Linear Complexity of A Family of Binary $pq^2$-periodic Sequences From Euler Quotients

TL;DR

This paper introduces a new family of binary sequences based on Euler quotients with high linear complexity, useful for cryptographic applications, and provides their minimal polynomials under specific conditions.

Contribution

The paper determines the minimal polynomials and linear complexities of a new family of binary $pq^2$-periodic sequences derived from Euler quotients, under certain modular conditions.

Findings

Sequences have high linear complexity

Minimal polynomials are explicitly determined

Sequences are suitable for cryptographic use

Abstract

We first introduce a family of binary $pq^2$-periodic sequences based on the Euler quotients modulo $pq$, where $p$ and $q$ are two distinct odd primes and $p$ divides $q-1$. The minimal polynomials and linear complexities are determined for the proposed sequences provided that $2^{q-1} \not\equiv 1 \mod{q^2}.$ The results show that the proposed sequences have high linear complexities.

Equations

$$\psi (t)=\frac{t^{\phi (pq)}-1}{pq}(\mathrm{mod}pq),$$

$$\psi(t+kpq)\equiv\psi(t){\color[rgb]{0,0,0}+}kt^{-1}(p-1)(q-1)\pmod{pq}.$$

$$s_{t}=\left\{\begin{array}[]{l@{\quad\quad}l}0,&\textrm{if}~{}~{}~{}0\leq\frac{\psi(t)}{pq}<\frac{1}{2},\\ 1,&\textrm{if}~{}~{}~{}\frac{1}{2}\leq\frac{\psi(t)}{pq}<1.\end{array}\right.$$

$$a_i+c_1\cdot a_{i-1}+\cdots +c_L\cdot a_{i-L}=0,foralli\ge L.$$

$$M_{\mathbf{a}}(x)=\frac{x^N-1}{\gcd (x^N-1,A(x))},$$

$$\mathcal{L}(\mathbf{a})=N-\mathrm{deg}(\gcd (x^N-1,A(x))).$$

$$M_{\mathbf{s}}(x)=\left\{\begin{array}[]{l@{\quad\quad}l}\Phi_{pq^{2}}(x),&\textrm{if}~{}~{}~{}q\equiv 1\pmod{4},\\ \Phi_{pq^{2}}(x)\Phi_{pq}(x),&\textrm{if}~{}~{}~{}q\equiv 3\pmod{4},\end{array}\right.$$

$$\mathcal{L}(\mathbf{s})=\left\{\begin{array}[]{l@{\quad\quad}l}(p-1)(q^{2}-q),&\textrm{if}~{}~{}~{}q\equiv 1\pmod{4},\\ (p-1)(q^{2}-1),&\textrm{if}~{}~{}~{}q\equiv 3\pmod{4}.\end{array}\right.$$

$$\psi (t+p{q}^2)=\psi (t)(\mathrm{mod}pq)$$

$$\psi (pq+1)\equiv \psi (1)+(p-1)(q-1)\equiv (p-1)(q-1)(\mathrm{mod}pq).$$

$$\psi (-1+kpq)=k(p+q-1)(\mathrm{mod}pq)$$

$$\left\{\begin{array}[]{l@{\quad\quad}l}h\equiv g\pmod{p},\\ h\equiv 1\pmod{q^{2}}.\end{array}\right.$$

$${Z}_{p{q}^2}^{\ast }=\{g^i{h}^j:0\le i<qe,0\le j<d\}.$$

$$\text{Img}(\psi )=p{\mathbb{Z}}_{pq}$$

$$\text{Ker}(\psi )=⟨g^q,h⟩=\{g^{qi}{h}^j\mid 0\le i<e,0\le j<d\},$$

$$\psi (t)=\frac{(1+t{}^{\prime }p{)}^{q-1}-1}{pq}\equiv t{}^{\prime }(q-1)q^{-1}\equiv 0(\mathrm{mod}p)$$

$$\psi (uv)=$$

$$=$$

$$\equiv$$

$$\psi (g)=$$

$$\equiv$$

$$\psi (g)\equiv pa\not\equiv 0(\mathrm{mod}pq).$$

$$\psi (g^q)=q\psi (g)=0(\mathrm{mod}q).$$

$$\psi (h)=\frac{h^{\phi (pq)}-1}{pq}\equiv p^{-1}\frac{(1+q^2{h}_1{)}^{\phi (pq)}-1}{q}\equiv 0(\mathrm{mod}q).$$

$$\{(g^q{)}^i{h}^j(\mathrm{mod}p{q}^2)\mid 0\le i<e,0\le j<d\}=⟨g^q,h⟩\subseteq \text{Ker}(\psi ).$$

$${\mathbb{Z}}_{p{q}^2}^{\ast }/⟨g^q,h⟩\simeq (⟨g,h⟩/⟨h⟩)/(⟨g^q,h⟩/⟨h⟩)\simeq ⟨g⟩/⟨g^q⟩.$$

