Algebraic dependence in generating functions and expansion complexity

TL;DR

This paper advances the understanding of expansion complexity in cryptographic sequences by analyzing its algebraic properties, providing bounds for random sequences, and examining sequences from differential equations, including the inversive generator.

Contribution

It introduces algebraic methods to analyze expansion complexity, establishes bounds for random sequences, and explores sequences generated by differential equations.

Findings

Expansion complexity relates to Gröbner bases of polynomial ideals.

Bounds on expansion complexity for random sequences are established.

Sequences from differential equations, like the inversive generator, are analyzed for expansion complexity.

Abstract

In 2012, Diem introduced a new figure of merit for cryptographic sequences called expansion complexity. Recently, a series of paper has been published for analysis of expansion complexity and for testing sequences in terms of this new measure of randomness. In this paper, we continue this analysis. First we study the expansion complexity in terms of the Gr\"obner basis of the underlying polynomial ideal. Next, we prove bounds on the expansion complexity for random sequences. Finally, we study the expansion complexity of sequences defined by differential equations, including the inversive generator.

Equations

$$G(x)=\sum _{n=0}^{\infty }{s}_n{x}^n,$$

$$h(x,G(x))=0$$

$$h(x,G(x))\equiv 0\mathrm{mod}{x}^N.$$

$$G_N(x)=\sum _{n=0}^{N-1}{s}_n{x}^n.$$

$$E_N(\mathcal{S})=\min \{|LE(P_1)|,\dots ,|LE(P_{\ell })|\},$$

$$E_N^{\ast }(\mathcal{S})\le \min \{|LE(P_i)|:P_i\in \mathcal{P}\text{is irreducible}\}.$$

$$\min \{|LE(P_1)|,\dots ,|LE(P_{\ell })|\}\le E_N^{\ast }(\mathcal{S})\le \max \{|LE(P_1)|,\dots ,|LE(P_{\ell })|\}.$$

$$h_1\left(x,\sum _{n=2}^{N-1}{s}_n{x}^n\right)=h\left(x,G_N(x)\right)\equiv 0\mathrm{mod}{x}^N.$$

$$P_i(x,y)=R_i(x,y)T_i(x,y),|LE(R_i)|,|LE(T_i)|\ge 1\text{for}i=1,\dots ,\ell .$$

$$R_i(x,G_N(x))\equiv 0\mathrm{mod}x.$$

$$R_i(x,y)=y{q}_1(x,y)+x{r}_1(x),T_i(x,y)=y{q}_2(x,y)+x{r}_2(x).$$

$$\underset{N\to \infty }{\mathrm{liminf}}\frac{E_N(\mathcal{S})}{N^{1/2}}\ge \frac{\sqrt{2}}{2}{\mu }_q^{\infty }\text{mbox}-almosteverywhere.$$

$$b_N=\lfloor (1-\epsilon )(N/2{)}^{1/2}\rfloor \text{mbox}forN=1,2,\dots .$$

$$b_N\ge 1\text{and}\left(\genfrac{}{}{0ex}{}{b_N+2}{2}\right)\le (1-{\epsilon }_0)N$$

$$A_N=\{\mathcal{S}\in {\mathbb{F}}_q^{\infty }:E_N(\mathcal{S})\le b_N\}.$$

$${\mu }_q^{\infty }(A_N)=q^{-N}\cdot \#\{\mathcal{S}\in {\mathbb{F}}_q^N:E_N(\mathcal{S})\le b_N\}.$$

$$h_i(x,G(x))\equiv 0\mathrm{mod}{x}^{N_i},(1\le i\le k)\text{with}{N}_1+\cdots +N_k=N.$$

$$\frac{1}{k}\sum _{j=1}^k\left(N_j-\left(\genfrac{}{}{0ex}{}{\mathrm{deg}{h}_j+2}{2}\right)\right)$$

$$\ge \frac{{\epsilon }_{0}N}{b_N}\ge {\epsilon }_0\sqrt{N}$$

$$h_1(x,G(x))\equiv 0\mathrm{mod}{x}^{N_1}.$$

$$a_0{x}^d+a_1{x}^{d-1}y+\cdots +a_d{y}^d,$$

$$I_2(d)=\frac{1}{q-1}{q}^{\left(\genfrac{}{}{0ex}{}{d+2}{2}\right)}+O\left(q^{\left(\genfrac{}{}{0ex}{}{d+1}{2}\right)}\right).$$

