ROTATION-EQUIVALENCE CLASSES OF BINARY VECTORS. 1. Introduction

Transcription

1 t m Mathematical Publicatios DOI: /tmmp Tatra Mt. Math. Publ. 67 (2016, ROTATION-EQUIVALENCE CLASSES OF BINARY VECTORS Otokar Grošek Viliam Hromada ABSTRACT. I this paper we study equivalece classes of biary vectors with regards to their rotatio by usig a algebraic approach based o the theory of liear feedback shift registers. We state the ecessary ad sufficiet coditio for existece of a equivalece class with give cardiality ad provide two formulas. The first represets the sharp distributio of cardialities for give legth ad Hammig weight of biary vectors ad the secod eables us to determie the umber of differet classes with the same cardiality. 1. Itroductio I cryptography ad codig theory, there are may algorithms, which use rotatio of a biary vector. Oe iterestig example is the McEliece cryptosystem [4], [5] that uses quasi-cyclic codes, e.g., QC-LDPC (low-desity parity-check codes as proposed by B a l d i et al. [1], [2]. Aother iterestig example, where equivalece classes of rotatio of biary vectors are studied, is the rotatioal cryptaalysis of various cryptosystems [7]. McEliece versio with QC-LDPC codes uses quasi-cyclic matrices, which are matrices cosistig of blocks of biary circulat matrices. A biary circulat matrix is a matrix, i which each row vector is rotated oe elemet to the right relative to the precedig row. It is therefore helpful to kow the correspodig equivalece class of a biary vector with regards to its rotatio ad the cardiality of this class. These rotatios are calculated i the real time i the implemetatio of these cryptosystems, sice it is sufficiet to store ito memory oly the first rows of used biary circulat matrices ad the other rows ca be computed o-demad by simple rotatios, which greatly lowers the memory requiremets. c 2016 Mathematical Istitute, Slovak Academy of Scieces M a t h e m a t i c s Subject Classificatio: 11T71, 94A60. K e y w o r d s: rotatioal equivalece classes, biary vectors, biary vector rotatio, rotatioal classes cardiality. This project is supported by NATO SPS Project G

2 OTOKAR GROŠEK VILIAM HROMADA This paper deals with the sufficiet ad ecessary coditio for the existece of a class with give cardiality ad the formulas preseted i this paper ca be used to determie the structure of classes for biary vectors with give legth ad Hammig weight, i.e., they preset the sharp distributio of cardialities ad the umber of differet classes with the same cardiality. 2. Rotatioal equivalece classes Let V be -dimesioal vector space over F 2,adE t = { e hw(e =t } V, where hw is the Hammig weight. Number of such vectors is equal to ( t, i.e., E t = ( t.leta be the associated matrix to the characteristic polyomial f(x =x +1overF 2 of the LFSR as defied i [3] A = For ay u E t let [u] ={u, ua,...,ua d 1 } be a class of words (state vectors obtaied from u by cosecutive shifts of this vector, where d is the smallest period of this sequece. Hece u = ua d. Let ϱ be a relatio defied o E t such that uϱ v if ad oly if u, v belog to the same class. The ϱ is a equivalece relatio o E t ad uϱ =[u]. The cardiality of such classes may vary from 1 to as show i the ext example. Example 1. Here we preset several typical cases: 1. If =6,t= 6, the clearly [1, 1, 1, 1, 1, 1]ϱ 6 =1. 2. If =7,t= 3, the all classes have the same cardiality 7, ad there are 5 such classes. 3. If =10,t= 4, the we have 20 classes of cardiality 10 ad 2 classes of cardiality 5, amely, [0, 0, 1, 0, 1, 0, 0, 1, 0, 1]ϱ 10 ad [0, 0, 0, 1, 1, 0, 0, 0, 1, 1]ϱ 10. All divisors of 10 are 2, 5, 10, but there is o class with cardiality 2. Remark 1. A ecessary coditio for havig the same cardiality for all classes is ( ( t. From [6] it ca be deduced that t is divisible by gcd(,t.thus,if gcd(, t =1,the ( ( t is divisible by. The coverse is ot true, e.g., 10 4 = 210, ad gcd(10, 4 > 1, but As show i Example 1 i this case there exist 2 classes with 5 elemets. 94

3 ROTATION-EQUIVALENCE CLASSES OF BINARY VECTORS It follows from the theory of LFSR that for ay iitial state u the cardiality of [u] =uϱ divides the order of A i the geeral liear group GL(, F 2. Equivaletly, the cardiality of [u] divides the order of f(x if 2 [x], i.e., the smallest l such that f(x x l +1. This l coicides with the order of A. Sice i our case the order of A is, d. Next, we prove a ecessary ad sufficiet coditio for havig a class of a give cardiality d. Theorem 1. Let ϱ be the equivalece relatio o E t defied above. The there exists a class uϱ with cardiality d if ad oly if d ad d t. P r o o f. The first coditio d of our claim results from geeral theory of LFSR (cf. [3]. Next we cocateate u from smaller parts. Thus we will speak about words over the alphabet {0, 1} of a give legth, i.e., elemets from the free semigroup S = {0, 1}.Ifthereisaclasswithd elemets, uϱ = d. The u = u u 1...u 1 = u d u d 1...u 1 u u 1...u d+1 (1 ad we ca cocateate u from words w 1 w 2... w z,wherethelegthofw i is w i = d, i =1, 2,...z,adz = /d. Next we show that 1. all these words are the same, i.e., w 1 = w 2 =...= w z ; 2. the weight of w i is t z = td for i =1, 2,...,z, providig td. Clearly, the secod claim is a direct cosequece of the first oe. From the defiitio of classes it follows that if u = w 1 w 2... w z,the u = ua d = w z w 1 w 2... w z 1. Thus w 1 = w z,w 2 = w 1,...,w z = w z 1 which cocludes the first part of the proof. O the other had, let d ad d t. The we ca costruct a word w d td/ td/ {}}{{}}{ w = = 0 d td/ 1 td/, i.e., u = w /d,ad[u] cotais precisely d elemets. Corollary 1. All classes uϱ have the same cardiality if ad oly if t =0 or gcd(, t =1. Proof. The cases t =0adt = are trivial. Let for ow 0 <t<.from Theorem 1 it follows that the cardiality d of a class must satisfy td ad d. Ifgcd(, t =1,thed =. O the other had, if all classes have the same cardiality d ad gcd(, t = k>1, the we ca costruct two words, amely 95

