Skip to main content
Log in

A generic method for investigating nonsingular Galois NFSRs

  • Published:
Designs, Codes and Cryptography Aims and scope Submit manuscript

Abstract

Let n be a positive integer. An n-stage Galois NFSR has n registers and each register is updated by a feedback function. Then a Galois NFSR is called nonsingular if every register generates (strictly) periodic sequences, i.e., no branch points. In this paper, a generic method for investigating nonsingular Galois NFSRs is provided. Two fundamental concepts that are standard Galois NFSRs and the simplified feedback function of a standard Galois NFSR are proposed. Based on the new concepts, a sufficient condition is given for nonsingular Galois NFSRs. In particular, for the class of Galois NFSRs with linear simplified feedback functions, a necessary and sufficient condition is presented.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6

Similar content being viewed by others

Notes

  1. A Galois NFSR is called an autonomous binary machine in [9]. Please refer to Fig. II-14 in [9].

References

  1. Ågren M., Hell M., Johansson T., Meier W.: Grain-128a: a new version of grain-128 with optional authentication. IJWMC 5(1), 48–59 (2011).

    Article  Google Scholar 

  2. Canteaut A., Trabbia M.: Improved fast correlation attacks using parity-check equations of weight 4 and 5. In: Preneel, Bart (ed), Advances in Cryptology—EUROCRYPT 2000, International Conference on the Theory and Application of Cryptographic Techniques, Bruges, Belgium, May 14–18, 2000, Proceeding, volume 1807 of Lecture Notes in Computer Science, Springer, pp. 573–588 (2000).

  3. Canteaut A., Carpov S., Fontaine C., Lepoint T., Naya-Plasencia M., Paillier P., Sirdey R.: Stream ciphers: a practical solution for efficient homomorphic-ciphertext compression. J. Cryptol. 31(3), 885–916 (2018).

    Article  MathSciNet  Google Scholar 

  4. Chose P., Joux A., Mitton M.: Fast correlation attacks: An algorithmic point of view. In: Knudsen, Lars R. (ed), Advances in Cryptology—EUROCRYPT 2002, International Conference on the Theory and Applications of Cryptographic Techniques, Amsterdam, The Netherlands, April 28 - May 2, 2002, Proceedings, volume 2332 of Lecture Notes in Computer Science, Springer, pp. 209–221 (2002).

  5. Courtois N., Meier W.: Algebraic attacks on stream ciphers with linear feedback. In: Biham, Eli (ed), Advances in Cryptology—EUROCRYPT 2003, International Conference on the Theory and Applications of Cryptographic Techniques, Warsaw, Poland, May 4-8, 2003, Proceedings, volume 2656 of Lecture Notes in Computer Science, Springer, pp. 345–359 (2003).

  6. Courtois N.T.: Fast algebraic attacks on stream ciphers with linear feedback. In: Boneh, Dan (ed), Advances in Cryptology—CRYPTO 2003, 23rd Annual International Cryptology Conference, Santa Barbara, California, USA, August 17-21, 2003, Proceedings, volume 2729 of Lecture Notes in Computer Science, Springer, pp. 176–194 (2003).

  7. De Cannière C., Preneel B.: Trivium. In: Robshaw and Billet [19], pp. 244–266.

  8. Dubrova E.: A transformation from the fibonacci to the galois nlfsrs. IEEE Trans. Inf. Theory 55(11), 5263–5271 (2009).

    Article  MathSciNet  Google Scholar 

  9. Golomb S.W.: Shift Register Sequences. Aegean Park Press, Laguna Hills (1982).

    MATH  Google Scholar 

  10. Hell M., Johansson T., Maximov A., Meier W.: The grain family of stream ciphers. In: Robshaw and Billet [19], pp. 179–190.

  11. Honggang H., Gong G.: Periods on two kinds of nonlinear feedback shift registers with time varying feedback functions. Int. J. Found. Comput. Sci. 22(6), 1317–1329 (2011).

    Article  MathSciNet  Google Scholar 

  12. Johansson T., Jönsson F.: Fast correlation attacks through reconstruction of linear polynomials. In: Bellare, Mihir (ed.), Advances in Cryptology—CRYPTO 2000, 20th Annual International Cryptology Conference, Santa Barbara, California, USA, August 20-24, 2000, Proceedings, volume 1880 of Lecture Notes in Computer Science, Springer, pp. 300–315 (2000).

  13. Lu Y., Vaudenay S.: Faster correlation attack on bluetooth keystream generator E0. In: Franklin, Matthew K. (ed), Advances in Cryptology—CRYPTO 2004, 24th Annual International CryptologyConference, Santa Barbara, California, USA, August 15-19, 2004, Proceedings, volume 3152 of Lecture Notes in Computer Science, Springer, pp. 407–425 (2004).

  14. Robshaw M.J.B., Billet, O. (eds).: New Stream Cipher Designs—The eSTREAM Finalists, volume 4986 of Lecture Notes in Computer Science. Springer, Heidelberg (2008).

  15. Simpson L., Boztas S.: State cycles, initialization and the trivium stream cipher. Cryptogr. Commun. 4(3–4), 245–258 (2012).

    Article  MathSciNet  Google Scholar 

  16. Tian T., Qi W.-F., Ye C.-D., Xie X.-F.: Spring: a family of small hardware-oriented block ciphers based on nfsrs. J. Cryptol. Res. 6(6), 815–834 (2019).

