Abstract
Let n be a positive integer. An n-stage Galois NFSR has n registers and each register is updated by a feedback function. Then a Galois NFSR is called nonsingular if every register generates (strictly) periodic sequences, i.e., no branch points. In this paper, a generic method for investigating nonsingular Galois NFSRs is provided. Two fundamental concepts that are standard Galois NFSRs and the simplified feedback function of a standard Galois NFSR are proposed. Based on the new concepts, a sufficient condition is given for nonsingular Galois NFSRs. In particular, for the class of Galois NFSRs with linear simplified feedback functions, a necessary and sufficient condition is presented.
Similar content being viewed by others
References
Ågren M., Hell M., Johansson T., Meier W.: Grain-128a: a new version of grain-128 with optional authentication. IJWMC 5(1), 48–59 (2011).
Canteaut A., Trabbia M.: Improved fast correlation attacks using parity-check equations of weight 4 and 5. In: Preneel, Bart (ed), Advances in Cryptology—EUROCRYPT 2000, International Conference on the Theory and Application of Cryptographic Techniques, Bruges, Belgium, May 14–18, 2000, Proceeding, volume 1807 of Lecture Notes in Computer Science, Springer, pp. 573–588 (2000).
Canteaut A., Carpov S., Fontaine C., Lepoint T., Naya-Plasencia M., Paillier P., Sirdey R.: Stream ciphers: a practical solution for efficient homomorphic-ciphertext compression. J. Cryptol. 31(3), 885–916 (2018).
Chose P., Joux A., Mitton M.: Fast correlation attacks: An algorithmic point of view. In: Knudsen, Lars R. (ed), Advances in Cryptology—EUROCRYPT 2002, International Conference on the Theory and Applications of Cryptographic Techniques, Amsterdam, The Netherlands, April 28 - May 2, 2002, Proceedings, volume 2332 of Lecture Notes in Computer Science, Springer, pp. 209–221 (2002).
Courtois N., Meier W.: Algebraic attacks on stream ciphers with linear feedback. In: Biham, Eli (ed), Advances in Cryptology—EUROCRYPT 2003, International Conference on the Theory and Applications of Cryptographic Techniques, Warsaw, Poland, May 4-8, 2003, Proceedings, volume 2656 of Lecture Notes in Computer Science, Springer, pp. 345–359 (2003).
Courtois N.T.: Fast algebraic attacks on stream ciphers with linear feedback. In: Boneh, Dan (ed), Advances in Cryptology—CRYPTO 2003, 23rd Annual International Cryptology Conference, Santa Barbara, California, USA, August 17-21, 2003, Proceedings, volume 2729 of Lecture Notes in Computer Science, Springer, pp. 176–194 (2003).
De Cannière C., Preneel B.: Trivium. In: Robshaw and Billet [19], pp. 244–266.
Dubrova E.: A transformation from the fibonacci to the galois nlfsrs. IEEE Trans. Inf. Theory 55(11), 5263–5271 (2009).
Golomb S.W.: Shift Register Sequences. Aegean Park Press, Laguna Hills (1982).
Hell M., Johansson T., Maximov A., Meier W.: The grain family of stream ciphers. In: Robshaw and Billet [19], pp. 179–190.
Honggang H., Gong G.: Periods on two kinds of nonlinear feedback shift registers with time varying feedback functions. Int. J. Found. Comput. Sci. 22(6), 1317–1329 (2011).
Johansson T., Jönsson F.: Fast correlation attacks through reconstruction of linear polynomials. In: Bellare, Mihir (ed.), Advances in Cryptology—CRYPTO 2000, 20th Annual International Cryptology Conference, Santa Barbara, California, USA, August 20-24, 2000, Proceedings, volume 1880 of Lecture Notes in Computer Science, Springer, pp. 300–315 (2000).
