Cryptographically Strong de Bruijn Sequences with Large Periods

Transcription

1 Cryptgraphically Strng d Bruijn Squncs with Larg Prids Kalikinkar Mandal, and Guang Gng Dpartmnt f Elctrical and Cmputr Enginring Univrsity f Watrl Watrl, Ontari, N2L 3G1, CANADA {kmandal, ggng}@uwatrl.ca Abstract. In this papr w first rfin Mykkltvit t al. s tchniqu fr prducing d Bruijn squncs thrugh cmpsitins. W thn cnduct an analysis n an apprximatin f th fdback functins that gnrat d Bruijn squncs. Th cycl structurs f th apprximatd fdback functins and th linar cmplxity f a squnc prducd by an apprximatd fdback functin ar dtrmind. Furthrmr, w prsnt a cmpact algbraic rprsntatin f an (n + 16)-stag nnlinar fdback shift rgistr (NLFSR) and a fw xampls f d Bruijn squncs f prid 2 n, 35 n 40, which ar gnratd by th rcursivly cnstructd NLFSR tgthr with th valuatin f thir implmntatin. Kywrds: d Bruijn squncs, nnlinar fdback shift rgistrs, psudrandm squnc gnratrs, span n squncs, cmpsitins. 1 Intrductin Rcntly, nnlinar fdback shift rgistrs (NLFSRs) hav rcivd a lt f attntin in dsigning cryptgraphic primitivs such as psudrandm squncs gnratrs (PRSGs) and stram ciphrs t prvid scurity and privacy in cmmunicatin systms. Fr xampl, wll-knwn stram ciphrs such as Grain and Trivium usd NLFSRs as th basic building blcks in thir dsigns [4]. Du t thir fficint hardwar implmntatins, NLFSRs hav a numbr f applicatins in cnstraind nvirnmnts fr instanc RFID tags and snsr ntwrks. Th thry f NLFSRs is nt wll xplrd. Mst f th knwn rsults ar cllctivly rprtd in Glmb s bk [9]. T dsign a scur cryptgraphic primitiv, such as a ky stram gnratr in a stram ciphr, an arbitrary NLFSR cannt b usd t gnrat kystrams with unprdictability, sinc th randmnss prprtis f a squnc gnratd by an arbitrary NLFSR ar nt knwn and hard t dtrmin. A classical apprach t us an NLFSR in a kystram gnratr is t cmbin it with a linar fdback shift rgistr (LFSR), whr th LFSR guarants th prid f an utput kystram. A (binary) d Bruijn squnc is a squnc f prid 2 n in which ach n-bit pattrn ccurs xactly nc in n

2 2 Kalikinkar Mandal and Guang Gng prid f th squnc (this is rfrrd t as th span n prprty). A d Bruijn squnc can b gnratd by an n-stag NLFSR and it has knwn randmnss prprtis such as lng prid, balanc, span n prprty [3, 8, 9]. Th linar span r linar cmplxity f a squnc is dfind as th lngth f th shrtst LFSR which gnrats th squnc. D Bruijn squncs hav high linar cmplxity [2], i.., th linar cmplxity is gratr than half f its prid. Hwvr, n can dlt n zr bit frm th run f zrs f lngth n f a d Bruijn squnc f prid 2 n. Th rsulting squnc is calld a mdifid d Bruijn r span n squnc. A span n squnc kps th balanc prprty and span n prprly f th crrspnding d Bruijn squnc xcpt fr linar span, which culd b vry lw. A classic xampl f this phnmnn is m-squncs, which ar a class f span n squncs that can b gnratd by an LFSR. By this tchniqu, n can gnrat a d Bruijn squnc frm an m-squnc. Th linar cmplxity f this typ f d Bruijn squncs is at last 2 n 1 + n + 1 [2]. Likwis, frm this d Bruijn squnc, n can rmv a zr frm th run f zrs f lngth n thn it bcms an m-squnc with linar cmplxity n. Thus, th lwr bund f th linar cmplxity f this d Bruijn squnc drps t n nly aftr rmving n zr frm th run f zrs f lngth n [12]. This shws that th linar cmplxity f a d Bruijn squnc is nt an adquat masurmnt fr its randmnss. Instad, it shuld b masurd in trms f th linar cmplxity f its crrspnding span n squnc, sinc thy hav nly n bit diffrnc. A d Bruijn squnc and a span n squnc ar in n-t-n crrspndnc, i.., a span n squnc can b prducd frm a d Bruijn squnc by rmving n zr frm th run f zrs f lngth n. A numbr f publicatins in th litratur hav bn discussd svral tchniqus fr gnrating d Bruijn squncs [1, 5 7, 16, 18, 21]. In mst f th tchniqus, a d Bruijn squnc is prducd by jining many small cycls, which nfrcs that ithr th prcdur nds sm xtra mmry fr string th stat infrmatin fr jining th cycls r th fdback functin must cntain many prduct trms in rdr t jin th cycls. Mst f th xisting mthds ar nt fficint fr prducing d Bruijn squncs f prid 2 n, n 30. Th bjctiv f this papr is t invstigat hw t gnrat a d Bruijn squnc whr th crrspnding span n squnc has a larg linar cmplxity thrugh an itrativ mthd r a cmpsitin mthd. Th cntributin f this papr is that first w rfin Mykkltvit t al. s itrativ mthd [21] fr gnrating a larg prid d Bruijn squnc rcursivly frm a fdback functin f a shrt stag fdback shift rgistr which gnrats a span n squnc. Thn w giv an analysis f th rcursivly cnstructd nnlinar rcurrnc rlatin frm a cryptgraphic

