2,\\ 0,&\text{if }v=1,\text{ or }v=f\text{ or }2v|f/2.\end{cases}**

Proof.

Since $\operatorname{ord}_{p}(2)=\frac{p-1}{\gcd(p-1,\,u)}$, it follows that $\gcd(u,f)=\gcd(\frac{(p-1)}{\operatorname{ord}_{p}(2)},f)=v$ [4].

(i) For $v=f$ this statement is clear.

Let $v|f/2$ or $v=2,v\neq f$. We shall prove this case by contradiction. Suppose $H_{k}^{(p)}(\alpha_{1})+H_{k+u}^{(p)}(\alpha_{1})=0$ for some integer $k$. Since $(H_{k}^{(p)}(\alpha_{1}))^{2}=H_{k+u}^{(p)}(\alpha_{1})$, it follows that $H_{k}^{(p)}(\alpha_{1}))\in\{0,1\}$. By [4] this is not possible for $v|f/2$ or $v=2,v\neq f$.

(ii) For $v=f/2$ this statement is clear. If $v=f$ then $2\in D^{(p)}_{0}$ and we have $H_{k}^{(p)}(\alpha_{1})+H_{k}^{(p)}(\alpha_{1})=1$. This is impossible

Suppose $H_{k}^{(p)}(\alpha_{1})+H_{k+u}^{(p)}(\alpha_{1})=1$ for some integer $k$. Without loss of generality, we assume $k=0$ and $H_{0}^{(p)}(\alpha_{1})=H_{u}^{(p)}(\alpha_{1})+1$.

In the case when $v\neq f$. Since $\gcd(u,f)=\gcd(\frac{(p-1)}{\operatorname{ord}_{p}(2)},f)=v$, by a similar argument as in the proof of Proposition 2 we get

[TABLE]

So, if $2v$ divides $f/2$, then $H_{f/2}^{(p)}(\alpha_{1})=H_{{2v\cdot f/4v}}^{(p)}(\alpha_{1})=H_{0}^{(p)}(\alpha_{1}),$ which is a contradiction.

Let $v=1$. Then we get $H_{i}^{(p)}(\alpha_{1})+H_{i+1}^{(p)}(\alpha_{1})+1=0,i=0,1,\dots,f-1$ and then $E_{i}^{(p)}(\alpha_{1})+E_{i+f/2}^{(p)}(\alpha_{1})+1=0,\quad i=0,1,\dots,f-1.$ In [4] it was shown that this is impossible.

∎

Proof of Theorem 1. Recall that the linear complexity of $s^{\infty}$ is given by

[TABLE]

(i) From Proposition 2 we know $S(\alpha_{n}^{i})\neq 0$ for $i\in\mathbb{Z}_{p^{n}}\setminus p^{n-1}\mathbb{Z}_{p}$. For the remaining set $p^{n-1}\mathbb{Z}_{p}$, if $i=0$, then $S(1)=1$; if $i\in p^{n-1}\mathbb{Z}_{p}^{*}$, we have

[TABLE]

for some integer $a\in\mathbb{Z}_{p}^{*}$.

Suppose $H^{(p)}_{k}(\alpha_{1}^{a})+H^{(p)}_{k+u}(\alpha_{1}^{a})=1$ for some integer $k$. Then

[TABLE]

and so on (here $u\not\equiv 0\pmod{f})$). So, we have

[TABLE]

where $r$ is an integer with $0\leq r\leq\frac{p-1}{\operatorname{ord}_{p}(2)}$.

Further, by (5) we see that

[TABLE]

Hence, $\alpha_{n}^{i}S(\alpha_{n}^{i})=T^{(p^{n})}_{b}(\alpha_{n}^{i})$. So, if $\alpha_{n}^{i}$ is a root of $S(x)$ and $S^{\prime}(x)$ then $1+T^{(p^{n})}_{b}(\alpha_{n}^{i})+(T^{(p^{n})}_{b}(\alpha_{n}^{i}))^{2}=0$ and $T^{(p^{n})}_{b}(\alpha_{n}^{i})=0$. It is not possible and any root of $S(x)$ is simple.

Then the statement of this theorem follows from Proposition 2.

(ii) In this case

[TABLE]

for some integer $a\in\mathbb{Z}_{p}^{*}$.

Then as earlier we again get

[TABLE]

where $r$ is an integer such that $0\leq r\leq\frac{p-1}{\operatorname{ord}_{p}(2)}$.

Here, by (5) we see that

[TABLE]

and also $\alpha_{n}^{i}\widetilde{S}(\alpha_{n}^{i})=T^{(p^{n})}_{b}(\alpha_{n}^{i})$. If $v=f$ then it follows from [4] that

[TABLE]

Then the statement of this theorem follows from Proposition 2.

