 # CRT Based Spectral Convolution in Binary Fields

In this paper, new results on convolution of spectral components in binary fields have been presented for combiatorial sequences. A novel method of convolution of DFT points through Chinese Remainder Theorem (CRT) is presented which has lower complexity as compared to known methods of spectral point computations. Exploring the inherent structures in cyclic nature of finite fields, certain fixed mappings between the spectral components from composite fields to their decomposed subfield components has been illustrated which are significant for analysis of combiner generators. Complexity estimations of our CRT based methodology of convolutions in binary fields proves that our proposed method is far efficient as comparised to to existing methods of DFT computations for convolving sequences in frequency domain.

## Authors

##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## 1 Introduction

Let be a Galois field and the integer divides . From a known theory of digital signal processing, the convolution in time domain corresponds to multiplication in frequency domain as :

 up=d−1∑i=0aib(p−i) (1)

is equivalent to spectral point multiplication in binary fields as:

 Uk=AkBk (2)

where U, A and B are Fourier components of u, a and b, for and .

Similarly treating the problem conversely, multiplication in time domain is equivalent to convolution in frequency domain. As bit wise multiplication is a fundamental block for any cipher design, frequency domain analysis of these cryptographic algorithms involves convolution theory invariably.

Consider a N-tupple sequence u = [ ] which is bit-wise product () of two N-tupple sequences a = [] and b = []. From , the frequency domain N-tupple U = [ ] is cyclic convolution of of and as:

 uj=1N∗N−1∑k=0A(j−k)Bkforj=0,1,⋯,N−1. (3)

The frequency domain scenerio of two N-tupple sequences belonging to same binary fields is simple to relate with Equation (2) and (3). However, when sequences belong to different binary fields, the relationship becomes little complex. Consider an LFSR sequence a having a period and another LFSR sequence b with period . The associated DFT components of these sequences are represented in terms of powers of primitive elements of their respective binary fields as and for instance. Computing product of terms directly in Equation (3), represented in terms of primitive elements and and belonging to different binary fields, is not simple and much of the details have not been discussed even in ,,  and . In this paper, we have dicussed this apsect explicitly and presented new method of computing spectral convolutions in binary fields.

Chinese Remainder Theorem (CRT) based computations of convolution between elements belonging to different binary fields is introduced as our novel finding in this paper. In Section-2, we have presented main idea of our work followed by illustration through an example in binary fields. Section-3 covers discussion on application of CRT based DFT computations in analysis of combinatorial sequences through subspace decomposition. New results are demonstrated through small examples for clarity of context. The computational efficiency of our CRT based proposed method in comparison to existing method of DFT computations in binary fields has been discussed in Section-4. The paper is finally concluded in section-5.

## 2 Spectral Convolution in Binary Fields and CRT

Over the past few years, spectral analysis of LFSR based sequence generators is introduced as a promising idea in cryptanalysis of stream ciphers and fundamental in the series is discrete fast fourier spectra attacks on filter generators . In case of combiner generators, typical designs involve number of LFSRs based on primitive connection polynomials having periods co-prime to each other for attaining maximum key-stream periods. In this case, when number of involved binary fields increase, convolution of spectral components represented in elements belonging to different binary fields is inevitable. To illustrate this, let we consider two sequences a and b based on primitive elements and and are coprime to each other where . If we consider a simplest case of bit wise product, being part of any non-linear boolean mapping, as where () such that and

, their fourier transform is determined using the relations:

 Ak=p−1∑t=0atα−tk,k=0,1,2,.....,p−1 (4)

and

 Bk=q−1∑t=0btβ−tk,k=0,1,2,.....,q−1 (5)

where and are -th frequency components of DFTs of a and b where and are the primitive elements within their respective fields; generators of and with periods and respectively . For u, Berlekamp-Massey algorithm  gives associated minimum polynomail of u. Classically, DFT of u is then taken with respect to as:

 Uk=q−1∑t=0utλ−tk,k=0,1,2,.....,N−1 (6)

For this case, we need bits of stream u for computing each component of U and all computations are in . For practical scenerios of cryptanalysis, availibility of number of bits may not be practical with non-feasible computational complexity. While stydying the behaviour of underline binary fields involved in LFSR based combiner generators, certain fixed patterns have been observed whose detailed discussion is given in . Here we discuss the aspects related to spectral convolutions in particular though an example.

###### Example 2.1.

Consider a sequence u generated from product of two LFSRs having primitive polynomials of and . The period of stream a corresponding to LFSR-1 is and of b corresponding to LFSR-2 is . The period of u is .