3 Cryptgraphically Strng d Bruijn Squncs 3 pint f viw. In th analysis, w invstigat an apprximatin f th fdback functin by stting sm prduct trms as cnstant functins, and dtrmin th cycl structur f an apprximatd fdback functin and th linar cmplxity f a squnc gnratd by an apprximatd fdback functin. Th analysis als shws that th d Bruijn squncs gnratd by th cmpsitin hav strng cryptgraphic prprtis if th starting shrt span n squnc is strng. Thirdly, w driv an algbraic nrmal frm rprsntatin f an (n + 16)-stag NLFSR and prsnt a fw instancs f cryptgraphically strng d Bruijn squncs with prids in th rang f 2 35 and 2 40 tgthr with th discussins f thir implmntatin issus. Th rmaindr f th papr is rganizd as fllws. In Sctin 2, w dfin sm ntatins and rcall sm backgrund rsults that ar usd in this papr. In Sctin 3, w prsnt th rcursiv cnstructin f an arbitrary stag nnlinar fdback shift rgistr that can gnrat a d Bruijn squnc. In Sctin 4, w analyz th fdback functin f th nnlinar rcurrnc rlatin frm th cryptgraphic pint f viw. In Sctin 5, w prsnt a fw instancs f cryptgraphically strng d Bruijn squncs with prids in th rang f 2 35 and In sctin 6, w dscrib sm mthds fr ptimizing th numbr f additins whil cmputing th fdback functin f a rcursivly cnstructd NLFSR with 40 stags. Finally, in Sctin 7, w cnclud th papr. 2 Prliminaris In this sctin, w dfin and xplain sm ntatins, trms and mathmatical functins that will b usd in this papr. - F 2 = {0, 1} : th Galis fild with tw lmnts. - F 2 t : a finit fild with 2 t lmnts that is dfind by a primitiv lmnt α with p(α) = 0, whr p(x) = c 0 + c 1 x + + c t 1 x t 1 + x t is a primitiv plynmial f dgr t ( 2) vr F 2. - Z n and Z n dnt tw sts f dd intgrs and vn intgrs btwn 1 and n, rspctivly. - Supp(f) : th st f all inputs fr which f(x) = 1, x F 2 n, whr f is a Blan functin in n variabls. - H(f) : th Hamming wight f th Blan functin f. 2.1 Basic Dfinitins and Prprtis Lt a = {a i } b a pridic binary squnc gnratd by an n-stag linar r nnlinar fdback shift rgistr, which is dfind as [9] a n+k = f(a k, a k+1,..., a k+n 1 ) = a k + g(a k+1,..., a k+n 1 ), a i F 2, k 0 (1)

4 4 Kalikinkar Mandal and Guang Gng whr (a 0, a 1,..., a n 1 ) is calld th initial stat f th fdback shift rgistr, f( ) is a Blan functin in n variabls and g( ) is a Blan functin in (n 1) variabls. Th rcurrnc rlatin (1) is calld a nnsingular rcurrnc rlatin. If th functin f is an affin functin, thn th squnc a is calld a LFSR squnc; thrwis it is calld a NLFSR squnc. Th minimal plynmial f th squnc a is dfind by th LFSR f shrtst lngth that can gnrat th squnc and th dgr f th minimal plynmial dtrmins th linar cmplxity f th squnc a. It is wll knwn that a nnsingular fdback shift rgistr with a fdback functin f partitins th spac f 2 n n-tupls int a finit numbr f cycls, which is knwn as th cycl dcmpsitin r cycl structur f f and w dnt by Ω(f) th cycl dcmpsitin f f. Each cycl in Ω(f) can b cnsidrd as a pridic squnc. In particular, th cycl dcmpsitin f a fdback shift rgistr that gnrats a span n squnc cntains nly tw squncs, n is th span n squnc and th thr n is th zr squnc. Prprty 1. Th linar span f a d Bruijn squnc, dntd as LS db, is bundd by [2] 2 n 1 + n + 1 LS db 2 n 1. On th thr hand, th linar span f a span n squnc, dntd as LS s, is bundd by [20] 2n < LS s 2 n 2. Frm this prprty, w say that a span n squnc has th ptimal r subptimal linar span if its linar span is qual t 2 n 2 r cls t 2 n 2. Prpsitin 1. [9] Lt f b a fdback functin in n variabls that gnrats a span n squnc, thn th functin h = f + n 1 i=1 (x i + 1) gnrats a d Bruijn squnc. Th Wlch-Gng (WG) Transfrmatin: Lt Tr(x) = x + x x 2t 1, x F 2 t b th trac functin mapping frm F 2 t t F 2. Lt t b a psitiv intgr with t md 3 0 and 3k 1 md t fr sm intgr k. W dfin a functin h frm F 2 t t F 2 t by h(x) = x + x q 1 + x q 2 + x q 3 + x q 4 and th xpnnts ar givn by q 1 = 2 k + 1, q 2 = 2 2k + 2 k + 1, q 3 = 2 2k 2 k + 1, q 4 = 2 2k + 2 k 1. Thn th functin, frm F 2 t t F 2 t, dfind by WGP(x) = h(x + 1) + 1

5 Cryptgraphically Strng d Bruijn Squncs 5 is knwn as th WG prmutatin and th functins, frm F 2 t t F 2, dfind by f d (x) = Tr(WGP(x d )) and g d (x) = Tr(h(x d )), d D t ar knwn as th WG transfrmatin and fiv-trm (r 5-trm) functin, rspctivly [10, 11], whr D t is th st f cst ladrs which ar c-prim with 2 t 1. Th WG transfrmatin has gd cryptgraphic prprtis such as high algbraic dgr, high nnlinarity. Mrvr, a WG squnc has high linar span [11]. Fr a fixd t, th numbr f WG transfrmatins including dcimatins is givn by ( φ(2 t 1) t 2.2 Cmpsit Rcurrnc Rlatins ) 2 [10]. Lt g(x 0, x 1,..., x n 1, x n ) = x 0 +G(x 1, x 2,..., x n 1 )+x n = 0 and f(x 0, x 1,..., x m 1, x m ) = x 0 + F (x 1, x 2,..., x m 1 ) + x m = 0 b tw rcurrnc rlatins f n and m stags, rspctivly that gnrat pridic squncs, whr G and F ar Blan functins in (n 1) and (m 1) variabls, rspctivly. Thn, a cmpsit rcurrnc rlatin, dntd as g f, is dfind by [21] g f = g(f(x 0,..., x m ), f(x 1,..., x m+1 ),..., f(x n,..., x m+n 1 )) = 0, which is a rcurrnc rlatin f (n + m) stags. Th pratin is rgardd as th cmpsitin pratin f rcurrnc rlatins. Nt that g f and f g ar nt th sam in gnral. Fr any fdback functin f, th cycl dcmpsitin f g is a subst f th cycl dcmpsitin f g f. Fr mr dtaild tratmnts n th cycl dcmpsitin f a cmpsit rcurrnc rlatin, s [21]. Lt ψ(x 0, x 1 ) = x 0 +x 1 b a Blan functin. Thrughut this papr, th dfinitin f ψ is fixd. W nw rstat th fllwing rsults frm [21] which will b usd t cnstruct an arbitrary stag NLFSR that will gnrat a d Bruijn squnc. Lmma 1. [21] Lt p b a charactristic plynmial, and q(x 0,..., x n ) = x 0 +x n +w(x 1,..., x n 1 ) whr w is a Blan functin in (n 1) variabls and lt a Ω(q) and x Ω(q p). If th minimal plynmial f a is cprim with p, thn x = b + c whr b s minimal plynmial is th sam as th minimal plynmial f a and c s minimal plynmial is p. Thrm 1. [21] Lt g = x 0 + x n + f(x 1,..., x n 1 ), which gnrats a d Bruijn squnc with prid 2 n and lt ψ(x 0, x 1 ) = x 0 +x 1. Thn bth h 1 = g ψ + i Z n x i i Z n(x i + 1) and h 2 = g ψ + i Z n(x i + 1) i Z n x i gnrat d Bruijn squncs with prid 2 n+1.

