Nonlinear Shi, Registers: A Survey and Open Problems. Tor Helleseth University of Bergen NORWAY

Size: px

Start display at page:

Download "Nonlinear Shi, Registers: A Survey and Open Problems. Tor Helleseth University of Bergen NORWAY"

Justin Day
5 years ago
Views:

1 Nonlinear Shi, Registers: A Survey and Open Problems Tor Helleseth University of Bergen NORWAY

2 Outline ntroduc9on Nonlinear Shi> Registers (NLFSRs) Some basic theory De Bruijn Graph De Bruijn graph Golomb s conjecture/mykkeltveit s proof Period of NLFRs Connec9ons to Finite Fields Cross- join pairs Cycle- joining and cyclotomy

3 Linear Recursion Linear recurrence s t+n + c n- 1 s t+n c 0 s t = 0, c i, s i GF(p) Characteris9c polynomial f(x) = x n + c n- 1 x n c 0 Ω(f) = The 2 n binary sequences generated by recursion Proper9es Easy to find period of the sequences in Ω(f) from f(x) Period determined by smallest e such that f(x) x e - 1 All sequences in Ω(f) have period e Smallest period for at least one sequences in Ω(f) Bounds on the distribu9on of elements in (s t ) are evaluated using methods from finite fields

4 m- sequences Linear recurrence s t+4 + s t+1 + s t = 0 Primi9ve polynomial f(x) = x 4 + x + 1 (s t ) : General proper9es of m- sequences Period ε = 2 n - 1 Balanced (except for a missing 0) Run property s t - s t+τ = s t+γ, s 2t = s t+δ During a period all nonzero n- tuples occur

5 Nonlinear Shift Registers s 0 s 1... s n- 1 f(s 0,s 1,,s n- 1 ) The feedback polynomial is nonlinear of the form f(s 0,s 1, s n- 1 ) = Σ ε{0,1} n c s 0 i0 s 1 i1 s n- 1 i n- 1 Determined by truth table giving f(s 0,s 1, s n- 1 ) for all possible 2 n values Number of nonlinear polynomials (Boolean func9ons) in n variables is 2 2n

6 Nonlinear Shift Registers - Challenges Mo9va9on NLSRs are used as building blocks in many modern stream ciphers (Grain, Trivium, Mickey, Pomaranch, ) ncrease complexity of the key stream in stream ciphers Challenges for NLFSRs How to determine the period of sequences from NLFSRs No general theory exists and many ad- hoc techniques have to be invented for these problems Construc9ng efficiently large classes long sequences of period 2 n (de Bruijn sequences)/classify de Bruijn sequences Find algebraic methods to analyze NLFSRs Find the distribu9on of the elements in sequences generated by an NLFSR

7 Nonlinear Shift Register - Example A nonlinear recursion in n-variables can be described using its truth table (Example n=3) s 0 s 1 s 2 f(s 0 s 1 s 2 ) The number of Boolean functions in n-variables are 2 2n The number of linear Boolean functions are 2 n S 0 S 1 S 2 S 2 f(s 0,s 1,s 2 ) = s 0 +s 1 s 2 ( s t+2 = s t + s t+1 s t+2 )

8 Example de Bruijn Sequence Let f(s 0,s 1,s 2 ) = 1+s 0 +s 1 +s 1 s This gives a maximal sequence of length 2 n and is called a de Bruijn sequence Number of de Bruijn sequences of period 2 n are 2 2n- 1 - n

9 Example Singular f Let f(s 0,s 1,s 2 ) = 1+s 0 +s 1 +s 2 +s 0 s 1 +s 0 s 2 +s 1 s Contains branch point and such an f is called singular f is nonsingular if and only if f = s 0 + g(s 1,,s n- 1 ) Then (s 0, s 1,., s n- 1 ) (s 1, s 2,., s n- 1, f(s 1,s 2,.,s n- 1 )) is a permuta9on of B n