    Google Scholar 

  17. Wu H.-J.: Acorn: a lightweight authenticated cipher (v3). Candidate for the CAESAR Competition (2016).

  18. Zhang S., Chen G.: New results on the state cycles of trivium. Des. Codes Cryptogr. 87(1), 149–162 (2019).

    Article  MathSciNet  Google Scholar 

  19. Zhao X.-X., Qi W.-F., Zhang J.-M.: Further results on the equivalence between galois nfsrs and fibonacci nfsrs. Des. Codes Cryptogr. 88(1), 153–171 (2020).

    Article  MathSciNet  Google Scholar 

Download references

Author information

Authors and Affiliations

Authors

Corresponding author

Correspondence to Tian Tian.

Additional information

Communicated by D. Panario.

This work was supported by the National Natural Science Foundation of China under Grants (61672533, 61521003).

Appendix

Appendix

In the following, we prove that \(\mathrm {NFSR}( F_{\mathrm {upper}} )\) and \(\mathrm {NFSR}( F_{\mathrm {lower}} )\) are inequivalent NFSRs.

Proposition 3

If \( k>1 \), then \(\mathrm {NFSR}( F_{\mathrm {upper}} )\) and \(\mathrm {NFSR}( F_{\mathrm {lower}} )\) are inequivalent.

Proof

Suppose NFSR\(( F_{\mathrm {upper}} )\) and NFSR(\( F_{\mathrm {lower}} \)) are equivalent. Then there is a permutation \( \sigma \) on the set \( \{0,1,\ldots , n-1\} \) such that \( \sigma ( F_{\mathrm {upper}}) = F_{\mathrm {lower}} \). Let

$$\begin{aligned} \varOmega (F_{\mathrm {upper}})= [i_k+l_k,\ldots , i_k]\parallel [i_{k-1}+l_{k-1},\ldots , i_{k-1}]\parallel \cdots \parallel [i_1+l_1,\ldots , i_1], \end{aligned}$$

and

$$\begin{aligned} \varOmega (F_{\mathrm {lower}})= [j_k+m_k,\ldots , j_k]\parallel [j_{k-1}+m_{k-1},\ldots , j_{k-1}]\parallel \cdots \parallel [j_1+m_1,\ldots , j_1]. \end{aligned}$$

Note that both NFSR\(( F_{\mathrm {upper}} )\) and NFSR(\( F_{\mathrm {lower}} \)) are standard NFSRs, and so \( \sigma \) only permutes the order of \([i_1+l_1,\ldots , i_1] ,\ldots , [i_k+l_k,\ldots , i_k]\). Then for \( 1\le u\le k \) we have

$$\begin{aligned} (\sigma (i_u),\sigma (i_u+l_u)) \in \{(j_1,j_1+m_1),(j_2,j_2+m_2),\ldots , (j_k,j_k+m_k)\}. \end{aligned}$$

Since the entry \( a_{u,v} \) in \( \mathcal {M}(F_{\mathrm {upper}}) = (a_{u,v})_{k\times k} \) is the coefficient of \( x_{i_v} \) in \( f_{i_u+l_u} \), it follows that there is a \( k\times k \) permutation matrix A such that

$$\begin{aligned} \mathcal {M}(F_{\mathrm {lower}}) = A \cdot \sigma (\mathcal {M}(F_{\mathrm {upper}})) \cdot A^{T}. \end{aligned}$$
(10)

Since

$$\begin{aligned} A\cdot \left( \begin{array}{cccc} 1 &{} 0 &{} \cdots &{} 0 \\ 0 &{} 1 &{} \cdots &{} 0 \\ \vdots &{} \vdots &{} \vdots &{} \vdots \\ 0 &{} 0 &{} \cdots &{} 1\\ \end{array} \right) \cdot A^{T} = \left( \begin{array}{cccc} 1 &{} 0 &{} \cdots &{} 0 \\ 0 &{} 1 &{} \cdots &{} 0 \\ \vdots &{} \vdots &{} \vdots &{} \vdots \\ 0 &{} 0 &{} \cdots &{} 1\\ \end{array} \right) , \end{aligned}$$

we have

$$\begin{aligned} A\cdot \sigma (\mathcal {M}(F_{\mathrm {upper}})) \cdot A^{T} = \left( \begin{array}{cccc} 1 &{} \cdots &{} *&{} *\\ *&{} 1 &{} \cdots &{} *\\ \vdots &{} \vdots &{} \vdots &{} \vdots \\ *&{} *&{} \cdots &{} 1\\ \end{array} \right) , \end{aligned}$$

i.e., multiplying A on the left and \( A^{T} \) on the right of \( \sigma (\mathcal {M}(F_{\mathrm {upper}})) \) will not change the main diagonal. It can be seen that when \( k>1 \), the first entry in \( \mathcal {M}(F_{\mathrm {lower}}) \) is 0 while the first entry in \( A\cdot \sigma (\mathcal {M}(F_{\mathrm {upper}})) \cdot A^{T} \) is 1, a contradiction to (10). Hence, NFSR\(( F_{\mathrm {upper}} )\) and NFSR(\( F_{\mathrm {lower}} \)) are inequivalent when \( k>1 \). \(\square \)

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Wang, XJ., Tian, T. & Qi, WF. A generic method for investigating nonsingular Galois NFSRs. Des. Codes Cryptogr. 90, 387–408 (2022). https://doi.org/10.1007/s10623-021-00982-5

Download citation

  • Received:

  • Revised:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s10623-021-00982-5

Keywords

Mathematics Subject Classification

Navigation