6 6 Kalikinkar Mandal and Guang Gng 3 Rcursiv Fdback Functins in Cmpsd d Bruijn Squncs In [21], Mykkltvit t al. mntind th ida f cnstructing a lng stag NLFSR frm a shrt stag NLFSR by rpatdly applying Thrm 1 whn g is a linar functin in tw variabls that gnrats a d Bruijn squnc. In this sctin, w first rfin Mykkltvit t al. s mthd and thn w shw an analytic frmulatin f a rcursiv fdback functin f an (n + k)-stag NLFSR, which is cnstructd frm a fdback functin f an n-stag NLFSR by rpatdly applying Thrm 1 and th cmpsitin pratin. 3.1 Th k-th Ordr Cmpsitin f a Blan Functin Lt g(x 0, x 1,..., x n ) = x 0 + x n + G(x 1, x 2,..., x n 1 ) b a Blan functin in (n + 1) variabls whr G is a Blan functin in (n 1) variabls. Th first rdr cmpsitin f ψ and g, dntd as g ψ, is givn by [21] g ψ = g(x 0 + x 1, x 1 + x 2,..., x n + x n+1 ) = x 0 + x 1 + x n+1 + x n + G(x 1 + x 2,..., x n 1 + x n ). Similarly, th k-th rdr cmpsitin f g with rspct t ψ is dfind by ( g ψ k = g ψ k 1) ψ, whr g ψ k 1 is (k 1)-th rdr cmpsitin f g with rspct t ψ. 3.2 Rpatd Cmpsitins f a Prduct trm Lt X p 0 b a prduct trm in p variabls which is givn by X p 0 = x i (x i + 1). i Z p i Z p Thn th first rdr cmpsitin f X p 0 with rspct t ψ, dntd as Xp 1, is givn by X p 1 = (x i + x i+1 ) (x i + x i+1 + 1) i Z p i Z p which is a prduct f sum trms in (p + 1) variabls. Similarly, th k-th rdr cmpsitin f X p 0 with rspct t ψ, dntd by Xp k, is dfind as X p k = (Xp k 1 ) ψ, which is a prduct f sum trms in (p+k) variabls. Nt that th cmpsitin pratin with rspct t ψ incrass th numbr f variabls in X p 0 by n whn it rpats nc, but th cmpsitin

7 Cryptgraphically Strng d Bruijn Squncs 7 pratin ds nt incras th algbraic dgr f X p 0. W dnt by J n 1 = n 1 i=1 (x i + 1). In a similar mannr, th k-th rdr cmpsitin f J n 1 with rspct t ψ, dntd as J n 1 k, is dfind by J n 1 k = ( J n 1 ) k 1 ψ, whr J n 1 k 1 is th (k 1)-th rdr cmpsitin f J n 1. Lt us nw dfin a functin Ik n in (n + k 1) variabls as fllws I n k (x 1, x 2,..., x n+k 1 ) = J n 1 k + Xk 1 n + Xn+1 k Xn+k X0 n+k 1. Thn, I n k satisfis th fllwing rcursiv rlatin whr I n 0 = J n 1. I n k+1 = In k ψ + Xn+k 0, fr k 0 and n 2, 3.3 Th Rcursiv Cnstructin f th NLFSR In this subsctin, w giv th cnstructin f an (n + k)-stag NLFSR that is cnstructd frm an n-stag NLFSR. Prpsitin 2. Lt g(x 0, x 1,..., x n ) = x n +x 0 +G(x 1, x 2,..., x n 1 ), which gnrats a span n squnc f prid 2 n 1, whr G is a Blan functin in (n 1) variabls. Thn, fr any intgr k 0, R n k (x 0, x 1,..., x n+k ) = (x n + x 0 ) ψ k + G(x 1, x 2,..., x n 1 ) ψ k + I n k (x 1,..., x n+k 1 ) gnrats a d Bruijn squnc f prid 2 n+k. Prf. By applying Thrm 1 t th fdback functin (g + J n 1 ) k tims, it bcms R n k (x 0, x 1,..., x n+k ) = (x n + x 0 ) ψ k + G(x 1, x 2,..., x n 1 ) ψ k + I n k (x 1,..., x n+k 1 ), k 0 (2) = (x n + x 0 ) ψ k + G(x 1 ψ k,..., x n 1 ψ k )+ I n k (x 1, x 2,..., x n+k 1 ). (3) Th functin Rk n is a fdback functin in (n + k) variabls f an NLFSR and th rcurrnc rlatin, Rk n = 0, gnrats a d Bruijn squnc with prid 2 n+k. in th fllw- On can cnstruct th fdback functin Rk+1 n frm Rn k ing rcursiv mannr R n k+1 = Rn k ψ + Xn+k 0 r R n k+1 = g ψk+1 + I n k+1, k 0 whr R n 0 = (g + J n 1 ).