Lu Y., Vaudenay S.: Faster correlation attack on bluetooth keystream generator E0. In: Franklin, Matthew K. (ed), Advances in Cryptology—CRYPTO 2004, 24th Annual International CryptologyConference, Santa Barbara, California, USA, August 15-19, 2004, Proceedings, volume 3152 of Lecture Notes in Computer Science, Springer, pp. 407–425 (2004).
Robshaw M.J.B., Billet, O. (eds).: New Stream Cipher Designs—The eSTREAM Finalists, volume 4986 of Lecture Notes in Computer Science. Springer, Heidelberg (2008).
Simpson L., Boztas S.: State cycles, initialization and the trivium stream cipher. Cryptogr. Commun. 4(3–4), 245–258 (2012).
Tian T., Qi W.-F., Ye C.-D., Xie X.-F.: Spring: a family of small hardware-oriented block ciphers based on nfsrs. J. Cryptol. Res. 6(6), 815–834 (2019).
Wu H.-J.: Acorn: a lightweight authenticated cipher (v3). Candidate for the CAESAR Competition (2016).
Zhang S., Chen G.: New results on the state cycles of trivium. Des. Codes Cryptogr. 87(1), 149–162 (2019).
Zhao X.-X., Qi W.-F., Zhang J.-M.: Further results on the equivalence between galois nfsrs and fibonacci nfsrs. Des. Codes Cryptogr. 88(1), 153–171 (2020).
Author information
Authors and Affiliations
Corresponding author
Additional information
Communicated by D. Panario.
This work was supported by the National Natural Science Foundation of China under Grants (61672533, 61521003).
Appendix
Appendix
In the following, we prove that \(\mathrm {NFSR}( F_{\mathrm {upper}} )\) and \(\mathrm {NFSR}( F_{\mathrm {lower}} )\) are inequivalent NFSRs.
Proposition 3
If \( k>1 \), then \(\mathrm {NFSR}( F_{\mathrm {upper}} )\) and \(\mathrm {NFSR}( F_{\mathrm {lower}} )\) are inequivalent.
Proof
Suppose NFSR\(( F_{\mathrm {upper}} )\) and NFSR(\( F_{\mathrm {lower}} \)) are equivalent. Then there is a permutation \( \sigma \) on the set \( \{0,1,\ldots , n-1\} \) such that \( \sigma ( F_{\mathrm {upper}}) = F_{\mathrm {lower}} \). Let
and
Note that both NFSR\(( F_{\mathrm {upper}} )\) and NFSR(\( F_{\mathrm {lower}} \)) are standard NFSRs, and so \( \sigma \) only permutes the order of \([i_1+l_1,\ldots , i_1] ,\ldots , [i_k+l_k,\ldots , i_k]\). Then for \( 1\le u\le k \) we have
Since the entry \( a_{u,v} \) in \( \mathcal {M}(F_{\mathrm {upper}}) = (a_{u,v})_{k\times k} \) is the coefficient of \( x_{i_v} \) in \( f_{i_u+l_u} \), it follows that there is a \( k\times k \) permutation matrix A such that
Since
we have
i.e., multiplying A on the left and \( A^{T} \) on the right of \( \sigma (\mathcal {M}(F_{\mathrm {upper}})) \) will not change the main diagonal. It can be seen that when \( k>1 \), the first entry in \( \mathcal {M}(F_{\mathrm {lower}}) \) is 0 while the first entry in \( A\cdot \sigma (\mathcal {M}(F_{\mathrm {upper}})) \cdot A^{T} \) is 1, a contradiction to (10). Hence, NFSR\(( F_{\mathrm {upper}} )\) and NFSR(\( F_{\mathrm {lower}} \)) are inequivalent when \( k>1 \). \(\square \)
Rights and permissions
About this article
Cite this article
Wang, XJ., Tian, T. & Qi, WF. A generic method for investigating nonsingular Galois NFSRs. Des. Codes Cryptogr. 90, 387–408 (2022). https://doi.org/10.1007/s10623-021-00982-5
Received:
Revised:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s10623-021-00982-5