$$\#\{\mathcal{S}\in {\mathbb{F}}_q^N:E_N(\mathcal{S})\le b_N\}$$

$$\ll \sum _{d_1\le b_N}\sum _{{\epsilon }_0\sqrt{N}+\left(\genfrac{}{}{0ex}{}{d_1+2}{2}\right)\le N_1\le N}{b}_N{q}^{\left(\genfrac{}{}{0ex}{}{d_1+2}{2}\right)-1+N-N_1}$$

$$\ll \sum _{d_1\le b_N}{b}_{N}N{q}^{N-{\epsilon }_0\sqrt{N}}\ll b_N^{2}N{q}^{N-{\epsilon }_0\sqrt{N}}.$$

$$\sum _N{\mu }_q^{\infty }(A_N)\le \sum _N{q}^{-\delta N^{1/2}}\ll \sum _N{N}^{-2}<\infty .$$

$$E_N(\mathcal{S})>b_N>(1-\epsilon )(N/2{)}^{1/2}$$

$$\underset{N\to \infty }{\mathrm{liminf}}\frac{E_N(\mathcal{S})}{(N/2{)}^{1/2}}\ge (1-\epsilon ).$$

$$D^{(r)}{x}^n=\left(\genfrac{}{}{0ex}{}{n}{r}\right)x^{n-r}.$$

$$D^{(r)}(fg)=\sum _{i=0}^r{D}^{(i)}(f)D^{(r-i)}(g)$$

$$f_{k+1}(x)D^{(k)}\left(G(x)\right)+\cdots +f_2(x)D^{(1)}\left(G(x)\right)+f_1(x)G(x)+f_0(x)=0$$

$$s_{n}=\left\{\begin{array}[]{cl}(an-b)^{-1}&\text{if }an-b\not\equiv 0\mod p\\ 0&\text{otherwise,}\end{array}\right.$$

Full text

1. Introduction

For a sequence $\mathcal{S}=(s_{n})_{n=0}^{\infty}$ over the finite field $\mathbb{F}_{q}$ of $q$ elements, we define its generating function $G(x)$ of $\mathcal{S}$ by

[TABLE]

viewed as a formal power series over $\mathbb{F}_{q}$.

A sequence $\mathcal{S}$ is called expansion sequence or automatic sequence if its generating function satisfies an algebraic equation

[TABLE]

for some nonzero polynomial $h(x,y)\in\mathbb{F}_{q}[x,y]$. Clearly, the polynomials $h(x,y)\in\mathbb{F}_{q}[x,y]$ satisfying (1) form an ideal in $\mathbb{F}_{q}[x,y]$. This ideal is called the defining ideal and it is a principal ideal generated by an irreducible polynomial, see [3, Proposition 4].

Expansion sequences can be efficiently computed from a relatively short subsequence via the generating polynomial of its defining ideal [3, Section 5].

Proposition 1**.**

Let $\mathcal{S}$ be an expansion sequence and let $h(x,y)$ be the generating polynomial of its defining ideal. The sequence $\mathcal{S}$ is uniquely determined by $h(x,y)$ and its initial sequence of length $(\deg h)^{2}$. Moreover, $h(x,y)$ can be computed in polynomial time (in $\log q\cdot\deg h$) from an initial sequence of length $(\deg h)^{2}$.

Based on Proposition 1, Diem [3] defined the $N$th expansion complexity in the following way. For a positive integer $N$, the $N$th expansion complexity $E_{N}=E_{N}(\mathcal{S})$ is $E_{N}=0$ if $s_{0}=\ldots=s_{N-1}=0$ and otherwise the least total degree of a nonzero polynomial $h(x,y)\in\mathbb{F}_{q}[x,y]$ with

[TABLE]

For recent results on expansion complexity we refer to [9, 10]. For example, it was pointed out in [9], that small expansion complexity does not imply high predictability in the sense of Proposition 1.

Example*.*

Let $\mathcal{S}$ be a sequence over the finite field $\mathbb{F}_{p}$ ($p\geq 3$) with initial segment $\mathcal{S}=000001\dots$ and generating function $G(x)\equiv x^{5}\mod x^{6}$. Then its 6th expansion complexity is $E_{6}(\mathcal{S})=2$ realized by the polynomial $h(x,y)=x\cdot y$. However, the first 4 elements do not determine the whole initial segment with length 6.

In order to achieve the predictability of sequences in terms of Proposition 1, one needs to require that the polynomial $h(x,y)$ satisfying (2) is irreducible. This observation leads to the i(rreducible)-expansion complexity of a sequence. Accordingly, for a positive integer $N$, the $N$th i-expansion complexity $E^{*}_{N}=E^{*}_{N}(\mathcal{S})$ is $E_{N}^{*}=0$ if $s_{0}=\ldots=s_{N-1}=0$ and otherwise the least total degree of an irreducible polynomial $h(x,y)\in\mathbb{F}_{q}[x,y]$ with (2).

