On the Linear Complexity of Legendre-Sidelnikov Sequences

Size: px

Start display at page:

Download "On the Linear Complexity of Legendre-Sidelnikov Sequences"

Beverly Newton
5 years ago
Views:

1 On the Linear Complexity of Legendre-Sidelnikov Sequences Ming Su Nankai University, China Emerging Applications of Finite Fields, Linz, Dec. 12

2 Outline Motivation Legendre-Sidelnikov Sequence Definition of Linear Complexity The Linear Complexity of Character based Sequences Our Contribution Multiplicities of the Roots of Unity Linear Complexity of Legendre-Sidelnikov Sequence

3 Background Legendre Sequence For a prime p > 2 let (s n ) be the Legendre sequence defined as { ( ) 1, n s n = p = 1, n 0, 0, otherwise, ( ) where ṗ denotes the Legendre symbol. Sidelnikov Sequence Let q be an odd prime power, g a primitive element of F q, and let η denote the quadratic character of F q, i.e., η(g i ) = ( 1) i, i = 0, 1,..., q 2. Then the Sidel nikov(lempel-cohn-eastman) sequence is defined: { 1, if η(g s n = n + 1) = 1, n = 0, 1,... 0, otherwise,

4 Background Legendre Sequence For a prime p > 2 let (s n ) be the Legendre sequence defined as { ( ) 1, n s n = p = 1, n 0, 0, otherwise, ( ) where ṗ denotes the Legendre symbol. Sidelnikov Sequence Let q be an odd prime power, g a primitive element of F q, and let η denote the quadratic character of F q, i.e., η(g i ) = ( 1) i, i = 0, 1,..., q 2. Then the Sidel nikov(lempel-cohn-eastman) sequence is defined: { 1, if η(g s n = n + 1) = 1, n = 0, 1,... 0, otherwise,

5 Definition of Legendre-Sidelnikov Sequence We consider the n-periodic binary sequence (s i ) : 1, if (i mod n) P, s i = 0, if (i mod n) Q, 1 i η(g p i +1) 2, if (i mod n) R, i 0, where p is an odd prime and q is the power of an odd prime such that gcd(p, q 1) = 1. n = p(q 1), P = {0, { p, 2p,...,(q 2)p}. } Q = q j(q 1) : j = 0,...,p 1, Q = Q \ { n 2 } because P Q = { n 2 }, R = {0, 1, 2,...,n 1} \ (P Q ).

6 Properties of Legendre-Sidelnikov Sequence This new sequence is balanced if p = q. The autocorrelation of (s i ) is given by AC(s i, l)= q 1 (p 1)(( 1) l + 1), l P \ {0}, ( 1) ( (q 1)/2 1 ) + 1 ( 1) 1)/8)( (q2 l ) p (1 + ( 1) p 1 2, l Q, p q 2 + ( 1 + ( 1) (p 1)/2) ( ) l p,l R, q 1 l, ( 1) l 1 + ( l p) (1 + ( 1) (p 1)/2 η( g l + 1) (1 + ( 1) (p 1)/2+(q 1)/2+l ) ), l R, q 1 l.

7 Properties of Legendre-Sidelnikov Sequence This new sequence is balanced if p = q. The autocorrelation of (s i ) is given by AC(s i, l)= q 1 (p 1)(( 1) l + 1), l P \ {0}, ( 1) ( (q 1)/2 1 ) + 1 ( 1) 1)/8)( (q2 l ) p (1 + ( 1) p 1 2, l Q, p q 2 + ( 1 + ( 1) (p 1)/2) ( ) l p,l R, q 1 l, ( 1) l 1 + ( l p) (1 + ( 1) (p 1)/2 η( g l + 1) (1 + ( 1) (p 1)/2+(q 1)/2+l ) ), l R, q 1 l.

8 Definition of Linear Complexity The linear complexity L(S) over F 2 of a binary sequence (s i ) is the shortest length L of a linear recurrence relation over F 2 s i+l = c L 1 s i+l c 0 s i, 0 i N L 1.

9 On the Linear Complexity The linear complexity should be large enough, i. e., larger than half of the period, resisting the Berlekamp-Massey attack Algebraic expression of the linear complexity of S: L(S) = N deg(gcd(x N 1, S(X))), where the generating polynomial S(X) := s 0 + s 1 X s N 1 X N 1.