$\square$

2.4 Additional remark

Let $p$ be a Wieferich prime. Wieferich primes are very rare [3], hence we could ignore these numbers but nonetheless we show that the old method also works in this case. In this subsection we consider only the case when $f=2^{r}$, where $r$ is a positive integer. Denote $D=\{k:\;\ 2^{p-1}\equiv 1\pmod{p^{k}}\}$ and $wn=\max\limits_{k\in D}{k}$.

Suppose $2\equiv g^{u}\pmod{p^{nw}}$. Then $u\equiv 0\pmod{p^{nw-1}}$. Thus, $u=p^{nw-1}z$ where $\gcd(z,p)=1$. It is easy to check that $2\equiv g^{p^{j-1}z}\pmod{p^{j}}$ for $j\leq nw$.

Let $v=\gcd(z,f)$. First, we study the value of $T_{k}^{(p^{j})}(\alpha_{j}^{i})$ for integers $i$ in the set $\mathbb{Z}_{p^{j}}$. Let $T_{k}^{(p^{j})}(\alpha_{j}^{i})\in\{0,1\}$ and $v\neq f$. Without loss of generality, we assume $T_{k}^{(p^{j})}(\alpha_{j}^{i})=0$. As earlier we obtain that

[TABLE]

Since $vp^{j-1}$ divides $d_{j}/2=p^{j-1}f/2$ for $f=2^{r}$, we have a contradiction. So, $T_{k}^{(p^{j})}(\alpha_{j}^{i})\in\{0,1\}$ for $i\in\mathbb{Z}_{p^{j}}$ only when $v=f$

We consider a few cases.

(i) Suppose $v=f$. Then $2\in D_{0}^{(p^{j})}$ for $j\leq nw$. In this case T^{(p^{j})}_{k}(\alpha_{j}^{i})=\bigl{(}T^{(p^{j})}_{k}(\alpha_{j}^{i})\bigr{)}^{2} and $T^{(p^{j})}_{k}(\alpha_{j}^{i})\in\{0,1\}$ for any $k$ and $i\in\mathbb{Z}_{p^{j}}$. Thus, $S(\alpha_{j}^{i})=1$ for $i\in\mathbb{Z}_{p^{j}}$. Further, $\widetilde{S}(\alpha_{j}^{i})=0$ for $i\in\mathbb{Z}_{p^{j}},\;\ i\neq 0$ and $|\{i:\widetilde{S}^{\prime}(\alpha_{j}^{i})=0,i=1,\dots,p^{j}-1\}|=(p^{j}-1)/2$.

(ii) Suppose $v=f/2$. In this case \bigl{(}T^{(p^{j})}_{k}(\alpha_{j}^{i})\bigr{)}^{2}=T^{(p^{j})}_{k+d_{j}/2}(\alpha_{j}^{i}). Thus, by Lemma 3 $\widetilde{S}(\alpha_{j}^{i})=1$ for $i\in\mathbb{Z}_{p^{j}}$. Further, $S(\alpha_{j}^{i})=0$ and $S^{\prime}(\alpha_{j}^{i})\neq 0$ for $i\in\mathbb{Z}_{p^{j}},\;i\neq 0$.

(iii) $v\neq f/2,f$. Here \bigl{(}T^{(p^{j})}_{k}(\alpha_{j}^{i})\bigr{)}^{2}=T^{(p^{j})}_{k+vp^{j-1}}(\alpha_{j}^{i}). So, if $T^{(p^{j})}_{k}(\alpha_{j}^{i})+T^{(p^{j})}_{k+u}(\alpha_{j}^{i})=0$ then $T^{(p^{j})}_{k}(\alpha_{j}^{i})=T^{(p^{j})}_{k+lvp^{j-1}}(\alpha_{j}^{i})$ for $l\geq 0$. Also, if $T^{(p^{j})}_{k}(\alpha_{j}^{i})+T^{(p^{j})}_{k+u}(\alpha_{j}^{i})=1$ then $T^{(p^{j})}_{k}(\alpha_{j}^{i})=T^{(p^{j})}_{k+2lvp^{j-1}}(\alpha_{j}^{i})$ for $l\geq 0$.

Since $f=2^{r}$ and $v\neq f/2,f$, it follows that $2vp^{j-1}$ divides $p^{j-1}f/2$. We obtain a contradiction with Lemma 3.

If $j\geq wn$ then $[\mathbb{F}_{2}(\alpha_{j+1}):\mathbb{F}_{2}(\alpha_{j})]=p,$ where $\alpha_{j}=\alpha_{n}^{p^{n-j}}$ and $\alpha_{n}$ is a primitive $p^{n}$-th root of unity. In this case we can use the method from [4] as earlier.

Let $m=\min(n,wn)$. So, for $f=2^{r}$ we can obtain that the linear complexity of $s^{\infty}$ is given by

[TABLE]

and the linear complexity of $\widetilde{s}^{\infty}$ for $n\geq wn$ is given by

[TABLE]