On the $k$-error linear complexity of subsequences of $d$-ary Sidel'nikov sequences over prime field $\mathbb{F}_{d}$

TL;DR

This paper investigates the $k$-error linear complexity of subsequences of $d$-ary Sidel'nikov sequences over prime fields, providing bounds and demonstrating high complexity for certain periods, which is relevant for cryptographic security.

Contribution

It establishes a general lower bound for the $k$-error linear complexity of these sequences and shows they have large complexity for specific periods, advancing understanding of their cryptographic strength.

Findings

Provided a general lower bound for $k$-error linear complexity.

Demonstrated sequences have large $k$-error linear complexity for certain periods.

Enhanced understanding of the cryptographic robustness of $d$-ary Sidel'nikov sequences.

Abstract

We study the $k$-error linear complexity of subsequences of the $d$-ary Sidel'nikov sequences over the prime field $\mathbb{F}_{d}$. A general lower bound for the $k$-error linear complexity is given. For several special periods, we show that these sequences have large $k$-error linear complexity.

Equations

$$s_{n+L}+c_{L-1}{s}_{n+L-1}+\cdots +c_0{s}_n=0\text{for all}n\ge 0.$$

$$LC(\{s_n\})=N-\mathrm{deg}(\gcd (x^N-1,S(x))),$$

$$D_0=\{{\gamma }^{dn}:0\le n\le (q-1)/d-1\}\text{and}{D}_j={\gamma }^j{D}_0,1\le j\le d-1.$$

$$s_n=\{\begin{array}{ll}j& \text{if αn+1∈Dj}\\ 0& \text{if αn+1=0.}\end{array}$$

$$|\sum _{c\in {\mathbb{F}}_q}\psi (af(c))|\le (e-1)q^{1/2}.$$

$$t_{n+L}+c_{L-1}{t}_{n+L-1}+\cdots +c_0{t}_n=0(n\ge 0).$$

$$\chi (\prod _{m=0}^L({\alpha }^{n+m}+1{)}^{c_m})=\prod _{m=0}^L{\xi }_d^{t_{n+m}{c}_m}={\xi }_d^{{\sum }_{m=0}^L{t}_{n+m}{c}_m}=1.$$

$$\begin{array}{rl}l-2k(L+1)& \le |\sum _{n=0}^{l-1}\chi (\prod _{m=0}^L({\alpha }^{n+m}+1{)}^{c_m})|\\ & =\frac{l}{q-1}|\sum _{n=0}^{q-2}\chi (\prod _{m=0}^L({\gamma }^{\frac{q-1}{l}n}{\alpha }^m+1{)}^{c_m})|\\ & \le \frac{l}{q-1}[(\frac{q-1}{l}(L+1)-1)\sqrt{q}+1]\\ & <(L+1)\sqrt{q},\end{array}$$

$${\xi }_d^{t_n}={\xi }_d^{s_n}=\chi ({\alpha }^n+1).$$

$$\prod _{j=0}^{l/r-1}({\alpha }^{jr}x+1)=1-(-1{)}^l{x}^{l/r},$$

$${\xi }_d^{{\sum }_{j=0}^{l/r-1}{t}_{b+jr}}=\prod _{j=0}^{l/r-1}\chi ({\alpha }^{b+jr}+1)=\chi (1-(-1{)}^l{\alpha }^{bl/r})=e,$$

$$|\sum _{b=0}^{r-1}\chi (1-(-1{)}^l{\alpha }^{bl/r})|\ge \{\begin{array}{ll}r-2k& \text{if l is odd}\\ r-2k-1& \text{if l is even, }\end{array}$$

$$\begin{array}{rl}r-2k-1& \le |\sum _{b=0}^{r-1}\chi (1-(-1{)}^l{\alpha }^{bl/r})|\\ & =\frac{r}{q-1}|\sum _{b=0}^{q-2}\chi (1-(-1{)}^l{\gamma }^{b(q-1)/r})|<\sqrt{q},\end{array}$$

$$S(x{)}^{(h)}=\sum _{n=h}^{l-1}(\genfrac{}{}{0ex}{}{n}{h})s_n{x}^{n-h}.$$

$$\left(\genfrac{}{}{0ex}{}{n}{h}\right)\equiv \left(\genfrac{}{}{0ex}{}{n_0}{h_0}\right)\cdots \left(\genfrac{}{}{0ex}{}{n_e}{h_e}\right)\mathrm{mod}d$$

$$\left(\genfrac{}{}{0ex}{}{n}{h}\right)\equiv \left(\genfrac{}{}{0ex}{}{i}{h}\right)\mathrm{mod}d.$$

