Algebraic Attacks on Summation Generators

Transcription

1 Algebraic Aacks on Summaion Generaors Dong Hoon Lee, Jaeheon Kim, Jin Hong, Jae Woo Han, and Dukjae Moon Naional Securiy Research Insiue 161 Gajeong-dong, Yuseong-gu, Daejeon, , Korea Absrac. We apply he algebraic aacks on sream ciphers wih memories o he summaion generaor. For a summaion generaor ha uses n LFSRs, an algebraic equaion relaing he key sream bis and LFSR oupu bis can be made o be of degree less han or equal o 2 log 2 n, using log 2 n + 1 consecuive key sream bis. This is much lower han he upper bound given by previous general resuls. We also show ha he echniques of [5] can be applied o summaion generaors using 2 k LFSRs o reduce he effecive degree of he algebraic equaion. Keywords: sream ciphers, algebraic aacks, summaion generaors 1 Inroducion Among recen developmens on sream ciphers, he algebraic aack has gahered much aenion. In his aack, an algebraic equaion relaing he iniial key bis and he oupu key sream bis is se up and solved hrough linearizaion echniques. Algebraic aack was firs applied o block ciphers and public key cryposysems [7, 2]. And is firs successful applicaion o sream cipher was done on Toyocryp [3]. As he mehod was soon exended o LILI-128 [6], i gahered much aenion. Sream ciphers ha uilize memory were firs hough o be much more resisan o hese aacks, bu soon i was shown ha even hese cases were subjec o algebraic aacks [1, 4]. The summaion generaor proposed by Ruepel [10] is a nonlinear combiner wih memory. I is known ha he generaor produces sequences whose period and correlaion immuniy are maximum, and whose linear complexiy is conjecured o be close o he period. Hence i serves as a good building block for sream ciphers. However, a correlaion aack on he summaion generaor ha uses wo LFSRs was presened in [9], even hough i is also saed in [9] ha his aack is no plausible if here are more han wo LFSRs in use. Anoher well known aack on summaion generaor is given by [8] and poins in he opposie direcion. I uses FCSRs o simulae he summaion generaor and indicaes ha for a fixed iniial key size, breaking hem ino oo many LFSRs will add o is weakness. In his work, we sudy he summaion generaor wih he algebraic aack in mind. We show ha for a summaion generaor ha uses n LFSRs, an algebraic equaion relaing he key sream bis and LFSR oupu bis can be made o be of degree less han or equal o 2 log 2 n, using log 2 n + 1 consecuive key

2 sream bis. This is much lower han he upper bound on he degree of algebraic equaions ha is guaraneed by he general works [1, 4]. We also show ha he echniques of [5] can be applied o summaion generaors using 2 k LFSRs o reduce he effecive degree of he equaion furher. The impaien reader may confer o Tables 3 and 4, appearing in laer secions, for a quick look on he improvemens we have given o undersanding he acual srengh of algebraic aacks on summaion generaors. Acually, Table 3 should be a good reference in view of algebraic aacks for anyone considering he use of a summaion generaor. 2 Summaion generaors and symmeric polynomials We consider a summaion generaor ha uses n binary LFSRs. The oupu of he j-h LFSR a ime will be denoed by x j. Since we are dealing wih binary values, we will no be using powers of hese erms, hence he superscrip should no cause any confusion. The curren carry value from he previous sage is denoed by c. Noe ha he carry can be expressed in k = log 2 n bis. We shall le c = (c k 1,..., c 1, c 0) be he binary expression of he carry value. The binary oupu z and he carry value for he nex sage from he summaion generaor is given by z = x 1 x 2 x n c 0, (1) = (x 1 + x x n + c )/2. (2) Le us denoe by Si, he i-h elemenary symmeric polynomial in he variables {x 1,..., x n}. We view hem as boolean funcions raher han as polynomials. Explicily, hey are S 0 = 1, S 1 = n j=1x j, S 2 = 1 j1 <j 2 nx j 1 x j 2,. S n = x 1x 2 x n. We shall also call hese by he name elemenary symmeric boolean funcions. For each 0 a, b n, le m a,b denoe he value of Sa under he condiion j x j = b. This condiion saes ha b of he n variable x j are equal o 1 and ha he ohers are equal o 0. Since Sa is symmeric, i makes sense o evaluae Sa under his condiion. I is also clear ha he values (m a,b ) n b=0 compleely deermines he value of Sa a an arbirary inpu. To calculae m a,b, one has only o coun how many of he monomials conained in Sa is nonzero. Hence we have ( ) b m a,b (mod 2). (3) a

