 # Linear Complexity of A Family of Binary pq^2-periodic Sequences From Euler Quotients

We first introduce a family of binary pq^2-periodic sequences based on the Euler quotients modulo pq, where p and q are two distinct odd primes and p divides q-1. The minimal polynomials and linear complexities are determined for the proposed sequences provided that 2^q-1≡ 1 q^2. The results show that the proposed sequences have high linear complexities.

## Authors

##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## I Introduction

We will begin by the following definition of the Euler quotient modulo a product of two distinct odd primes. Let and be two distinct odd primes. For a nonnegative integer that is relatively prime to , the Euler quotient is defined as a unique integer in with

 ψ(t)=tφ(pq)−1pq(modpq), (1)

where is the well-known Euler-phi function. We also define if and are not relatively prime.

It can be seen easily that the Euler quotient has the following property:

 ψ(t+kpq)≡ψ(t)+kt−1(p−1)(q−1)(modpq). (2)

where and is relatively prime to

In 2010, Chen, Ostafe and Winterhof introduced families of binary sequences using Fermat/Euler quotients. Since then several nice cryptographic properties of these sequences were proved in [6, 7, 8, 3, 5, 4]. Based on the distribution and algebraic structure of the Fermat quotients, the linear complexity was determined for a binary threshold sequence defined from Fermat quotients . Naturally, the definition of the Euler quotient can be generalized by the Euler’s Theorem  

. Chen and Winterhof extended the distribution of pseudorandom numbers and vectors derived from Fermat quotients to Euler quotients

. Moreover, linear complexities were calculated for binary sequences derived from Euler quotients with prime-power modulus. Trace representations and linear complexities were investigated for binary sequences derived from the Fermat quotient . Subsequently, a trace representation was given for a family of binary sequences derived from Euler quotients modulo a fixed power of a prime . Chen and Winterhof generalized the Fermat quotient to the polynomial quotient in . Then the -error linear complexity was determined for binary sequences derived from the polynomial quotient modulo a prime  or its power , respectively. In , a series of optimal families of perfect polyphase sequences were derived from the array structure of Fermat-quotient sequences. All of the above results show that pseudorandom sequences derived from Fermat quotients, Euler quotients or their variants can be regarded as an important class of sequences from a cryptographic point of view.

In this paper, we study binary sequences derived from the Euler quotient modulo . Using the same notation as above, a binary threshold sequence from the Euler quotient modulo can be defined as

 (3)

For our purpose, we introduce the concept of the linear complexity of binary sequences now. The linear complexity of an -periodic sequence over the binary field is the smallest nonnegative integer for which there exist elements such that

 ai+c1⋅ai−1+⋯+cL⋅ai−L=0, for all i≥L.

Let be the generating polynomial of . By , the minimal polynomial of is defined as

 Ma(x)=xN−1gcd(xN−1,A(x)),

where denotes the greatest common divisor of two polynomials over and the linear complexity of is

 L(a)=N−deg(gcd(xN−1,A(x))).

Note that the linear complexity is of fundamental importance as a complexity measure for binary sequences in sequences designs [12, 15, 16]. Besides the measure of the linear complexity for sequences, other measures are also required according to different specific requirements from applications, for example, low autocorrelation or cross-correlation [24, 25], good nonlinear properties [27, 18, 26], and -error complexities [10, 9]. For a binary sequence to be cryptographically strong, the linear complexity of the sequence should be at least a half of the least period of the sequence in order to resist the attack of Berlekamp-Massey algorithm [20, 12].

The main contribution of this paper is to determine the minimal polynomial and the linear complexity of the sequence defined in (3). We state our main result as follows.

###### Theorem 1

Let and be two distinct odd primes with dividing . Assume that Then the binary threshold sequence defined in (3) has period at least The minimal polynomial of is

 Ms(x)={Φpq2(x),if   q≡1(mod4),Φpq2(x)Φpq(x),if   q≡3(mod4),

where denotes the -th cyclotomic polynomial for any positive integer and the linear complexity of is

 L(s)={(p−1)(q2−q),if   q≡1(mod4),(p−1)(q2−1),if   q≡3(mod4).