See [9] for more details for expansion and i-expansion complexity.

In this paper we first give bounds on the expansion and i-expansion complexity in terms of the Gröbner basis of the ideal of polynomials (2) in Section 2. In Section 3 we study the typical value of expansion complexity for random sequences. Finally, in Section 4 we study the expansion complexity of sequences defined by differential equations. An example of such a sequence is the so-called explicit inversive generator.

2. Expansion complexity and Gröbner bases

In this section we determine the expansion and i-expansion complexity of a sequence in terms of the Gröbner basis of its defining ideal.

2.1. A brief introduction to Gröbner bases

In the following section, we give a brief introduction of Gröbner bases with special emphasis in properties. For a more complete introduction, we recommend to consult the introductory books of Eisenbud [4] and zur Gathen [13]. In this section we focus only on polynomials with 2 variables and recall the basic notion just for this special case.

For vectors of integer components $\mathbf{\alpha}=(\alpha_{1},\alpha_{2})$ define $|\mathbf{\alpha}|=\alpha_{1}+\alpha_{2}$. The graded lexicographical ordering, denoted by $<_{grlex}$, is defined as $\mathbf{\alpha}<_{grlex}\mathbf{\beta}$ for vectors $\mathbf{\alpha}=(\alpha_{1},\alpha_{2})$ and $\mathbf{\beta}=(\beta_{1},\beta_{2})$ if $|\mathbf{\alpha}|<|\mathbf{\beta}|$ or $|\mathbf{\alpha}|=|\mathbf{\beta}|$ and $\alpha_{2}<\beta_{2}$.

We will use the following notation: Let $C=\sum_{\alpha_{1},\alpha_{2}}c_{\alpha_{1},\alpha_{2}}x^{\alpha_{1}}y^{\alpha_{2}}$ be a nonzero polynomial with each $c_{\alpha_{1},\alpha_{2}}\not=0$ and $I\subset\mathbb{F}_{q}[x,y]$. Then,

1. (a)

$LE(C)=leadexp(C)$ is the largest exponent vector $\alpha$ in $C$ with respect to $<_{grlex}$. 2. (b)

$LM(C)$ denotes the leading monomial of $C$ so if $LE(C)=(\alpha_{1},\alpha_{2})$, then $LM(C)=x^{\alpha_{1}}y^{\alpha_{2}}$. 3. (c)

$LC(C)$ denotes the coefficient of $LM(C)$. In other words, the so called leading term of $C$ is $LC(C)LM(C)$. 4. (d)

$LE(I)=\left\{LE(C)\ |\ 0\neq C\in I\right\}\subseteq\mathbb{N}_{0}^{2}$. (Note that if $I=\{0\}$, then $LE(I)=\emptyset$.) 5. (e)

$LM(I)=\left\{LM(C)\ |\ 0\neq C\in I\right\}=\left\{x^{\alpha_{1}}y^{\alpha_{2}}\ |\ (\alpha_{1},\alpha_{2})\in LE(I)\right\}$. (If $I=\{0\}$, then $LM(I)=\emptyset$.) 6. (f)

For $C(x,y)\in\mathbb{F}_{q}[x,y]$ with $|LE(C)|\geq 2$ and $a,b\in\mathbb{F}_{q}$ we have $LC(C(x,y))=LC(C(x,y+ax+b))$ and $LM(C(x,y))=LM(C(x,y+ax+b))$ with respect to $<_{grlex}$.

Definition 1**.**

Let $\mathcal{P}=\{P_{1},\ldots,P_{\ell}\}\subset\mathbb{F}_{q}[x,y]$ and write $I=\langle P_{1},\ldots,P_{\ell}\rangle$. $\mathcal{P}$ is a Gröbner basis for $I$ with respect to $<_{grlex}$ if $\langle LM(P_{1}),\ldots,LM(P_{\ell})\rangle=\langle LM\left(I\right)\rangle$. If $LC(P_{i})=1$ for $i=1,\ldots,\ell$ and $LM(P_{i})$ does not divide any term of $P_{j}$ for $i\neq j$, then $\mathcal{P}$ is a reduced Gröbner basis for $I$ with respect to $<_{grlex}$.

It is known that for any ideal $I$, there exists $\{P_{1},\ldots,P_{\ell}\}$ that is a reduced Gröbner basis with respect to $<_{grlex}$ and this basis is unique, apart from permutations of the elements.