$$|\text{Ker}(\psi )|=|\frac{{\mathbb{Z}}_{p{q}^2}^{\ast }}{\text{Img}(\psi )}|=\frac{(p-1)(q-1)q}{q}=(p-1)(q-1)$$

$$\psi (\hat{g})=b\cdot \psi (g)(\mathrm{mod}pq)$$

$$\psi (\hat{g})\equiv pab\equiv p(\mathrm{mod}q).$$

$$\begin{gathered} D_{\ell }=\{t:\psi (t)=p\ell (\mathrm{mod}pq),t\in \\ {Z}_{p{q}^2}^{\ast }\} \end{gathered}$$

$${\hat{D}}_{\ell }={\hat{g}}^{\ell }{D}_0=\{{\hat{g}}^{\ell }\cdot t(\mathrm{mod}p{q}^2):t\in D_0\}$$

Full text

I Introduction

We will begin by the following definition of the Euler quotient modulo a product of two distinct odd primes. Let $p$ and $q$ be two distinct odd primes. For a nonnegative integer $t$ that is relatively prime to $pq$, the Euler quotient $\psi(t)\pmod{pq}$ is defined as a unique integer in $\mathbb{Z}_{pq}$ with

[TABLE]

where $\varphi(\cdot)$ is the well-known Euler-phi function. We also define $\psi(t)=0$ if $t$ and $pq$ are not relatively prime.

It can be seen easily that the Euler quotient has the following property:

[TABLE]

where $t,k\in{\mathbb{Z}}$ and $t$ is relatively prime to $pq.$

In 2010, Chen, Ostafe and Winterhof[11] introduced families of binary sequences using Fermat/Euler quotients. Then several nice cryptographic properties of these sequences were proved in [6, 7, 8, 3, 5, 4]. Based on the distribution and algebraic structure of the Fermat quotients, the linear complexity was determined for a binary threshold sequence defined from Fermat quotients [8]. Naturally, the definition of the Euler quotient can be generalized by Euler’s Theorem [1]. Chen and Winterhof extended the distribution of pseudorandom numbers and vectors derived from Fermat quotients to Euler quotients [6]. Moreover, linear complexities were calculated for binary sequences derived from Euler quotients with prime-power modulus. Trace representations and linear complexities were investigated for binary sequences derived from Fermat quotients [3]. Subsequently, a trace representation was given for a family of binary sequences derived from Euler quotients modulo a fixed power of a prime [4]. Chen and Winterhof generalized Fermat quotients to the so-called polynomial quotients in [7]. Then the $k$-error linear complexity was determined for binary sequences derived from the polynomial quotient modulo a prime [5] or its power [21], respectively. In [22], a series of optimal families of perfect polyphase sequences were derived from the array structure of Fermat-quotient sequences. All of the above results show that pseudorandom sequences derived from Fermat quotients, Euler quotients or their variants can be regarded as an important class of sequences from a cryptographic point of view.

In this paper, we study binary sequences derived from the Euler quotient modulo $pq$. Using the same notation as above, a binary threshold sequence $\mathbf{s}=\{s_{t}|t\in\mathbb{Z},t\geq 0\}$ from the Euler quotient modulo $pq$ can be defined as

[TABLE]

For our purpose, we introduce the concept of the linear complexity of binary sequences now. The linear complexity of an $N$-periodic sequence $\mathbf{a}=\{a_{i}|i\in\mathbb{Z},i\geq 0\}$ over the binary field $\mathbb{F}_{2}$ is the smallest nonnegative integer $L$ for which there exist elements $c_{1},c_{2},\cdots,c_{L}\in\mathbb{F}_{2}$ such that

[TABLE]

Let $A(x)=\sum\limits_{i=0}^{N-1}a_{i}x^{i}\in\mathbb{F}_{2}[x]$ be the generating polynomial of $\mathbf{a}$. By [13], the minimal polynomial of $\mathbf{a}$ is defined as

[TABLE]

where $\gcd(\cdot,\cdot)$ denotes the greatest common divisor of two polynomials over $\mathbb{F}_{2}$ and the linear complexity of $\mathbf{a}$ is

[TABLE]

Note that the linear complexity is of fundamental importance as a complexity measure for binary sequences in sequences designs [13, 14, 15]. Besides the measure of the linear complexity for sequences, other measures are also required according to different specific requirements from applications, for example, low autocorrelations or cross-correlations [25, 26], good nonlinear properties [28, 17, 27], and sphere complexities (or $k$-error complexities) [10, 9].

For a binary sequence to be cryptographically strong, the linear complexity of the sequence should be at least a half of the least period of the sequence. In fact, if the linear complexity of a binary sequence $\mathbf{a}$ for additive stream ciphering purposes is $\mathcal{L}(\mathbf{a})$, then $2\mathcal{L}(\mathbf{a})$ consecutive bits of the sequence can be employed to “recover” the whole key stream with the well-known Berlekamp-Massey algorithm [19, 13]. Therefore, it is necessary that key stream sequences must have large linear complexity in additive stream ciphers to resist the Berlekamp-Massey attack from a point of cryptographic view.

