1.
Introduction
The linear complexity and the k-error linear complexity are important cryptographic characteristics of stream cipher sequences. The linear complexity of an N-periodic sequence s={su}∞u=0, denoted by LC(s), is defined as the length of the shortest linear feedback shift register (LFSR) that generates it [1]. With the Berlekamp-Massey (B-M) algorithm [2], if LC(s)≥N/2, then s is regarded as a good sequence with respect to its linear complexity. For an integer k≥0, the k-error linear complexity LCk(s) is the smallest linear complexity that can be obtained by changing at most k terms of s in the first period and periodically continued [3]. The cryptographic background of the k-error linear complexity is that some key streams with large linear complexity can be approximated by some sequences with much lower linear complexity [2]. For a sequence to be cryptographically strong, its linear complexity should be large enough, and its k-error linear complexity should be close to the linear complexity.
The relationship between the linear complexity and the DFT of the sequence was given by Blahut in [4]. Let m be the order of 2 modulo an odd number N. For a primitive N-th root β∈F2m of unity, the DFT of s is defined by
Then
where WH(A) is the hamming weight of the sequence A. The polynomial
is called the Mattson-Solomon polynomial (M-S polynomial) of s [5]. It can be deduced from Eqs (1.2)and (1.3) that the linear complexity of s is equal to the number of the nonzero terms of G(X), namely
By the inverse DFT,
There are many studies about two-prime generators. In 1997–1998, Ding calculated the linear complexity and the autocorrelation values of binary Whiteman generalized cyclotomic sequences of order two [6,7]. In 2013, Li defined a new generalized cyclotomic sequence of order two of length pq, which is based on Whiteman generalized cyclotomic classes, and calculated its linear complexity [8]. In 2015, Wei determined the k-error linear complexity of Legendre sequences for k=1,2 [9]. In 2018, Hofer and Winterhof studied the 2-adic complexity of the two-prime generator of period pq [10]. Alecu and Sălăgean transformed the optimisation problem of finding the k-error linear complexity of a sequence into an optimisation problem in the DFT domain, by using Blahut's theorem in the same year [11]. In 2019, in terms of the DFT, Chen and Wu discussed the k-error linear complexity for Legendre, Ding-Helleseth-Lam, and Hall's sextic residue sequences of odd prime period p [12]. In 2020, Zhou and Liu presented a type of binary sequences based on a general two-prime generalized cyclotomy, and derived their minimal polynomial and linear complexity [13]. In 2021, the autocorrelation distribution and the 2-adic complexity of generalized cyclotomic binary sequences of order 2 with period pq were determined by Jing [14].
This paper is organized as follows. Firstly, we present some preliminaries about Whiteman generalized cyclotomic classes and the linear complexity in Section 2. In Section 3, we give main results about the linear complexity of Whiteman generalized cyclotomic sequences of order two. In Section 4, we give the 1-error linear complexity of these sequences. At last, we conclude this paper in Section 5.
2.
Preliminaries
Let p and q be two distinct odd primes with gcd(p−1,q−1)=2, and N=pq, e=(p−1)(q−1)/2. By the Chinese Remainder Theorem, there is a fixed common primitive root g of both p and q such that ordN(g)=e. Let x be an integer satisfying
Then the set
for i=0,1 is called a Whiteman generalized cyclotomic class of order two [15].
As pointed out in [14], the unit group of the ring ZN is
Let P={p,2p,⋯,(q−1)p}, Q={q,2q,⋯,(p−1)q} and R={0}. Then ZN=Z∗N∪P∪Q∪R. The sequence s(a,b,c)={su}∞u=0 over F2 is defined by
where (⋅⋅) denotes the Legendre symbol and a,b,c∈F2 [14].
Lemma 2.1. [7] −1∈D1, if |p−q|/2 is odd; and −1∈D0, if |p−q|/2 is even.
Lemma 2.2. [6]
Lemma 2.3. [6] (1) If a∈P, then aP=P and aQ=R.
(2) If a∈Q, then aP=R and aQ=Q.
(3) If a∈Di, then aP=P, aQ=Q, and aDj=D(i+j)mod2, where i,j=0,1.
It was shown in [6] that, for a primitive N-th root β∈F2m of unity, we have
and
Lemma 2.4. [6]
Actually, if p≡−1(mod8) or p≡3(mod8), then (p−1)/2=1; if p≡1(mod8) or p≡−3(mod8), then (p−1)/2=0. By symmetry, if q≡−1(mod8) or q≡3(mod8), then (q−1)/2=1; if q≡1(mod8) or q≡−3(mod8), then (q−1)/2=0.
