Determine the Degree of Annihilators by Using Run-Length Property of
Pseudorandom Sequences
Fan Zhang
College of Computer and Information Technology
Xinyang Normal University
Xinyang, Henan, China
Zhangfan0376@163.com
Junjie He, Chuanda Qi, Hui Wang
College of Mathematics and Information Science
Xinyang Normal University
Xinyang, Henan, China
qichuanda@sina.com
Abstract—The effectiveness of algebraic attacks of ciphers
depends on the algebraic degrees of annihilators of nonlinear
Boolean functions and its complementary function. By using
the run-lengths property of pseudorandom sequences, it is
proved that there exists the annihilator of algebraic degree
n-k of Boolean function or its complementary function, if
there exists a subspace of dimension k in the zero set or the
support set of the Boolean function.
Keywords-Boolean function; annihilators; algebraic
attacks; m-sequence; run-length
I. INTRODUCTION
LFSR-based algebraic attack is brought forward by N.
Courtois et.al.
[1]
, as soon as the approach is proposed, it is
regarded as a great threat to the current sequence cipher
system. By using algebraic attacks, people have success-
fully deciphered Toycrypt and LILI-128
which are de-
signed by using Boolean function with favorable property
and can resist all the known attacks
[2-4]
. The effectiveness
of algebraic attacks depends on the algebraic degrees of
the annihilators of nonlinear Boolean function f and its
complementary function
1 f⊕
[5]
. The lower the algebraic
degree of
f or 1 f⊕ annihilator is, the lower the compu-
tational complexity of the algebraic attack is. Conse-
quently, it is the key to the implementation of algebraic
attacks in search of the low-degree annihilators of Boo-
lean function. Reference [6] proved the existing condi-
tions of low-degree annihilators of Boolean function. Ref-
erence [7] presented a sufficient condition which there
exists annihilator of algebraic degree
nk− of Boolean
function. In this paper, it is proved that there exists annihi-
lator of algebraic degree n-k of Boolean function
f or its
complementary function
1 f⊕ by using the run-lengths
property of pseudorandom sequences, if there exists a
k -
dimension subspace in the zero set or the support set of
Boolean function.
II. T
HE RUN-LENGTHS PROPERTY OF PSEUDORANDOM
SEQUENCES
Definition 1 Let
0
{}
ii
a
∞
=
be a sequence with cycle of T
on
2
, then arrange a cycle section
01 1
,,,
T
aa a
" of
0
{}
ii
a
∞
=
on a circle in turn, meanwhile, make
1T
a
and
0
a
adjacent. Here, we call the 1s (or 0s) which are connected
with each other on the circle 1-run-length (or 0-run-
length). It is the number of the 1s which are linked to-
gether in a run-length that is named the length of run-
length.
Completely random sequence shows such run-length
property that: in the former
N items of the sequence, the
number of the run-length with length of 1 approximately
accounts for half of the total; the number of the run-length
with length of
(2)ii≥ approximately takes up 1/2
i
of
the total;..., moreover, in all the run-lengths with the same
length, The number of 0-run-length and 1-run-length each
approximately account for half. If a cycle sequence exhib-
its the similar run-length property as mentioned above, it
is called that the sequence displays the run-lengths prop-
erty of pseudorandom sequences.
m-sequence
[8]
indicates ideal run-length property, and
its run-length property is also taken as the criteria on
whether the cycle sequence exhibits the run-lengths prop-
erty of pseudorandom sequences.
The run-lengths property of m-sequence: in a cycle
section of m-sequence of order n (T=
21
n
− ), the total
number of the run-lengths is
1
2
n−
, and The number of 0-
run-lengths and 1-run-lengths each account for half. And
what’s more:
(1) When
12ln
≤−, the run-lengths with length of l
takes up
1/2
l
of the total (that is,
1
2
nl−−
) , here, The num-
ber of 0-run-lengths and 1-run-lengths each account for
half ;
(2) The number of the 0-run-lengths with length of
1n
is 1, and the number of the 1-run-length with length
of
1n
is 0;
(3) The number of the 0-run-lengths with length of n
is 0, and the number of the 1-run-lengths with length of n
is 1;
(4) The number of the run-lengths with length of
greater than n is 0.
In terms of the run-lengths property of m-sequence, it
is easy to verify the following theorem.
Theorem 1 In a cycle section of m-sequence of order n,
k-dimension
(1 )kn
≤ all-one vector (1,1, ,1)" exactly
appears
2
nk
times in the vector sequence
21
111
{( , , , )}
n
ii ik i
bb b
++−=
" , thus
21
11
1
2
n
nk
ii ik
i
bb b
−
−
++−
=
=
⊕
" .