Constructing Sequences from Algebraic Curvescage.ugent.be/~ml/irsee5/slides/Ozbudak.pdf · Constructing Sequences from Algebraic Curves Olav Geil 3, Ferruh Ozbudak 1;2, Diego Ruano

logo2

Introduction Construction and the Main Result Comparison of the Bounds

Constructing Sequences from Algebraic Curves

Olav Geil3, Ferruh Ozbudak1,2, Diego Ruano3

1 Department of Mathematics and 2 Institute of Applied MathematicsMiddle East Technical University

Ankara, Turkey3 Department of Mathematical Sciences

Aalborg UniversityAalborg, Denmark

Finite Geometries Fifth Irsee Conference, September 2017

logo2


Outline

1 IntroductionSequence Background

2 Construction and the Main ResultConstruction

3 Comparison of the Bounds

logo2


Outline




logo2


Outline




logo2


Sequences over finite fields from the complexity-theoreticstandpoint have many applications in cryptography andpseudorandom number generation1,2,3,4.

1C. Ding, G. Xiao, W. Shan: The satibility theory of stream ciphers, LectureNotes in Computer Science, 561, ISBN 3-540-549973-0, 1991.

2W. Meidl, A. Winterhof: Linear complexity of sequences andmultisequences, In Handbook of Finite Fields (editors: G. L. Mullen, D.Panario), ISBN: 9781439873786, 2013.

3H. Niederreiter: Random number generation and quasi-Mionte Carlomethods, SIAM, ISBN: 0-89871-295-5, 2002.

4R. A. Rueppel: Stream Ciphers, Comtemporary cryptography, IEEE, NewYork, 65-134, 1992.

logo2


There are many results on linear complexity of sequences overfinite fields.

Recently there have been interesting results in the nonlinearcomplexity of sequences5,6.

They use the notion of k−th order nonlinear complexity asdefined in the next slide.

5W. Meidl, H. Niederreiter: Multiseqeunces with high joint lonlinearcomplexity, Designs, Codes and Cryptography, 81, 337-346, 2016.

6H. Niederreiter, C. Xing: Sequences with high nonlinear complexity, IEEETransaction on Information Theory, 60, 6696-6701, 2014.

logo2







logo2







logo2


Definition 1

Let s = (s1, s2, . . . , sn) be a sequence of length n ≥ 1 over the finitefield Fq and let k ∈ N. If si = 0 for all 1 ≤ i ≤ n, then we definethe k−th order nonlinear complexity Nk(s) to be 0. Otherwise letNk(s) be the smallest m ∈ N for which there exists a polynomialf ∈ Fq[x1, . . . , xm] of degree at most k in each variable such that

si+m = f (si , si+1, . . . , si+m−1) for 1 ≤ i ≤ n −m.

logo2


Our Contribution

In7, among other results, they gave a construction ofsequences with high nonlinear complexity using Hermitianfunction field. As we use Hermitian function field over Fq2 , itsuits better to consider sequences over Fq2 in thispresentation.

They also construct a long sequence of length (q − 1)(q2 − 1)over Fq2 with high nonlinear complexity. Their main tools arean explicit automorphism of the Hermitian function field andRiemann-Roch theorem.


logo2


Our Contribution

In7, among other results, they gave a construction ofsequences with high nonlinear complexity using Hermitianfunction field. As we use Hermitian function field over Fq2 , itsuits better to consider sequences over Fq2 in thispresentation.

They also construct a long sequence of length (q − 1)(q2 − 1)over Fq2 with high nonlinear complexity. Their main tools arean explicit automorphism of the Hermitian function field andRiemann-Roch theorem.


logo2


In the rest of this presentation [N-X] refers to the paper:

H. Niederreiter, C. Xing: Sequences with high nonlinear complexity,IEEE Transaction on Information Theory, 60, 6696-6701, 2014.

logo2


We use a similar approach, however we use Weierstrasssemigroup of pairs of distinct rational places of the Hermitianfunction field instead of using Riemann-Roch theorem directly.Thereby we improve Theorem 3 and Theorem 4 of [N-X]considerably in our main results.

We use the language of algebraic function fields, which isessentially equivalent to the language of algebraic curves.

For the sake of simplicity we use the term rational placeinstead of place of degree one throughout the paper.