10 On the Linear Complexity The linear complexity should be large enough, i. e., larger than half of the period, resisting the Berlekamp-Massey attack Algebraic expression of the linear complexity of S: L(S) = N deg(gcd(x N 1, S(X))), where the generating polynomial S(X) := s 0 + s 1 X s N 1 X N 1.

11 Linear Complexity of Other Character Sequences Legendre sequence (Ding, Helleseth, Shan) By using quadratic residues and nonresidues Sidelnikov sequence (Helleseth, Yang; Kyureghyan, Pott; Meidl, Winterhof) In some cases by using results on certain cyclotomic numbers and the factorization of some cyclotomic polynomials Generalized Cyclotomic binary sequence of order 2 (Ding) By using properties of cyclotomic cosets Two prime generators(brandstatter, Winterhof; Ding); Two prime Sidelnikov sequence(brandstatter, Pirsic, Winterhof)

12 Linear Complexity of Other Character Sequences Legendre sequence (Ding, Helleseth, Shan) By using quadratic residues and nonresidues Sidelnikov sequence (Helleseth, Yang; Kyureghyan, Pott; Meidl, Winterhof) In some cases by using results on certain cyclotomic numbers and the factorization of some cyclotomic polynomials Generalized Cyclotomic binary sequence of order 2 (Ding) By using properties of cyclotomic cosets Two prime generators(brandstatter, Winterhof; Ding); Two prime Sidelnikov sequence(brandstatter, Pirsic, Winterhof)

13 Linear Complexity of Other Character Sequences Legendre sequence (Ding, Helleseth, Shan) By using quadratic residues and nonresidues Sidelnikov sequence (Helleseth, Yang; Kyureghyan, Pott; Meidl, Winterhof) In some cases by using results on certain cyclotomic numbers and the factorization of some cyclotomic polynomials Generalized Cyclotomic binary sequence of order 2 (Ding) By using properties of cyclotomic cosets Two prime generators(brandstatter, Winterhof; Ding); Two prime Sidelnikov sequence(brandstatter, Pirsic, Winterhof)

14 Linear Complexity of Other Character Sequences Legendre sequence (Ding, Helleseth, Shan) By using quadratic residues and nonresidues Sidelnikov sequence (Helleseth, Yang; Kyureghyan, Pott; Meidl, Winterhof) In some cases by using results on certain cyclotomic numbers and the factorization of some cyclotomic polynomials Generalized Cyclotomic binary sequence of order 2 (Ding) By using properties of cyclotomic cosets Two prime generators(brandstatter, Winterhof; Ding); Two prime Sidelnikov sequence(brandstatter, Pirsic, Winterhof)

15 Linear Complexity of this Sequence? Intuitively p (related to the Legendre sequence) and q (Sidelnikov) should both contribute equivalently. Can we determine the exact linear complexity?

16 Linear Complexity of this Sequence? Intuitively p (related to the Legendre sequence) and q (Sidelnikov) should both contribute equivalently. Can we determine the exact linear complexity?

17 Linear Complexity of this Sequence? Intuitively p (related to the Legendre sequence) and q (Sidelnikov) should both contribute equivalently. Can we determine the exact linear complexity?

18 Generating Polynomial of Legendre-Sidelnikov Sequence Note that X n 1 = (X rp 1) 2, where r = q 1 2. Next we discuss the multiplicities of 1, β(rth root of unity), α(pth root of unity), and other prth roots of unity for S(X).

19 Generating Polynomial of Legendre-Sidelnikov Sequence Note that X n 1 = (X rp 1) 2, where r = q 1 2. Next we discuss the multiplicities of 1, β(rth root of unity), α(pth root of unity), and other prth roots of unity for S(X).