The main contribution of this paper is to determine the minimal polynomial and the linear complexity of the sequence defined in (3). We state our main result as follows.

Theorem 1

Let $p$ and $q$ be two distinct odd primes with $p$ dividing $q-1$. Assume that $2^{q-1}\not\equiv 1\pmod{q^{2}}.$ Then the binary threshold sequence $\mathbf{s}$ defined in (3) has period at least $pq^{2}.$ The minimal polynomial of $\mathbf{s}$ is

[TABLE]

where $\Phi_{n}(x)$ denotes the $n$-th cyclotomic polynomial for any positive integer $n$ and the linear complexity of $\mathbf{s}$ is

[TABLE]

To the best of our knowledge, this is the first time to introduce this kind of sequences based on the Euler quotient modulo a product of two distinct odd primes. Under the condition that $p$ divides $q-1$, we will show that the binary sequence has period at least $pq^{2}$. Furthermore, minimal polynomials and linear complexities of this class of binary sequences are determined. It turns out that the proposed sequence has linear complexity which is much higher than a half of the least period. This means that it can be employed in stream ciphers. Note that the sphere complexity [13] (or $k$-error linear complexity [24]) of key stream sequences which measures the stability of linear complexity is also cryptographically important. Several classes of sequences derived from Euler (or Fermat) quotients modulo a fixed prime power have good $k$-error linear complexities (see [5, 21]). We expect that the proposed sequence also posses such good properties. In fact, some experimental results have indicated that $1$-error linear complexity of the presented sequence here is still equal to the original linear complexity, which means that it is entirely possible to have good linear complexity stability for the proposed sequence. We leave this problem as future work.

By using the generalized cyclotomic techniques, one can also construct other binary sequences with period $pq^{2}$. We refer the reader to see [12, 2, 16] for more details. We emphasize that our results are new. In particular, we point out that our results are not special cases of Theorem 4.2 of [16] although both may give a sequence with period $pq^{2}$. In fact, this can be seen easily by comparing linear complexities of the two families of binary sequences.

In the rest of the paper, we give a proof of the above theorem in Section II, and conclude with a few remarks in Section III.

II Proof of Main Results

In this section, we are devoting to the proof of the main results.

We first show that $pq^{2}$ is one of the periods of sequence $\mathbf{s}$ under the condition that $p$ is a divisor of $q-1$. Setting $k=q$ in (2), we see that

[TABLE]

which implies $s_{t+pq^{2}}=s_{t}$ for all $t\geq 0$. Thus the sequence $\mathbf{s}$ is periodic with period $pq^{2}$. We will demonstrate that $pq^{2}$ is the least period of the sequence $\mathbf{s}$ in the following lemma.

Lemma 1

With the notation above, the sequence $\mathbf{s}$ has period at least $pq^{2}$.

Proof:

We first prove that $pq$ is not a period of the sequence $\mathbf{s}$. By (2), we have

[TABLE]

It follows from $2(p-1)(q-1)-pq=(p-2)(q-1)-p>0$ that the $(pq+1)$-th term of the sequence $\mathbf{s}$ is equal to 1, i.e., $s_{pq+1}=1$. Note that $s_{1}=0\neq 1=s_{pq+1}$ according to the definition of the sequence $\mathbf{s}$. Hence $pq$ is not a period of the sequence $\mathbf{s}$.

Now we prove that $q^{2}$ is not a period of the sequence $\mathbf{s}$. We can assume that $q^{2}$ is a period of the sequence $\mathbf{s}$. Let $k=\lceil\frac{pq}{2(p+q-1)}\rceil$. It follows from (2) that

[TABLE]

and thus $s_{-1+kpq}=1$. This means that the sequence $\mathbf{s}$ satisfies $s_{-1+kpq+q^{2}}=s_{-1+kpq}=1$. However, we have $s_{-1+kpq+q^{2}}=0$ according to the definition of the sequence $\mathbf{s}$ and $\gcd(kpq-1+q^{2},pq)=\gcd(kpq+(q-1)(q+1),pq)=p.$ It follows that $s_{kpq-1+q^{2}}\neq s_{kpq-1}$, a contradiction.

Hence the least period of the sequence $\mathbf{s}$ is $pq^{2},$ which completes the proof of the lemma. ∎

For any integer $n\geq 2$, we denote by $\mathbb{Z}_{n}=\{0,1,\cdots,n-1\}$ all representatives for the residue classes of integers modulo $n$ and by $\mathbb{Z}_{n}^{*}$ all representatives that are relatively prime to $n$ in $\mathbb{Z}_{n},$ respectively. Since the least period of $\mathbf{s}$ is $pq^{2}$, we restrict the action of $\psi$ on $\mathbb{Z}_{pq^{2}}$ sometimes. With a slight abuse of notation, we shall still use the same symbol $\psi$ to denote this restriction of the Euler quotient on $\mathbb{Z}_{pq^{2}}$.