$$S(1{)}^{(h)}$$

$$=\sum _{i=h}^{d^e-1}\left(\genfrac{}{}{0ex}{}{i}{h}\right)\sum _{\genfrac{}{}{0ex}{}{h=0}{n=h{d}^e+i}}^{l/d^e-1}\sum _{m=1}^{d-1}\sum _{s_n=m}m$$

$$=\sum _{i=h}^{d^e-1}\left(\genfrac{}{}{0ex}{}{i}{h}\right)\sum _{j=0}^{\frac{q-1}{l}{d}^{e-1}-1}\sum _{m=1}^{d-1}(\frac{q-1}{l}i,jd+m{)}_{\frac{q-1}{l}\cdot d^e}m.$$

$$\displaystyle(i,j)_{c}=(c-i,j-i)_{c}=\left\{\begin{array}[]{ll}(j,i)_{c}&f\ even\\ (j+c/2,i+c/2)_{c}&f\ odd.\end{array}\right.$$

$$\begin{array}{rl}S(1{)}^{(0)}& =(0,1{)}_6\cdot 1+(2,1{)}_6\cdot 1+(4,1{)}_6\cdot 1\\ & +(0,2{)}_6\cdot 2+(2,2{)}_6\cdot 2+(4,2{)}_6\cdot 2\\ & +(0,4{)}_6\cdot 1+(2,4{)}_6\cdot 1+(4,4{)}_6\cdot 1\\ & +(0,5{)}_6\cdot 2+(2,5{)}_6\cdot 2+(4,5{)}_6\cdot 2,\end{array}$$

$$\begin{array}{rl}S(1{)}^{(1)}& =(2,1{)}_6\cdot 1+(2,2{)}_6\cdot 2+(2,4{)}_6\cdot 1+(2,5{)}_6\cdot 2\\ & +2\cdot (4,1{)}_6\cdot 1+2\cdot (4,2{)}_6\cdot 2+2\cdot (4,4{)}_6\cdot 1\\ & +2\cdot (4,5{)}_6\cdot 2,\end{array}$$

$$\begin{array}{rl}S(1)=& (0,1{)}_6+(0,2{)}_6\cdot 2+(4,0{)}_6\cdot 2+\\ & (0,4{)}_6\cdot 1+(2,0{)}_6\cdot 1+(2,5{)}_6\cdot 2,\end{array}$$

$$\begin{array}{rl}S(1{)}^{(1)}=& (2,1{)}_6+(1,0{)}_6\cdot 2+(1,2{)}_6\cdot 1+(0,1{)}_6\cdot 2\\ & +(0,5{)}_6\cdot 2+(1,2{)}_6+(1,1{)}_6\cdot 2+(2,1{)}_6.\end{array}$$

$$\text{A}ppendix$$

Full text

[TABLE]

With the notations as before, let $\chi$ denote a nontrivial multiplicative character with $\chi(\gamma^{j})=\xi_{d}^{j}$ $(0\leq j\leq q-2)$, where $\xi_{d}=e^{2\pi\sqrt{-1}/d}$, then we have $\xi_{d}^{s_{n}}=\chi(\alpha^{n}+1)$, if $l$ is odd or $l$ is even and $n\neq l/2$. In what follows, we only consider the case that $l$ is odd. When $l$ is even, the results can be similarly proven. If $l$ is odd, we have $\xi_{d}^{t_{n}}=\chi(\alpha^{n}+1)$ for at least $l-k$ terms of per period of $\{t_{n}\}$. Then from (3), for at least $l-k(L+1)$ terms of each period of $\{t_{n}\}$ we have

[TABLE]

So

[TABLE]

where the penultimate step is obtained from Lemma 1, then the results are proven. ∎

Now we give lower bounds for some special periods which improve Theorem 1.

Proposition 1 Let $r(r\neq d)$ be an odd prime divisor of $l$. Let $\{t_{n}\}$ be a sequence obtained by altering at most $k$ elements of $\{s_{n}\}$ and $T(x)=t_{0}+t_{1}x+\cdots+t_{l-1}x^{l-1}$. From the fact that $d$ is a primitive root modulo $r$ and $r\geq\sqrt{q}+2k+1$, then for each $r$-th root of unity $\beta\neq 1$ we have $T(\beta)\neq 0$.

For at least $l-k-1$ many $n$ of one period of the sequence, we have

[TABLE]

As

[TABLE]

combining with (4), for at least $r-k-1$ or $r-k$ many $b$ in the set $\{0,1,\ldots,r-1\}$ if $l$ is even or odd, respectively, we have

[TABLE]

where $e$ is a constant. Then

[TABLE]

according to the fact that when $l$ is even and $r$ is odd, $\chi(0)$ appears in the sum only once.

So

[TABLE]

where the penultimate step is followed by Weil’s bound. This contradicts our assumption on $r$. ∎

Corollary 1 Let $l=d^{m}rv$, where $r$ is a prime and $r\geq\sqrt{q}+2k+1$, $r,v$ are coprime with $d$ and $d$ is a primitive root modulo $r$. Then we have $LC_{k}(\{s_{n}\})\geq(r-1)d^{m}$.