The following corollary directly follows from Property (f).

Corollary 1**.**

Let $\mathcal{P}=\{P_{1}(x,y),\ldots,P_{\ell}(x,y)\}$ be a reduced Gröbner basis for $\langle\mathcal{P}\rangle$ with respect to $<_{grlex}$. If $|LE(P_{i})|\geq 2$ for all $i=1,\dots,\ell$, then for any $a,b\in\mathbb{F}_{q}$, $\mathcal{P}^{\prime}=\{P_{1}(x,y+ax+b),\ldots,P_{\ell}(x,y+ax+b)\}$ is a reduced Gröbner basis for $\langle\mathcal{P}^{\prime}\rangle$.

2.2. Main results on expansion complexity and Gröbner bases

For a sequence $\mathcal{S}=(s_{n})_{n=0}^{\infty}$ and $N\geq 1$, let $G_{N}(x)\in\mathbb{F}_{q}[x]$ be the generating polynomial of the truncated sequence $(s_{n})_{n=0}^{N-1}$, that is,

[TABLE]

Clearly, $G(x)\equiv G_{N}(x)\mod x^{N}$.

The polynomials $h(x,y)$ satisfying (2) form an ideal $I$ generated by $I=\langle y-G_{N}(x),x^{N}\rangle$. We prove the following result which makes a link between the expansion and i-expansion complexity and the Gröbner basis of $I$.

Theorem 1**.**

Given any sequence $\mathcal{S}$ over $\mathbb{F}_{q}$ let $\mathcal{P}=\{P_{1},\ldots,P_{\ell}\}$ be a reduced Gröbner basis for $\langle y-G_{N}(x),x^{N}\rangle$ with respect to $<_{grlex}$. Then

[TABLE]

and

[TABLE]

As a consequence, we have the following bounds on the i-expansion complexity:

[TABLE]

Remark*.*

From a Gröbner basis with respect to a lexicographic order one can compute the Gröbner basis of the same ideal with respect to the graded lexicographical using the FGLM algorithm [6]. The computational complexity of the algorithm, from an ideal generated by $I=\langle y-G_{N}(x),x^{N}\rangle$ is $O\left(N^{3}\right)$ field operations [6, Proposition 4.1]. Thus one can find the polynomials $P_{1},\dots,P_{\ell}$ in Theorem 1, and compute the expansion and i-expansion complexity in at most $N^{3}(\log q)^{O(1)}$ binary operations.

Proof.

In order to prove the first part, observe that for any polynomial $h(x,y)$ satisfying (2) we have $LM(P_{i})\leq_{grlex}LM(h)$ for some $i$, so $\deg P_{i}\leq\deg h(x,y)$.

For the second part, if $s_{n}=0$ for $2\leq n\leq N-1$, then the result is immediate. Otherwise, we can reduce it to the case when $s_{0}=s_{1}=0$. If the non-zero polynomial $h(x,y)$ satisfies (2), then $h_{1}(x,y)=h(x,y+s_{0}+s_{1}x)$ is a polynomial with $\deg h=\deg h_{1}$ and

[TABLE]

As $E_{N}(\mathcal{S})\geq 2$, we have $|LE(P_{1})|,\dots,|LE(P_{\ell})|\geq 2$ by the first part of the theorem. Then by Corollary 1 the reduced Gröbner basis changes according to the linear transform of the variables $y\rightarrow y+s_{0}+s_{1}x$. Moreover, the irreducibly of polynomials $h(x,y)$ and $P_{1},\dots,P_{\ell}$ does not changes under this transformation. Evenmore, because the definition of $<_{grlex}$, applying that linear transformation to $P_{1},\ldots,P_{\ell}$ results in a Gröbner basis with respect to $<_{grlex}$.

Now, we are going to show that one of the polynomials $P_{1},\ldots,P_{\ell}$ must be irreducible. Suppose contrary, that all the polynomials $P_{1},\ldots,P_{\ell}$ are reducible, so for all $i=1,\ldots,\ell,$

[TABLE]

As $P_{i}$ belongs to the reduced Gröbner basis of $\langle y-G_{N}(x),x^{N}\rangle$, we have $T_{i}(x,G_{N}(x))\not\equiv 0\mod x^{N}$ and so

[TABLE]

Since $s_{0}=s_{1}=0$, the smallest degree term of $G_{N}(x)$ has degree at least two, so we must have $R_{i}(x,y)\in\langle x,y\rangle$. Similarly, we also get $T_{i}(x,y)\in\langle x,y\rangle$. Write

[TABLE]

Then $R_{i}(x,y)T_{i}(x,y)\in\langle y^{2},yx,x^{2}\rangle$, so $I=\langle y-G_{N}(x),x^{N}\rangle=\langle R_{1}T_{1},\ldots,R_{\ell}T_{\ell}\rangle\subset\langle y^{2},yx,x^{2}\rangle$. However, $y-G_{N}(x)\not\in\langle y^{2},yx,x^{2}\rangle$, a contradiction. ∎

3. A probabilistic result

In this section we study the $N$th expansion complexity for random sequences. We prove, that for such sequences the $N$th expansion complexity is large.