3 Now, consider he (n + 1) (n + 1) marix M = (m a,b ). The n = 4 case is given in Table 1, as an example. Denoe by M, he n n marix obained by x j S S S S S Table 1. The marix M for n = 4 removing he las row and column from M. When we wan o make explici he number of variable used in defining M and M, we shall wrie M(n) and M (n). Lemma 1. For powers of 2, he marix M saisfies ( M (2 k+1 M ) = (2 k ) M (2 k ) ) 0 M (2 k. ) Proof. Le us firs divide M ino four pars and wrie ( ) M II I =. III IV I is clear from (3) ha he second quadran, par II, is M (2 k ), as claimed. The equaion also shows ha he lower riangular par of M is zero. Hence he hird quadran is filled wih zero, as claimed. We now show ha I, II, and IV are idenical. Once more, referring o (3), i suffices o show ( ) b a ( 2 k ) + b a ( 2 k ) + b 2 k + a for all 0 a, b < 2 k. To his end, we may easily check ha (1 + x) 2k +b = (1 + x) 2k (1 + x) b (1 + x 2k )(1 + x) b (mod 2) = (1 + x) b + x 2k (1 + x) b. (mod 2) (4) The coefficien of x a ha would appear in he expansion of he lef hand side (1 + x) 2k +b is he middle erm of (4). Since a < 2 k, he x a erm in he righ hand side may appear only in (1 + x) b and is equal o he firs erm of (4). This shows he firs equaliy. Similarly, comparison of he coefficiens of x 2k +a shows he equaliy beween he firs and he las erms of (4). This complees he proof.

4 This lemma allows one o wrie he marix M (2 k ) explicily for any given k. Then, owing o (3), he marix M(n) for any n may be obained as a submarix of a big enough M (2 k ). For example, Table 1 is a submarix of M (8). The basic heory on symmeric polynomials ells us ha he se consising of producs of elemenary symmeric polynomials forms a basis for he space of symmeric polynomials. In case of symmeric boolean funcions, he following lemma can easily be seen o be rue. Lemma 2. Any boolean funcion ha is symmeric in is variables, may be wrien as a linear combinaion of he elemenary symmeric boolean funcions. 3 Summaion generaor on 4 LFSRs We fix n = 4 hroughou his secion and derive an algebraic equaion of degree 4 ha is saisfied by he summaion generaor. The variables of he final equaion will consis of he LFSR oupu bis and he key sream bis bu will no conain any carry bis. Since we are dealing wih 4 = 2 2 LFSRs, we have k = 2, and i suffices o use 2 bis in expressing he carry value. I is clear ha he carry value should be symmeric wih respec o he order of he LFSRs in use. Recalling Lemma 2, his implies ha, when he curren carry value c is fixed, he carry bis 0 and 1 may be expressed as linear combinaions of he elemenary symmeric boolean funcions Si. In he general case when he curren carry bis are no fixed, hey will be linear combinaions of he Si wih boolean funcions of he carry bis c 0 and c 1 used as coefficiens. For each value of c and LFSR inpus possible, we explicily calculaed 0 and 1. We hen used Table 1 o expressed hem using he elemenary symmeric boolean funcions. The resul is given in Table 2. c S2 S1 S2 S0 S2 S0 S1 S2 1 S4 S3 S4 S2 S4 S1 S2 S3 S4 Table 2. The nex carry bis in relaion o he curren carry value Lemma 3. For a summaion generaor on 4 LFSRs, he following expresses he nex sage carry bis as funcions of he curren LFSR oupu bis and curren carry bis. Proof. Using Table 2, we may wrie 0 = S2 c 0S1 c 1 (5) 1 = S4 c 0S3 c 1S2 c 0c 1S1. (6) 0 = {(1 c 0)(1 c 1)S 2} {c 0(1 c 1)(S 1 S 2)} {(1 c 0)c 1(S 0 S 2)} {c 0c 1(S 0 S 1 S 2)}