Now we give exact values of the 1-error linear complexity of the sequence defined in (2) when $d=3$ for some special cases.

If $l=d^{s}r$ and $gcd(d,r)=1$, then $x^{l}-1=(x^{r}-1)^{d^{s}}$. The Hasse derivative $S(x)^{(h)}$ is employed to determine the multiplicity of the roots of unity for $S(x)$, which is defined to be

[TABLE]

The multiplicity of $\theta$ as a root of $S(x)$ is $u$ if it satisfies $S(\theta)=S(\theta)^{(1)}=\ldots=S(\theta)^{(u-1)}$ and $S(\theta)^{(u)}\neq 0$ ([12, Lemma 6.51]). The binomial coefficients appearing in $S(x)^{(h)}$ can be evaluated by Lucas’ congruence [8]

[TABLE]

where $n_{0},\ldots,n_{e}$ and $h_{0},\ldots,h_{e}$ are the digits in the $d$-ary representation of $n$ and $h$ respectively. It is easy to see that

[TABLE]

for $h<d^{e}$ and $n\equiv i\mod d^{e}$.

With the cyclotomic classes of order $v$ denoted by $D_{j}$, the cyclotomic numbers $(i,j)_{v}$ (see [4]) are defined by $(i,j)_{v}=|(D_{i}+1)\cap D_{j}|,0\leq i,j\leq v-1.$ We can express the $h$th Hasse derivative corresponding to the sequence defined in (2) using (5),

[TABLE]

Let $q=cf+1$, the relation between the cyclotomic numbers of order $c$ is given in [4]

[TABLE]

We use the expressions of $S(1)^{(h)}$ to get the multiplicity of 1 as a root of $S(x)$. If the corresponding cyclotomic numbers are known, then from the multiplicity of 1 as a root of $S(x)$ we can get the exact value of $LC_{1}(\{s_{n}\})$ for some special cases. We take $l=\frac{q-1}{2}$, $d=3$ as an example.

To get the following theorem, we need to use cyclotomic numbers of order 6 that rely on the unique decomposition $q=6f+1=A^{2}+3B^{2}$ of $q$ with $A\equiv 1\bmod 3$ and moreover $\gcd(A,q)=1$ when $q=p^{m}$ and $p\equiv 1\bmod 6$. The sign of $B$ relies on the choice of the primitive element $\gamma$.

Theorem 2 Let $\{s_{n}\}$ be a sequence defined in (1) over the finite field $\mathbb{F}_{3}$ with period $l=(q-1)/2$, where $l=3^{a}r\ (a\geq 1)$, $r$ is a prime, $r\neq 3$, 3 is a primitive root modulo $r$ and $r\geq\sqrt{q}+3$. If $B\equiv 0\mod 3$, then $LC_{1}(\{s_{n}\})=LC(\{s_{n}\}).$ Furthermore, if $B\equiv 0\mod 3$ and $A\not\equiv 1\mod 9$ then $LC_{1}(\{s_{n}\})=l-1.$

[TABLE]

[TABLE]

Let $2=\gamma^{b}$, from the the results about the cyclotomic numbers of order 6 given in [4] which we list at the end of the paper, we have the following cases.

From the conditions about $l$ and $q=6f+1$, we know that $f$ is odd. Then from (7), we have

[TABLE]

[TABLE]

According to the cyclotomic number of order 6 listed below, we have

Case I a. $b\equiv 0\mod 3$: $S(1)=-B,\ S(1)^{(1)}=(1-A)/3.$

Case I b. $b\equiv 1\mod 3$: $S(1)=-B,\ S(1)^{(1)}=(1-A)/3-B.$

Case I c. $b\equiv 2\mod 3$: $S(1)=-B,\ S(1)^{(1)}=(1-A)/3+B.$

On the basis of the cases above, combining with Proposition 1, we prove the result. ∎

Example 1 Let $l=711$. Then we have $r=237$ which satisfies the conditions of Theorem 2. From $q=6f+1=A^{2}+3B^{2}$, we know $A=10$ and $B\equiv 0\bmod 3$. Then according to Theorem 2, $LC_{1}(\{s_{n}\})=LC(\{s_{n}\}).$

3  Conclusion

The $k$-error linear complexity of a sequence is an important index in cryptographic. Firstly, we give a general lower bound for the $k$-error linear complexity of subsequences of the $d$-ary Sidel’nikov sequences over the prime field $\mathbb{F}_{d}$. Secondly, we determine the $k$-error linear complexity of subsequences of the $d$-ary Sidel’nikov sequences over the prime field $\mathbb{F}_{d}$.