Let $\mu_{q}$ be the uniform probability measure on $\mathbb{F}_{q}$ which assigns the measure $1/q$ to each element of $\mathbb{F}_{q}$. Let $\mathbb{F}_{q}^{\infty}$ be the sequence space over $\mathbb{F}_{q}$ and let $\mu_{q}^{\infty}$ be the complete product probability measure on $\mathbb{F}_{q}^{\infty}$ induced by $\mu_{q}$. We say that a property of sequences $\mathcal{S}\in\mathbb{F}_{q}^{\infty}$ holds $\mu_{q}^{\infty}$-almost everywhere if it holds for a set of sequences $\mathcal{S}$ of $\mu_{q}^{\infty}$-measure $1$. We may view such a property as a typical property of a random sequence over $\mathbb{F}_{q}$.

Theorem 2**.**

We have

[TABLE]

We remark, that Theorem 2 is the corrected form of [10, Theorem 4]. In [10], the authors used [3, Proposition 7], which requires the irreducibly property, and consequently, it holds for the i-expansion complexity instead for the expansion complexity, see [9, Theorem 2]. Theorem 2 gives now a lower bound on the expansion complexity of typical sequences.

Proof.

First we fix an $\varepsilon$ with $0<\varepsilon<1$ and we put

[TABLE]

Then

[TABLE]

for some positive $\varepsilon_{0}$ if $N$ is large enough. For such $N$ put

[TABLE]

Since $E_{N}({\mathcal{S}})$ depends only on the first $N$ terms of ${\mathcal{S}}$, the measure $\mu_{q}^{\infty}(A_{N})$ is given by

[TABLE]

If $\mathcal{S}\in\mathbb{F}_{q}^{N}$ is a sequence with $E_{N}(\mathcal{S})\leq b_{N}$, there is a polynomial $h(x,y)$ with degree at most $b_{N}$ with (2). Write $h(x,y)=h_{1}(x,y)\cdots h_{k}(x,y)$ with $h_{i}(x,y)$ irreducible factor, then

[TABLE]

Now

[TABLE]

by the choice of $b_{N}$. So $N_{j}-\binom{\deg h_{j}+2}{2}\geq\varepsilon_{0}\sqrt{N}$ for some $1\leq j\leq k$. Without loss of generality, we can suppose that $j=1$.

We estimate the cardinality of $A_{N}$ by the number of such sequences that

[TABLE]

Write $\mathcal{S}=(\mathcal{S}_{1},\mathcal{S}_{2})\in\mathbb{F}_{q}^{N}$ with $\mathcal{S}_{1}\in\mathbb{F}_{q}^{N_{1}}$ and $\mathcal{S}_{2}\in\mathbb{F}_{q}^{N-N_{1}}$. For a fixed irreducible polynomial of degree $d$ there are at most $d$ choices for $\mathcal{S}_{1}$ (see [3, p. 332]) and $q^{N-N_{1}}$ choices for $\mathcal{S}_{2}$. If two irreducible polynomials are constant multiples of each other, they define the same sequences $\mathcal{S}_{1}$.

Let a polynomial $f(x,y)$ of degree $d$ be called normalized if in the coefficient vector $(a_{0},a_{1},\dots,a_{d})$ of the homogeneous part with degree $d$ of $f$, i.e.,

[TABLE]

the first nonzero element is 1.

Let $I_{2}(d)$ be the number of normalized irreducible polynomials (with two variables) in $\mathbb{F}_{q}[x,y]$ of total degree $d$. Then by [2] we have

[TABLE]

Thus

[TABLE]

By the choice of $b_{N}$, we have that $\mu_{q}^{\infty}(A_{N})$ is at most $q^{-\delta N^{1/2}}$ for some positive $\delta$. If $N$ is large enough, then $q^{-\delta N^{1/2}}<N^{-2}$ so

[TABLE]