20 Lemma A On the multiplicity of 1 If p 1 (mod 4), then for k 1 satisfying 2 t 1 k < 2 t+1 1 with some positive integer t, we have S (j) (1) = 0 for all j k if and only if q 1 (mod 2 t+1 ). Equivalently, if p 3 (mod 4), 1 is not a root of S(X); if p 1 (mod 4), and q 1 (mod 2 l ) for the maximal integer l, the multiplicity of the root 1 is 2 l 1. Proof: Suppose the conclusion is true for 2 t 1 k < 2 t+1 1 on some t. Then for k = 2 t+1 1, by Lucas property and Hasse derivative = S (k) (1) = i P i 2 t+1 1 (mod 2 t+1 ) p(q 1) 1 s i + i=0 ( ) i s i = k i Zn i 2 t+1 1 (mod 2 t+1 ) p(q 1) 1 i=0 i 2 t+1 1 (mod 2 t+1 ) ( i p s i ) η(g i + 1).

21 Lemma A On the multiplicity of 1 If p 1 (mod 4), then for k 1 satisfying 2 t 1 k < 2 t+1 1 with some positive integer t, we have S (j) (1) = 0 for all j k if and only if q 1 (mod 2 t+1 ). Equivalently, if p 3 (mod 4), 1 is not a root of S(X); if p 1 (mod 4), and q 1 (mod 2 l ) for the maximal integer l, the multiplicity of the root 1 is 2 l 1. Proof: Suppose the conclusion is true for 2 t 1 k < 2 t+1 1 on some t. Then for k = 2 t+1 1, by Lucas property and Hasse derivative = S (k) (1) = i P i 2 t+1 1 (mod 2 t+1 ) p(q 1) 1 s i + i=0 ( ) i s i = k i Zn i 2 t+1 1 (mod 2 t+1 ) p(q 1) 1 i=0 i 2 t+1 1 (mod 2 t+1 ) ( i p s i ) η(g i + 1).

22 On the multiplicity of 1 From q 1 (mod 2 t+1 ) we derive and X i Zn i 2 t+1 1 (mod 2 t+1 ) Hence we have S (k) (1) = i P i 2 t+1 1 (mod 2 t+1 ) «i η(g i + 1) = X «i p p i Z p s i = q 1 2 t+1, X i 2 t+1 1 (mod 2 t+1 ) i Z q 1 { 0 q 1 (mod 2 t+2 ) 1 q t+1 (mod 2 t+2 ). η(g i + 1) = 0. For the other cases 2 t+1 1 < k < 2 t+2 1 analogously.

23 Lemma B On the multiplicity of β Let q 1 = 2r with an integer divisor r. For each r th root of unity β 1, if p 3 (mod 4) we have S(β) 0; if p 1 (mod 4) we have S(β) = 0. Proof: We have S(β) = r 1 h=0 2p 1 j=0 s h+jr β h. Since h + ( jr ) Q for h 0, and for i R ( 1) s i = i p η(g i + 1), we have P 2p 1 2p 1 ( 1) j=0 s h+jr = ( 1) j:h+jr P j=0 h+jr P ( h + jr p ) η(( 1) j g h + 1).

24 On the multiplicity of β-continued By the property of Legendre symbol and quadratic character, the coefficients of β h is 0 over F 2 for h = 1,...,r 1, and that of β 0 is ( 1) p 1 2. Lemma C Let q 1 = 2r with an integer divisor r. For each r th root of unity β 1, if p 1 (mod 4) we have S (1) (β) = 0.

25 On the multiplicity of β-continued By the property of Legendre symbol and quadratic character, the coefficients of β h is 0 over F 2 for h = 1,...,r 1, and that of β 0 is ( 1) p 1 2. Lemma C Let q 1 = 2r with an integer divisor r. For each r th root of unity β 1, if p 1 (mod 4) we have S (1) (β) = 0.

26 Lemma D On the multiplicity of α Let α 1 be a pth root of unity. If p ±3 (mod 8), then S(α) 0; if p ±1 (mod 8), then one half of the pth roots of unity satisfy S(α) = 0 and the other half of roots satisfy S(α) 0. By the property of (non)quadratic residue squares and cyclotomic number. Lemma E Let p ±1 (mod 8). For the half of the pth roots of unity α 1 satisfying S(α) = 0, we also have S (1) (α) = 0 if q 7 (mod 8), and S (1) (α) 0 if q 3 (mod 8).