To the best of our knowledge, this is the first time to introduce this kind of sequences on basis of the Euler quotient modulo a product of two distinct odd primes. Under the condition that divides , we will show that the binary sequence has period at least . Furthermore, minimal polynomials and linear complexities of this class of binary sequences are determined. It turns out that the proposed sequences have high linear complexities and may be useful in cryptography and digital communications.

By using the generalized cyclotomic techniques, one can also construct other binary sequences with period . We refer the reader to see [13, 2, 17] for more details. We emphasize that our results are new. In particular, we point out that our results are not one special case of Theorem 4.2 of  although both may give a sequence with period . In fact, this can be seen easily by comparing linear complexities of the two families of binary sequences.

In the rest of the paper, we give a proof of the above theorem in Section II, and conclude with a few remarks in Section III.

## Ii Proof of Main Results

In this section, we are devoting to the proof of the main results.

We first show that is one of the periods of sequence under the condition that is a divisor of . Setting in (2), we see that

 ψ(t+pq2)=ψ(t)(modpq)

which implies for all . Thus the sequence is periodic with period . We will demonstrate that is the least period of the sequence in the following lemma.

###### Lemma 1

With the notation above, the sequence has period at least .

We first prove that is not a period of the sequence . By (2), we have

 ψ(pq+1)≡ψ(1)+(p−1)(q−1)≡(p−1)(q−1)(modpq).

It follows from that the -th term of the sequence is equal to 1, i.e., . Note that according to the definition of the sequence . Hence is not a period of the sequence .

Now we prove that is not a period of the sequence . We can assume that is a period of the sequence . Let . It follows from (2) that and thus . This means that the sequence satisfies . However, we have according to the definition of the sequence and It follows that , a contradiction.

Hence the least period of the sequence is which completes the proof of the lemma.

For any integer , we denote by all representatives for the residue classes of integers modulo and by all representatives that are relatively prime to in respectively. Since the least period of is , we restrict the action of on sometimes. With a slight abuse of notation, we shall still use the same symbol to denote this restriction of the Euler quotient on .

Let be a fixed common primitive root of both and . The Chinese Reminder Theorem(CRT)  guarantees that there exists an element of such that

 {h≡g(modp),h≡1(modq2).

Put and where lcm denotes least common multiple. Then the unit group of the ring  can be written as follows

 Z∗pq2={gihj:0≤i

The following lemma shows that the map is a group homomorphism when we restrict the action of the map to the unit group .

###### Lemma 2

Let be the map from to where contains exactly all of the residue classes which are divisible by in the addition group . Then is a surjective group homomorphism.

Let and be defined as above. Then the image and kernel of is given as

 Img(ψ)=pZpq

and

 Ker(ψ)=⟨gq,h⟩={gqihj}∣0≤i

respectively.

Note that for . We can write for some integer . Substituting it into (1), we have

 ψ(t)=ψ(t)=(1+t′p)q−1−1pq≡t′(q−1)q−1≡0(modp)

as divides . This means that is divisible by and thus the map is well defined.

For it follows from the Euler’s Theorem that

 ψ(uv)= (uv)φ(pq)−1pq = (uv)φ(pq)−uφ(pq)+uφ(pq)−1pq = uφ(pq)ψ(v)+ψ(u) ≡ ψ(u)+ψ(v)(modpq)

which yields the map is a group homomorphism.

Now we show that the map is surjective. There exists some integer such that with since is a primitive root in . This implies that

 ψ(g)=gφ(pq)−1pq≡(1+t1q)p−1−1pq≡t1(p−1)p−1≢0(modq).

Note that . It follows from the CRT that there exists some positive integer with such that

 ψ(g)≡pa≢0(modpq).

It follows that is one generator of the addition group . Consequently, the map is surjective and .

It is known that both and are divisible by . Also,

 ψ(gq)=qψ(g)=0(modq).

On the basis of the CRT, we have . Hence . Observe that . We can write . Hence

 ψ(h)=hφ(pq)−1pq≡p−1(1+q2h1)φ(pq)−1q≡0(modq).