8 8 Kalikinkar Mandal and Guang Gng Rmark 1. Fr k = 1, Prpsitin 2 is th sam as Thrm 1 which is als fund by Lmpl in [18]. Fr k = 1 and g is a primitiv plynmial, Prpsitin 2 is similar t Thrm 2 in [21]. Rmark 2. Accrding t Thrm 1, th prduct trm X p 0 in th rcurrnc rlatin (2) can b rplacd by th prduct trm i Z p(x i + 1) i Z p x i. W nw prsnt an algbraic nrmal frm rprsntatin f I n 16 fr a rcurrnc rlatin f (n + 16) stags, which is drivd by putting k = 16 in th rcurrnc rlatin (2). Thn, th nnlinar rcurrnc rlatin f (n + 16) stags is givn by R n 16(x 0,..., x n+16 ) = x n+16 + x n + x 0 + x 16 + G(x 1 + x 17,..., x n 1 + x n+15 ) + J n X n X n X n+15 0 = 0 (4) whr J16 n 1 = n 1 i=1 (x i + x i ) and Xj i = T,j i T,j i, i + j = (n + 15), n i n + 15, T,j i and T,j i ar givn in Tabl 1. In th prduct trms, th subscripts and rprsnt th dd indics prduct trms and vn indics prduct trms. Nt that ach prduct trm Xj i, i + j = (n + 15), n i n + 15, is a functin f (n + 15) variabls. Tabl 1. Prduct trms in I n 16 f th rcurrnc rlatin (4) ( 15 ) l=0 x i+l T,14 n+1 = ( 7 i Z n+1 l=0 i+2l) x T,15 n = i Z n T,13 n+2 = i Z n+2 (x i + x i l=1 (x i+2 l + x i+2 l +1)) T,12 n+3 = i Z n+3 ( 3 l=0 x i+4l) T,11 n+4 = i Z n+4 ( 4 l=0 x i+l + 11 l=8 x i+l) T,10 n+5 = i Z n+5 (x i + x i+2 + x i+8 + x i+10 ) T,9 n+6 = i Z n+6 (x i + x i+1 + x i+8 + x i+9 ) T,8 n+7 = i Z n+7 (x i + x i+8 ) T,7 n+8 = i Z n+8 ( 7 l=0 x i+l) T,6 n+9 = i Z n+9 ( 3 l=0 x i+2l) T,5 n+10 = i Z n+10 (x i + x i+1 + x i+4 + x i+5 ) T,4 n+11 = i Z n+11 (x i + x i+4 ) T,3 n+12 = i Z n+12 ( 3 l=0 x i+l) T,2 n+13 = i Z n+13 (x i + x i+2 ) T,1 n+14 = i Z n+14 (x i + x i+1 ) T,0 n+15 = i Z n+16 x i T,15 n = i Z n( 15 l=0 x i+l + 1) T,14 n+1 = i Z n+1 ( 7 l=0 x i+2l + 1) T,13 n+2 = i Z n+2 (x i + x i l=1 (x i+2 l + x i+2 l +1) + 1) T,12 n+3 = i Z n+3 ( 3 l=0 x i+4l + 1) T,11 n+4 = i Z n+4 ( 4 l=0 x i+l + 11 l=8 x i+l + 1) T,10 n+5 = i Z n+5 (x i + x i+2 + x i+8 + x i ) T,9 n+6 = i Z n+6 (x i + x i+1 + x i+8 + x i+9 + 1) T,8 n+7 = i Z n+7 (x i + x i+8 + 1) T,7 n+8 = i Z n+8 ( 7 l=0 x i+l + 1) T,6 n+9 = i Z n+9 ( 3 l=0 x i+2l + 1) T,5 n+10 = i Z n+10 (x i + x i+1 + x i+4 + x i+5 + 1) T,4 n+11 = i Z n+11 (x i + x i+4 + 1) T,3 n+12 = i Z n+12 ( 3 l=0 x i+l + 1) T,2 n+13 = i Z n+13 (x i + x i+2 + 1) T,1 n+14 = i Z n+14 (x i + x i+1 + 1) T,0 n+15 = i Z n+16 (x i + 1) 4 Cryptanalysis f th Rcursivly Cnstructd NLFSR fr Gnrating d Bruijn Squncs Sinc th fdback functin cntains Ik n and it includs many prduct trms whs algbraic dgrs ar high and th Hamming wights f ths

9 Cryptgraphically Strng d Bruijn Squncs 9 prduct trms ar lw, as a rsult, th functin Ik n can b apprximatd by a linar functin r a cnstant functin with high prbability. In this sctin, w first invstigat th succss prbability f apprximating th functin Ik n by th zr functin. W thn study th cycl dcmpsitin f an apprximatd rcurrnc rlatin aftr a succssful apprximatin f th fdback functin with high prbability. 4.1 Hamming Wights f th Prduct Trms Bfr calculating th succss prbability f apprximating th functin Ik n by th zr functin, w first nd t driv th Hamming wight f a cmpsd prduct trm as Ik n is a sum f (k + 1) cmpsd prduct trms. Prpsitin 3. Fr an intgr r 1, th Hamming wight f Xr p qual t 2 r. is Prf. Fr any prduct trm X p 0, th r-rdr cmpsitin is f th frm Xr p = U i V i i Z p i Z p whr U i is a sum f at mst (r + 1) variabls and V i is als a sum f at mst (r +1) variabls and th xact numbr f variabls in U i /V i dpnds n th valu f r. Fr simplicity, w assum that r = 2 l, l 0. T find th Hamming wight f X p r, thr ar tw cass aris. Cas I: Whn 1 p r + 1 If r = 2 l, thn U i and V j can b writtn as U i = x i + x i+r, i Z p, V j = (x j + x j+r + 1), j Z p, rspctivly. X p r = 1 if and nly if U i = 1 and V j = 1 fr all i Z p and j Z p. This implis x 1 = 1 + x 1+r = 1 + x 1+2r = = 1 + x l1 = 0/1 x 2 = x 2+r = x 2+2r = = x l2 = 0/1. x p = 1 + x p+r = 1 + x p+2r = = 1 + x ln = 0/1, if p is dd x p = x p+r = x p+2r = = x lp = 0/1, if p is vn whr l i p + r, i = 1, 2,..., p. Nt that Xr p is a functin in (p + r) variabls. Fr an (p + r)-tupl with Xr p = 1, th valus at 2p psitins ar dtrmind by th valus at p psitins, which fllws frm th abv st f quatins and th rmaining (p + r 2p) psitins can tak any binary valu. Hnc, th ttal numbr f (p + r)-tupls fr which Xr p = 1