27 Lemma D On the multiplicity of α Let α 1 be a pth root of unity. If p ±3 (mod 8), then S(α) 0; if p ±1 (mod 8), then one half of the pth roots of unity satisfy S(α) = 0 and the other half of roots satisfy S(α) 0. By the property of (non)quadratic residue squares and cyclotomic number. Lemma E Let p ±1 (mod 8). For the half of the pth roots of unity α 1 satisfying S(α) = 0, we also have S (1) (α) = 0 if q 7 (mod 8), and S (1) (α) 0 if q 3 (mod 8).

28 Factorization of the Generating Polynomial of Legendre-Sidelnikov Sequence We require a simple factorization for x n 1 so that it is possible to determine the linear complexity of the Legendre-Sidelnikov sequence. Now we restrict q to a safe prime, then X n 1 = (X rp 1) 2 = ( (X 1)Φ r (X)Φ p (X)Φ rp (X)) 2. Let γ be a primitive rpth root of unity. Next we need to investigate the multiplicity of γ, which is the most difficult and crucial part for determining the exact linear complexity.

29 Lemma F On the multiplicity of γ Let q = 2r + 1 be a safe prime, r 3, where 2 is a primitive root modulo r. Then we have S(γ) 0. Proof: Note that S(γ) = rp 1 i=0 (s i + s i+rp )γ i. For our case we have 0, i P 1 η(gi +1)+η( g i +1) 2, i R, i + rp R s i + s i+rp = 1 i η(2) p 2, i Q, i + rp R 1 i η(2) p 2, i R, i + rp Q.

30 Lemma F On the multiplicity of γ Let q = 2r + 1 be a safe prime, r 3, where 2 is a primitive root modulo r. Then we have S(γ) 0. Proof: Note that S(γ) = rp 1 i=0 (s i + s i+rp )γ i. For our case we have 0, i P 1 η(gi +1)+η( g i +1) 2, i R, i + rp R s i + s i+rp = 1 i η(2) p 2, i Q, i + rp R 1 i η(2) p 2, i R, i + rp Q.

31 Proof-continued Note that γ can be expressed as γ 1 γ 2, where γ 1 is a primitive rth root of unity, and γ 2 is a primitive pth root of unity. + S(γ) = rp 1 = i=0 i Q,i+rp R rp 1 (s i + s i+rp 1)γ i i=0 rp 1 i=0 i R,i+rp R η(g i + 1) + η( g i + 1) 2 ( ) 1 + i p η(2) γ1 i 2 γi 2 + rp 1 i=0 i R,i+rp Q rp 1 γ1 i γi 2 + i=0 i P γ i 1 γi 2 ( ) 1 + i p η(2) γ1 i 2 γi 2.

32 Proof -Continued Then we obtain ( ) S(γ) = 1 + i p η(2) 2 i Z p r 1 γ2 i + i=1 1 + η(1 g 2i ) γ1 i 2. Finally we have S(γ) F 4 and the conclusion follows.

33 Result on the Linear Complexity-Theorem 1 Theorem 1 The linear complexity of Legendre-Sidelnikov sequences L(S) satisfies: p 1 2p + q 3 2(p 1) p + q 2 L(S) p(q 1) p+2q 5 2 p 1 mod 8 p(q 1) p 3 mod 8 p(q 1) q + 2 p 5 mod 8 p(q 1) p 1 2 p 7 mod 8

34 Experiments Table: The Linear Complexity of Legendre-Sidelnikov Sequences p q g LinearComplexity GivenUpperBound p 1 mod p 3 mod p 5 mod p 7 mod The upper bounds listed in Theorem 1 can be attained as shown in Table. The gap between listed lower bounds and upper bounds remains an open problem.

35 Result on the Linear Complexity-Theorem 2 Theorem 2 Let q = 2r + 1 be a safe prime, r 3, where 2 is a primitive root modulo r. If p 3 (mod 8), then the linear complexity of Legendre-Sidelnikov sequences is L(S) = p(q 1); L(S) = p(q 1) p+1 if p q 7 (mod 8), and L(S) = p(q 1) p 1 2 if p 7 (mod 8), q 3 (mod 8). Note that X rp 1 = (X 1)Φ r (X)Φ p (X)Φ rp (X).