10 De Bruijn Graph Directed graph 2 n nodes (states) (s 0,s 1,...,s n- 1 ) Each state has two successors (α 0 α 1 α n-1 ) (α 1 α 2 α n-1 0) (α 1 α 2 α n-1 1) Each state has two predecessors (0 α 1 α 2 α n-1 ) (α 1 α 2 α n-1 0) (1 α 1 α 2 α n-1 ) (α 1 α 2 α n-1 1)

11 De Bruijn Graphs (B 2 and B 3 ) B 2 B

12 De Bruijn graph B

13 Pure Cycling Register (PCR n ) Let f(s 0,s 1,...,s n- 1 ) = s 0 i.e., g=0 (since f=s 0 +g(s 1,...,s n )) Weight of truth table of g is 0 Cycle structure (PCR n ) n=3 (0), (1), (001), (011) n=4 (0), (1), (01), (0001), (0011), (0111) Number of cycles of B n 1 Z( n) = ϕ( d)2 n d n n/ d ( = even number )

14 Pure Cycling Register (PCR 3 ) : (f = s 0 ) Decomposi9on of B 3 for Boolean func9on f=s 0 (0) (001) f = s (101) (1) 111 Number of cycles Z(3) = 4

Pure Cycling Register (PCR 4 ) 0000 (0) 0001 1000 0010 0100 (0001) 0011

15 Pure Cycling Register (PCR 4 ) 0000 (0) (0001) (1001) (01) (1011) 1111 (1)

16 Golomb s Conjecture Golomb s conjecture (1967) The maximum number of cycles obtained in any decomposi9on of the de Bruijn graph B n (for all nonlinear func9ons f) is Z(n). This occurs for the PCR n when g=0 (but also in many other cases). History (approx.) S. Golomb n=5 / H. Fredricksen n=6, 7 / A. Lempel n=8, 9, 10 / J. Mykkeltveit and Fredriksen n=11,12.. Proved by J. Mykkeltveit (1972), for all n (one year of work to color B n ) Main idea Select one node from each cycle in PCR n (i.e, Z(n) nodes) such that: any cycle in B n contains at least one of these nodes.

17 Coloring de Bruijn graph B Any cycle in B 4 contains at least one of the Z(4)=6 green colored nodes Coloring due to Mykkeltveit How to select green color?

18 CM of a binary n- tuple y v 1 v 0 x CM v 4 v 2 v 3 Let V 0 =(v 0,v 1,v 2,v 3, v 4 ), (n=5) Place v t in coordinate posi9on! (x, y) = # cos 2πit " n,sin 2πit n Compute CM=Center of mass n 1 Moment y = $ & % m V0 = v t sin 2πit n t=0 Color a vector (v 0, v 1,, v n- 1 ) L = f CM on the le, of the x- axis (y > 0) = f CM on the x- axis (y = 0) R = f CM on the right of the x- axis (y < 0)

19 Coloring the PCR n Cycles Coloring L R v 1 v 0 CM v 4 v 2 v 3 Type 1: (CM not in center of PCR cycle) Select unique node L with predecessor not L) L L L L /R /L R R R R Type 2: (CM in the center of PCR cycle) Select any node colored

20 Remarks- Coloring Shi>ing a node cyclically shi>s CM The two predecessors for a node in B n have the same color (since they only differ in 0- th coordinate on the x- axis). The two successors of a node can not both have color (since they only differ in posi9on n- 1). A cycle in PCR n has either: All nodes colored One R block and one L block separated by most one. Any cycle S =(s 0,s 1,,s e- 1 ) in B n has (average moment = 0), i.e. has either: All nodes colored At least one R and one L separated by most one.

21 Colors on a cycle Lemma 1 Let (s 0,s 1,,s e- 1 ) be a cycle of length e on B n. The nodes (n- tuples) of the cycles are S t =(s t,s t+1,,s t+n- 1 ), t=0,1,,e- 1. Then either All nodes on the cycle have the color Cycle contains at least one R and one L Proof. This follows since the sum of the moments of the y- coordinates on the nodes on a cycle is e 1 e 1 n 1 m St = s t+t' sin 2πt ' t=0 e 1 n 1 = s t sin 2πt ' = 0 n n t=0 t'=0 t=0 t'=0

22 Proof of Golomb s conjecture Theorem (Mykkeltveit) No decomposi9on of the de Bruijn graph B n for any nonsingular Boolean func9on f can give more cycles than the PCR n. Proof. Select Z(n) nodes one node from each PCR n cycle. (1) f CM in center select arbitrary node on cycle. (2) f CM not in center select first L with predecessor not L. Then any cycle in any decomposi9on will contain at least one of these Z(n) nodes.