5 and 1 = {(1 c 0)(1 c 1)S 4} {c 0(1 c 1)(S 3 S 4)} {(1 c 0)c 1(S 2 S 4)} {c 0c 1(S 1 S 2 S 3 S 4)}. Simplificaion of hese equaions gives he claimed saemens. Lemma 4. For n = 4, he following expresses he carry bis of he summaion generaor as polynomials in he LFSR oupu bis and he key sream bis. c 0 = S 1 z. (7) c 1 = S 2 (1 z )S 1 S +1 1 z +1. (8) The firs carry bi c 0 is linear and he second carry bi c 1 LFSR oupu bis. is of degree 2 in he Proof. The firs equaion follows immediaely from (1). I is a linear funcion on he variables x j. Subsiuing his and is shif c+1 0 ino (5) gives c 1 = S 2 (S 1 z )S 1 S +1 1 z +1. Now, since we are dealing wih boolean funcions, we have (S1 )2 = S1 second equaion follows. and he Finally, wih his lemma, we may remove all occurrence of he carry bis from (6) o obain he following proposiion. Proposiion 1. The following algebraic equaion holds rue for a summaion generaor on 4 LFSRs. 0 = S4 (1 z )S3 S2S 1 +1 (1 z +1 )S2 S2 +1 (1 z )S1S 1 +1 (1 z )(1 z +1 )S1 (1 z +1 )S1 +1 S1 +2 z +2. I is of degree 4 in he oupu bis of he LFSRs and uses 3 consecuive key sream bis. While simplifying he subsiuion of (7), (8), and shif of (8) ino (6), we have used he equaliy S 1S 3 = S 3 of boolean funcions. 4 Summaion generaor on n = 2 k LFSRs Le us denoe by Fi +1 (n), he (symmeric) polynomial ha expresses he nex sage carry bi i in erms of LFSR oupus x j and curren carry bis c j. Since we shall be dealing wih polynomials on differen number of variables, we

6 shall wrie Sj (n) o denoe he elemenary symmeric boolean funcion on n variables. As an example, we saw in he previous secion ha by F0 +1 (2 2 ) = S2(2 2 ) c 0S1(2 2 ) c 1, (9) F1 +1 (2 2 ) = S4(2 2 ) c 0S3(2 2 ) c 1S2(2 2 ) c 0c 1S1(2 2 ). (10) Le us suppose ha for some n = 2 k, he polynomials Fi +1 (2 k ) are given F +1 i (2 k ) = j f i,j S j(2 k ). (11) Here, each coefficien f i,j is a boolean funcion defined on he curren carry bis c 0, c 1,..., c k 1. For example, we see from (10) ha f 1,4 = 1, f 1,3 = c 0, f 1,2 = c 1, f 1,1 = c 0c 1, f 1,0 = 0, for k = 2. The following proposiion will allow us o inducively calculae all F +1 i (2 k ) for any i and k. Proposiion 2. Suppose equaion (11) holds for some k. Then we have F +1 i (2 k+1 ) = j f i,j S j(2 k+1 ), for i < k 1, (12) F +1 k 1 (2k+1 ) = ( j f k 1,j S j(2 k+1 ) ) c k, (13) F +1 k (2 k+1 ) = ( j f k 1,j S j+2 k (2 k+1 ) ) c k( j f k 1,j S j(2 k+1 ) ). (14) The proof of his proposiion may be found in he appendices. As an immediae applicaion of his proposiion o (9) and (10), we may wrie F0 +1 (2 3 ) = S2(2 3 ) c 0S1(2 3 ) c 1, (15) F1 +1 (2 3 ) = S4(2 3 ) c 0S3(2 3 ) c 1S2(2 3 ) c 0c 1S1(2 3 ) c 2, (16) F2 +1 (2 3 ) = S8(2 3 ) c 0S7(2 3 ) c 1S6(2 3 ) c 0c 1S5(2 3 ) c 2S4(2 3 ) c 0c 2S3(2 3 ) c 1c 2S2(2 3 ) c 0c 1c 2S1(2 3 ). (17) Now, le us briefly recall he process we wen hrough in Secion 3 in obaining he degree 4 equaion of Proposiion 1. We sared ou wih hree equaions. z = S 1 c 0. (18) 0 = S2 c 0S1 c 1. (19) 1 = S4 c 0S3 c 1(S2 c 0S1). (20) We used (18) o wrie c 0 as a degree 1 equaion ha involves jus he key sream bi and he LFSR oupus. This was subsiued in he nex equaion (19) o wrie c 1 as a degree 2 equaion of he same kind. Finally, hese expressions for c 0 and c 1 were subsiued in he las equaion o obain he degree 4 equaion ha involves only key sream bis and LFSR oupu bis.