Let H denote the Hermitian function field

H = Fq2(x , y) with yq + y = xq+1.

Recall that Fq2 is the full constant field of H. Moreover H has

q3 + 1 distinct rational places and its genus isq(q + 1)

2.

logo2









2.

logo2









2.

logo2









2.

logo2


Construction

Let θ ∈ F?q2 be a generator of the multiplicative group of F?

q2 .Let φ : H → H be the automorphism of H fixing Fq2 definedas

φ : H → Hx 7→ θxy 7→ θq+1y .

(1)

Note that φ(q2−1) = ι, where ι is the identity automorphism

of H. Let P∞ be the rational place of H corresponding to thecommon pole of x and y .

It is clear that φ fixes P∞. The action of φ on the rationalplaces of H is well-known8.

8A. Garcia, H. Stichtenoth, C. Xing: On subfields of the Hermitian functionfield, Compositio Math. 120, 137-170, 2000.

logo2


Construction



φ : H → Hx 7→ θxy 7→ θq+1y .

(1)





logo2


Construction



φ : H → Hx 7→ θxy 7→ θq+1y .

(1)





logo2


In particular, there exist distinct rational placesQ,P1,P2, . . . ,Pq−1 different from P∞ such that their orbitsunder φ are distinct and having length equal to q2 − 1.

The following is a partial list of distinct orbits of the rationalplaces of H under φ:

P∞Q, φ(Q), . . . , φ(q

2−2)(Q)

P1, φ(P1), . . . , φ(q2−2)(P1)

...Pq−1, φ(Pq−1), . . . , φ(q

2−2)(Pq−1).

The union of these orbits form 1 + q(q2 − 1) = q3 − q + 1distinct rational places. We do not use the remaining of qrational places. We fix the notation of these rational places.

logo2




P∞Q, φ(Q), . . . , φ(q

2−2)(Q)

P1, φ(P1), . . . , φ(q2−2)(P1)

...Pq−1, φ(Pq−1), . . . , φ(q

2−2)(Pq−1).


logo2




P∞Q, φ(Q), . . . , φ(q

2−2)(Q)

P1, φ(P1), . . . , φ(q2−2)(P1)

...Pq−1, φ(Pq−1), . . . , φ(q

2−2)(Pq−1).


logo2


The following proposition is crucial for our construction. Weneed to use certain facts from the theory of Weierstrass pairsof rational places of the Hermitian function field H in itsproof9,10.

Proposition 2

Under notation and assumptions as above there exists h ∈ H suchthat its pole divisor satisfies

(h)∞ = (q − 1)P∞ + (q − 1)Q.

We also fix h and use it in our construction below.

9A. Garcia, S. J. Kim, R. F. Lax: Consecutive Weierstrass gaps andminimum distance of Goppa codes: J. Pure and Appl. Algebra, 84, 199-207,1993.

10G. L. Matthews: Weierstrass semigroups and codes from a quotient of theHermitian curves: Designs, Codes and Cryptography, 37, 473-492, 2005.

logo2


Remark 1

The main difference of our construction with the correspondingconstruction of Niederreiter and Xing in [N-X] is as follows. Usingonly Riemann-Roch Theorem in their paper, they obtain existenceof f ∈ H such that its pole divisor satisfies

(f )∞ = (2g − 1)P∞ + Q,

where g is the genusq(q − 1)

2of H. It turns out that using h as in

Proposition 2 instead of f gives a construction with much highernonlinear complexity lower bound. Note that existence of h as inProposition 2 does not follow from Riemann-Roch Theoremdirectly and it requires more knowledge on the geometricstructures of the Hermitian function field H.

logo2


We are ready to present our construction.

Construction 1

Under notation and construction as above let M = (q − 1)(q2 − 1)and s = (s1, . . . , sM) be a sequence of length M with terms in Fq2

defined as

s1 = h(P1), s2 = h(φ(P1)), · · · , sq2−1 = h(φ(q

2−2)(P1)),

sq2 = h(P2), sq2+1 = h(φ(P2)), · · · , s2(q2−1) = h(φ(q

2−2)(P2)),

s2q2−1 = h(P3), s2q2 = h(φ(P3)), · · · , s3(q2−1) = h(φ(q

2−2)(P3)),

· · ·s(q−2)(q2−1)+1 = h(Pq−1), · · · , s(q−1)(q2−1) = h

(φ(q

2−2)(Pq−1)).