23 Overview - Proof Coloring v 1 L v 0 R CM v 4 v 2 v 3 L Nodes L and R L /R L L PCR - Cycles R R R R /L All nodes Arbitrary Cycle Select node on cycle with color L and predecessor not L is the first L in a block of L s on PCR L /R L L /R R R R A cycle with only s is a PCR cycle with (CM in center)

24 Cycle Join Algorithm Joining Cycles Defini9on (α, α*) is a conjugate pair iff α + α* = (1,0,,0) A conjugate pair have the same two possible successors (0, ) = α (,0) Exchanging successors of (α, α*) (1, ) = α* (,1) changes g( ) for only one value Joining two cycles Change successors of α and α* on different cycles α* α

25 Spli\ng a Cycle Spli ng a cycle Exchanging the successors of a conjugate pair (α, α*) on the same cycle This change parity of truth table g by one (and also changes parity of number of cycles by one) α* α

26 Parity of Number of Cycles Theorem The number of cycles which B n is composed into has the same parity as the weight of the truth table of g Proof: The func9on f=x 0 +g where g=0 gives Z(n) (even) cycles Any other nonlinear func9on f can be obtained by changing truth table bit by bit. Each change of truth table of g changes the number of cycles by one and the weight of g by 1 Hence, parity stays invariant between cycles and weight

27 DeBruijn sequences (Necc. condi^ons) Theorem (1) To obtain a debruijn sequence then f uses all n variables (2) The truth table of g (f=s 0 +g) must have odd weight (at least Z(n)- 1) Proof: Follows since otherwise truth table has even weight and can not generate a de Bruijn sequence

28 De Bruijn sequences from m- sequences Change longest run in m- sequence by appending an extra 0. The result is a debruijn sequence Example: This de Bruijn sequence is almost linear However, linear complexity is as large as possible for debruijn sequences This is a prime example that linear complexity is no guarantee for security Bounds on the linear complexity of de Bruijn sequences is studied (Chan, Games 1980s)

29 Periods on NLFSRs 1. General 2. Kjeldsen s method 3. Mykkeltveit and AN- codes

30 Period of Nonlinear Shift Registers Hard problem in general Rather few general results on the period Some nontrivial results known in the case when g(x 1,...,x n- 1 ) is a symmetric polynomial (Kjeldsen, Søreng from the s) Proofs are in general very technical and hard to read and new simpler methods are needed to progress Mykkeltveit (1979) used arithme9c codes to study periods of nonlinear shi> registers Classifica9on of de Bruijn sequences (Fredricksen 1982, Hauge and Mykkeltveit 1990 s)

31 Kjeldsen s Mapping (1) δ: x i x i+1 for i=0,1,,n- 2 x n- 1 x n = x 0 + g(x 1,,x n- 1 ) This algebra homomorphism leads to a sequence of polynomials in the polynomial ring F[x 0,x 1,,x n- 1 ]/(x 02 +1,,x n ) (x 0,x 1,,x n- 1,x n,x n+1,..,x t+n = x t + g(x t+1,,x t+n- 1 ),. ) Defini9on The period of δ is the smallest integer p such that δ p = id. (= smallest period of x 0 ) Theorem All sequences in Ω(f) (generated by s t+n = s t + g(s t+1,,s t+n- 1 )) have period dividing p and at least one sequence has least period p.