Lemma 2.5. Define
Then for β, we have D0(β)=0 and D1(β)=1 if 2∈D0; D0(β)=ω and D1(β)=1+ω if 2∈D1, where ω∈F4∖F2.
Proof. (1) If 2∈D0, by Lemma 2.3 we have
(2) If 2∈D1, by Lemma 2.3 we have
Hence Di(β)∈F4∖F2.
And by Eq (2.1), we have D0(β)≠D1(β) and D0(β)+D1(β)=1. Assume that D0(β)=0, D1(β)=1 for 2∈D0, and D0(β)=ω, D1(β)=1+ω for 2∈D1, where ω∈F4∖F2.
3.
The linear complexity of s(a,b,c)
Let LC(s(a,b,c)) be the linear complexity of s(a,b,c), and the other symbols be the same as before.
Theorem 3.1. Let p≡v(mod8) and q≡w(mod8), where v,w=±1,±3. Then the linear complexity of s(a,b,c) respect to different values of p and q is as shown as Table 1.
Proof. We provide the process of calculating LC(s(0,0,0)) when v=−1 and w=−3, and can prove other cases in a similar way.
By Lemmas 2.1–2.3 and Eq (1.1), we have −1∈D1, 2∈D1, then
and ρ0=0. By Eq (1.3), we have
Let t=iu. Then by Lemmas 2.3–2.5, we have
By Eq (1.4) we can get the linear complexity of s(0,0,0) as
Actually, the linear complexity of s(1,0,0) was studied by Ding in [6] with its minimal polynomial.
4.
The 1-error linear complexity of s(a,b,c)
Let LCk(s(a,b,c)) be the k-error linear complexity of s(a,b,c), ˜s={˜su}∞u=0 be the new sequence obtained by changing at most k terms of s, that ˜s=s+e, where e={eu}∞u=0 is an error sequence of period N. Ding has provided in [2] that, the k-error linear complexity of a sequence can be expressed as
It is clearly that LC0(s)=LC(s) and
where l=WH(s).
Let G(X), Gk(X) and ˜G(X) be the M-S polynomials of s, e and ˜s respectively. Note that
where ρi, ηi and ξi are the DFTs of s, e and ˜s respectively. By Eqs (1.5), (4.1) and (4.2), we have ˜G(X)=G(X)+Gk(X), then
Assume that eu0=1 for 0≤u0≤N−1 and eu=0 for u≠u0 in the first period of e. Then the DFT of e is
Specially, if u0=0, then ηi=1 for all 0≤i≤N−1; otherwise, η0=1 and the order of ηi is N for 1≤i≤N−1.
Theorem 4.1. Let p≡v(mod8) and q≡w(mod8), where v,w=±1,±3, and the other symbols be the same as before. Then the 1-error linear complexity of s(a,b,c) is as shown as Table 2.
Proof. We consider the case v=−1,w=−3 for LC1(s(0,0,0)). By Lemmas 2.1–2.5 and Eq (1.1), we have −1∈D1, 2∈D1 and
Then by Eq (4.2), we can get
According to Lemma 2.3, we can get the following results.
(1) If u0=0, then
(2) If u0∈Q, then
(3) If u0∈D0 or u0∈D1 or u0∈P, then
Compare the results of Cases (1)–(3) with LC(s(0,0,0))=pq−p. If p>q, then pq−p<pq−q+1<pq; if p<q, then pq−q+1<pq−p<pq. Hence
Similarly we can prove the other cases for LC1(s(a,b,c)).
All results of LC(s(a,b,c)) and LC1(s(a,b,c)) in Sections 3 and 4 have been tested by MAGMA program.
5.
Conclusions
The purpose of this paper is to determine the linear complexity and the 1-error linear complexity of s(a,b,c). In most of the cases, s(a,b,c) possesses high linear complexity, namely LC(s(a,b,c))>N/2, consequently has decent stability against 1-bit error. Notice that the linear complexity of some of the sequences above is close to N/2. Then the sequences can be selected to construct cyclic codes by their minimal generating polynomials with the method introduced by Ding [16].
Acknowledgments
This work was supported by Fundamental Research Funds for the Central Universities (No. 20CX05012A), the Major Scientific and Technological Projects of CNPC under Grant (No. ZD2019-183-008), the National Natural Science Foundation of China (Nos. 61902429, 11775306) and Shandong Provincial Natural Science Foundation of China (ZR2019MF070).
Conflict of interest
The authors declare that they have no conflicts of interest.