10 10 Kalikinkar Mandal and Guang Gng is givn by 2 p 2 r p = 2 r. Cas II: Whn p r + 1 Similarly, Xr p = 1 if and nly if U i = 1 and V j = 1 fr all i Z p and j Z p. This implis x 1 = 1 + x 1+r = 1 + x 1+2r = = 1 + x l1 = 0/1 x 2 = x 2+r = x 2+2r = = x l2 = 0/1. x r 1 = 1 + x 2r 1 = = 1 + x lr 1 = 0/1 x r = x 2r = = x lr = 0/1 whr l i p + r, i = 1, 2,..., r. Accrding t th abv systm f quatins, th binary valus at (p + r) psitins ar dtrmind by th binary valus at r psitins and ths r psitins can tak any valus. Hnc, th ttal numbr f (p + r)-tupls fr which Xr p = 1 is givn by 2 r. By cnsidring U i = 1 and V j = 1 fr all i Z p and j Z p as a systm f linar quatins with p quatins and (p + r) unknwn variabls vr F 2, it fllws that th Hamming wight f Xr p is qual t th numbr f slutins f th systm f linar quatins, which is qual t 2 p+r r = 2 r fr any psitiv intgr r( 2 l ). Prpsitin 4. Fr any intgr r 1, th Hamming wight f Jr n 1 qual t 2 r. Prf. Th prf is similar t th prf f Prpsitin 3. is Prpsitin 5. Fr any intgr k 1 and n 2, th Hamming wight f functin Ik n is qual t 2k + 1. On can apprximat functin Ik n by th zr functin with prbability (1 1 1 ). 2 n 1 2 n+k 1 Prf. By Prpsitin 3, th Hamming wight f X n+k 1 j j, i., H(X n+k 1 j j ) is qual t 2 j, fr 0 j k 1. Nt that X n+k 1 j j = 1 is a systm f linar quatins with (n + k 1 j) quatins and (n + k 1) unknwn variabls and Supp(X n+k 1 j j ) cntains th st f all slutins. It is nt hard t shw that th supprt f Xi n+k 1 i and X n+k 1 j j ar disjint fr 0 i j n 1. Again, ( k 2 j=0 Supp(Xn+k 1 j j )) Supp(J n 1 k ), and Supp(X n+k 1 k 1 ) and Supp(J n 1 k ) ar disjint. Thn th cardinality f th supprt f Ik n is qual t (2k +2 k 1 k 2 j=0 2j ) = (2 k +2 k 1 2 k 1 +1) = 2 k + 1. Hnc, th Hamming wight f Ik n is 2k + 1. Sinc th Hamming wight f Ik n is 2k + 1, th numbr f inputs fr which Ik n taks th valu zr is qual t 2n+k 1 2 k 1. Hnc, n

11 Cryptgraphically Strng d Bruijn Squncs 11 can apprximat th functin Ik n by th zr functin with prbability (1 1 1 ). 2 n 1 2 n+k Cycl Structurs f th Rcurrnc Rlatin aftr Apprximatin By Prpsitin 5, th functin Ik n can b apprximatd by th zr functin with prbability abut (1 1 ). As a cnsqunc, Eq. (2) can b 2 n 1 writtn as fllws R n k,a (x 0, x 1,..., x n+k ) = ((x n + x 0 ) + G(x 1, x 2,..., x n 1 )) ψ k. (5) In th fllwing prpsitin, w prvid th cycl structur f th abv rcurrnc rlatin. Lmma 2. Fr an intgr k 1, Ω(Rk,a n ) = Ω(g) Ω(ψk ), i.., any squnc x Ω(Rk,a n ) can b writtn as x = b + c, whr b s minimal plynmial is th sam as th minimal plynmial f a span n squnc that is gnratd by g and c s minimal plynmial is (1 + x) k and dnts th dirct sum pratin. Prf. Lt s b a span n squnc gnratd by g and lt h(x) th minimal plynmial f s. Thn, h(x) = h 1 (x) h 2 (x) h r (x), whr h i s ar distinct irrducibl plynmials f dgr lss than r qual t n and th valu f r dpnds n th squnc, s [10, 12, 20]. If h i (x) = (1 + x) fr sm i, thn th squnc s is nt a span n squnc. On th thr hand, th minimal plynmial f ψ k is (1 + x) k. Again, th minimal plynmial f a squnc gnratd by ψ k is a factr f (1 + x) k. As h(x) ds nt cntain th factr (1 + x), th minimal plynmial f s and th minimal plynmial f ψ k ar rlativly prim with ach thr. Thn, by Lmma 1, any squnc x Ω(Rk,a n ) can b rprsntd by x = b+c whr b Ω(g) and c Ω(ψ k ). Hnc, th cycl dcmpsitin f Rk,a n is a dirct sum f Ω(g) and Ω(ψ k ), i.., Ω(Rk,a n ) = Ω(g) Ω(ψk ). Prpsitin 6. Th cycl dcmpsitin f R n k,a, i.., Ω(Rn k,a ) cntains 2 (Γ 2 (k) + 1) cycls with (Γ 2 (k) + 1) cycls f prid at last 2 n 1 and (Γ 2 (k) + 1) cycls f prid at mst 2 lg 2 k, whr Γ 2 (k) is th numbr f all cst ladrs mdul 2 k 1. Prf. Fr any psitiv intgr k 1, th cycl dcmpsitin f ψ k is th cycl dcmpsitin f (1 + x) k, which cntains squncs with prid 2 lg 2 i, 1 i k, and th numbr f cycls is givn by (Γ 2 (k) + 1) including th zr cycl (s [9], Th. 3.4, pag-42). Again, th cycl dcmpsitin f g cntains nly tw cycls, n is a cycl f lngth 2 n 1 and th thr n is th zr cycl f lngth n. Thrfr, by Lmma 2,

12 12 Kalikinkar Mandal and Guang Gng Ω(R n k,a ) cntains 2 (Γ 2(k) + 1) cycls whr (Γ 2 (k) + 1) cycls ar f lngth at last 2 n 1 and (Γ 2 (k)+1) cycls ar f lngth at mst 2 lg 2 k. Rmark 3. If th functin Rk n is apprximatd by th functin (Rn k,a + J n 1 k ) with high prbability, thn Ω(Rk,a n + J n 1 k ) = Γ 2 (k) + 1 and th prid f a squnc in Ω(Rk,a n + J n 1 k ) is bundd blw by 2 n. Prpsitin 7. Lt Ω(Rk,a n ) b th cycl dcmpsitin f Rn k,a. Fr any squnc x Ω(Rk,a n ) with prid at last 2n 1, th linar cmplxity f x is bundd blw by th linar cmplxity f th squnc gnratd by g. Prf. W alrady shwd in Lmma 2 that any squnc x Ω(Rk,a n ) can b writtn as x = b + c whr b Ω(g), c Ω(ψ k ), and th minimal plynmial f b is cprim with th minimal plynmial f c. Sinc th minimal plynmial f b is cprim with th minimal plynmial f c, th linar cmplxity f x is qual t th sum f th linar cmplxitis f b and c. Thrfr, th linar cmplxity f x is gratr r qual t th linar cmplxity f b. Hnc, th assrtin is stablishd. Rmark 4. Using th rcurrnc rlatin (2) with G as a linar functin, n can gnrat a d Bruijn squnc with prid 2 n+k and linar cmplxity at last (2 n+k 1 + n + k + 1) fr an arbitrary psitiv intgr k. Nvrthlss, this d Bruijn squnc is nt suitabl fr cryptgraphic applicatins such as t us this squnc as a building blck fr dsigning a PRSG r a stram ciphr, bcaus in th ntir squnc mst f th bits ar linarly rlatd t th intrnal stat bits and nly at H(Ik n) psitins th bits ar nnlinarly rlatd t th intrnal stat bits du t th nnlinar trm Ik n, which is vulnrabl against a cryptanalytic attack. Whras, if th functin g is nnlinar, thn th utput squnc bits f th d Bruijn squnc will b nnlinarly rlatd t th intrnal stat bits f th NLFSR and which may crat a cmplx cryptanalytic attack. Rmark 5. Prpsitins 5, 6, and 7 suggst that in rdr t gnrat a strng d Bruijn squnc by this tchniqu, th starting span n squnc gnratd by g shuld hav gd randmnss prprtis, particularly, lng prid and an ptimal r subptimal linar cmplxity. If an attackr is succssful in apprximating th fdback functin Rk n by th fdback functin g ψ k, thn th scurity f th squnc gnratd by Rk n dpnds n th scurity f th squnc gnratd by g.