Combining the above equation with , we get Therefore, we have

 {(gq)ihj(modpq2)∣0≤i

Now we need to show that the kernal and the subgroup have the same cardinality. By the Third Isomorphism Theorem , we have

 Z∗pq2/⟨gq,h⟩≃(⟨g,h⟩/⟨h⟩)/(⟨gq,h⟩/⟨h⟩)≃⟨g⟩/⟨gq⟩.

This yields that are all cosets of the subgroup of . It follows that . On the other hand, according to the Fundamental Homomorphism Theorem , we see that

 |Ker(ψ)|=|Z∗pq2Img(ψ)|=(p−1)(q−1)qq=(p−1)(q−1)

and so . This completes the whole proof of the lemma. Note that Lemma 2 gives that with some . This means that by the CRT. Let be the inverse of in , i.e., . Define in . Then

 ψ(^g)=b⋅ψ(g)(modpq)

by the homomorphism property of the map . It follows from that

 ψ(^g)≡pab≡p(modq).

Combining the above equality with , we get . The following lemma describes a partition of which will give a new explanation of the definition of the sequence .

###### Lemma 3

Let be an element in with Define

 Dℓ={t:ψ(t)=ψ(t)=pℓ(modpq),t∈Z∗pq2}

and

 ^Dℓ=^gℓD0={^gℓ⋅t(modpq):t∈D0}

for Then and for all .

We first prove that for all . Note that Lemma 2 gives that It is easy to see that for with we have

 ψ(^gℓt0)=l⋅ψ(^g)+ψ(t0)=ℓp(modpq).

This implies that . Conversely, for , we have

 ψ(t)=pl=lψ(^g)=ψ(^gℓ)(modpq)

and thus

 ψ(t^gℓ)=0(modpq)

by the homomorphism property of . This means that

 t^gℓ∈Ker(ψ)=D0.

Therefore, there exists some element such that

 t^gℓ≡t0(modpq).

Hence we have and so . This completes the whole proof of the lemma.

By the definition of and , Lemma 3 gives that for Let . The sequence can be rewritten as

The new explanation of the sequence will be helpful to determine linear complexities. We will make extensive use of the following lemmas for completing the proof of Theorem 1.

###### Lemma 4

For any if for some we have

 uDi={uv(modpq2):v∈Di}=Di+j.

where all the subscripts are certainly understood modulo . In particular, for .

If and , then and with . Hence This implies that . Conversely, it can be seen easily that . This finishes the proof of the lemma.

The study of the behavior of the coset under modulo various divisors of leads to a number of useful lemmas.

###### Lemma 5

For we have the following two multiset equalities

 {u(modp):u∈Dℓ}=(q−1)∗Z∗p,

where is the multiset in which each element of appears with multiplicity , and

 {u(modq):u∈Dℓ}=(p−1)∗Z∗q,

where is the multiset in which each element of appears with multiplicity .

For with some fixed it can be written as for and Recall that with some fixed in Lemma 3. Then in and so

 u=^gℓgqihj≡gqi+bℓ+j≡gbℓ+j⋅(gq)i(modp).

According to we see that is also a primitive root of . If we fix some , then runs through when run throughs . Now we count the multiplicity of each element in when and run through and respectively. Assume that

 u≡gqi+bℓ+j0≡ga0(modp)

where This means that

 qi=a0−j0−bℓ(modp−1)

for . According to it is equivalent to

 i≡q−1(a0−j0−bℓ)(modp−1).

There exists many solutions in the form of Note that has choices. This implies that there are many elements of mapping into one element in In a similar manner, we can prove the second multiset equality in the lemma. This completes the whole proof of the lemma.

###### Lemma 6

For we have

 {u(modpq):u∈Dℓ}=Z∗pq.

It is obvious that the map from to with is well-defined. Thus it is sufficient to prove that the map is one-to-one since both and have the same cardinality.

For we write and with and respectively. Assume that

 ^gℓgqi1hj1=u1≡u2=^gℓgqi2hj2(modpq).

We will illustrate that and .

Note that

 gqi1hj1=gqi2hj2(modpq)

as . It follows from the CRT that

 {gqi1+j1=gqi2+j2(modp),gqi1=gqi2(modq).

This implies that

 {qi1+j1≡qi2+j2(modp−1),qi1≡qi2(modq−1).

Note that . It follows from the above equality that

 {qi1+j1≡qi2+j2(modd),qi1≡qi2(modd).