7 Wha would happen if we waned o do he same for n = 2 3. We would sar wih he following se of equaions. z = S 1 c 0. (21) 0 = S2 c 0S1 c 1. (22) 1 = S4 c 0S3 c 1S2 c 0c 1S1 c 2. (23) 2 = S8 c 0S7 c 1S6 c 0c 1S5 c 2(S4 c 0S3 c 1S2 c 0c 1S1). (24) Noice ha he firs wo equaions here are idenical o (18) and (19), as saed by (12) of Proposiion 2. Hence, as before, c 0 and c 1 will be wrien as degree 1 and 2 polynomials. The main par of (23) is idenical o (20), as saed by (13). They only differ in ha c 2 appears a he end of (23). Since (20) is of degree 4, equaion (23) gives a degree 4 expression for c 2. Now, as given by (14), he righ hand side of (24) may be broken ino wo big erms of degree (less han or equal o) 8. The firs erm is a degree 4 equaion shifed by degree 4 and he second erm is a produc of wo degree 4 equaions. Finally, he lef hand side of (24) is of degree 4. Hence, subsiuion of c 0, c 1 and c 2 ino (24) gives a degree 8 polynomial connecing various LFSR oupu bis and key sream bis. One can easily see ha he above argumen is general enough o be seen as he inducion sep needed in proving he following heorem. Theorem 1. Consider a summaion generaor on n = 2 k LFSRs. There exiss an algebraic equaion connecing LFSR oupu bis and k + 1 consecuive key sream bis in such a way ha i is of degree 2 k in he LFSR oupu bis. 5 The general case The following is an easy corollary o Theorem 1. Theorem 2. Consider a summaion generaor of n LFSRs. We shall le k = log 2 n. There exiss an algebraic equaion connecing LFSR oupu bis and k + 1 consecuive key sream bis in such a way ha i is of degree less han or equal o 2 k in he LFSR oupu bis. Proof. We may model a summaion generaor on n LFSRs as a summaion generaor on 2 k LFSRs wih (2 k n) of he LFSRs se o zero. Hence, our claim follows from Theorem 1. For small n s, we explicily calculaed he algebraic equaions. Table 3 compares he upper bounds on he degree of he algebraic equaion claimed by various mehods. We believe his able is big enough o cover any pracically usable summaion generaor and should serve as a good reference for anyone implemening a summaion generaor and considering is immuniy o algebraic aacks.

