Linear Approximating to Integer Addition

Transcription

1 Lear Approxmatg to Iteger Addto L A-Pg Bejg 00085, P.R. Cha apl000@a.com Abtract The teger addto ofte appled cpher a a cryptographc mea. I th paper we wll preet ome reult about the lear approxmatg for the teger addto. Keyword : Lear approxmatg, ba, teger addto.

2 . Prelmary For the udecded effect of carry operato the teger addto, t ofte ued a a cryptographc mea ome cpher, for tace, the caddate cpher of estream (The ECRYPT Stream Cpher Project) ome of them employed the combato of the teger addto, XOR ad rotato a ma cryptographc traformato. Therefore, t gfcat to ow the effect of the teger addto cryptography. J. Walle [3] provded a algorthm for computg the correlato of lear approxmato of addto modulo 2. I th paper, we wll how ome explct reult about the lear approxmatg to the teger addto. 2. Some bac reult I th paper, the ymbol a uually tad for XOR operato. Suppoe z a bary egmet of legth, deoted by z [] the -th bt, ad let ( ) [ ] z = z, 0( z) = ( z), ad d( z) = 0( z) ( z), that, ( z) 0 ad ( ) z are the umber of the bt 0 ad bt z repectvely, ad d( z ) the ba of them. Let x ad y be two teger of legth bt, deoted by Lxy (, ) = ( x+ y) ( x y), Lxy (, ) = ( + x+ y) ( x y) We have the followg reult D 2 2 (2 2 L( x, y)[ ])/ 2, xy, 2 2 xy, xy, 2 ( (, ))/ 2., ad defe D = (2 2 L ( x, y)[ ])/ 2, (2.) = D= d L x y Propoto D = /2, 0 <, (2.2) D = /2, 0 <, (2.3) 2 D = 2. (2.4) Proof. It eay to chec drectly D 0 =, o we aume that > 0. For a teger z, deoted by deoted by z the teger formed by the egmet of z from bt 0 to bt. Let w= L( x, y), N the umber of Lxy (, ) wth w [] =. It eay to ow that w [] = 0 f ad

3 oly f x + y < 2, o Hece, N ( ) 2 2 = ( ) 2 = (2 2 )/2. (2.5) < 2 D = =. 2 2 (2 2 N) / 2 / 2 The proof of (.3) mlar to the above, o omtted. It eay to ow that o, D= ( D)/, (2.6) 0 < 2 D= ( 2 )/ = 0 2 <. From Propoto, we have ee that x + y tll ome le x y o the bt tattc, epecally for the frt bt, though there are udecded carry operato the addto. I other word, the probablty ( x + y)[ ] = ( x y)[ ] ha otable advatage whe mall, e.g. = 0,, 2,, etc. I the followg, we wll how a more geeral reult o the lear approxmatg to the teger addto. Suppoe that z a teger varable over the doma Ω, deoted by δ ( z) = z[ ] ad defe Δ z = ( Ω 2 δ ( z)) / Ω. (2.7) z Ω Moreover, for a cotat teger c, deoted by C { c[ ] } = =. Suppoe the C = { }, > > >, a uual, C repreet the cardalty of et C,.e. C =, ad defe 2 C =. ( ) Propoto 2 Suppoe that c a cotat teger, deoted by L = L( x, y)& c ad c L = L ( x, y)& c, we have c C Δ = /2, Δ Lc L c = C C ( ) /2, (2.8) Proof. We prove the formula (2.8) by the ducto o C. By the Propoto, we have

4 ow the formula (2.8) true whe =. Now aume t true the cae. We coder the frt + bt, deoted by N 0 ad N the umber of the par ( x, y) of + -bt teger uch that x y < ad x y 2 + +, we have ow that whch are equal the umber of the par ( x, y) wth that Lxy (, )[ + ] = 0 ad repectvely ad N = (2 + )2, N = (2 )2. (2.9) Deote j, = +, ad C = { j }, the we apply the ducto o the et C, that, o the egmet of teger begg the + -th bt, we have So, C Δ = /2, Δ L c C = ( ) /2, Δ = 2 { N ( +Δ /2) + N ( + ( ) Δ /2)} 2 + Lc 0 2 { N ( Δ /2) + N ( ( ) Δ /2)} = 2 ( N + ( ) N ) Δ = (( + ( ) ) / ( + ( ) ) / 2) ΔL c ( + ( ) ) + / 2 = 2 Δ = 2 ( ( ) j + ( + ( ) ) + /2) = 2 ( ) + ( ( ) ) + / 2 ( + ( ) ) + / 2 = 2 ( ) + ( ( ) ) + / 2 ( + ( ) ) + / 2 ( ) + = 2. The proof for the ecod formula of (2.8) mlar to the above, o omtted. I the ome real cae, t poble to come to the partal cae, that, Lxy (, ) = ( x+ y) ( x y) the varable y = a a cotat. Let c be a cotat, deoted by L = L( x, a)& c, we defe c φ ( ac, ) = δ( L), φ ( ac, ) = 2 φ ( ac, ). (2.0) c 0 0 x< 2 Moreover, let Φ ( ac, ) = ( φ0( ac, ), φ( ac, )). We wll mply wrte them a Φ, φ ad 0 φ