1. In time domain representation, we have following sequences with initial state of ’01’ and ’001’ for both LFSRs as:

1. Sequence a:                                                                            (of period 3)

2. Sequence b:                                                                    (of period 7)

3. Sequence u:                 (of period 21)

2. From equations (4), (5) and (6) , frequency domain representations of these sequences represented in powers of roots of their associated binary fields as , and , are:

1. .

2. .

3. To compute , associated minimaum polynomial, determined through Berlekamp-massey algorithm, is: .

4. The DFT of u is: .

To compute DFT of u, we first determined its associated minimal polynomial through Berlekamp-massey algorithm and then carried out DFT computations in . We have observed that there exists a fixed mapping between elements belonging to base fields of and to their product field which can be exploited to determine spectral componenets of product stream. To illustrate these novel observations, we arrange spectral components of , and in a Table 1 as:

It is very clear from Table 1 that non-zero spectral component of U only exists where corresponding DFT points of A and B are non-zero. Moreover, their exists a certain fixed mapping from DFT points of A and B to S. Theorem 2.1 describes the phenomenon of this fixed mapping.

###### Theorem 2.1.

Let u be a product sequence with period and , having two constituent sequences a and b based on primitive polynomials where periods and are coprime to each other and . Let be a DFT spectra of a, B be a DFT spectra of b and U be a DFT spectra of u, any spectral component U of U, corresponding to non-zero spectral components of A and B, can be determined directly through CRT as:

 dk ≡ dk1\; (mod\;n1) dk ≡ dk2\; (mod\;n2)

where , and are degrees of non-zero spectral components of , , and represented in terms of associated roots , and of minimal polynomials of u, a and b respectively.

###### Proof.

All roots of minimal polynomials of a, b and s lie within their respective fields i.e. , and respectively. As and are coprime, .

As u = a.b. Let generates a sequence a of period having zeros with where is an primitive element of order . Similarly, let generates a sequence b of period having zeros with where is an primitive element of order .

As we know from equation (6),

 Uk=N−1∑t=0stλtk,k=0,1,2,.....,N−1 (7)

where is the root of polynomial . Through Berlekamp-Massey Algorithm, we know that sequence u is generated by an LFSR defined over polynomial . In our particular case when , is irreducible with degree . In such a case all roots of can be written in terms of with . Thus we can represent in equation (7) as

 Uk=N−1∑t=0st(αβ)tk,k=0,1,2,.....,N−1 (8)

As u = a.b, equation (8) can be written as:

 Uk=N−1∑t=0(atbt)(αβ)tk,k=0,1,2,.....,N−1
 ⇒Uk=N−1∑t=0(atαtk)(btβtk),k=0,1,2,.....,N−1

Due to orthogonality and cyclic behaviour of these fields, we will have:

 ⇒Uk=N−1∑t=0(atαtk)N−1∑t=0(btβtk),k=0,1,2,.....,N−1 (9)

By substituting equation (4) and (5) in (9), we get

 Uk=A1kB2k,k=0,1,2,.....,N−1. (10)

Thus from Equation (10), spectral components of U are non-zero at all indices where corresponding spectral components of A and B are non-zero. As all DFT spectral components of U lie within and correspond to , where . Considering any component of U corresponding to non-zero DFT components of A and B, we only need to prove that both non-zero spectral components of A and B have one to one mapping to U through CRT.

We now transform the relationship of u= a.b into roots of associated polynomials of each sequence in their respective binary fields by representing U in terms of (), A in terms of () and B in terms of (). Thus we have:

 λdk=αdk.βdk,dk=0,1,2,.....,N−1. (11)

As we can write u= a.b and , Equation (11) can be expressed as:

 λdk=αdkmodn1.βdkmodn2,dk=0,1,2,.....,N−1, (12)
 ⇒λdk=αdk1.βdk2,dk=0,1,2,.....,N−1. (13)

From equations (12) and (13), there exists a unique mapping for degrees of , , and which can be computed using CRT as:

 dk ≡ dk1(modn1) dk ≡ dk2(modn2).

Let we relate the results of Example 2.1 with Theorem 2.1. Using A and B from Table 1, we can directly compute the U using the Theorem Theorem 2.1. As A and B, we will use CRT as:

 d5 ≡ 0(mod3) d5 ≡ 2(mod7).

Thus d and therefore U. Similarly, all six non-zero spectral points of U at indices and can be computed directly using CRT relation of Theorem 2.1.

