1 Introduction
Let be a Galois field and the integer divides . From a known theory of digital signal processing, the convolution in time domain corresponds to multiplication in frequency domain as [10]:
(1) 
is equivalent to spectral point multiplication in binary fields as:
(2) 
where U, A and B are Fourier components of u, a and b, for and .
Similarly treating the problem conversely, multiplication in time domain is equivalent to convolution in frequency domain. As bit wise multiplication is a fundamental block for any cipher design, frequency domain analysis of these cryptographic algorithms involves convolution theory invariably.
Consider a Ntupple sequence u = [ ] which is bitwise product () of two Ntupple sequences a = [] and b = []. From [8], the frequency domain Ntupple U = [ ] is cyclic convolution of of and as:
(3) 
The frequency domain scenerio of two Ntupple sequences belonging to same binary fields is simple to relate with Equation (2) and (3). However, when sequences belong to different binary fields, the relationship becomes little complex. Consider an LFSR sequence a having a period and another LFSR sequence b with period . The associated DFT components of these sequences are represented in terms of powers of primitive elements of their respective binary fields as and for instance. Computing product of terms directly in Equation (3), represented in terms of primitive elements and and belonging to different binary fields, is not simple and much of the details have not been discussed even in [2],[1], [3] and [4]. In this paper, we have dicussed this apsect explicitly and presented new method of computing spectral convolutions in binary fields.
Chinese Remainder Theorem (CRT) based computations of convolution between elements belonging to different binary fields is introduced as our novel finding in this paper. In Section2, we have presented main idea of our work followed by illustration through an example in binary fields. Section3 covers discussion on application of CRT based DFT computations in analysis of combinatorial sequences through subspace decomposition. New results are demonstrated through small examples for clarity of context. The computational efficiency of our CRT based proposed method in comparison to existing method of DFT computations in binary fields has been discussed in Section4. The paper is finally concluded in section5.
2 Spectral Convolution in Binary Fields and CRT
Over the past few years, spectral analysis of LFSR based sequence generators is introduced as a promising idea in cryptanalysis of stream ciphers and fundamental in the series is discrete fast fourier spectra attacks on filter generators [5]. In case of combiner generators, typical designs involve number of LFSRs based on primitive connection polynomials having periods coprime to each other for attaining maximum keystream periods. In this case, when number of involved binary fields increase, convolution of spectral components represented in elements belonging to different binary fields is inevitable. To illustrate this, let we consider two sequences a and b based on primitive elements and and are coprime to each other where . If we consider a simplest case of bit wise product, being part of any nonlinear boolean mapping, as where () such that and
, their fourier transform is determined using the relations:
(4) 
and
(5) 
where and are th frequency components of DFTs of a and b where and are the primitive elements within their respective fields; generators of and with periods and respectively [9]. For u, BerlekampMassey algorithm [4] gives associated minimum polynomail of u. Classically, DFT of u is then taken with respect to as:
(6) 
For this case, we need bits of stream u for computing each component of U and all computations are in . For practical scenerios of cryptanalysis, availibility of number of bits may not be practical with nonfeasible computational complexity. While stydying the behaviour of underline binary fields involved in LFSR based combiner generators, certain fixed patterns have been observed whose detailed discussion is given in [7]. Here we discuss the aspects related to spectral convolutions in particular though an example.
Example 2.1.
Consider a sequence u generated from product of two LFSRs having primitive polynomials of and . The period of stream a corresponding to LFSR1 is and of b corresponding to LFSR2 is . The period of u is .

In time domain representation, we have following sequences with initial state of ’01’ and ’001’ for both LFSRs as:

Sequence a: (of period 3)

Sequence b: (of period 7)

Sequence u: (of period 21)

To compute DFT of u, we first determined its associated minimal polynomial through Berlekampmassey algorithm and then carried out DFT computations in . We have observed that there exists a fixed mapping between elements belonging to base fields of and to their product field which can be exploited to determine spectral componenets of product stream. To illustrate these novel observations, we arrange spectral components of , and in a Table 1 as:
Index 
0  1  2  3  4  5  6  7  8  9  10  11 