8 n [1, 4] Thm explici calc Table 3. Degree bounds on algebraic equaions for summaion generaors 6 Reducing he degree furher for he n = 2 k case For he case when n = 2 k, we may reduce he degree of he algebraic equaion a lile bi furher, assuming ha we have access o consecuive key sream bis. We will apply he aack described in [5] due o Courois. Following he noaion of [2, 5], we classify mulivariae equaions ha relae key bis k i and oupu bis z j ino ypes given by heir degrees of k i and z j. We say ha a polynomial is of ype k d z f if all of is monomial erms are of he form k i1 k id z j1 z jf. Capial leers will be used in a similar manner o denoe ypes of equaions ha may conain lower degree monomials also. For example, K 2 = k 2 k 1 and KZ = kz k z 1. In [5], double-decker equaions (DDE) of degree (d, e, f) are defined o be any mulivariae equaion of ype K d K e Z f. Cases where d > e are of ineres from he aacker s poin of view. The following proposiion saes ha he equaions describing he summaion generaor on 2 k inpu LFSRs, given by Theorem 1, are DDEs. Theorem 3. A double-decker equaion of degree (2 k, 2 k 1, 2 k 1 ) ha relaes iniial key bis and oupu sream bis exiss for he summaion generaor on 2 k LFSRs. Proof. Le us, once more, recall he n = 2 2 case. The following is a very simple illusraion of he process we wen hrough in obaining he degree 4 equaion. (18) Z 1 = K 1 c 0 c 0 is of ype K 1 Z 1 (25) (19), (25) K 1 Z 1 = K 2 (K 1 Z 1 )K 1 c 1 c 1 is of ype K 2 K 1 Z 1 (26) (20), (26) K 2 K 1 Z 1 = (K 2+2 K 1+2 Z 1 ) (K 2 K 1 Z 1 )(K 2 K 1 Z 1 ) relaion of ype K 4 K 3 Z 2 (27) Le us nex consider he n = 2 3 case also. Since changing he number of variables, i.e., replacing S j (22 ) wih S j (23 ) does no change he degree of hese

9 equaions, he degree 2 3 equaion is obained as follows. (18) = (21), (25) c 0 is of ype K 1 Z 1 (28) (19) = (22), (26) c 1 is of ype K 2 K 1 Z 1 (29) (20) (23), (27) c 2 is of ype K 4 K 3 Z 2 (30) (24), (30) K 4 K 3 Z 2 = (K 4+4 K 3+4 Z 2 ) (K 4 K 3 Z 2 )(K 4 K 3 Z 2 ) relaion of ype K 8 K 7 Z 4 (31) This shows ha he general case may be proved by inducion. To prove he inducion sep, i suffices o show ha K 2k K 2k 1 Z 2k 1 = (K 2k +2 k K 2k 1+2 k Z 2k 1 ) (K 2k K 2k 1 Z 2k 1 )(K 2k K 2k 1 Z 2k 1 ) gives a DDE of ype K 2k+1 K 2k+1 1 Z 2k. Checking he validiy of his saemen is rivial. And his complees he proof. We may assume ha all periods of he LFSRs used in he summaion generaor are relaively prime. Then he summaion generaor saisfies he requiremen of he aack described in [5], if we have access o consecuive key sream bis. The following seps may be aken o reduce he complexiy of he algebraic aack. 1. Compue an algebraic equaion explicily using he formulae given in Proposiion Wrie he resuling DDE in he following form. L (k) = R (k, z). Here, L (k) is he sum of all monomials of ype K d appearing in he equaion and R (k, z) is he sum of all oher monomials of ype K e Z f. 3. Fix an arbirary nonrivial iniial key k and compue he value L (k ) for a sequence of lengh 2 ( ) m d. 4. Using he Berlekamp-Massey algorihm, find a linear relaion α = (α ) such ha α L (k ) = 0. We noe ha seps 1,2,3,4 are independen of he iniial key k, hence we can pre-compue he relaion α. 5. We have obained an algebraic equaion of degree e. I is given by α R (k, z) = Apply he general algebraic aack given in [6] o he above equaion.