36 Result on the Linear Complexity-Theorem 2 Theorem 2 Let q = 2r + 1 be a safe prime, r 3, where 2 is a primitive root modulo r. If p 3 (mod 8), then the linear complexity of Legendre-Sidelnikov sequences is L(S) = p(q 1); L(S) = p(q 1) p+1 if p q 7 (mod 8), and L(S) = p(q 1) p 1 2 if p 7 (mod 8), q 3 (mod 8). Note that X rp 1 = (X 1)Φ r (X)Φ p (X)Φ rp (X).

37 Result on the Linear Complexity-Theorem 3 Theorem 3 If q = 2 s + 1 is a Fermat prime, then the linear complexity of Legendre-Sidelnikov sequences is L(S) = p(q 1) if p 3 (mod 8), and L(S) = p(q 1) q + 2 if p 5 (mod 8). Note that 1 X n = (1 X p ) 2s = ( (1 X)(1 + X + + X p 1 )) q 1.

38 Result on the Linear Complexity-Theorem 3 Theorem 3 If q = 2 s + 1 is a Fermat prime, then the linear complexity of Legendre-Sidelnikov sequences is L(S) = p(q 1) if p 3 (mod 8), and L(S) = p(q 1) q + 2 if p 5 (mod 8). Note that 1 X n = (1 X p ) 2s = ( (1 X)(1 + X + + X p 1 )) q 1.

39 Result on the Linear Complexity-Choosing Parameters If p = q = 2r (mod 8) are both safe primes, and 2 is a primitive root modulo r, the linear complexity is just the period. For example, 11, 59, 107,...,587, 1019, 1307,... And if p = q = 2r (mod 8) are both safe primes, and 2 is a primitive root modulo r, then the linear complexity of Legendre-Sidelnikov sequences is (p 1) 2. Similarly, 23, 167,... Conjecture: We may remove the condition of 2 being a primitive root modulo r; and determine the exact linear complexity value for more cases.

40 Result on the Linear Complexity-Choosing Parameters If p = q = 2r (mod 8) are both safe primes, and 2 is a primitive root modulo r, the linear complexity is just the period. For example, 11, 59, 107,...,587, 1019, 1307,... And if p = q = 2r (mod 8) are both safe primes, and 2 is a primitive root modulo r, then the linear complexity of Legendre-Sidelnikov sequences is (p 1) 2. Similarly, 23, 167,... Conjecture: We may remove the condition of 2 being a primitive root modulo r; and determine the exact linear complexity value for more cases.

41 References Ding C., Helleseth T., Shan W.: On the linear complexity of Legendre sequences. IEEE Trans. Inf. Theory, 44(3), , (1998). Helleseth T., Yang K.: On binary sequences with period n = p m 1 with optimal autocorrelation. In: SETA 2001, LNCS, Helleseth T., Kumar P., Yang K., eds. pp , Springer, (2002). Jungnickel D.: Finite Fields. BI-Wissenschaftsverlag, Mannheim, (1993). Kyureghyan G. M., Pott A.: On the linear complexity of the Sidelnikov-Lempel-Cohn-Eastman sequences. Des. Codes Cryptogr., 29, , (2003). Lidl R., Niederreiter H.: Finite Fields. Addison-Wesley, Reading, MA, (1983). Meidl W., Winterhof A.: Some notes on the linear complexity of Sidel nikov-lempel-cohn-eastman sequences. Des. Codes Cryptogr., 38(2), , (2006). Su M.: On the Linear Complexity of Legendre-Sidelnikov Sequences, Designs, Codes and Cryptography, Springer published online, /s , (2013). Su M., Winterhof A.: Autocorrelation of Legendre-Sidelnikov sequences. IEEE Trans. Inf. Theory, 56, , (2010). Topuzoğlu A., Winterhof A.: Pseudorandom sequences. Topics in geometry, coding theory and cryptography, Algebr. Appl., 6, Springer, Dordrecht, , (2007).

42 Thank you! vielen Dank!

Binary Sequences with Optimal Autocorrelation

Cunsheng DING, HKUST, Kowloon, HONG KONG, CHINA September 2008 Outline of this talk Difference sets and almost difference sets Cyclotomic classes Introduction of binary sequences with optimal autocorrelation