0  0  0  0  

0  0  0  0  0  0  0  0  

0  0  0  0  0  0  0  0  0  0  
Index  12  13  14  15  16  17  18  19  20  

0  0  0  

0  0  0  0  

0  0  0  0  0  

It is very clear from Table 1 that nonzero spectral component of U only exists where corresponding DFT points of A and B are nonzero. Moreover, their exists a certain fixed mapping from DFT points of A and B to S. Theorem 2.1 describes the phenomenon of this fixed mapping.
Theorem 2.1.
Let u be a product sequence with period and , having two constituent sequences a and b based on primitive polynomials where periods and are coprime to each other and . Let be a DFT spectra of a, B be a DFT spectra of b and U be a DFT spectra of u, any spectral component U of U, corresponding to nonzero spectral components of A and B, can be determined directly through CRT as:
where , and are degrees of nonzero spectral components of , , and represented in terms of associated roots , and of minimal polynomials of u, a and b respectively.
Proof.
All roots of minimal polynomials of a, b and s lie within their respective fields i.e. , and respectively. As and are coprime, .
As u = a.b. Let generates a sequence a of period having zeros with where is an primitive element of order . Similarly, let generates a sequence b of period having zeros with where is an primitive element of order .
As we know from equation (6),
(7) 
where is the root of polynomial . Through BerlekampMassey Algorithm, we know that sequence u is generated by an LFSR defined over polynomial . In our particular case when , is irreducible with degree . In such a case all roots of can be written in terms of with . Thus we can represent in equation (7) as
(8) 
As u = a.b, equation (8) can be written as:
Due to orthogonality and cyclic behaviour of these fields, we will have:
(9) 
By substituting equation (4) and (5) in (9), we get
(10) 
Thus from Equation (10), spectral components of U are nonzero at all indices where corresponding spectral components of A and B are nonzero. As all DFT spectral components of U lie within and correspond to , where . Considering any component of U corresponding to nonzero DFT components of A and B, we only need to prove that both nonzero spectral components of A and B have one to one mapping to U through CRT.
We now transform the relationship of u= a.b into roots of associated polynomials of each sequence in their respective binary fields by representing U in terms of (), A in terms of () and B in terms of (). Thus we have:
(11) 
As we can write u= a.b and , Equation (11) can be expressed as:
Let we relate the results of Example 2.1 with Theorem 2.1. Using A and B from Table 1, we can directly compute the U using the Theorem Theorem 2.1. As A and B, we will use CRT as:
Thus d and therefore U. Similarly, all six nonzero spectral points of U at indices and can be computed directly using CRT relation of Theorem 2.1.
3 Subspace Decomposition and CRT Based Spectral Convolutions
In this section, application of our proposed method of computing spectral components for analysis of cryptographic sequences is discussed. Specifically for combiner generators, relevance of CRT based commputations of DFT points in binary fields to their analysis through subspace decomposition is made. As booelan functions used in combiner generators comprise of different combination of smaller product sequences, our proosed method of computing DFT helps to analyze the sequences in frequency domain. Let we consider a simple boolean function as:
where , , and . As the boolean function commprises of three product components, its frequency domain analysis can be based either on its composite form of or on three subcomponents of , and . Let the resultant stream be having a period . To analyze the sequence in frequency domain classically, its associated minimal polynomial is required to be determined through BerlekampMassey algorithm. With primitive element of polynomial , each spectral component S is calculated through Equation (6) in . On the contrary, our proposed methodology of CRT based method of computing spectral components can be used to decompose the involved space of on the basis of its basic component fields of , and . The analysis through sub space decomposition in this case reduces the complexity significantly. To illustrate the idea, let we discuss the details with an example here:
Example 3.1.
Consider a Boolean function combining three LFSR sequences a generated with , b generated with and c generated with to make the combined sequence as:
(14) 
where which is in this case here. We generate bits of and run BerlekampMassey algorithm. Linear complexity of s is 31 and the corresponding minimum polynomial = .
As , we will consider the component streams of ab, bc and ac one by one. As spectral points of ab have already been computed in Example 2.1, let we denote it by AB. For bc, we will take individual spectra of B and C and will then use our method of computing nonzero spectral points. Frequency domain representations of these sequences represented in powers of roots of their associated binary fields as , are:

B .

C .
The period . The associated minimal polynomial of stream bc is . From famous Blahut’s Theorem [1], number of nonzero spectral components of BC must be . We can directly compute all nonzero DFT points of BC through our CRT based method. Taking nonzero component of B and th non zero DFT point of C, we can determine the corresponding index of nonzero spectral component of BC through CRT as:
Thus and value of spectral component BC is again computed by using our method of CRT based DFT points as:
We get . Similarly, all 15x nonzero DFT points of BC are determined using our method in in a Table 2 as:
Index 
108  178  213  122  185  201  54  89 

B 

C 

BC 

Index 
215  61  139  209  27  153  216  
B 

C 

BC 


Now consider ac which has period of . The associated minimal polynomial of stream ac is . Number of nonzero spectral components of AC must be . We can directly compute all nonzero DFT points of BC through our CRT based method. Taking nonzero component of A and non zero DFT point of C, we can determine the corresponding index of nonzero spectral component of BC through CRT as:
Thus and value of spectral component BC is again computed by using our method of CRT based DFT points as:
We get . Similarly, all 10x nonzero DFT points of AC are determined using our method in Table 3 as:
Index 
46  85  58  91  61  77  23  89  29  92 

A 

C 

AC 


Now we consider spectras of all three sequences togather:

A .

B .