## 3 Subspace Decomposition and CRT Based Spectral Convolutions

In this section, application of our proposed method of computing spectral components for analysis of cryptographic sequences is discussed. Specifically for combiner generators, relevance of CRT based commputations of DFT points in binary fields to their analysis through subspace decomposition is made. As booelan functions used in combiner generators comprise of different combination of smaller product sequences, our proosed method of computing DFT helps to analyze the sequences in frequency domain. Let we consider a simple boolean function as:

 f(x1,x2,,x3)=x1x2+x2x3+x1x3

where , , and . As the boolean function commprises of three product components, its frequency domain analysis can be based either on its composite form of or on three sub-components of , and . Let the resultant stream be having a period . To analyze the sequence in frequency domain classically, its associated minimal polynomial is required to be determined through Berlekamp-Massey algorithm. With primitive element of polynomial , each spectral component S is calculated through Equation (6) in . On the contrary, our proposed methodology of CRT based method of computing spectral components can be used to decompose the involved space of on the basis of its basic component fields of , and . The analysis through sub space decomposition in this case reduces the complexity significantly. To illustrate the idea, let we discuss the details with an example here:-

###### Example 3.1.

Consider a Boolean function combining three LFSR sequences a generated with , b generated with and c generated with to make the combined sequence as:

 st=f(at,bt,ct)=atbt+btct+atctwith0≤t≤N−1 (14)

where which is in this case here. We generate bits of and run Berlekamp-Massey algorithm. Linear complexity of s is 31 and the corresponding minimum polynomial = .

As , we will consider the component streams of ab, bc and ac one by one. As spectral points of ab have already been computed in Example 2.1, let we denote it by AB. For bc, we will take individual spectra of B and C and will then use our method of computing non-zero spectral points. Frequency domain representations of these sequences represented in powers of roots of their associated binary fields as , are:

1. B .

2. C .

The period . The associated minimal polynomial of stream bc is . From famous Blahut’s Theorem , number of non-zero spectral components of BC must be . We can directly compute all non-zero DFT points of BC through our CRT based method. Taking non-zero component of B and th non zero DFT point of C, we can determine the corresponding index of non-zero spectral component of BC through CRT as:

 k ≡ 3(mod7) k ≡ 15(mod31).

Thus and value of spectral component BC is again computed by using our method of CRT based DFT points as:

 d108 ≡ 4(mod7) d108 ≡ 29(mod31).

We get . Similarly, all 15x non-zero DFT points of BC are determined using our method in in a Table 2 as:

Now consider ac which has period of . The associated minimal polynomial of stream ac is . Number of non-zero spectral components of AC must be . We can directly compute all non-zero DFT points of BC through our CRT based method. Taking non-zero component of A and non zero DFT point of C, we can determine the corresponding index of non-zero spectral component of BC through CRT as:

 k ≡ 1(mod3) k ≡ 15(mod31).

Thus and value of spectral component BC is again computed by using our method of CRT based DFT points as:

 d46 ≡ 0(mod3) d46 ≡ 29(mod31).

We get . Similarly, all 10x non-zero DFT points of AC are determined using our method in Table 3 as:

Now we consider spectras of all three sequences togather:

1. A .

2. B .

3. C .

With non-zero index of A, of B and of C, we can determine non-zero index of S as :

 k ≡ 1(mod3) k ≡ 3(mod7) k ≡ 15(mod31).

Result of CRT is indicating S to be non-zero. Now taking , and , the value of S is determined through CRT as:

 dk ≡ 0(mod3) dk ≡ 4(mod7) dk ≡ 29(mod31).

Thus S , where is the root of polynomial . Similarly, corresponding to all non-zero indices of A, B and C, we will determine the spectral components of S through our CRT based methods mentioned at Table 4.

Correlating subspace components of AB, BC and AC to S from tables above, certain fixed mapping is observed between the spectral components from composite fields componnents to its constituent sub field components. For instance, decommposition of S into its subspace components AB, BC and ACand then further to A, B and C is depicted in Figure 1. This fixed mapping is considered very useful for exploitation during analysis of the combinatorial sequences.

The conjugate property  of spectral sequence S can be verified from Figure 2 below, where trail of only fifteen components is shown. All other Spectral components in Table 4 follow the same trail in succession. The advantage of this magical behaviour of DFT components in binary fields is drastic reduction in computations required for complete spectra S. In Table 4 above, we need to compute S only and spectra for all other indices can be computed by conjugate operation.