Then the Borel-Cantelli lemma shows that the set of all ${\mathcal{S}}\in\mathbb{F}_{q}^{\infty}$ for which ${\mathcal{S}}\in A_{N}$ for infinitely many $N$ has $\mu_{q}^{\infty}$-measure [math]. In other words, $\mu_{q}^{\infty}$-almost everywhere we have ${\mathcal{S}}\in A_{N}$ for at most finitely many $N$. It follows then from the definition of $A_{N}$ that $\mu_{q}^{\infty}$-almost everywhere we have

[TABLE]

for all sufficiently large $N$. Therefore $\mu_{q}^{\infty}$-almost everywhere,

[TABLE]

By applying this for $\varepsilon=1/r$ with $r=1,2,\ldots$ and noting that the intersection of countably many sets of $\mu_{q}^{\infty}$-measure $1$ has again $\mu_{q}^{\infty}$-measure $1$, we obtain the result of the theorem. ∎

4. Sequences defined by differential equations

In this section we study the expansion complexity of sequences characterized by the property that their generating function satisfies certain differential equations. For $r\geq 0$ let $D^{(r)}$ denote the $r$-th Hasse derivative defined by

[TABLE]

The first Hasse derivative $D^{(1)}$ is identical to the standard derivative. Moreover, it satisfies the chain rule

[TABLE]

for all $f,g\in\mathbb{F}_{q}[x]$. For more details see [7].

In this section we consider sequences $\mathcal{S}=(s_{n})$ whose generating function $G(x)$ satisfies

[TABLE]

with polynomials $f_{k+1}(x),\dots,f_{0}(x)\in\mathbb{F}_{q}[x]$.

In Theorem 3 below, we give bounds on the $N$th expansion complexity of sequences over prime fields whose generating function satisfies a first order differential equation (7) with small degree coefficient polynomials.

One of the most important examples for such sequence is the explicit inversive generator over a prime field $\mathbb{F}_{p}$, with some prime $p\geq 3$, defined by

[TABLE]

with some $a,b\in\mathbb{F}_{p}$, $a\neq 0$. Its generating function $G_{a,b}(x)$ satisfies

[TABLE]

see Corollary 2 below.

Theorem 3**.**

Let $\mathcal{S}=(s_{n})$ be a sequence over $\mathbb{F}_{p}$. Assume, that its generating function $G(x)$ satisfies

[TABLE]

with $M\geq 1$ for some polynomials $f_{0}(x),f_{1}(x),f_{2}(x)\in\mathbb{F}_{p}[x]$ such that there is an $\alpha\in\overline{\mathbb{F}}_{q}$ with $f_{2}(\alpha)=0$, $f_{1}(\alpha)=0$ and $f_{2}^{\prime}(\alpha)f_{0}(\alpha)\neq 0$.

Let $F=\max\{\deg f_{2}-1,\deg f_{1},\deg f_{0}-1\}$. Then

[TABLE]

Previously, only a few examples for sequences were known with large expansion complexity, all of them share the property (7). Namely, the sequences of binomial coefficients $\mathcal{A}=(a_{n})_{n=0}^{\infty}$, defined by

[TABLE]

for some $k\geq 0$, whose generating function is $G_{k}(x)=(1-x)^{-1-k}$ by [10, Lemma 2], which satisfies

[TABLE]

and the explicit inversive generator defined by (8) with $b=0$, see [9].

We also remark, that (9) defines a linear recurrence relation to the counter-dependent sequence $(n\,s_{n})$ in terms of $(s_{n})$ and $(n\,s_{n})$. This type of relations appears in the so called counter-dependent nonlinear recursive pseudorandom number generators. A counter-dependent nonlinear recursive pseudorandom number generator is of the form:

[TABLE]

This class of generators was introduced by Shamir and Tsaban in order to avoid unexpected short cycles (see Definition 2.4 of [11]) for $m=1$. Special cases of this type of generators have been studied in relation with exponential sums and multiplicative character sums [1, 5, 8, 12]. For example, sequences whose generating function $G(x)$ satisfies

[TABLE]

coincides with the special class of sequences proposed by Shparlinski and Winterhof [12], defined as $s_{n}=ns_{n-1}+1$.

In order to prove Theorem 3, we need the following result, see [3, Lemma 6].

Lemma 2**.**

Let $h(x,y)\in\mathbb{F}_{q}[x,y]$ be an irreducible polynomial of degree $d$ and let $\mathcal{S}$ be an expansion sequence defined by $h(x,y)$. Let $f(x,y)\in\mathbb{F}_{q}[x,y]$ be a nonzero polynomial with

[TABLE]

Then $f(x,y)$ is a multiple of $h(x,y)$.

Proof of Theorem 3.