4 OTOKAR GROŠEK VILIAM HROMADA 1. u =0 t 1 t, which yields uϱ =, ad 2. v = w 1... w k such that w i = w, i =1,...,k, w = /k, hw(w =t/k. From the costructio it follows that vϱ = /k, a cotradictio with our suppositio. This completes the proof. Here is a more complex example: Example 2. Let = 20, t = 10. The we have the followig distributio of classes: 9225 classes with cardiality d = 20; 25 classes with cardiality d = 10; 1 class with cardiality d =4; 1 class with cardiality d =2. I this case there is o class with cardiality d =5sice d t. Importat questio is how may classes with the maximum cardiality d = exist. Let for give, t; C(, t, d deotes the umber of classes with the cardiality d. IExample2,e.g.,C(20, 10, 4 = 1, C(20, 10, 5 = 0. Accordig to Theorem 1 ad defiitio of ϱ we have ( = dc(, t, d. (2 t d By Theorem 1 we ca exclude i this formula all summads d for which C(, t, d =0. ( = dc(, t, d. (3 t d /d t There are 2 trivial cases C(,, d =C(, 0,d= { 1, if d =1; 0, if d>1. (4 Let for give, t; D,t be the set of all d for which summads i Formula 3 are o-zero. Usig the proof of Theorem 1 we ca easily derive a formula for all o-trivial ad o-zero C(, t, d: 96 C(, t, d = 1 d ( d td kc(, t, k. (5 k D,t k d,k<d

5 ROTATION-EQUIVALENCE CLASSES OF BINARY VECTORS Example 3. We apply formula (5 to our examples: ( If = 10, t =4,theD 10,4 = {5, 10}; C(10, 4, 5 = =2ad (( C(10, 4, 10 = C(10, 4, 5 = 20. ( If =20,t= 10, the D 20,10 = {2, 4, 10, 20}; C(20, 10, 2 = =1, C(20, 10, 4 = 1 4 2C(20, 10, 2 =1, C(20, 10, 10 = 1 10 C(20, 10, 20 = 1 20 (( 4 2 (( C(20, 10, 2 = 25, (( C(20, 10, 2 4C(20, 10, 4 10C(20, 10, 10 = Coclusio I this paper we studied equivalece classes of biary vectors with regards to their rotatio. We used the theory of liear feedback shift registers, sice the rotatio of a biary vector ca be modeled by a register with correspodig characteristic polyomial f(x = x + 1. We stated ecessary ad sufficiet coditio for the existece of such classes with give cardialities, ad provided a formula that ca be used to determie the structure of equivalece classes for biary vectors with give legth ad Hammig weight. Oe of the applicatios of our results are the quasi-cyclic codes used i the McEliece cryptosystems based o QC-LDPC codes, sice we are able to determie the existece of square biary circulat matrices with distict rows ad the structure of biary circulat matrices, e.g., the umber of distict rows, depedig o the legth ad Hammig weight t of the first row. REFERENCES [1] BALDI, M. CHIARALUCE, F.: Cryptaalysis of a ew istace of McEliece cryptosystem based o QC-LDPC codes, i: Iterat. Symposium o Iformatio Theory ISIT 07, Nice, Frace, 2007, IEEE, 2007, pp [2] BALDI, M. BODRATO, M. CHIARALUCE, F.: A ew aalysis of the McEliece cryptosystem based o QC-LDPC codes, i: 6th Iterat. Cof. o Security ad Cryptography for Networks SCN 08, Amalfi, Italy, 2008, (R. Ostrovsky et al., eds., Lecture Notes i Comput. Sci., Vol. 5229, Spriger-Verlag, Berli, 2008, pp [3] LIDL, R. NIEDERREITER, H.: Fiite Fields. Cambridge Uiversity Press, Cambridge, [4] MCELIECE, R. J.: A public-key cryptosystem based o algebraic codig theory, DSN Progress Report, 1978, pp [5] REPKA, M. ZAJAC, P.: Overview of the McEliece cryptosystem ad its security, Tatra Mt. Math. Publ. 60 (2014,

6 OTOKAR GROŠEK VILIAM HROMADA [6] SINGHMASTER, D.: Divisibility of biomial ad multiomial coeficiets by primes ad prime powers, i: A Collectio of Mauscripts Related to the Fiboacci Sequece, 18th Aiversary Volume of the Fiboacci Associatio, 1980, pp [7] ZAJAC, P. ONDROŠ, M.: Rotatioal cryptaalysis of GOST with idetical S-boxes. Tatra Mt. Math. Publ. 57 (2013, Received November 18, 2016 Istitute of Computer Sciece ad Mathematics Faculty of Electrical Egieerig ad Iformatio Techology Slovak Uiversity of Techology i Bratislava Ilkovičova 3 SK Bratislava SLOVAKIA otokar.grosek@stuba.sk viliam.hromada@stuba.sk 98