Let $g\in\mathbb{Z}_{pq^{2}}^{*}$ be a fixed common primitive root of both $p$ and $q^{2}$. The Chinese Reminder Theorem(CRT) [23] guarantees that there exists an element $h$ of $\mathbb{Z}_{pq^{2}}^{*}$ such that

[TABLE]

Put $d=\gcd(p-1,q-1)$ and $e=\textrm{lcm}(p-1,q-1)=(p-1)(q-1)/d$ where lcm denotes least common multiple. Then the unit group $\mathbb{Z}_{pq^{2}}^{*}$ of the ring $\mathbb{Z}_{pq^{2}}$ [12] can be written as follows

[TABLE]

The following lemma shows that the map $\psi$ is a group homomorphism when we restrict the action of the map $\psi$ to the unit group $\mathbb{Z}_{pq^{2}}^{*}$.

Lemma 2

Let $\psi:t\rightarrow\psi(t)$ be the map from $\langle\mathbb{Z}_{pq^{2}}^{*},\cdot\rangle$ to $\langle p\mathbb{Z}_{pq},+\rangle,$ where $p\mathbb{Z}_{pq}=\{lp\mid 0\leq l\leq q-1\}$ contains exactly all of the residue classes which are divisible by $p$ in the addition group $\mathbb{Z}_{pq}$. Then $\psi$ is a surjective group homomorphism.

Let $g$ and $h$ be defined as above. Then the image and kernel of $\psi$ are given as

[TABLE]

and

[TABLE]

respectively.

Proof:

Note that $t^{p-1}\equiv 1\pmod{p}$ for $t\in\mathbb{Z}_{pq^{2}}^{*}$. We can write $t^{p-1}=1+t{{}^{\prime}}p$ for some integer $t^{\prime}$. Substituting it into (1), we have

[TABLE]

as $p$ divides $q-1$. This means that $\psi(t)$ is divisible by $p$ and thus the map $\psi$ is well defined.

For $u,v\in\mathbb{Z}_{pq^{2}}^{*}$ it follows from Euler’s Theorem that

[TABLE]

which yields the map $\psi$ is a group homomorphism.

Now we show that the map $\psi$ is surjective. There exists some integer $t_{1}$ such that $g^{q-1}=1+t_{1}q$ with $t_{1}\not\equiv 0\pmod{q}$ since $g$ is a primitive root in $\mathbb{Z}_{q^{2}}^{*}$. This implies that

[TABLE]

Note that $\psi(g)\equiv 0\pmod{p}$. It follows from the CRT that there exists some positive integer $a$ with $a\in\mathbb{Z}_{q}^{*}$ such that

[TABLE]

It follows that $pa$ is one generator of the addition group $p\mathbb{Z}_{pq}$. Consequently, the map $\psi$ is surjective and $\textrm{Img}(\psi)=p\mathbb{Z}_{pq}$.

It is known that both $\psi(g)$ and $\psi(h)$ are divisible by $p$. Also,

[TABLE]

On the basis of the CRT, we have $\psi(g^{q})=0\pmod{pq}$. Hence $g^{q}\in\textrm{Ker}(\psi)$. Observe that $h\equiv 1\pmod{q^{2}}$. We can write $h=1+q^{2}h_{1}$. Hence

[TABLE]

Combining the above equation with $\psi(h)=0\pmod{p}$, we get $h\in\textrm{Ker}(\psi).$ Therefore, we have

[TABLE]

Now we need to show that the kernal $\textrm{Ker}(\psi)$ and the subgroup $\langle g^{q},h\rangle$ have the same cardinality. By the Third Isomorphism Theorem [20], we have

[TABLE]

This yields that $g^{0}\langle g^{q},h\rangle,g^{1}\langle g^{q},h\rangle,\cdots,g^{q-1}\langle g^{q},h\rangle$ are all cosets of the subgroup $\langle g^{q},h\rangle$ of $\mathbb{Z}_{pq^{2}}^{*}$. It follows that $|\langle g^{q},h\rangle|=(p-1)(q-1)$. On the other hand, according to the Fundamental Homomorphism Theorem [20], we see that

[TABLE]

and so $\langle g^{q},h\rangle=\textrm{Ker}(\psi)$. This completes the proof of the lemma. ∎

Note that Lemma 2 gives that $\psi(g)=pa\pmod{pq}$ with some $a\in\mathbb{Z}_{q}^{*}$. This means that $\psi(g)=pa\pmod{q}$ by the CRT. Let $b$ be the inverse of $a$ in $\mathbb{Z}_{q}^{*}$, i.e., $ab\equiv 1\pmod{q}$. Define $\hat{g}=g^{b}$ in $\mathbb{Z}_{pq^{2}}^{*}$. Then

[TABLE]

by the homomorphism property of the map $\psi$. It follows from $\psi(g)\equiv pa\pmod{q}$ that

[TABLE]

Combining the above equality with $\psi(\hat{g})=0\pmod{p}$, we get $\psi(\hat{g})=p\pmod{pq}$. The following lemma describes a partition of $\mathbb{Z}_{pq^{2}}^{*}$ which will give a new explanation of the definition of the sequence $\mathbf{s}$.