10 Example 1. The DDE for n = 2 2 is given as follows: S4 S3 S1 +1 S 2 S2 +1 S2 S1S 1 +1 = S1 +2 S1 +1 S1 z S3 z +1 S2 z S1S +1 1 z +1 S1 +1 z z +1 S1. z +1 S1 z S1 z +2 We ake 4 LFSRs defined by he following characerisic polynomials. L 1 : x 3 + x + 1 L 2 : x 5 + x L 3 : x 7 + x + 1 L 4 : x 11 + x Since ( ) , 000, we compue 30,000 bis from he lef hand side of he above equaion for some arbirary nonrivial key bis k. Afer applying he Berlekamp-Massey algorihm, we found ha he sequence has a linear relaion of lengh 3892 < ( ) Wih a consecuive key sream of lengh of he order 6520 = (3 1) + ( ( ) ), one will be able o find he 26 bi iniial key k. Table 4 gives a simple comparison of he daa and compuaional complexiies needed for aacks on summaion generaors. Le w be he Gaussian eliminaion exponen. We shall use w = log 2 7, as given by he Srassen algorihm. Le he summaion generaor wih 2 k inpu LFSRs use an m-bi iniial key. generaor size (m, 2 k ) (128, 2 2 ) (256, 2 2 ) (256, 2 3 ) ( ) m daa k 1 (k+1) [1, 4] ) w compuaion ( m 2 k 1 (k+1) daa T = 2 m 2 k +k [8] compuaion T 2 log 2 T log 2 log 2 T ( daa m ) Thm 1 ( k compuaion m ) w ( k daa m ) k 1 Thm 3 ( compuaion m ) w k 1 Table 4. Complexiy comparison of aacks on summaion generaors We remark ha for [8] and Theorem 3, he key sream needs o be consecuive. For [1, 4] and Theorem 1, he key sream need only be parially consecuive, i.e., we need groups of k + 1 consecuive bis, bu hese groups may be far apar from each oher. Hence, a sraighforward comparison of daa complexiy migh no be fair. Also, he values for [8] have been calculaed assuming ha he LFSRs in use have been chosen well, so ha heir 2-adic span is maximal.

11 7 Conclusion We have applied he general resuls of [1, 4] and [5] on sream ciphers wih memories o he summaion generaor. Our resuls show ha he degree of algebraic equaion obainable and he complexiy of he aack applicable are much lower han given by he general resuls. For a summaion generaor ha uses n LFSRs, he algebraic equaion relaing he key sream bis and LFSR oupu bis can be made o be of degree less han or equal o 2 log 2 n, using log 2 n + 1 consecuive key sream bis. Under cerain condiions, for he n = 2 k case, he effecive degree may furher be reduced by 1. And for small n s we have summarized he degrees of he explici equaions in Table 3. The able should be aken ino accoun by anyone using a summaion generaor. References 1. F. Armknech and M. Krause, Algebraic aacks on combiners wih memory, Advances in Crypology - Crypo 2003, LNCS 2729, Springer-Verlag, pp , N. Courois, The securiy of Hidden Field Equaions (HFE), CT-RSA 2001, LNCS 2020, Springer-Verlag, pp , N. Courois, Higher order correlaion aacks, XL algorihm and Crypanalysis of Toyocryp, ICISC 2002, LNCS 2587, Springer-Verlag, pp , N. Courois, Algebraic aacks on combiners wih memory and several oupus, E-prin archive, 2003/ N. Courois, Fas algebraic aack on sream ciphers wih linear feedback, Advances in Crypology - Crypo 2003, LNCS 2729, Springer-Verlag, pp , N. Courois and W. Meier, Algebraic aacks on sream ciphers wih linear feedback, Advances in Crypology - Eurocryp 2003, LNCS 2656, Springer-Verlag, pp , N. Courois and J. Pieprzyk, Crypanalysis of block ciphers wih overdefined sysems of equaions, Asiacryp 2002, LNCS 2501, Springer-Verlag, pp , A. Klapper and M. Goresky, Crypanalysis based on 2-adic raional approximaion, Advances in Crypology - Crypo 95, LNCS 963, Springer-Verlag, pp , W. Meier and O. Saffelbach, Correlaion Properies of Combiners wih Memory in Sream Cipher, Journal of Crypology, vol.5, pp.67 86, R.A. Rueppel, Correlaion immuniy and he summaion generaor, Advances in Crypology - Crypo 85, LNCS 219, Springer-Verlag, pp , A Proof of Proposiion 2, equaion (12) To prove (12), we shall evaluae is righ hand side a some arbirary inpu value and show ha i equals he nex carry bi i. Bu before we do his, le us make some observaions. Noe ha we may ake i ( j x j + c )/2 i+1 (mod 2) (32) as he definiion of he carry bis. We may evaluae he righ hand side of (11) a j x j = 0 and equae i wih he evaluaion of (32) a he same poin o shows c i+1 = f i,0. Now, from he discussions in Secion 2 on he marix M, we know ha a j x j = 2k, we have S0 (2k ) = S (2 k ) = 1 and all oher S 2 k j (2k ) = 0. Once more, evaluaing (11) and (32) a j x j = 2k wih his in mind shows