5 f the parameter are clear from the cotext, I the followg we wll maly calculate the Φ ( ac, ). Suppoe that A= { a[] = } ad C = { c[] = }, that, A ad C are the et of the poto of bt of the cotat a ad c repectvely. Wthout lo the geeralty, we aume that A C = AC AC AC (2.) 2 2, whch the arragemet of A ad C the order from mall to large, where A= A, C = C. I th paper we retrct the cae A C =. Deoted by a the egmet of the teger a formed by A to A. Let α be the mallet elemet of A but α t α = 0, α + =, ad = α+ α,, χ( A ) = 2 2. Suppoe C = { x} 0, x x x we defe 0 < < <, Lemma If =, the 0 j t A j x ( C ) ( ) 2 j α+ =, τ ( C) = 2 ( C). (2.2) φ ( ac, ) = a τ ( C). (2.3) Proof. It clear that the umber φ ( ac, ) the umber of Lxawth (, ) odd carre the poto of cotat c. Suppoe that C = { x} 0, x0 < x < < x, deoted by N r the umber of Lxawth (, ) r carre the poto of cotat c. It ot dffcult to ow that the r carre mut appear the frt r poto of C,.e. x0 < x, < < xr hece t eay to have N r = a ( xr xr ) xr (2 ) 2 = a xr xr (2 2 ). (2.4) Therefore, φ τ. (2.5) x2 x2+ ( ac, ) = N + 2 = a (2 2 ) = a ( C) 0 2 For two vector v = ( x, y), v2 = ( u, w), we defe

6 v v2 = ( xu + yw, xw + yu). (2.6) ad for 2-vector ( x, y ), we defe T( x, y) = ( y, x). Let pac (, ) = δ ( Lc ), 2 a x< 2 qac (, ) = a pac (, ), ad Γ ( ac, ) = ( qac (, ), pac (, )). Deoted by I = 2, ad for the α teger,0 <, let = 2 +, a I & a, I α = a + = 2 a, ad c = I & c. Moreover, deoted by λ = C. Lemma 2 Γ ( ac, ) = T ( ( A ) Φ( a, c )), (2.7) λ χ + where t aumed that Φ ( a0, c0) = (,0). Proof. Let z be the teger of legth uch that z x+ a mod(2 ), ad a = 2 a, hece t ha x= z+ a mod(2 ), o Lax (, ) = z ( a+ z) a= z ( a+ z) a ( a a) = Lza (, ) ( a a), Deoted by I = a a, uppoe that α = m{ t t A}, the t eay to ow I α + =. Thu t ha, Hece, 2 2 Deoted by L( a, x)& c= ( L( z, a) I )& c= ( L( z, a)& c) c. p( ac, ) = δ ( Lza (, )& c) δ ( c). (2.8) 0 z< a p[] = δ ( L(, z a)& c), q[] = a p[] ad Γ [] = ([], q p[]), from 0 z< a (2.8) we ow that order to prove (2.7) t uffce to prove Γ ( ac, ) = χ( A + ) Φ( a, c ). (2.9) < It eay to ow that the bt of Lza (, ) excel over a + zafter A all are, o t follow that A wll be 0 for the bt of a ad L(, z a)& c= L(, z a)& c We dvde the a teger the terval [0, a) to χ ( ) + clae S,0 χ( A ), a A

7 α teger z belog to S ff z >> = ( A). It clear that for α =, 2,, χ( A ), S = 2, ad S0 = a. Hece we have z S z S0 0 z< a The equato above ca be wrtte a χ δ( Lza (, )& c) = δ( Lza (, )& c ) = φ ( a, c ), for> 0, z S δ( Lza (, )& c) = δ( Lza (, )& c ) = p [ ] χ Γ [] = ( A ) Φ ( a, c ) +Γ[ ] (2.20). So, the equato (2.9) wll be followed by the ducto. For each teger,, deoted by d = χ( A ) τ ( C ), ζ = (2 d, d ), Moreover, let p( a ) ad qa ( ) be defed a the Lemma 2 ad deoted by e = τ ( C) ( qa ( ) pa ( )), σ = ( e, e), ad aumg that σ 0 = (, 0), σ = (0, 0), ad ζ + = (, 0), the we have Propoto 3 If A C =, Φ ( ac, ) = ( σ ζ ), (2.2) 0 < + Proof. We wll apply the ducto o. From Lemma, we ca ow that the Propoto 3 true for =. Coder the teger of legth α, by the ducto we have ( φ [ ], φ[ ]) ( σ ζ ). = 0 0 < I the cae, t clear that there are a teger that wll carry the poto α, whch are 2 a,2 a +,,2. Suppoe that thee a teger there are α α α p [ ] oe φ [ ] ad q [ ] oe φ 0 [ ] repectvely. Coder the lat egmet of teger from the a = a a, c = c c α -bt to the ed, let a ad c be defed a the above ad, ad deoted by N 0 ad N the umber of the egmet Lxa (, )& c wth eve ad odd bt repectvely, by Lemma, we ow

8 Let 0 N = χ( A ) τ( C ) = d, N = 2 d. 0 N = ( χ( A ) + ) τ( C ), N = 2 N, t ha, φ [ ] = ( φ [ ] q[ ]) N + ( φ[ ] p[ ]) N + N q[ ] + N p[ ] = φ [ ] N + φ[ ] N + ( q [ ] p [ ]) τ( C) 0 0 = Im( ( σ ζ )). 0 < + Where Im( x, y) = y. A a example, the cae = 2, φ ( ac, ) = d 2 + d 2 2 d d + ( ) a τ( C). 2 C The cae A C may be treated a mlar way but wll requre a lttle more coderato to et A C = B ad a the frt tep to calculate the cae of a bloc ABC, the detal dcuo omtted. 3. Cocluo We hope that thee reult preeted here wll be ueful the deg ad cryptaaly of cpher the future, the reult of Propoto were oce appeared the paper [] ad [2]. Referece [] L A-Pg, Lear approxmatg for the cpher Sala20, avalable at [2] L A-Pg, Lear approxmatg for the cpher Sala20 (II), avalable at [3] J. Walle, Lear Approxmato of Addto Modulo 2, Fat Software Ecrypto FSE 2003, LNCS v. 288, pp , Sprger-Verlag, 2003.