Namely for 0 ≤ i ≤ q − 2 and 1 ≤ i ≤ q2 − 1 we have

siq+j = h(φ(j−1)(Pi+1)

).

logo2


We are ready to present our construction.

Construction 1

Under notation and construction as above let M = (q − 1)(q2 − 1)and s = (s1, . . . , sM) be a sequence of length M with terms in Fq2

defined as

s1 = h(P1), s2 = h(φ(P1)), · · · , sq2−1 = h(φ(q

2−2)(P1)),

sq2 = h(P2), sq2+1 = h(φ(P2)), · · · , s2(q2−1) = h(φ(q

2−2)(P2)),

s2q2−1 = h(P3), s2q2 = h(φ(P3)), · · · , s3(q2−1) = h(φ(q

2−2)(P3)),

· · ·s(q−2)(q2−1)+1 = h(Pq−1), · · · , s(q−1)(q2−1) = h

(φ(q

2−2)(Pq−1)).

Namely for 0 ≤ i ≤ q − 2 and 1 ≤ i ≤ q2 − 1 we have

siq+j = h(φ(j−1)(Pi+1)

).

logo2


Results

The following is our first result.

Theorem 3

Under notation and assumptions as above, let1 ≤ n ≤ M = (q − 1)(q2 − 1) be an integer and consider the initialsequence sn = (s1, s2, . . . , sn) of the sequence s constructed inConstruction 1 above. For any integer 1 ≤ k ≤ q2 − 1, we have

N(k)(sn) ≥b nq2−1c(q

2 − 1)− (q − 1)

b nq2−1c+ 2k(q − 1)

(2)

for the k−th order nonlinear complexity.

logo2


Remark 2

Theorem 3 gives a much improved lower bound on N(k)(sn)compared to the lower bound of Theorem 3 in [N-X] for allparameters. Recall that they construct a sequence t usingHermitian function field of length M = (q − 1)(q2 − 1) with termsin Fq2 . For their initial sequence tn with 1 ≤ n ≤ M, the lowerbound of Theorem 3 in [N-X] is

N(k)(tn) ≥b nq2−1c(q

2 − 1)− 1

b nq2−1c+ q(q − 1)k

. (3)

We compare (2) and (3) using some figures later in thispresentation.

The following is a direct corollary of Theorem 3 using the fact thatN(k)(sn) is an integer.

logo2


Corollary 4

Under the notation and assumptions as in Theorem 3, for anyinteger 1 ≤ k ≤ q2 − 1 we have

N(k)(sn) ≥

⌈b nq2−1c(q

2 − 1)− (q − 1)

b nq2−1c+ 2k(q − 1)

⌉. (4)

Remark 3

Similarly the lower bound of Theorem in [N-X] has a directimprovement. Namely under notation and assumptions as inRemark 2 we have

N(k)(sn) ≥

⌈b nq2−1c(q

2 − 1)− 1

b nq2−1c+ q(q − 1)k

⌉. (5)

For comparison of (4) and (5) we also refer to figures later in thispresentation.

logo2


Corollary 4


N(k)(sn) ≥

⌈b nq2−1c(q

2 − 1)− (q − 1)

b nq2−1c+ 2k(q − 1)

⌉. (4)

Remark 3

Similarly the lower bound of Theorem in [N-X] has a directimprovement. Namely under notation and assumptions as inRemark 2 we have

N(k)(sn) ≥

⌈b nq2−1c(q

2 − 1)− 1

b nq2−1c+ q(q − 1)k

⌉. (5)

For comparison of (4) and (5) we also refer to figures later in thispresentation.

logo2


The nonlinear complexity notion of Definition 1 is the mainnonlinear complexity notion used, for example, in11,12.

Moreover in [N-X] they also use a modified notion fornonlinear complexity, denoted as Lk(s) instead of Nk(s)

The difference is that the condition “of degree at most k ineach variable” in Nk(s) is replaced with the condition “oftotal degree at most k” in Lk(s). For the sake of clarity weformally give its definition in the next slide.