This gives that

 j1≡j2(modd).

Since and belong to , we have . In the following, we will show that on the basis of the fact that . Now we have

 {qi1≡qi2(modp−1),qi1≡qi2(modq−1).

Since , it follows that

 {i1≡i2(modp−1),i1≡i2(modq−1).

Recall . It follows from the above equations that

 i1=i2(mode).

Since and belong to , we have . This completes the whole proof of the lemma.

###### Lemma 7

Let be the same notations as above. For we have the following multiset equality

 {u(modq2):u∈Dℓ}=(p−1)∗^gℓ⟨gq⟩,

where and denote and respectively. The set is contained in and is the multiset in which each element of appears with multiplicity .

Note that

 u=^gℓgqihj≡^gℓgqi⋅1≡^gℓ(gq)i(modq2).

This means that belongs to indeed. So the map from to with is well-defined. Now we count the multiplicity when runs through the set . Assume that

 ^gℓ(gq)i≡^gℓ(gq)a0(modq2)

for some fixed It follows that

 qi≡qa0(modq−1),

i.e.,

 i≡a0(modq−1).

There exists many solutions for in the form of Note that has choices. Altogether, there are many elements of mapping into one element in This finishes the proof of the lemma.

Define There exists an important connection between the polynomial and the cyclotomic polynomial that will allow us to determine the minimal polynomial of sequences

###### Lemma 8

Let be a fixed -th primitive root of unity and an element in . Then

 Dℓ(γv)={1,if   gcd(v,pq2)=q,0,if   gcd(v,pq2)∈{p,pq,q2}

and

 Dℓ(x)≡{1(modΦpq(x)),0(mod(Φp(x)Φq(x)Φq2(x))).

We distinguish two cases according to the distinct value of the greatest common divisor of and .

1. For with , it follows that is a -th primitive root of unity. On the basis of Lemma 6, we have

 Dℓ(γv)=∑u∈Dℓγuv=∑u∈Z∗pq(γv)u.

Note that is equal to the sum of all -th primitive roots of unity that is also the coefficient of the second highest term of the cyclotomic polynomial . According to Exercise 2.57 of , we see that

 Φpq(x)=Φq(xp)Φq(x)=xp(q−1)+xp(q−2)+⋯+1xq−1+xq−2+⋯+1=x(p−1)(q−1)+1⋅x(p−1)(q−1)−1+⋯.

This indicates that

 Dℓ(γv)=∑u∈Dℓγuv=∑u∈Z∗pqγuv=1

for with .

2. For with , it follows that is a -th primitive root of unity. It follows from Lemma 5 and the even parity of that

 ∑u∈Dℓγuv=(q−1)∑u∈Z∗p(γv)u=(q−1)∑u∈Z∗pγuv≡0(mod2).

For with , then is a -th or -th primitive root of unity respectively. Using the similar argument, it follows from Lemmas 5 and 7 and the even parity of that in this case.

It follows from the definition of cyclotomic polynomials that

 Dℓ(x)≡{1(modΦpq(x)),0(modΦn(x)) if n=p, q or q2.

Therefore, we get the desired result since the cyclotomic polynomials and over are relatively prime.

###### Lemma 9

For we have

 q−1∑ℓ=0Dℓ(γv)=∑u∈Z∗pq2γuv={1,if   gcd(v,pq2)=q,0,otherwise.

For with , we see that equals exactly the coefficient of the second highest term of the -th cyclotomic polynomial . It follows from the properties of cyclotomic polynomials (see Exercise 2.57 of ) that This gives the second highest term of the -th cyclotomic polynomial is equal to and so for with .

Recall that . For with , it follows from Lemma 8 that

 ∑u∈Z∗pq2γuv=q−1∑ℓ=0∑u∈Dℓγuv=(q−1)⋅0≡0(mod2).

For with , it follows that is a -th primitive root of unity. On the basis of Lemma 6, we have

 ∑u∈Z∗pq2γuv=q−1∑ℓ=0∑u∈Dℓγuv=q−1∑ℓ=0∑u∈Z∗pqγuv=q∑u∈Z∗pqγuv=∑u∈Z∗pqγu