Equivalent Keys of a Nonlinear Filter Generator Using a Power Residue Symbol

Abstract

The existence of equivalent keys for a secret key is an inseparable topic in cryptography. Especially for pseudorandom number generators for cryptographic applications, equivalent keys are not only a specific pair of keys that generate the same sequence but includes the one that gives simply the phase-shifted sequence. In this paper, the authors especially focus on a kind of nonlinear filter generator (NLFG) defined by using a power residue calculation over an odd characteristic. Generally speaking, an evaluation of NLFGs has conducted by the randomness of the sequence itself and the security of keys. Though the previous evaluations of the randomness of the target NLFG are studied and proven theoretically, the security aspects as a cryptosystem still have not discussed. Therefore, this paper would like to begin a new security evaluation by focusing on the existence of equivalent keys for the NLFG. As a result, the authors first show that sequences generated by the NLFG are classified into several types of sequences depending on the choice of a certain parameter. Owing to this, it is found that there exist equivalent keys concerning the parameter corresponding to the above. At the same time, we show that the equivalent keys are possible to eliminate by giving the restriction on the corresponding parameter adequately.

Appendix

1.1 A) Proof of Eq. (14)

The proof of the equivalence of and through the nonlinear function $f_k\left( \cdot \right)$ is shown, where the variables used below are the same as the proof of Theorem 1. Since we have Eq. (11) and Fermat’s little theorem, the following transformation holds for .

Recall from Eq. (6) that since $f_k\left( \cdot \right)$ applies the logarithmic operation to an output of the power residue symbol, it is found that $f_k\left( x \right) =f_k\left( y \right)$ if the respective result of power residue symbol satisfies $\left( \frac{x}{p} \right) _{k} = \left( \frac{y}{p} \right) _{k}$. (Q.E.D.)

1.2 B) Proof of Eq. (15)

The proof of how to derive Eq. (15) based on the property of $f_k\left( \cdot \right)$ is shown here. First, recall that since $f_k\left( \cdot \right)$ is defied by $f_k\left( x \right) = \mathrm {log}_{\epsilon _k}x$ for a non-zero input $x \in \mathbb {F}_p$, where $\epsilon _k$ is a primitive kth root of unity. Thus, it has the logarithmic property for non-zero values $x,y \in \mathbb {F}_p$ as follows:

$$\begin{aligned} f_k\left( xy \right)= & {} \mathrm {log}_{\epsilon _k}\left( \frac{xy}{p} \right) _{k} \\[2pt]= & {} \mathrm {log}_{\epsilon _k}\left\{ \left( \frac{x}{p} \right) _{k}\left( \frac{y}{p} \right) _{k} \right\} \\[2pt]= & {} \mathrm {log}_{\epsilon _k}\left( \frac{x}{p} \right) _{k} + \mathrm {log}_{\epsilon _k}\left( \frac{y}{p} \right) _{k} \\[2pt]= & {} f_k\left( x \right) + f_k\left( y \right) . \end{aligned}$$

By taking into account the above property of $f_k\left( \cdot \right)$, is found to be transformed into Eq. (15) as follows:

It is noted that $\eta = \frac{p^m-1}{p-1}$ and . (Q.E.D.).