13 Cryptgraphically Strng d Bruijn Squncs 13 5 Dsigning Paramtrs fr Strng Cryptgraphic d Bruijn Squncs In this sctin, w prsnt a fw xampls f cryptgraphically strng d Bruijn squncs with prid 2 n+k that ar gnratd by an (n + k)-stag NLFSR fr 19 n 24 and k = 16. In rdr t gnrat d Bruijn squncs with prid 2 40, w chs n = 24 and k = Tradff Btwn n and k It can b bsrvd frm th cnstructin f th rcurrnc rlatin that n can cnstruct an (n+k)-stag rcurrnc rlatin by chsing a small valu f n and a larg valu f k sinc fr a small valu f n it is asy t find a span n squnc and th succss prbability f apprximating th fdback functin is lw (s Prpsitin 5). Hwvr, fr such a chic f th paramtrs, th rcurrnc rlatin cntains many prduct trms, as a rsult, th functin Ik n may nt b calculatd fficintly. Thus, fr gnrating a strng d Bruijn fficintly, n nds t chs th paramtrs in such a way that th nnlinarly gnratd span n squnc is larg nugh and th numbr f prduct trms in Ik n is as small as pssibl. 5.2 Exampls f d Bruijn Squncs with Larg Prids Lt {x j } j 0 b a binary span n squnc gnratd by th fllwing n- stag rcurrnc rlatin fr a suitabl chic f a dcimatin numbr d, a primitiv plynmial p(x), and a t-tap psitin [19] x n = x 0 + f d (x r1, x r2,..., x rt ) (6) whr (r 1, r 2,..., r t ) with 0 < r 1 < r 2 < < r t < n is calld a t-tap psitin and f d is a WG transfrmatin. Hr a dcimatin numbr is a cst ladr which is cprim with 2 t 1. Thn th rcurrnc rlatin (4) with G as th WG transfrmatin can b writtn as R16 n = x n+16 + x n + x 0 + x 16 + f d (x r1 + x r1 +16,..., x rt + x rt+16) + J16 n 1 + X15 n + X14 n X1 n+14 + X n+15 = 0 (7) whr J16 n 1 = n 1 i=1 (x i + x i ) and X p j = T p,j T p,j, p + j = (n + 15), n p n + 15, T p,j and T p,j ar givn in Tabl 1. Th rcurrnc rlatin (7) can gnrat a d Bruijn squnc fr a suitabl chic f a dcimatin numbr d, a primitiv plynmial p(x), and a t-tap psitin. Our d Bruijn squncs ar uniquly rprsntd by th fllwing fur paramtrs: 1. th dcimatin numbr d,

14 14 Kalikinkar Mandal and Guang Gng 2. th primitiv plynmial p(x), 3. th t-tap psitin (r 1, r 2,..., r t ), and 4. I n k. Tabl 2 prsnts a fw xampls f cryptgraphically strng d Bruijn squncs with prids in th rang f 2 35 and In Tabl 2, th cmputatins fr th linar cmplxity f th 24-stag span n squnc has nt finishd yt. Hwvr, currntly th lwr bund f th linar cmplxity is at last Fr mr instancs f span n squncs with an ptimal r subptimal linar span, s [19]. Tabl 2. D Bruijn squncs with prids 2 35 WG vr F 2 t Dcimatin Basis Plynmial t-tap psitins span n Linar Span, I k, Prid t d (c 0, c 1,..., c t 1) (r 1, r 2,..., r t) n span n k 2 n+k (1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0) (1, 2, 3, 4, 5, 6, 9, 10, 11, 12, 13, 15, 17) (1, 1, 1, 0, 0, 1, 1, 1) (1, 2, 5, 6, 8, 11, 12, 15) (1, 1, 1, 0, 0, 0, 0, 1) (1, 2, 6, 8, 9, 15, 16, 19) (1, 1, 1, 0, 0, 0, 0, 1) (1, 2, 10, 12, 13, 16, 18, 19) (1, 1, 0, 0, 0, 1, 1, 0) (1, 3, 4, 5, 8, 11, 12, 15) (1, 0, 0, 1, 1, 1, 0) (1, 2, 6, 8, 10, 12, 16) (1, 0, 1, 0, 0, 1, 1) (1, 2, 3, 5, 6, 10, 18) (1, 1, 1, 0, 1) (5, 10, 12, 18, 19) Rmark 6. Any fdback functin g that gnrats a span n squnc can b usd in rcurrnc rlatin (4) fr prducing a lng prid d Bruijn squnc. T th bst f ur knwldg, Tabl 2 cntains a st f (lngst) d Bruijn squncs whs algbraic nrmal frm rprsntatins f th rcurrnc rlatins ar knwn. W hr usd WG transfrmatins fr prducing lng prid d Bruijn squncs bcaus a span n squnc can b fund by using WG transfrmatins and th cmpact rprsntatin f th rcurrnc rlatin (6) in a systmatic mannr. In [23], ight span n squncs with prids in th rang f (2 22 1) and (2 31 1) ar prsntd and that hav bn usd in a stram ciphr. 6 Implmntatin In this sctin, w prvid sm tchniqus fr ptimizing th numbr additins in th prduct trms fr k = 16, and giv an stimatin fr th numbr f multiplicatins and th tim cmplxity fr cmputing th functin Ik n in trms f n and k. 6.1 Optimizing th Numbr f Additins Fr k = 16, Ik n in rcurrnc rlatin (7) cntains 17 prduct trms. Fr xampl, fr n = 24 and k = 16, n nds 2116 additins fr cmputing