12 c i+1 = f i,0 f i,2 k. Since we already know c i+1 = f i,0, his implies f i,2 k = 0, or equivalenly, ha he erm S does no appear in he linear sum (11). 2 k We shall now evaluae he righ hand side of (12) a some fixed LFSR oupu values (x 1,..., x ) and carry value c. Se 2 k+1 x = j x j, x = remainder of x divided by 2 k, c = remainder of c divided by 2 k. From he above observaion, we know ha he righ hand side of (12) conains some of he erms S0 (2k+1 ),..., S 2 k 1 (2k+1 ), bu does no conain any of he erms S j (2 k+1 ) for j 2 k. We also know from discussions of Secion 2 ha he evaluaion of each Sj (2k+1 ) a x for j < 2 k is equal o is evaluaion a x. Noe also ha he erm c does no appear as inpu o any of he coefficiens f 2 k i,j in he righ hand side of (12). Hence, RHS of (12) a x and c = RHS of (12) a x and c = RHS of (11) a x and c = (x + c )/2 i+1 (mod 2) = (x + c )/2 i+1 (mod 2) = i a x and c. The condiion i k 2 has been used in he fourh equaliy. And he las equaliy is jus (32). We have compleed he proof ha (12) is a valid expression for he nex carry bis. B Proof of Proposiion 2, equaion (13) The proof for (13) is very similar o ha of (12) and hence we shall be very brief. We ask he readers o read Appendix A before reading his secion. The carry bi is given by k 1 ( j x j + c )/2 k (mod 2). Evaluaion of (11) a j x j = 0 and 2k shows ha f k 1,0 = 0 and f k 1,2 k = 1, hence we now always have S as a linear erm, wih coefficien equal o 1, in 2 k he sums (11) and (13). The emporary values x, x, and c may be defined as before. From he discussions of Secion 2, one may wrie ( S 2 k (2 k+1 ) a x ) = x/2 k = ( S 2 k (2 k+1 ) a x ) x/2 k (mod 2) and ( S j (2 k+1 ) a x ) = ( S j(2 k+1 ) a x )

13 for j < 2 k. Also noe ha none of he erms S j (2 k+1 ), for j > 2 k, appears in he sum (13) and ha he erm c k visible in (13) is is only use in (13). Hence, RHS of (13) a x and c = ( RHS of (13) a x and c ) c k = ( RHS of (13) a x and c ) c k x/2k (mod 2) = ( RHS of (11) a x and c ) c k x/2k (mod 2) = (x + c )/2 k c k x/2k (mod 2) = (x + c )/2 k (mod 2) = k 1 a x and c. This complees he proof. C Proof of Proposiion 2, equaion (14) Define x = j x j. Careful reading of Appendices A and B shows ha he firs erm of (14) simplifies o { j f k 1,j S j+2 (2 k+1 0 for 0 x 2 k, ) = k (x 2 k + c )/2 k c k for 2 k < x 2 k+1 (33), and ha he second erm saisfies c k( j f k 1,j S j(2 k+1 ) ) = c k( (x + c )/2 k c k). (34) I now suffices o compare he sum of hese wo values wih k (x + c )/2 k+1 (mod 2). (35) Define x = x 2 k when x > 2 k and define c = c 2 k when c k = 1. Case 1) x 2 k, c k = 0. This is he mos easy case. Case 2) x 2 k, c k = 1. Case 3) x > 2 k, c k = 0. (33) (34) = 0 = (x + c )/2 k+1. (33) (34) = (x + c )/2 k 1 = (x + c )/2 k = {(x + c ) + 2 k }/2 k+1 = (x + c)/2 k+1. (33) (34) = (x + c )/2 k = {(x + c ) + 2 k }/2 k+1 = (x + c )/2 k+1.

14 Case 4) x > 2 k, c k = 1. (33) (34) = (x + c )/2 k (x + c )/2 k = (x + c )/2 k ( (x + c )/2 k 1) = 1 = (x + c )/2 k+1. This complees he proof.