32 Kjeldsen s Mapping (2) δ: x i x i+1 for i=0,1,,n- 2 x n- 1 x n = x 0 + g(x 1,,x n- 1 ) Let h(x 0,,x n- 1 ) = h 1 (x 0,,x n- 2 ) + x n- 1 h 2 (x 0,,x n- 2 ) Then δ(h) = h 1 (x 1,,x n- 1 ) + (x 0 +g)h 2 (x 1,,x n- 1 ) = h 1 (x 1,,x n- 1 ) + x 0 h 2 (x 1,,x n- 1 ) + gh 2 (x 1,,x n- 1 ) = h(x 1,,x n- 1,x 0 ) + g(x 1,,x n- 1 ) h 2 (x 1,,x n- 1 ) = h(σ(x 0,,x n- 1 )) + g(x 1,,x n- 1 )h 2 (x 1,,x n- 1 ) where σ is cyclic shi> of n- tuples. Hence, defining g 2 = g* δ(g) = σ(g(x 0,,x n- 1 )) + g*g

33 Symmetric Feedback Polynomials Let S j be elementary symmetric polynomial of degree j in n- 1 variables Theorem (Kjeldsen) (n 2/2 f g( x 1,..., x n 1 ) = a k S 2k+1 (x 1,..., x n 1 ), a k ε{0,1}, g 0, S 1, k=0 then the minimal period of δ is n(n+1). Proof sketch: t follows that due to symmetry in g we can derive the condi9on (σ j g)* g = 0 if j = - 1 (mod n) (since independent of x n- 1 ) = g if j - 1 (mod n) (periodic in j and symmetry) Hence, δ(g) = σ(g(x 0,,x n- 1 )) + gg* = σ(g(x 0,,x n- 1 )) + g where ( ) = a k S 2k (x 2,..., x n 1 ) g* x 1,..., x n 1 (n 2/2 k=0

34 Proof Remarks Note δ(g) = σ(g(x 0,,x n- 1 )) + g*g = σ(g) + g Therefore δ(σ(g)) = σ 2 (g(x 0,,x n- 1 )) + (σg)*g = σ 2 (g(x 0,,x n- 1 )) + g*g = σ 2 (g) + g and in general δ(σ n- 1 (g)) = g for j = - 1 mod n δ(σ j (g)) = σ j+1 (g) + g for j - 1 mod n

35 Kjeldsen s Method x 0 x 1 x n- 1 g σ(g) σ n- 2 (g) σ n- 1 (g) Linear register of period n(n+1) Characteris9c polynomial (x n +1)(x n+1 +1)/(x+1) Provided some suitable condi9ons on g (like gg* = g etc.) Many symmetric polynomials g sa9sfy condi9ons Lead to controllable periods n(n+1) Even though small period the was important idea

36 Period of Nonlinear Register and Coding Theorem Let C be a cyclic code (not necessarily linear) with d min 3. Define f = x 0 + g where g(x 1, x n- 1 )=1 iff (0,x 1 +1, x n- 1 +1)εC or (0,x 1 +1, x n- 1 +1)εC. Then all sequences in Ω(f) have periods dividing n(n+1). Proof: Follows since also in this case σ i (g)g*= 0 if j = - 1 (mod n) = g if j - 1 (mod n)

37 AN- Codes and Period of NLFSRs An AN- Code is an arithme9c code is a code with codewords where AB=2 n - 1. C = {AN (mod 2 n - 1) : N=0,1,,B- 1} The codewords AN can be represented binary (a 0,a 1,,a n- 1 ) a i = (N 2 i (mod B)) (mod 2) The codewords have period dividing n and can be defined via NLFSRs Mykkeltveit (1977) determined the corresponding NLFSRs for the codewords in the AN- code for several values of A and thus their periods.