15 Cryptgraphically Strng d Bruijn Squncs 15 all prduct trms in Ik n. In Tabl 1, w can bsrv that many partialsum trms appar in diffrnt prduct trms. By rusing th rsult f a prviusly cmputd sum trm, w can ptimiz th numbr f additins. Fr k = 16, thr ptimizatin ruls ar dscribd in Tabl 3. Accrding Tabl 3. Optimizatin ruls fr additin Optimizatin Rul I (OR-I) Y1,i 1 i + x i+1 Y1,i 2 i+2 + x i+3 Y3,i 1 i+8 + x i+9 Y3,i 2 i+10 + x i+11 Y2,i 1 i+4 + x i+5 Y2,i 2 i+6 + x i+7 Y4,i 1 i+12 + x i+13 Y4,i 2 i+14 + x i+15 Y 1,i = Y1,i 1 1,i 2 Y 2,i = Y2,i 1 2,i 2 Y 0,2,i = x i + x i+2 Y 4,6,i = x i+4 + x i+6 Y 3,i = Y3,i 1 3,i 2 Y 4,i = Y4,i 1 4,i 2 Y 8,10,i = x i+8 + x i+10 Y 12,14,i = x i+12 + x i+14 Q 0,i = x i Q 4,i = x i + x i+4 Q 3,i = Y 1,i Q 7,i = Q 3,i + Y 2,i Q 8,i = x i + x i+8 Q 12,i = Q 4,i + x i+8 + x i+12 Q 11,i = Q 3,i + Y 3,i Q 15,i = Q 7,i + Y 3,i + Y 4,i Q 2,i = Y 0,2,i Q 6,i = Q 2,i + Y 4,6,i Q 1,i = Y1,i 1 Q 5,i = Q 1,i + Y2,i 1 Q 10,i = Q 2,i + Y 8,10,i Q 14,i = Q 6,i + Y 8,10,i + Y 12,14,i Q 9,i = Q 1,i + Y3,i 1 Q 13,i = Q 5,i + Y3,i 1 + Y 4,i 1 Optimizatin Rul II (OR-II) Y1,i 1 i + x i+1 Y1,i 2 i+2 + x i+3 Y 1,i = Y1,i 1 1,i 2 Y 2,i = Y2,i 1 2,i 2 Y2,i 1 i+4 + x i+5 Y2,i 2 i+6 + x i+7 Y i = Y 1,i + Y 2,i Y 0,2,i = x i + x i+2 Y 4,6,i = x i+4 + x i+6 Y 8,10,i = x i+8 + x i+10 W 0,i = x i W 1,i = Y1,i 1 W 4,i = x i + x i+4 W 5,i = Y1,i 1 2,i 1 W 2,i = Y 0,2,i W 3,i = Y 1,i W 6,i = Y 0,2,i + Y 4,6,i W 7,i = Y 1,i + Y 2,i W 8,i = x i + x i+8 W 9,i = Y 1 1,i + x i+8 + x i+9 W 10,i = Y 0,2,i + Y 8,10,i Optimizatin Rul III (OR-III) Y 1,i = x i + x i+1 Y 2,i = x i+2 + x i+3 Z 0,1 = x i Z 1,i = Y 1,i Z 2,i = x i + x i+2 Z 3,i = Y 1,i + Y 2,i Z 4,i = x i + x i+4 t th abv thr ruls givn in Tabl 3, th prduct trms in Tabl 1 can b writtn as that ar givn in Tabl 4. Applying th ruls givn in Tabls 3, th ttal numbr f additins rquird fr cmputing I16 n n+5 n+5 is givn by (n ) = (32 (n + 5) + n + 151), sinc th numbrs f additins rquird fr OR-I, OR-II and OR-III in Tabl 3 ar 32, 18 and 5, rspctivly. Fr n = 24, th numbr f additins aftr applying th abv thr ruls is qual t Th Ttal Numbr f Multiplicatins and th Tim Cmplxity fr Cmputing I n k Th maximum numbr f multiplicatins rquird fr cmputing Ik n is givn by n+k 1 (k 1)(k 2) i=n 1 (i 1) = (n(k + 1) + 2 3) as n rquirs (i 1) multiplicatins t cmput a prduct f i numbrs. In th fllwing prpsitin, w stimat th tim cmplxity fr cmputing th functin Ik n.