## 4 Complexity Estimations

Deatiled account of complexity of computing DFT in binary fields can be found in , we reuse the results discussed therein to draw commparison of our proposed methodology in case of combinatorial sequences. In terms of polynomail operations, DFT expression of Equation (9) can be expressed showing the relatioship between DFT and associated minimal polynomial as:

 Sk=s(γ−k),k=0,1,⋯,N−1 (15)

where . The complexity for computing any using the Equation (15) to evaluate s(x) at is determined as follows:-

1. The complexity for computing is Xor operations, where for two polynomials of degree .

2. The complexity to evaluate at is Xor operations.

3. Since the degree of is on average and , the total complexity of computing any is:

 O[(log(k)η(n))+(deg(s(x))η(n))]≈O(N/2η(n))Xor operations. (16)

Now, we determine complexity of CRT based method of computing any DFT point S for sequence sa.b with and a , b and s as assumed in Section 2. As from Equation (7), S is computed through CRT relationship of A and B, we have following relations of computations:

1. The complexity of computing A is

 O[(log(k1)η(p))+(deg(a(x))η(p))]≈O(n1/2η(a))Xor operations.
2. The complexity of computing B is

 O[(log(k2)η(q))+(deg(b(x))η(p))]≈O(n2/2η(q))Xor operations.
3. The computational cost for CRT is where number of bits required for representation of .

4. Total complexity of computing S through CRT based method is:

 ≈O[(n1/2η(p))+(n2/2η(q))+(len(N)2)]% Xor operations. (17)
5. Total number of bits required in this case is .

Our results reveal that complexity of CRT based method of computing any DFT component of a combinatorial sequence through Equation (17) is far less than complexity of Equation (16). Let we briefly demonstrate the results through stream bc from Example 3.1. Taking first component of Table 2 which is BC, corresponding CRT based constituent spectral points are B and C. Normally the spectral point BC can be computed in for which complete bits are required by using Equation (6). On the other hand, our proposed CRT based method of direct calculations of spectral points use the constituent DFT components in and . Comparison of complexities of these two methods for a case scenerio of BC is given in Table 5 which clearly shows that the CRT based DFT method is efficient than classical DFT computations in binary fields for combinatorial sequences.

## 5 Conclusion

In this paper, new method of computing convolution in frequency domain is presented for combinatorial sequences in binary fields. A simplest case of product of LFSR sequences being a fundamental block of any non-linear Boolean function is considered to demonstrate our results on convolution through DFT in binary fields. CRT based novel approach to determine DFT points for combinatorial sequences has been illustrated with associated mathematical rationale. With regard to analysis of combiner generators through subspace decomposition, applicability of our proposed methodology of computing spectral points is made. We presented certain fixed mapping between the spectral components from composite fields to its decomposed subfield components and highlighted inherent structures in cyclic nature of finite fields which can be exploited during analysis of combiners. The comparison of our proposed CRT based methodology to known theory of DFT computations is discussed and it is proven that proposed CRT based method to compute convolution in binary fields is efficient than exiting methods of DFT computations.

## References

•  R. Blahut (1983) Theory and practice of error control codes. Addison-Wesley Publishing Company, USA. Cited by: §1, Example 3.1.
•  C. Ding (1996) Chinese remainder theorem. World Scientific. Cited by: §1.
•  J. D. Golić (1995) Linear cryptanalysis of stream ciphers. In Fast Software Encryption, pp. 154–169. Cited by: §1.
•  S. W. Golomb and G. Gong (2005) Signal design for good correlation: for wireless communication, cryptography, and radar. Cambridge University Press, New York, USA. Cited by: §1, §2, §3.
•  G. Gong, S. Rønjom, T. Helleseth, and H. Hu (2011) Fast discrete fourier spectra attacks on stream ciphers. Information Theory, IEEE Transactions on 57 (8), pp. 5555–5565. Cited by: §2.
•  G. Gong A closer look at selective DFT attacks. Cited by: §4.
•  M. A. Khan, A. A. Khan, and F. Mirza (2015) CRT and fixed patterns in combinatorial sequences. arXiv preprint arXiv:1504.01099. Cited by: §2.
•  J. L. Massey and S. Serconek (1994)

A fourier transform approach to the linear complexity of nonlinearly filtered sequences

.
In Advances in Cryptology—CRYPTO’94, pp. 332–340. Cited by: §1.
•  J. M. Pollard (1971) The fast Fourier Transform in a finite field. Mathematics of computation 25 (114), pp. 365–374. Cited by: §2.
•  I. S. Reed and T. Truong (1975) The use of finite fields to compute convolutions. Information Theory, IEEE Transactions on 21 (2), pp. 208–213. Cited by: §1.