Put $K=\deg f_{0}(x)$. There is a nonzero element among $s_{0},\dots,\allowbreak s_{K+1}$ and thus $E_{K+1}(\mathcal{S})\geq 1$. Indeed, if $G(x)\equiv 0\mod x^{K+2}$, then $f_{0}(x)=0$ by (9), a contradiction.

If $s_{0}=0$, consider the sequence $\bar{\mathcal{S}}=(\bar{s}_{n})$ with $\bar{s}_{0}=1$ and $\bar{s}_{n}=s_{n}$ for $n\geq 1$. Let $\bar{G}(x)=G(x)+1$ be the generating function of $\bar{\mathcal{S}}$. Then $h(x,\bar{G}(x))\equiv 0\mod x^{N}$ if and only if $h(x,G(x)+1)\equiv 0\mod x^{N}$. Thus $E_{N}(\mathcal{S})=E_{N}(\bar{\mathcal{S}})$ whenever $E_{N}(\mathcal{S})>0$. As it holds for $N\geq K+1$, we can assume that $s_{0}\neq 0$ and $E_{1}(\mathcal{S})=1$.

Now suppose that the result does not hold for some $N\geq K+2$, and fix $N$ as a minimal value such

[TABLE]

where $d=E_{N}(\mathcal{S})$. We can assume, that $d<p$. Let $h(x,y)\in\mathbb{F}_{q}[x,y]$ such that $\deg h(x,y)=d$ and $h(x,G(x))\equiv 0\mod x^{N}$. First we prove, that $h(x,y)$ is irreducible. Suppose, that $h(x,y)=h_{1}(x,y)h_{2}(x,y)$ and

[TABLE]

Then by the minimality of $N$ we have

[TABLE]

Thus

[TABLE]

a contradiction.

Taking the derivative of the equation $h(x,G(x))\equiv 0\mod x^{N}$ we get

[TABLE]

thus multiplying it with $f_{2}(x)$ the we get by (9) that

[TABLE]

The degree of

[TABLE]

is $\deg g(x,y)\leq d+F$.

Let $\bar{\mathcal{S}}=(\bar{s}_{n})$ be an expansion sequence defined $h(x,y)$ with $\bar{s}_{n}=s_{n}$ for $0\leq n<N$. As $d^{2}<N$, $\bar{S}$ is unique. Then by (10), (12) and by Lemma 2 we get that $g(x,y)$ is a multiple of $h(x,y)$,

[TABLE]

for some nonzero $c(x,y)\in\mathbb{F}_{q}[x,y]$. Comparing the degrees of $g(x,y)$ and $c(x,y)h(x,y)$ with respect to $y$, we get $c(x,y)=c(x)\in\mathbb{F}_{q}[x]$.

We show, that $c(\alpha)\neq 0$. Write

[TABLE]

We can assume, that $k<p$ and $r_{k}(x)\neq 0$. The coefficient of $y^{k}$ in $c(x)h(x,y)$ is

[TABLE]

If $\alpha$ is a zero of $c$, then it’s a zero of $g$ by (14) and thus it’s a zero of $\frac{\partial h}{\partial y}$ by (13). As $k<p$, $\alpha$ is also a zero of $r_{k}$. Let $t\geq 1$ be the multiplicity of $\alpha$ in $r_{k}$. As $\alpha$ is a single zero of $f_{2}$, its multiplicity of the left hand side of (15) is $t$, while its multiplicity of the right hand side is at least $t+1$, a contradiction.

Substituting $x=\alpha$ in (14), we get

[TABLE]

Since $c(\alpha)\neq 0$, $h(\alpha,y)$ must be zero, otherwise it cannot be a constant multiple of its derivative. Thus the minimal polynomial of $\alpha$ divides $h(x,y)$, a contradiction. ∎

Theorem 3 allows us to control the expansion complexity of the explicit inversive generator defined by (8). We remark, that for $b=0$ it was shown by Gómez-Pérez, Mérai and Niederreiter that the sequence has optimal expansion complexity, see [9]. Now we deal with the general case.

Corollary 2**.**

Let $\mathcal{S}=(s_{n})$ be the explicit inversive generator defined by (8) with $a,b\in\mathbb{F}_{p}$, $a\neq 0$. Then we have

[TABLE]

for some absolute constant $c>0$.

Proof.

For $b=0$ a stronger bound follows from [9, Theorem 8], thus we can assume, that $b\neq 0$.