Lemma 3

Let $\hat{g}$ be an element in $\mathbb{Z}_{pq^{2}}^{*}$ with $\psi(\hat{g})=p\pmod{pq}.$ Define

[TABLE]

and

[TABLE]

for $\ell=0,1,\cdots,q-1.$ Then $\mathbb{Z}_{pq^{2}}^{*}=\bigcup\limits_{\ell=0}^{q-1}D_{\ell}$ and $D_{\ell}=\hat{D}_{\ell}$ for all $\ell\in\mathbb{Z}_{q}$.

Proof:

We first prove that $\hat{D}_{\ell}=D_{\ell}$ for all $\ell\in\mathbb{Z}_{q}$. Note that Lemma 2 gives that $D_{0}=\textrm{Ker}(\psi).$ It is easy to see that for $\hat{g}^{\ell}t_{0}\in\hat{D}_{\ell}$ with $t_{0}\in D_{0}=\textrm{Ker}(\psi)$. We have

[TABLE]

This implies that $\hat{D}_{\ell}\subseteq D_{\ell}$. Conversely, for $t\in D_{\ell}$, we have

[TABLE]

and thus

[TABLE]

by the homomorphism property of $\psi$. This means that

[TABLE]

Therefore, there exists some element $t_{0}\in D_{0}$ such that

[TABLE]

Hence we have $t=\hat{g}^{\ell}\cdot t_{0}\in\hat{g}^{\ell}D_{0}=\hat{D}_{\ell}$ and so ${D}_{\ell}=\hat{D}_{\ell}$. This completes the whole proof of the lemma. ∎

By the definition of $D_{\ell}$ and $\hat{D}_{\ell}$ , Lemma 3 gives that $|D_{\ell}|=|\hat{D}_{\ell}|=(p-1)(q-1)$ for $\ell=0,1,\cdots,q-1.$ Let $P=\{t:t\in Z_{pq^{2}},\gcd(t,pq)\neq 1\}$. The sequence $\mathbf{s}$ can be rewritten as

[TABLE]

The new explanation of the sequence $\mathbf{s}$ will be helpful to determine linear complexities. We will make extensive use of the following lemmas for completing the proof of Theorem 1.

Lemma 4

For any $0\leq i<q,$ if $u\pmod{pq^{2}}\in{D_{j}}$ for some $0\leq j<q,$ we have

[TABLE]

where all the subscripts are certainly understood modulo $q$. In particular, $D_{ri}=\hat{g}^{r}D_{i}$ for $0\leq r\leq q-1$.

Proof:

If $v\in D_{i}$, then $u=\hat{g}^{j}u_{0}$ and $v=\hat{g}^{i}v_{0}$ with $u_{0},~{}v_{0}\in D_{0}$. Hence $uv=\hat{g}^{i+j}u_{0}v_{0}\in\hat{g}^{i+j}D_{0}=D_{i+j}.$ This implies that $uD_{i}\subseteq D_{i+j}$. Conversely, it can be seen easily that $D_{i+j}\subseteq uD_{i}$. This finishes the proof of the lemma. ∎

The study of the behavior of the coset $D_{\ell}$ modulo various divisors of $pq^{2}$ leads to a number of useful lemmas.

Lemma 5

For $0\leq\ell<q,$ we have the following two multiset equalities

[TABLE]

where $(q-1)*\mathbb{Z}_{p}^{*}$ is the multiset in which each element of $\mathbb{Z}_{p}^{*}$ appears with multiplicity $q-1$, and

[TABLE]

where $(p-1)*\mathbb{Z}_{q}^{*}$ is the multiset in which each element of $\mathbb{Z}_{q}^{*}$ appears with multiplicity $p-1$.

Proof:

Note that $u\in{D_{\ell}}$ can be written as $u=\hat{g}^{\ell}g^{qi}h^{j}$ for $0\leq i<e$ and $0\leq j<d.$ Recall that $\hat{g}=g^{b}$ with some fixed $b\in\mathbb{Z}_{q}^{*}$ in Lemma 3. Then $u=g^{qi+b\ell}h^{j}$ in $\mathbb{Z}_{pq^{2}}$ and so

[TABLE]

According to $\gcd{(p-1,q)}=1,$ we see that $g^{q}$ is also a primitive root of $\mathbb{Z}_{p}^{*}$. If we fix some $j_{0}\in\mathbb{Z}_{d}$, then $u\equiv g^{qi+b\ell+j_{0}}\pmod{p}$ runs through $\mathbb{Z}_{p}^{*}$ when $i$ runs through $\mathbb{Z}_{e}$. Now we count the multiplicity of each element in $\mathbb{Z}_{p}^{*}$ when $i$ and $j$ run through $\mathbb{Z}_{e}$ and $\mathbb{Z}_{d}$ respectively. Assume that

