Generalization of the Self-Shrinking Generator in the Galois Field GF(𝑝^𝑛)

Abstract

The proposed by Meier and Staffelbach Self-Shrinking Generator (SSG) which has efficient hardware implementation only with a single Linear Feedback Shift Register is suitable for low-cost and fast stream cipher applications. In this paper we generalize the idea of the SSG for arbitrary Galois Field GF(𝑝^𝑛). The proposed variant of the SSG is called the 𝑝-ary Generalized Self-Shrinking Generator (pGSSG). We suggest a method for transformation of a non-binary self-shrunken pGSSG sequence into balanced binary sequence. We prove that the keystreams of the pGSSG have large period and good statistical properties. The analysis of the experimental results shows that the pGSSG sequences have good randomness properties. We examine the complexity of exhaustive search and entropy attacks of the pGSSG. We show that the pGSSG is more secure than SSG and Modified SSG against these attacks. We prove that the complexity of the used pGSSG attacks increases with increasing the prime 𝑝. Previously mentioned properties give the reason to say that the pGSSG satisfy the basic security requirements for a stream chipper and can be useful as a part of modern stream ciphers.

1. Introduction

The binary Pseudorandom Sequences (PRSs) with maximum period and good statistical and correlation properties have established themselves as foundation for generation of many signals used in modern communication and information systems. Among the most important applications [1, 2] of these signals are the Code Division Multiple Access (CDMA) systems, wireless networks, and communication systems where the multiple access interference is minimized. Generators of pseudorandom sequences for security at authorization process and stream cipher are other key areas of the PRSs implementation in different kinds of local and global networks.

A great number of methods for generation of pseudorandom sequences are used in practice [3–13]. They are divided as linear and nonlinear [5]. Most linear methods such as Linear Congruent Generator, Multiplicative Linear Congruent Generator and Multiply Recursive Generator [5] cannot be used for ensuring the security and for information encryption in the communication network. Digital multi-step and formal series [5] can solve that problem but they are too slow because many steps are done recursive. In order to ensure practical stability of a chosen crypto-algorithm it is necessary to break the linearity in the generated linear sequence. It could be done by applying a nonlinear function over a part of the generated bits for additional allocation [5, 12]. The binary sequences with maximum period (𝑚-sequences) are mainly used in many communication systems because of their properties such as uniformly allocation of the binary digits and the runs over its period and the ideal two-level autocorrelation. The main methods for generation of the 𝑚-sequences are Linear Feedback Shift Register (LFSR) which function is described by algebra in finite Galois field GF(2) and Feedback with Carry Shift Register (FCSR) where the algebra in finite 2-adic field is used.

Self-shrinking generator [11] is a keystream generator used as a stream cipher. It is based on the shrinking principle [4, 14] and has remarkably low hardware requirements. So far, it has shown considerable resistance against cryptanalysis. The binary sequences generated by shrinking generator have very good encryption properties [4, 5, 9, 12, 15, 16].

The self-shrinking generator (SSG) was proposed by Meier and Staffelbach at Euro-crypt'94 in [11]. It is a variant of the original Shrinking Generator given by Coppersmith et al. in [4]. This amazingly simple cipher, containing a single LFSR, has up to now surprisingly well-resisted all the known cryptographic attack techniques. In [17] Mihaljevic presented a faster attack with minimal time complexity 𝑂(2^0.5𝐿) that needs a longer part of keystream sequence. It is shown that cryptanalysis is successful with high probability after 2^𝐿−𝑙 steps, 𝑙≤𝐿/2, where 𝑙 is 𝑙-bit section of the keystream and 𝐿 is the key length. Since the procedure is done for 𝐿/4≤𝑙≤𝐿/2, the running time can vary from 2^0,5𝐿 in the very best case to 2^0,75𝐿 under more unfavorable circumstances. Later Zenner et al. improve the cryptanalysis of self-shrinking generator. The attack [18] is based on a backtracking algorithm and will reconstruct the key from a short sequence of known keystream bits. The algorithm takes at most 𝑂(2^0.694𝐿) steps, where 𝐿 is the key length.

An attack on SSG requiring very small keystream data (2.41𝑛) is the binary decision diagram (BDD) cryptanalysis proposed by Krause in [19] with time complexity 𝑂(2^0.656𝑛) and equivalent memory complexity 𝑂(2^0.656𝑛). The BBD-attack was improved in [20] with the same time complexity and only 𝑂(𝑛²) memory complexity.