38 Algebraic Methods for NLFSRs Cross- join pairs on a cycle Two conjugate pairs (α,α*) and (β, β*) on a cycle such that interchanging the successors of each of these pairs give the same number of cycles ( split and join ). The number of cross- join pairs were conjectured for m- sequences by Kim et. al. in 1990 and solved Helleseth and Kløve using simple connec9ons with finite field Cyclotomy and the number of conjugate pairs from irreducible cyclic codes An irreducible cyclic code of period e 2 n - 1 decomposes B n into E=(2 n - 1)/e disjoint cycles. Using a special mapping between nodes in B n reduces problem of finding conjugate pairs on the E cycles to This gives es9mate of number of de Bruijn sequences that can be constructed by joining the cycles from the irreducible code

39 Cross Join Pairs (α,α*) and (β,β*) conjugate pairs α + α* = β + β* = (1,0,,0) β β α α* α α* β* β* β α α * β*

40 Cross Join Pairs on m- sequences Given an m- sequence 1. Split the cycle into two cycles using a conjugate pair (α,α*) on m- sequence 2. Join the two cycles into one cycle using a new conjugate pair (β, β*) (on the two new cycles) The pair (α,β) is called a cross- join pair Theorem (Helleseth and Kløve) The number of cross- join pairs on an m- sequence is N = (2 n- 1-1)(2 n- 1-2)/6

41 Mapping Mapping φ between F 2 n and F 2 n Example: Ψ 4 + Ψ = o 1 Ψ Ψ 2 Ψ Ψ Ψ Ψ Ψ Ψ Ψ Ψ Ψ Ψ Ψ Ψ Ψ Ψ Ψ Let s t be the first coordinate sequences. Then Φ(0) = ( 0, 0,, 0) Φ(Ψ t )= (s t, s t+1,..,s t+n- 1 ) Conjugate pairs (x,x*) correspond to elements with x + x*=1 Cross- join pairs corresponds to equivalence classes of intersec9ng chords

1000 0001 ψ 1 ψ 14 0100 0011 ψ 2 Ψ 13 0010 0111 ψ 3 Ψ 12 1001 1111

42 ψ 1 ψ ψ 2 Ψ ψ 3 Ψ ψ 4 Ψ ψ ψ ψ 9 ψ ψ 7 ψ

43 Number of Cross Join Pairs One- to- one correspondence between cross join pairs and equivalence classes of subsets {θ 1, θ 2, θ 3, θ 4 } with θ 1 + θ 2 + θ 3 + θ 4 =0 (wlog {θ 1, θ 3 } and {θ 2, θ 4 } are intersec9ng Two sets are equivalent iff θ{θ 1,θ 2, θ 3, θ 4 } ={θ 1,θ 2,θ 3,θ 4 } The number of dis9nct subsets are (2 n - 1)(2 n 2)/24 Each equivalence class contains exactly one cross- join pair. Thus dividing by 2 n - 1 gives the number of cross join pairs The cross join pair corresponds to the unique θ with θθ 1 +θθ 3 = θ θ 2 +θθ 4 =1

44 Cyclotomy and Cross Join pairs Let C be irreducible cyclic code of period e = (2 n 1)/E C={ c a (c a ) x = Tr(ax E ), aεgf(2 n )} Code consists of E cycles of period e. The cyclotomic classes C i = {Ψ tj+i : 0 t< (2 n - 1)/E)} for i=0,1,,e- 1. The cyclotomic numbers (i,j) of order E is the number of solu9ons z i +1 = z j where z i, z j belong C i and C j respec9vely.

45 Mapping of Cycles Similar mapping as for cross- join pairs Nodes in cycle i can be represented by Ψ i β t, t=0,1,,e- 1 where β is zero of irreducible (pairty- check) polynomial of the code. The number of conjugate pairs between cycle i and j is the number of solu9ons z i +1=z j which is the cyclotomic number. The number of de Bruijn sequences obtained by joining cycles in the irreducible code can be es9mated from the BEST theorem that gives the number of spanning trees in the Cycle Joining Algorithm (CJA)

46 Conclusions NLFSRs is an important topic with great poten9al Many open problems Period Distribu9on Construc9on of sequence families Most results are quite old New ideas are needed to solve the challenges in the analysis of nonlinear generated sequences

On The Nonlinearity of Maximum-length NFSR Feedbacks

On The Nonlinearity of Maximum-length NFSR Feedbacks Meltem Sönmez Turan National Institute of Standards and Technology meltem.turan@nist.gov Abstract. Linear Feedback Shift Registers (LFSRs) are the main