[TABLE]

where $0\leq a_{0}\leq p-2.$ This means that

[TABLE]

for $i\in\mathbb{Z}_{e}$. According to $\gcd{(p-1,q)}=1,$ it is equivalent to

[TABLE]

There exist $\frac{q-1}{d}$ many solutions in the form of $i_{0},i_{0}+(p-1),\cdots,i_{0}+(\frac{q-1}{d}-1)(p-1).$ Note that $j_{0}$ has $d$ choices. This implies that there are $(q-1)$ many elements of $D_{\ell}$ mapping into one element in $\mathbb{Z}_{p}^{*}.$ In a similar manner, we can prove the second multiset equality in the lemma. This completes the proof of the lemma. ∎

Lemma 6

For $0\leq\ell<q,$ we have

[TABLE]

Proof:

It is obvious that the map from $D_{\ell}$ to $\mathbb{Z}_{pq}^{*}$ with $u\rightarrow u\pmod{pq}$ is well-defined. Thus it is sufficient to prove that the map is one-to-one since both $D_{\ell}$ and $\mathbb{Z}_{pq}^{*}$ have the same cardinality.

For $u_{1},~{}u_{2}\in{D_{\ell}},$ we write $u_{1}=\hat{g}^{\ell}g^{qi_{1}}h^{j_{1}}$ and $u_{2}=\hat{g}^{\ell}g^{qi_{2}}h^{j_{2}}$ with $i_{1},~{}i_{2}\in\mathbb{Z}_{e}$ and $j_{1},~{}j_{2}\in\mathbb{Z}_{d}$ respectively. Assume that

[TABLE]

We will illustrate that $i_{1}=i_{2}$ and $j_{1}=j_{2}$.

Note that

[TABLE]

as $\gcd(\hat{g},pq)=1$. It follows from the CRT that

[TABLE]

This implies that

[TABLE]

Note that $d=\gcd(p-1,q-1)$. It follows from the above equality that

[TABLE]

This gives that

[TABLE]

Since $j_{1}$ and $j_{2}$ belong to $\mathbb{Z}_{d}$, we have $j_{1}=j_{2}$. In the following, we will show that $i_{1}=i_{2}$ on the basis of the fact that $j_{1}=j_{2}$. Now we have

[TABLE]

Since $\gcd(q,p-1)=\gcd(q,q-1)=1$, it follows that

[TABLE]

Recall $e=(p-1)(q-1)/d=\textrm{lcm}(p-1,q-1)$. It follows from the above equations that

[TABLE]

Since $i_{1}$ and $i_{2}$ belong to $\mathbb{Z}_{e}$, we have $i_{1}=i_{2}$. This completes the proof of the lemma.

∎

Lemma 7

Let $\hat{g},~{}g\in\mathbb{Z}_{pq^{2}}^{*}$ be the same notations as above. For $0\leq\ell<q,$ we have the following multiset equality

[TABLE]

where $\mathfrak{\hat{g}}$ and $\mathfrak{g}$ denote $(\hat{g}\pmod{q^{2}})$ and $(g\pmod{q^{2}}),$ respectively. The set $\mathfrak{\hat{g}}^{\ell}\langle\mathfrak{g}^{q}\rangle$ is contained in $\mathbb{Z}_{q^{2}}^{*}$ and $(p-1)*\mathfrak{\hat{g}}^{\ell}\langle\mathfrak{g}^{q}\rangle$ is the multiset in which each element of $\mathfrak{\hat{g}}^{\ell}\langle\mathfrak{g}^{q}\rangle$ appears with multiplicity $p-1$.

Proof:

Note that

[TABLE]

This means that $(u\pmod{q^{2}})$ belongs to $\mathfrak{\hat{g}}^{\ell}\langle\mathfrak{g}^{q}\rangle$ indeed. So the map from $D_{\ell}$ to $\mathfrak{\hat{g}}^{\ell}\langle\mathfrak{g}^{q}\rangle$ with $u\rightarrow u\pmod{q^{2}}$ is well-defined. Now we count the multiplicity when $u$ runs through the set $D_{\ell}$. Assume that

[TABLE]

for some fixed $a_{0}\in\mathbb{Z}_{q-1}.$ It follows that

[TABLE]

i.e.,

[TABLE]

There exist $\frac{p-1}{d}$ many solutions for $i\in\mathbb{Z}_{e}$ in the form of $a_{0},a_{0}+(q-1),\cdots,a_{0}+(\frac{p-1}{d}-1)(q-1).$ Note that $j\in\mathbb{Z}_{d}$ has $d$ choices. Altogether, there are $(p-1)$ many elements of $D_{\ell}$ mapping into one element in $\mathfrak{\hat{g}}^{\ell}\langle\mathfrak{g}^{q}\rangle.$ This finishes the proof of the lemma. ∎