The best tradeoff between time, memory and data complexity today is the new guess-and-determine cryptanalysis [21]. The time complexity of this attack is 0𝑥0039𝑓(2^0.571𝑛) and memory complexity 𝑂(𝑛²) from 0𝑥0039𝑓(2^0.194𝑛) keystream bits for 𝑛<100, and time complexity 𝑂(2^0.556𝑛) and memory complexity 𝑂(𝑛²) from 0𝑥0039𝑓(2^0.161𝑛) keystream bits for 𝑛≥100.

In this paper a 𝑝-ary generalized self-shrinking generator which produces nonbinary sequences is proposed. A method for transformation of nonbinary self-shrunken sequence into balance binary sequence is given.

The paper is organized as follows. First, the basic principles of the 𝑝-ary LFSR are described. In Section 3 the function of the Self-Shrinking Generator is given. The working algorithm of the 𝑝-ary Generalized Self-Shrinking Generator for Galois Field GF(𝑝^𝑛) is given in Section 4. Then the properties of the proposed pGSSG are discussed and analyzed. Finally, the security of the pGSSG against the exhaustive search and entropy attacks are analysed.

2. Basics Principles of the 𝑝-Ary LFSR

The basic principles of wide spread LFSR registers [5, 7, 10, 12] for GF(𝑝^𝑛) when 𝑝 is arbitrary prime will be given in this section.

Real systems use pLSFR constructed in two different architectures Fibonachi and Galois. The properties of the finite Galois field [7, 22] are used.

Definition 1. If 𝑝 is a prime then generated 𝑝-ary pseudorandom sequence (pPRS) consists of numbers 0÷𝑝−1 and the appearance of every number is independent by the value of the previous and the following digits in the sequence.

2.1. pLFSR with Fibonachi Architecture

Definition 2. 𝑝-ary LFSR with Fibonachi architecture and length 𝐿 (Figure 1) consists of 𝐿 stages (delay elements) 𝑎_𝑖, 𝑖=0,1,…,𝐿−1, and one input and one output.

Figure 1 

pLFSR register with Fibonachi architecture.

Every element can remember one 𝑝-ary number. The register is initialized by 𝑝-ary sequence (𝑎₀,𝑎₁,…,𝑎_𝐿−1).

During each clock cycle the following operations are performed.(1)The content of stage 0 is output and forms part of the output sequence.(2)The content of element 𝑖 is passed to element 𝑖−1 for each 𝑖, 1≤𝑖≤𝐿−1.(3)A calculation of the linear recurrent dependency is done 𝑎_𝑛=^𝐿_𝑖=1𝑞_𝑖𝑎_𝑛−𝑖mod𝑝,for𝑛≥𝐿 (1) and its result is stored in the most left element of the register.

The output sequence is described by (1) taking into consideration 𝑛≥𝐿, the first 𝐿−1𝑝-ary digits are eliminated from the output sequence.

Every configuration of this architecture is defined by the feedback coefficients 𝑞_𝑖, 𝑖=1,2,…,𝐿. The generated output sequence 𝐴=(𝑎₀,𝑎₁,𝑎₂,…) is well defined for 𝑞_𝐿≠0 and the feedback polynomial 𝑞(𝑥)=𝑞_𝐿𝑥^𝐿+𝑞_𝐿−1𝑥^𝐿−1+⋯+𝑞₁𝑥−1. (2) Every infinite 𝑝-ary sequence 𝐴 can be represented by its generating function𝐴(𝑥)=^∞_𝑖=0𝑎_𝑖𝑥^𝑖 (3) which is an element of the ring GF(𝑝)[𝑥] of the formal powers with coefficients in GF(𝑝).

The generated sequence 𝐴 is periodic only if the generating function 𝐴(𝑥) could be represented as a quotient of two polynomials𝐴(𝑥)ℎ(𝑥)=−𝑞(𝑥). (4) The generated sequence 𝐴 is strictly periodic if the following condition is in effect:deg(ℎ(𝑥))<deg𝑞(𝑥). (5) The reverse dependence is in effect as well. If 𝐵=(𝑏₀,𝑏₁,𝑏₂,…) is a strictly periodic sequence and 𝐵(𝑥)=−ℎ(𝑥)/𝑞(𝑥) is its generating function then 𝑞(𝑥) is a connection polynomial of the pLFSR which generates sequence 𝐵 and a polynomial ℎ(𝑥) defines the initial state of the register by using ℎ(𝑥)=^𝐿−1_𝑘=0^𝑘_𝑖=0𝑞_𝑖𝑎_𝑘−𝑖𝑥^𝑘. (6)