16 16 Kalikinkar Mandal and Guang Gng Tabl 4. Prduct trms f th rcurrnc rlatin (7) T,15 n = i Z n T,13 n+2 = i Z n+2 n+1 Q15,i T,14 = i Z n+1 Q14,i Q13,i T n+3,12 = i Z n+3 T,11 n+4 = i Z n+4 Q11,i T n+5 T n+6,9 = i Z n+5 T,7 n+8 = i Z n+5 Q7,i n+8 i=n+6,dd T,5 n+10 = i Z n+5 Q5,i n+10 i=n+6,dd T,3 n+12 = i Z n+5 Q3,i n+11 i=n+6,dd T,1 n+14 = i Z n+5 Q1,i n+11 i=n+6,dd T,15 n = i Z n T,13 n+2 = i Z n+2 Q9,i W9,n+6 T n+7,8 = i Z n+5 W7,i T n+9,6 = i Z n+5 W5,i T n+11,4 = i Z n+5 W3,i Z3,n+12 T n+13,2 = i Z n+5 Q12,i,10 = i Z n+5 Q10,i Q11,i Q2,i n+11 i=n+6,dd n+7 i=n+6,dd W8,i Q6,i n+9 i=n+6,dd W6,i Q4,i n+11 i=n+6,dd W4,i n+13 n+15 W1,i i=n+12,dd Z1,i (xn+14 + xn+15) T,0 = i Z n+16 xi n+1 Q15,i T,14 = i Z n+1 Q14,i Q13,i T n+3,12 = i Z n+3 T,11 n+4 = i Z n+4 Q11,i T n+5 T n+6,9 = i Z n+5 T,7 n+8 = i Z n+5 Q7,i n+8 i=n+6,vn T,5 n+10 = i Z n+5 Q5,i n+10 i=n+6,vn T,3 n+12 = i Z n+5 Q3,i n+11 i=n+6,vn T,1 n+14 = i Z n+5 Q1,i n+11 i=n+6,vn Q9,i W9,n+6 T n+7,8 = i Z n+5 W7,i T n+9,6 = i Z n+5 W5,i T n+11,4 = i Z n+5 W3,i Z3,n+12 T n+13,2 = i Z n+5 n+13 W2,i i=n+12,dd Z2,i Q12,i,10 = i Z n+5 Q10,i Q11,i Q2,i n+11 i=n+6,dd n+7 i=n+6,vn W8,i Q6,i n+9 i=n+6,vn W6,i Q4,i n+11 i=n+6,vn W4,i n+13 n+15 W1,i i=n+12,vn Z1,i (xn+14 + xn+15) T,0 = i Z n+16 xi n+13 W2,i i=n+12,vn Z2,i Prpsitin 8. Th tim cmplxity fr cmputing th functin Ik n apprximatly givn by n+k 1 p=n 1 lg 2 p. is Prf. T cmput a prduct trm X p k, n p n+k 1, n rquirs at mst lg 2 p -tim. Sinc th functin Ik n cntains (k + 1) prduct trms, th tim cmplxity fr cmputing Ik n is givn by n+k 1 p=n 1 lg 2 p. 7 Cnclusins In this papr, w first rfind a tchniqu by Mykkltvit t al. fr prducing a lng prid d Bruijn squnc frm a shrt prid span n squnc thrugh th cmpsitin pratin. W thn prfrmd an analysis f th fdback functin f th lng prid d Bruijn squnc frm th cryptgraphic pint f viw. In ur analysis, w studid an apprximatin f th fdback functins and th cycl structur f an apprximatd fdback functin, and dtrmind th linar cmplxity f a squnc gnratd by an apprximatd fdback functin. In additin, w prsntd a cmpact algbraic nrmal frm rprsntatin f an (n + 16)-stag NLFSR and a fw instancs f d Bruijn squncs with prids in th rang f 2 35 and 2 40 tgthr with th discussins f thir implmntatin issus. A lng prid d Bruijn squnc prducd by this tchniqu can b usd as a building blck t dsign scur lightwight cryptgraphic primitivs such as psudrandm squnc gnratrs and stram ciphrs with dsird randmnss prprtis. Rfrncs 1. A.H. Chan, and R.A. Gams. On th Quadratic Spans f d Bruijn Squncs, IEEE Transactins n Infrmatin Thry, Vl. 36, N. 4, pp , July 1990.

17 Cryptgraphically Strng d Bruijn Squncs A.H. Chan, R.A. Gams, and E.L. Ky. On th Cmplxitis f d Bruijn Squncs, Jurnal f Cmbinatrial Thry, Sris A, Vl. 33, N. 3, pp , N.G. d Bruijn. A Cmbinatrial Prblm, Prc. Kninklijk Ndrlands Akadmi v. Wtnschappn, Vl. 49, pp , Th Stram Prjct T. Etzin. and A. Lmpl. Cnstructin f d Bruijn Squncs f Minimal Cmplxity, IEEE Transactins n Infrmatin Thry, Vl. 30, N. 5, pp , Sptmbr H. Frdricksn. A Survy f Full Lngth Nnlinar Shift Rgistr Cycl Algrithms, SIAM Rviw, 24(2):pp , H. Frdricksn. A Class f Nnlinar d Bruijn Cycls, Jurnal f Cmbinatrial Thry, Sris A, Vl. 19, Issu 2, pp Sptmbr S.W. Glmb. On th Classificatin f Balancd Binary Squncs f Prid 2 n 1, IEEE Transfrmatin n Infrmatin Thry, Vl. 26, N. 6, pp , Nvmbr S. W. Glmb. Shift Rgistr Squncs. Agan Park Prss, Laguna Hills, CA, USA, S. W. Glmb, and G. Gng. Signal Dsign fr Gd Crrlatin: Fr Wirlss Cmmunicatin, Cryptgraphy, and Radar, Cambridg Univrsity Prss, Nw Yrk, NY, USA, G. Gng, and A. Yussf. Cryptgraphic Prprtis f th Wlch-Gng Transfrmatin Squnc Gnratrs, IEEE Transactins n Infrmatin Thry, Vl. 48, N. 11, pp , Nvmbr G. Gng. Randmnss and Rprsntatin f Span n squncs, In Prcdings f th 2007 Intrnatinal Cnfrnc n Squncs, Subsquncs, and Cnsquncs, SSC 07, pp , Springr-Vrlag, I.J. Gd. Nrmal Rcurring Dcimals, Jurnal f Lndn Math. Sc., Vl. 21 (Part 3), D. H. Grn and K. R. Dimnd. Nnlinar Prduct-Fdback Shift Rgistrs, Prcding IEE 117, pp , D. H. Grn and K. R. Dimnd. Sm Plynmial Cmpsitins f Nnlinar Fdback Shift Rgistrs and thir Squnc-Dmain Cnsquncs, Prc. IEE 117, pp , C.J.A. Jansn, W.G. Franx, and D.E. Bk. An Efficint Algrithm fr th Gnratin f d Bruijn Cycls, IEEE Transactins n Infrmatin Thry, Vl. 37, N. 5, pp , Sptmbr K. Kjldsn. On th Cycl Structur f a St f Nnlinar Shift Rgistrs with Symmtric Fdback Functins, Jurnal Cmbinatrial Thry Sris A, Vl. 20, pp , A. Lmpl. On a Hmmrphism f th d Bruijn Graph and its Applicatins t th Dsign f Fdback Shift Rgistrs, IEEE Transactins n Cmputrs, Vl. C-19, Issu 12, pp , Dcmbr K. Mandal, and G. Gng. Prbabilistic Gnratin f Gd Span n Squncs frm Nnlinar Fdback Shift Rgistrs, CACR Tchnical Rprt, G.L. Mayhw, and S.W. Glmb. Charactrizatins f Gnratrs fr Mdifid d Bruijn Squncs, Advancd Applid Mathmatics, Vl. 13, pp , Dcmbr J. Mykkltvit, M-Kung. Siu, and P. Tng. On th Cycl Structur f Sm Nnlinar Shift Rgistr Squncs, Infrmatin and Cntrl, pp , T. Rachwalik, J. Szmidt, R. Wicik, J. Zablcki. Gnratin f Nnlinar Fdback Shift Rgistrs with Spcial-Purps Hardwar, Rprt 2012/314, Cryptlgy Print Archiv,