Define $D_{\ell}(x)=\sum\limits_{u\in{D_{\ell}}}x^{u}\in{\mathbb{F}_{2}[x]}.$ There exists an important connection between the polynomial $D_{\ell}(x)$ and the cyclotomic polynomial $\Phi_{n}(x)$ that will allow us to determine the minimal polynomial of sequences $\mathbf{s}.$

Lemma 8

Let $\gamma$ be a fixed $pq^{2}$-th primitive root of unity in the algebraic closure of ${\mathbb{F}}_{2}$ and $v$ an element in $\mathbb{Z}_{pq^{2}}$. Then

[TABLE]

and

[TABLE]

Proof:

We distinguish two cases according to the distinct value of the greatest common divisor of $v$ and $pq^{2}$.

For $v\in\mathbb{Z}_{pq^{2}}$ with $\gcd(v,pq^{2})=q$, it follows that $\gamma^{v}$ is a $pq$-th primitive root of unity . On the basis of Lemma 6, we have

[TABLE]

Note that $\sum_{u\in\mathbb{Z}_{pq}^{*}}\gamma^{uv}$ is equal to the sum of all $pq$-th primitive roots of unity that is also the coefficient of the second highest term of the cyclotomic polynomial $\Phi_{pq}(x)$. According to Exercise 2.57 of [18], we see that

[TABLE]

This indicates that

[TABLE]

for $v\in\mathbb{Z}_{pq^{2}}$ with $\gcd(v,pq^{2})=q$. 2. 2.

For $v\in\mathbb{Z}_{pq^{2}}$ with $\gcd(v,pq^{2})=q^{2}$, it follows that $\gamma^{v}$ is a $p$-th primitive root of unity. It follows from Lemma 5 and the even parity of $(q-1)$ that

[TABLE]

For $v\in\mathbb{Z}_{pq^{2}}$ with $\gcd(v,pq^{2})=pq\textrm{~{}or~{}}p$, then $\gamma^{v}$ is a $q$-th or $q^{2}$-th primitive root of unity respectively. Using a similar argument, it follows from Lemmas 5 and 7 and the even parity of $(p-1)$ that $\sum_{u\in{D_{\ell}}}\gamma^{uv}=0$ in this case.

It follows from the definition of cyclotomic polynomials that

[TABLE]

Therefore, we get the desired result since the cyclotomic polynomials $\Phi_{p}(x),\Phi_{q}(x)$ and $\Phi_{q^{2}}(x)$ over $\mathbb{F}_{2}$ are relatively prime. ∎

We are now in a position to give a proof of Theorem 1.

Proof:

For $j\in\mathbb{Z}_{q}$, we denote $\Lambda_{j}(x)=\sum\limits_{\ell=\frac{q+1}{2}}^{q-1}D_{\ell+j}(x),$ where all the subscripts are understood modulo $q$ here. Note that $\Lambda_{0}(x)=\sum\limits_{\ell=\frac{q+1}{2}}^{q-1}D_{\ell}(x)$ is the generating polynomial of the sequence $\mathbf{s}$ exactly. Now we claim that $\Lambda_{j}(\gamma)\neq 0$ for all $j\in\mathbb{Z}_{q}$.

We first prove $2\not\in{D_{0}}$ under the condition that $2^{q-1}\not\equiv 1\pmod{q^{2}}$. Suppose that $2\in{D_{0}},$ i.e., $\psi(2)=\frac{2^{\varphi(pq)}-1}{pq}=0\pmod{pq}$ according to the definition of Euler quotients. This implies that

[TABLE]

and thus

[TABLE]

This means that the order of $2^{q-1}\pmod{q^{2}}$ is a factor of $p-1.$ However, it follows from $2^{q-1}\not\equiv 1\pmod{q^{2}}$ that the order of $2^{q-1}\pmod{q^{2}}$ is exactly equal to $q$. This implies that $q$ divides $p-1,$ which contradicts the condition that $p<q.$ Hence, there exists some fixed nonzero $\sigma\in\mathbb{Z}_{q}$ such that $2\in{D_{\sigma}}$.

In the following we argue by contradiction. Assume that there exists some $j_{0}\in\mathbb{Z}_{q}$ such that $\Lambda_{j_{0}}(\gamma)=0,$ where $\gamma$ is a $pq^{2}$-th primitive root of unity. By Lemma 4 we get

[TABLE]

for any $i\in\mathbb{Z}_{q}$. According to $\sigma\neq 0$ in $\mathbb{Z}_{q}$, the number $j_{0}+i\sigma$ runs through $\mathbb{Z}_{q}$ when $i$ runs through $\mathbb{Z}_{q}$. This means that $\Lambda_{j}(\gamma)=0$ for all $j\in\mathbb{Z}_{q}.$ In particular, we can choose $\Lambda_{0}(\gamma)=0$.