2.2. pLFSR with Galois Architecture

Definition 3. 𝑝-ary LFSR with Galois architecture and length 𝐿 (Figure 2) consists of 𝐿 delay elements 𝑎_𝑖, 𝑖=0,1,…,𝐿−1, and one input and one output. The multipliers of the feedback are given as 𝑞₁,𝑞₂,…,𝑞_𝐿. Every element can remember one 𝑝-ary number. The register is initialized by 𝑝-ary sequence (𝑎₀,𝑎₁,…,𝑎_𝐿−1).

Figure 2 

pLFSR register with Galois architecture.

During each clock cycle the following operations are performed.(1)The content of stage 0 is output and forms part of the output sequence.(2)The content of element 𝑖 is passed to element 𝑖−1 for each 𝑖, 1≤𝑖≤𝐿−1, and the following recurrent dependencies are in effect 𝑎^′_𝑖=𝑎_𝑖+1+𝑞_𝑖+1𝑎₀𝑎mod𝑝,0≤𝑖≤𝐿−2,_′𝐿−1=𝑞_𝐿𝑎₀mod𝑝. (7)(3)The output of the element 0 is implemented in every multiplier of feedbacks and a sum with the previous element by modulo 𝑝 is done.

The Galois architecture of pLFSR is described by the feedback polynomial 𝑞(𝑥) which is defined by (2) and the polynomial ℎ(𝑥)ℎ(𝑥)=𝑎₀+𝑎₁𝑥+⋯+𝑎_𝐿−1𝑥^𝐿−1 (8) which is defined by the initial state of the register (𝑎₀,𝑎₁,…,𝑎_𝐿−1).

The generated output sequence 𝐵=(𝑏₀,𝑏₁,𝑏₂,…) is a sequence of polynomial coefficients 𝐵(𝑥)=−ℎ(𝑥)/𝑞(𝑥). The reverse statement for defining 𝑞(𝑥) and initial state by using (8) is also in effect.

2.3. Properties of the pLFSR Sequences

One of the most important properties of the pLFSR is the maximal period [22] and it depends on the length of the registers 𝐿𝑇≤𝑝^𝐿−1. (9) pPRS sequences which have a maximal period (mp-sequences) are used in cryptography and in communication systems for designing complex signals due to their good correlation properties. In order to generate mp-sequences it is necessary that the feedback polynomial 𝑞(𝑥) of the pLFSR is primitive in extended Galois field GF(𝑝^𝐿).

The uniform allocation of the 𝑝-ary digits and their runs (series) is another important property. The following statements are true.(i)The number of appearances of all nonzero elements 𝑁_𝑗 in maximal period 𝑇=𝑝^𝐿−1 is 𝑁_𝑖=𝑝^𝐿−1 for 𝑖=1,2,…,𝑝−1 and the number of zero elements is 𝑁₀=𝑝^𝐿−1−1. (ii)Every nonzero 𝑝-ary runs (series) 𝐵 with length 𝑠, 1≤𝑠≤𝐿 appears in a period 𝑝^𝐿−𝑠 times and 𝑝^𝐿−𝑠−1 times if it is zero.

Figure 3 shows the 3LFSR register with Galois architecture and length 𝐿=2. As one can see the output numbers 1 and 2 appear 𝑁₁=𝑁₂=3 times in one period and the number of zeros is 𝑁₀=2. All nonzero runs with length 2 appear only ones and zero run is not used.

Figure 3 

3LFSR register with Galois architecture and length 𝐿=2.

3. Nonbinary Self-Shrinking Generator

3.1. Basics of Shrinking Generators

The shrinking generator [4, 9] consists of two Linear Feedback Shift Registers (LFSR) 𝐴 and 𝐵 generating the 𝑚-sequences (𝑎_𝑖)_𝑖≥0 (denoted as 𝐴 sequence) and (𝑏_𝑖)_𝑖≥0 (denoted as 𝐵 sequence), respectively. The keystream sequence (𝑧_𝑗)_𝑗≥0 is constructed from these two sequences according to the following selection rule: for every clock 𝑖, consider the selection bit 𝑏_𝑖. If 𝑏_𝑖=1, the output is 𝑎_𝑖. Otherwise, discard both 𝑏_𝑖 and 𝑎_𝑖. This way, a nonlinear keystream is generated. Even a cryptanalyst who knows part of the keystream sequence cannot tell easily which (𝑧_𝑗)_𝑗≥0 corresponds to which 𝑎_𝑖, since the length of the gaps (i.e., the number of 𝑎_𝑖 that has been discarded) is unknown. In [4, 14] the shrinking generator is shown to have good algebraic and statistical properties. It is shown that the number of attacks that could reconstruct the initial state of 𝐴 and 𝐵 increases and requires exponential running time in the length of |𝐵| register (LFSR 𝐵).