12H. Niederreiter, C. Xing:Sequences with high nonlinear complexity, IEEETransaction on Information Theory, 60, 6696-6701, 2014.

logo2


Definition 5

Let s = (s1, s2, . . . , sn) be a sequence of length n ≥ 1 over thefinite field Fq and let k ∈ N. If si = 0 for all 1 ≤ i ≤ n, then wedefine the k−th order nonlinear complexity Lk(s) to be 0.Otherwise let Lk(s) be the smallest m ∈ N for which there exists apolynomial f ∈ Fq[x1, . . . , xm] of total degree at most k such that

si+m = f (si , si+1, . . . , si+m−1) for 1 ≤ i ≤ n −m.

logo2


Note that our construction gives sequences over Fq2 andhence our statements in our results are over Fq2 , although weformally present Definition 1 and Definition 5 over Fq.

The following is our second result.

Theorem 6

Under assumptions above, let 1 ≤ n ≤ M = (q − 1)(q2 − 1) be aninteger and consider the initial sequence sn = (s1, s2, . . . , sn) of thesequence s constructed in Construction 1 above. For any integer1 ≤ k ≤ q2 − 1, we have

L(k)(sn) ≥b nq2−1c(q

2 − 1)− (k + 1)(q − 1)

b nq2−1c+ k(q − 1)

(6)


logo2


Note that our construction gives sequences over Fq2 andhence our statements in our results are over Fq2 , although weformally present Definition 1 and Definition 5 over Fq.

The following is our second result.

Theorem 6

Under assumptions above, let 1 ≤ n ≤ M = (q − 1)(q2 − 1) be aninteger and consider the initial sequence sn = (s1, s2, . . . , sn) of thesequence s constructed in Construction 1 above. For any integer1 ≤ k ≤ q2 − 1, we have

L(k)(sn) ≥b nq2−1c(q

2 − 1)− (k + 1)(q − 1)

b nq2−1c+ k(q − 1)

(6)


logo2


Remark 4

It is trivial that Lk(s) ≥ Nk(s) for all k . We remark that Theorem6 gives a better bound then using the bound of Theorem 3 and thefact Lk(s) ≥ Nk(s). This is the same phenomenon that happenedin Theorem 3 and Theorem 4 of [N-X] , which also uses Hermitianfunction fields.

Remark 5

The lower bounds on Nk(s) and Lk(s) are important for allintegers 1 ≤ k ≤ q2 − 1 as s is a sequence over Fq2 .

logo2


Remark 4

It is trivial that Lk(s) ≥ Nk(s) for all k . We remark that Theorem6 gives a better bound then using the bound of Theorem 3 and thefact Lk(s) ≥ Nk(s). This is the same phenomenon that happenedin Theorem 3 and Theorem 4 of [N-X] , which also uses Hermitianfunction fields.

Remark 5

The lower bounds on Nk(s) and Lk(s) are important for allintegers 1 ≤ k ≤ q2 − 1 as s is a sequence over Fq2 .

logo2


Remark 6

Theorem 6 gives an improved lower bound on Lk(s) compared tothe bound of Theorem 4 of [N-X] for relatively large k or small n.Under the notation of Remark 2 for the sequence t theyconstructed in [N-X] using Hermitian function field, the lowerbound of Theorem 4 of [N-X] is

L(k)(tn) ≥b nq2−1c(q

2 − 1)− (q2 − q − 1)k − 1

b nq2−1c+ k

. (7)

We also compare (6) and (7) using some figures later in thispresentation.

logo2


Similarly to the situation above, the following is a direct corollaryof Theorem 6 using the fact that L(k)(sn) is an integer.

Corollary 7


L(k)(sn) ≥

⌈b nq2−1c(q

2 − 1)− (k + 1)(q − 1)

b nq2−1c+ k(q − 1)

⌉. (8)

logo2


Similarly to the situation above, the following is a direct corollaryof Theorem 6 using the fact that L(k)(sn) is an integer.

Corollary 7


L(k)(sn) ≥

⌈b nq2−1c(q

2 − 1)− (k + 1)(q − 1)

b nq2−1c+ k(q − 1)

⌉. (8)

logo2


Remark 7

Again, the lower bound of Theorem 3 in [N-X] has a directimprovement. Namely under notation and assumptions as inRemark 6 we have

L(k)(sn) ≥

⌈b nq2−1c(q

2 − 1)− (q2 − q − 1)k − 1

b nq2−1c+ k

⌉. (9)

For comparison of (8) and (9) we also refer to Section 3 below.

logo2


Comparison of the Bounds

In this section we compare Construction 1 in this paper withthe construction corresponding Theorem 3 and Theorem 4 of[N-X].