As $G_{a,b}(x)=a^{-1}G_{1,b/a}(x)$, we can assume, that $a=1$. Write $G(x)=G_{1,b}(x)$. Then

[TABLE]

Now

[TABLE]

On the other hand

[TABLE]

Then by (16) and (17) we get

[TABLE]

For $N\leq b$ we have

[TABLE]

thus by Theorem 3 we have

[TABLE]

For $N>b$ (18) leads to

[TABLE]

and by Theorem 3 we get

[TABLE]

If $N\ll b$, $E_{N}(\mathcal{S})\gg\sqrt{N}$ by  (19) and if $N\gg b^{2}$, we get $E_{N}(\mathcal{S})\gg\sqrt{N}$ by (20). Finally, using $E_{N+1}(\mathcal{S})\geq E_{N}(\mathcal{S})$, we get $E_{N}(\mathcal{S})\gg\sqrt{b}$ for $b\ll N\ll b^{2}$ which gives the result. ∎

Remark*.*

The proof gives the stronger bounds on expansion complexity of the explicit inversive generator $\mathcal{S}_{a,b}$ with parameters $a\in\mathbb{F}_{p}^{*}$, $b\in\mathbb{F}_{p}$

[TABLE]

If the parameters $(a,b)$ are chosen uniformly from $\mathbb{F}_{p}^{*}\times\mathbb{F}_{p}$, then it provides a square-root bound for almost all parameters $(a,b)$ which is optimal, see [9, Theorem 1].

In Theorem 3 we gave lower bounds on the $N$th expansion complexity of sequences whose generating function satisfies a first order differential equation (7). However, we conjecture that sequences with higher order differential equation (7) have also large expansion complexity.

Problem 1**.**

Let $\mathcal{S}=(s_{n})$ be a sequence in $\mathbb{F}_{q}$ such that its generating function $G(x)$ satisfies (7). Estimate the $N$th expansion complexity $E_{N}(\mathcal{S})$ of the sequence $\mathcal{S}$ in terms of the coefficient polynomials of (7).

In [10], Mérai, Niederreiter and Winterhof studied the connection between the expansion and linear complexity of sequences. We recall, that the $N$th linear complexity $L_{N}(\mathcal{S})$ of a sequence $\mathcal{S}$ over a finite field $\mathbb{F}_{q}$ is zero if $s_{0}=\dots=s_{N-1}=0$, otherwise the least positive $L$ such that there exist $c_{0},\dots,c_{L-1}\in\mathbb{F}_{q}$ such that

[TABLE]

They proved, that large expansion complexity implies large linear complexity

[TABLE]

They also provided a lower bound on the expansion complexity in terms of the linear complexity, however the bound also depends on the linear recurrence relation (21).

Here we give lower bounds on the $N$th linear complexity of sequences with (7) over arbitrary (i.e. not prime) finite fields. This result along with [10] motivates Problem 1.

Theorem 4**.**

For polynomials $f_{k+1}(x),\dots,f_{0}(x)\in\mathbb{F}_{q}[x]$ consider the differential operator $T:\mathbb{F}_{p}[[x]]\rightarrow\mathbb{F}_{q}[[x]]$,

[TABLE]

with coprime coefficients such that it has no rational zero. If $\mathcal{S}=(s_{n})_{n=0}^{\infty}$ is a sequence over $\mathbb{F}_{q}$ such that its generating function $G(x)$ satisfies

[TABLE]

then

[TABLE]

with $F=\max\left\{\deg f_{k+1}(x),\dots,\deg f_{0}(x)\right\}$.

Remark*.*

Theorem 4 also holds with the standard derivative instead of the Hasse derivative. Thus one can also consider the analogue of Problem 1.

Proof.

For $N\leq M$ put $L=L_{N}(\mathcal{S})$. Then there exist polynomials $g(x),h(x)\in\mathbb{F}_{q}[x]$, $\deg g(x)<L$, $\deg h(x)\leq L$, $h(x)\neq 0$ such that

[TABLE]

One can choose

[TABLE]

where $c_{L}=-1$ and $c_{0},\dots,c_{L-1}$ are the coefficients of the linear recurrence relation (21).

By the chain rule (6), and by (22) we get

[TABLE]

Then multiplying $T(G(x))$ by $h^{k+1}(x)$ we get

[TABLE]

Whence

[TABLE]

If $J(x)=0$, then $\overline{G}(x)=g(x)/h(x)$ is a zero of $T$, as (23) holds for $\overline{G}(x)$ with equality, a contradiction.

Comparing the degrees of both sides we get

[TABLE]

which gives the result. ∎

Acknowledgement

D. G-P. is partially supported by project MTM2014-55421-P from the Ministerio de Economia y Competitividad and L. M. is partially supported by the Austrian Science Fund FWF Project I1751-N26 and P 31762.