The self-shrinking generator is a modified version of the shrinking generator and was first presented by Meier and Staffelbach in [11].

The self-shrinking generator requires only one LFSR 𝐴, whose length will be denoted by 𝐿. The LFSR generates an 𝑚-sequence (𝑎_𝑖)_𝑖≥0. The selection rule is the same as for shrinking generator, using the even bits 𝑎₀,𝑎₂,𝑎₄,… as 𝐵-bits and the odd bits 𝑎₁,𝑎₃,𝑎₅,… as 𝐴-bits in the above sense. Thus, the self-shrinking rule requires a couple (𝑎_2𝑖,𝑎_2𝑖+1) as input and outputs 𝑎_2𝑖+1 if 𝑎_2𝑖=1.

The close relationship between shrinking and self-shrinking generator is shown in Figure 4.

(a)

(b)

Figure 4 

Shrinking and self-shrinking generator.

In [12] an algorithm is given that transforms an 𝐿-bit self-shrinking generator into a 2𝐿-bit shrinking generator. It is also shown that a shrinking generator with register lengths |𝐴| and |𝐵| has an equivalent self-shrinking generator of length 𝐿=2⋅(|𝐴|+|𝐵|). Despite this similarity, the self-shrinking generator has shown even more resistance to cryptanalysis than the shrinking generator [18].

3.2. 𝑝-ary Generalized Self-Shrinking Generator

The proposed 𝑝-ary generalized Self-Shrinking Generator (pGSSG), given in Figure 4, consists of a pLFSR generator 𝐴, whose length will be denoted by 𝐿. It generates sequence (𝑎_𝑖)_𝑖≥0 with 𝑝-ary digits (i.e., (𝑎_𝑖)_𝑖≥0, 0≤𝑎_𝑖≤𝑝−1) and 0≤𝑖≤𝐿−1. The multipliers of the feedbacks are given by coefficients 𝑞₁,𝑞₂,…,𝑞_𝐿, 𝑞_𝐿∈[0,1,…,𝑝−1] of the primitive polynomial in GF(𝑝^𝐿). Every element can remember one 𝑝-ary number. The register is initialized by 𝑝-ary sequence (𝑎₀,𝑎₁,…,𝑎_𝐿−1).

The pGSSG selects a portion of the output 𝑝-ary LFSR sequence by controlling the 𝑝-ary LFSR itself using the following algorithm.

Definition 4. The algorithm of the 𝑝-ary Generalized Self-Shrinking Generator (Figure 5) consists of the following steps.(1)The 𝑝-ary LFSR is clocked with clock sequence with period 𝑇.(2)The output pLFSR sequence is split into 𝑝-tuples 𝑎_𝑝𝑖,𝑎_𝑝𝑖+1,𝑎_𝑝𝑖+2,…,𝑎_{𝑝𝑖+(𝑝−1)}, 𝑖=0,1,….(3)If 𝑎_𝑝𝑖=0 the whole 𝑝-tuple is discarded from the GSSG output, that is, the output is shrunken. (4)When 𝑎_𝑝𝑖≠0, the corresponding digit 𝑎_{𝑝𝑖+𝑎𝑝𝑖} in the 𝑝-tuple forms the output of the GSSG. For example, if 𝑎_𝑝𝑖=1, then 𝑎_𝑝𝑖+1 is output and the other digits 𝑎_𝑝𝑖,𝑎_𝑝𝑖+2,…,𝑎_{𝑝𝑖+(𝑝−1)} are discard. If 𝑎_𝑝𝑖=2, then 𝑎_𝑝𝑖+2 is output and the other digits 𝑎_𝑝𝑖,𝑎_𝑝𝑖+1,𝑎_𝑝𝑖+3,…,𝑎_{𝑝𝑖+(𝑝−1)} are discard and so on. If 𝑎_𝑝𝑖=𝑝−1, then 𝑎_{𝑝𝑖+(𝑝−1)} is output and the other digits 𝑎_𝑝𝑖,𝑎_𝑝𝑖+1,…,𝑎_{𝑝𝑖+(𝑝−2)} are discard.(5)The shrunken 𝑝-ary GSSG output sequence is transformed into binary sequence in which every 𝑝-ary number is presented with ⌈log₂(𝑝−1)⌉ binary digits, where ⌈𝑥⌉ is the smallest integer which is greater or equal to 𝑥. Every output number 𝑖 from 1 to 𝑝−1 of 𝑝-ary GSSG sequence is depicted with 𝑝-ary expansion of the number: ()+2𝑖−1^{⌈log2𝑝−1⌉}−𝑝−12. (10) For example the transformation of every 𝑝-ary digit for 𝑝=3,5,7,11,13 is done according to the Table 1.(6)Every 𝑝-ary zero in its 𝑖 appearance (𝑖=1,2,3,…) of the generated 𝑝-ary sequence can be represented binary by number 𝑑_𝑖, 𝑑_𝑖=𝑑_𝑖−1+1mod𝑝if𝑑_𝑖−11<𝑝−1if𝑑_𝑖−1=𝑝−1 (11) and initial condition 𝑑₀=0.