C .
With nonzero index of A, of B and of C, we can determine nonzero index of S as :
Result of CRT is indicating S to be nonzero. Now taking , and , the value of S is determined through CRT as:
Thus S , where is the root of polynomial . Similarly, corresponding to all nonzero indices of A, B and C, we will determine the spectral components of S through our CRT based methods mentioned at Table 4.
Index  61  89  122  139  178  185  209  215  244  271 

Spectral Component 

Index 
278  325  356  370  395  418  430  433  461  488 
Spectral Component 

Index 
523  542  556  587  619  635  643  647  649  650 
Spectral Component 
Correlating subspace components of AB, BC and AC to S from tables above, certain fixed mapping is observed between the spectral components from composite fields componnents to its constituent sub field components. For instance, decommposition of S into its subspace components AB, BC and ACand then further to A, B and C is depicted in Figure 1. This fixed mapping is considered very useful for exploitation during analysis of the combinatorial sequences.
The conjugate property [4] of spectral sequence S can be verified from Figure 2 below, where trail of only fifteen components is shown. All other Spectral components in Table 4 follow the same trail in succession. The advantage of this magical behaviour of DFT components in binary fields is drastic reduction in computations required for complete spectra S. In Table 4 above, we need to compute S only and spectra for all other indices can be computed by conjugate operation.
4 Complexity Estimations
Deatiled account of complexity of computing DFT in binary fields can be found in [6], we reuse the results discussed therein to draw commparison of our proposed methodology in case of combinatorial sequences. In terms of polynomail operations, DFT expression of Equation (9) can be expressed showing the relatioship between DFT and associated minimal polynomial as:
(15) 
where . The complexity for computing any using the Equation (15) to evaluate s(x) at is determined as follows:

The complexity for computing is Xor operations, where for two polynomials of degree .

The complexity to evaluate at is Xor operations.

Since the degree of is on average and , the total complexity of computing any is:
(16)
Now, we determine complexity of CRT based method of computing any DFT point S for sequence sa.b with and a , b and s as assumed in Section 2. As from Equation (7), S is computed through CRT relationship of A and B, we have following relations of computations:

The complexity of computing A is

The complexity of computing B is

The computational cost for CRT is where number of bits required for representation of .

Total complexity of computing S through CRT based method is:
(17) 
Total number of bits required in this case is .
Our results reveal that complexity of CRT based method of computing any DFT component of a combinatorial sequence through Equation (17) is far less than complexity of Equation (16). Let we briefly demonstrate the results through stream bc from Example 3.1. Taking first component of Table 2 which is BC, corresponding CRT based constituent spectral points are B and C. Normally the spectral point BC can be computed in for which complete bits are required by using Equation (6). On the other hand, our proposed CRT based method of direct calculations of spectral points use the constituent DFT components in and . Comparison of complexities of these two methods for a case scenerio of BC is given in Table 5 which clearly shows that the CRT based DFT method is efficient than classical DFT computations in binary fields for combinatorial sequences.
DFT based on Equation (6)  CRT based DFT  

Number of Bits Required  217  7 and 31 
Field 
and  
For B  
For C  
Total Complexity  For CRT step  
5 Conclusion
In this paper, new method of computing convolution in frequency domain is presented for combinatorial sequences in binary fields. A simplest case of product of LFSR sequences being a fundamental block of any nonlinear Boolean function is considered to demonstrate our results on convolution through DFT in binary fields. CRT based novel approach to determine DFT points for combinatorial sequences has been illustrated with associated mathematical rationale. With regard to analysis of combiner generators through subspace decomposition, applicability of our proposed methodology of computing spectral points is made. We presented certain fixed mapping between the spectral components from composite fields to its decomposed subfield components and highlighted inherent structures in cyclic nature of finite fields which can be exploited during analysis of combiners. The comparison of our proposed CRT based methodology to known theory of DFT computations is discussed and it is proven that proposed CRT based method to compute convolution in binary fields is efficient than exiting methods of DFT computations.
References
 [1] (1983) Theory and practice of error control codes. AddisonWesley Publishing Company, USA. Cited by: §1, Example 3.1.
 [2] (1996) Chinese remainder theorem. World Scientific. Cited by: §1.
 [3] (1995) Linear cryptanalysis of stream ciphers. In Fast Software Encryption, pp. 154–169. Cited by: §1.
 [4] (2005) Signal design for good correlation: for wireless communication, cryptography, and radar. Cambridge University Press, New York, USA. Cited by: §1, §2, §3.
 [5] (2011) Fast discrete fourier spectra attacks on stream ciphers. Information Theory, IEEE Transactions on 57 (8), pp. 5555–5565. Cited by: §2.
 [6] A closer look at selective DFT attacks. Cited by: §4.
 [7] (2015) CRT and fixed patterns in combinatorial sequences. arXiv preprint arXiv:1504.01099. Cited by: §2.

[8]
(1994)
A fourier transform approach to the linear complexity of nonlinearly filtered sequences
. In Advances in Cryptology—CRYPTO’94, pp. 332–340. Cited by: §1.  [9] (1971) The fast Fourier Transform in a finite field. Mathematics of computation 25 (114), pp. 365–374. Cited by: §2.
 [10] (1975) The use of finite fields to compute convolutions. Information Theory, IEEE Transactions on 21 (2), pp. 208–213. Cited by: §1.
Comments
There are no comments yet.