For an integer 1 ≤ r ≤ (q − 1), Construction 1 gives asequence s of length (q − 1)(q2 − 1) with terms in Fq2 such

that if b n

q2 − 1c = r , then for the initial sequence sn we have

(see Theorem 3 above)

Nk(sn) ≥ B1(r) =r(q2 − 1)− (q − 1)

r + 2k(q − 1). (10)

logo2





that if b n



Nk(sn) ≥ B1(r) =r(q2 − 1)− (q − 1)

r + 2k(q − 1). (10)

logo2





that if b n



Nk(sn) ≥ B1(r) =r(q2 − 1)− (q − 1)

r + 2k(q − 1). (10)

logo2


Similarly the construction corresponding to Theorem 3 in[N-X] gives a sequence t of length (q − 1)(q2 − 1) with terms

in Fq2 such that if b n

q2 − 1c = r , then for initial sequence sn

we have

Nk(tn) ≥ B2(r) =r(q2 − 1)− 1

r + q(q − 1)k. (11)

In Figures 1, 2, 3, 4 below we compare B1(r) in (10) andB2(r) in (11) for k = 5, 10, 20, 30, respectively. Moreover rruns through 1 ≤ r ≤ q − 1 with q = 32 in these figures.

It is clear that Construction 1 gives large improvements innonlinear complexity bounds compared to [N-X].

Note that dB1(r)e is also much larger than dB2(r)e asobserved in Figures 1, 2, 3, 4 below.

Hence Corollary 4 is also much better than the directimprovement of Theorem 3 in [N-X] given in Remark 3 above.

logo2


Figure 1

logo2


Figure 2

logo2


Figure 3

logo2


Figure 4

logo2


Similarly by Theorem 6 we have

Lk(sn) ≥ C1(r) =r(q2 − 1)− (k + 1)(q − 1)

r + k(q − 1), (12)

and Theorem 4 in [N-X] gives

Lk(tn) ≥ C2(r) =r(q2 − 1)− (q2 − q − 1)− 1

r + k. (13)

In Figures 5, 6, 7, 8 below we compare C1(r) in (12) andC2(r) in (13) for k = 5, 10, 20, 30, respectively. Again r runsthrough 1 ≤ r ≤ q − 1 with q = 32 in these figures.

It is clear that Construction 1 gives improvements in nonlinearcomplexity bounds compared to Theorem 4 in [N-X] forrelatively large k or small n.

Note that dC1(r)e gives the same improvements compared todC2(r)e as observed in Figures 5, 6, 7, 8 below. HenceCorollary 7 is also an improvement of Theorem 4 in [N-X]given in Remark 7 above.

logo2


Similarly by Theorem 6 we have

Lk(sn) ≥ C1(r) =r(q2 − 1)− (k + 1)(q − 1)

r + k(q − 1), (12)

and Theorem 4 in [N-X] gives

Lk(tn) ≥ C2(r) =r(q2 − 1)− (q2 − q − 1)− 1

r + k. (13)

In Figures 5, 6, 7, 8 below we compare C1(r) in (12) andC2(r) in (13) for k = 5, 10, 20, 30, respectively. Again r runsthrough 1 ≤ r ≤ q − 1 with q = 32 in these figures.

It is clear that Construction 1 gives improvements in nonlinearcomplexity bounds compared to Theorem 4 in [N-X] forrelatively large k or small n.

Note that dC1(r)e gives the same improvements compared todC2(r)e as observed in Figures 5, 6, 7, 8 below. HenceCorollary 7 is also an improvement of Theorem 4 in [N-X]given in Remark 7 above.

logo2


Figure 5

logo2


Figure 6

logo2


Figure 7

logo2


Figure 8

logo2


Thanks a lot....

Documents

Constructing Sequences from Algebraic Curvescage.ugent.be/~ml/irsee5/slides/Ozbudak.pdf · Constructing Sequences from Algebraic Curves Olav Geil 3, Ferruh Ozbudak 1;2, Diego Ruano