For any $v\in{D_{j}}$ with $j\in\mathbb{Z}_{q},$ it follows from Lemma 4 that

[TABLE]

Note that $\mathbb{Z}_{pq^{2}}^{*}=\bigcup\limits_{j=0}^{q-1}D_{j}.$ It is immediate that $\Lambda_{0}(\gamma^{v})=0$ for any $v\in{\mathbb{Z}_{pq^{2}}^{*}}.$ Thus the cyclotomic polynomial $\Phi_{pq^{2}}(x)$ divides $\Lambda_{0}(x)$. By Lemma 8, we see that $\Phi_{q^{2}}(x)$ divides $\Lambda_{0}(x).$ Then $\Phi_{pq^{2}}(x)\Phi_{q^{2}}(x)$ divides $\Lambda_{0}(x)$ since $\gcd(\Phi_{pq^{2}}(x),\Phi_{q^{2}}(x))=1.$ On the basis of Exercise 2.57 of [18], we have

[TABLE]

We write

[TABLE]

Note that

[TABLE]

We can restrict $\deg{\pi(x)}<pq$ and thus $\pi(x)$ can be written as $\pi(x)=\sum\limits_{i=0}^{t-1}x^{\nu_{i}},$ where $0\leq\nu_{0}<\nu_{1}<\cdots<\nu_{t-1}<pq.$ Then

[TABLE]

However $\Lambda_{0}(x)$ has $\frac{1}{2}(p-1)(q-1)^{2}$ terms and $\sum\limits_{i=0}^{t-1}\sum\limits_{j=0}^{q-1}x^{\nu_{i}+jpq}$ has $qt$ terms, which is a contradiction since the prime $q$ does not divide $\frac{1}{2}(p-1)(q-1)^{2}$. It follows that $\Lambda_{j}(\gamma)\neq 0$ for any $j\in\mathbb{Z}_{q}.$

This implies that $\Lambda_{j}(\gamma^{v})\neq 0$ for all $v\in{\mathbb{Z}_{pq^{2}}^{*}}$ and $0\leq j<q.$ In particular, we have $\Lambda_{0}(\gamma^{v})\neq 0$ for all $v\in{\mathbb{Z}_{pq^{2}}^{*}}$. By Lemma 8, for $v\in\mathbb{Z}_{pq^{2}}$ and $0\leq j<q$ we get

[TABLE]

This implies that $(x-1){(\Phi_{p}(x)\Phi_{q}(x)\Phi_{q^{2}}(x))}$ divides $\Lambda_{0}(x)$ if $q\equiv 3\pmod{4}$. Hence the minimal polynomial in the case that $q\equiv 3\pmod{4}$ is

[TABLE]

by using the basic properties of cyclotomic polynomials. In a similar manner, if $q\equiv 1\pmod{4}$, then $\Phi_{pq}(x)$ divides $\Lambda_{0}(x)$. This yields that the minimal polynomial in the case that $q\equiv 1\pmod{4}$ is

[TABLE]

Note that the linear complexity of $\mathbf{s}$ is equal to the degree of the minimal polynomial of the sequence and so the third assertion in Theorem 1 follows. This completes the whole proof of Theorem 1. ∎

In the following, we will give a small example for confirming our main results.

Example 1

Let $p=3$ and $q=7$. The least period of the binary threshold sequence $\mathbf{s}$ derived from modulo $pq$ is $147$. The sequence $\mathbf{s}$ in one period is

[TABLE]

The minimal polynomial of the sequence $\mathbf{s}$ over $\mathbb{F}_{2}$ is

[TABLE]

and so the linear complexity of this sequence is exactly $(p-1)\cdot(q^{2}-1)=2\cdot 48=96.$

III Conclusion Remarks

In this paper, we determined the linear complexities of a class of binary sequences with period $pq^{2}$ based on the Euler quotients modulo $pq$. In addition, the proposed sequences have a good balance asymptotically if the prime $p$ tends to infinity, i.e., the number of 1’s is asymptotically equal to the number of 0’s in one period if $p$ tends to infinity. Finally, there are several unsolved problems about the proposed sequence. Below are some of them.

• •

Determine $k$-error linear complexity of the proposed sequence. This problem is closely related to the stability of linear complexity of the proposed sequence from a cryptographic point of view.

• •

Explore whether this family of sequences derived from the Euler quotient modulo $pq$ can induce more optimal families of perfect polyphase sequences similar to [22].

• •

Regard the proposed sequence as the sequence over the ring $\mathbb{Z}_{4}$ or other finite fields with odd prime characteristics and analyze its cryptographic properties ( for example, linear complexity and $k$-error linear complexity).

• •

Determine the autocorrelation of the proposed sequence although it may be hard to tackle this problem.

• •

Analyze properties of sequences derived from the Euler quotient with other modulus (for example, the modulus is equal to the product of more odd distinct primes).

Acknowledgment

The authors would like to thank the associate editor Prof. Sihem Mesnager and the two anonymous referees for their helpful suggestions which improved this manuscript.

Part of the work were done while the first and third authors were Visiting Scholars at Clemson University.