Table 1 

Binary transformation of 𝑝-ary digit.

Figure 5 

𝑝-ary Generalized Self-Shrinking Geneator.

3.3. Examples

3.3.1. 3GSSG

Let us chose Extended Galois field GF(3³) and the primitive polynomial that generates GF(3³) is 𝑎³+2𝑎²+1. Then the corresponding pLFSR (i.e., 3LFSR) will be as shown in Figure 6.

Figure 6 

3LFSR for GF(33) and primitive polynomial 𝑎3+2𝑎2+1.

The feedback polynomial is 𝑞(𝑥)=2𝑥³+𝑥²−1 and all algebraic function is done modulo 𝑝 (i.e., 𝑝=3).

Let the initial state be [𝑎₂,𝑎₁,𝑎₀]=[0,0,1].

For all possible 3-tuples generated by the 3LFSR the 3GSSG output for a period will be [011120210220022110] and the way of its derivation according to the given algorithm is shown in Table 2.

Table 2 

Output of the 3GSSG.

The period of sequence is 𝑇=18. The output is chosen from the value of the first symbol of 3-tuple, which defines which symbol forms the 3GSSG output. It is pointed out by the bold digits. Then the 3-ary output sequence is transformed into binary by the rules 5 and 6 in the pGSSG algorithm for 𝑝=3 given in Table 1.

The binary output is given in the brackets in Table 2.

3.3.2. 5GSSG

Let us chose Extended Galois field GF(5³) and primitive polynomial is 𝑎³+3𝑎²+2. The corresponding pLFSR (i.e., 5LFSR) is shown in Figure 7.

Figure 7 

3LFSR for GF(53) and primitive polynomial 𝑎3+3𝑎2+2.

The feedback polynomial is 𝑞(𝑥)=2𝑥³+𝑥²−1 and all algebraic function is done modulo 5 (i.e., 𝑝=5).

Let the initial state be [𝑎₂,𝑎₁,𝑎₀]=[1,1,0].

For a part of all possible 5-tuples generated by the 5LFSR the output of the 5SSG generator for a part of period will be [01422213100342201230103404012000]. The way of its derivation according to the given algorithm is shown in Table 3.

Table 3 

Output of the 5GSSG.

The period is 𝑇=100. The output is chosen from the value of the first symbol of 5-tuple, which defines which position symbol from this point to be selected to exit. Finally the 5-ary output sequence is transformed into binary by the rules 5 and 6 in the pGSSG algorithm for 𝑝=5 given in Table 1. The binary output is given in the brackets in Table 3.

4. Properties of the pGSSG Output Sequence

The research of the 𝑝-ary GSSG has been modeled with Visual C++. To analyze the properties of the 𝑝-ary GSSG output sequence have been made more than 1000 tests with prime 𝑝 up to 257 and various primitive feedback polynomials and initial states.

In this section first the pGSSG period is established. Then is proven that the output pGSSG sequence is balanced, that is, the number of 1s and 0s are equal in a period of pGSSG sequence. In Section 4.3 the minimum length of the used pLFSR registers to guarantee a key length of 512 and 1024 bits, which is useful for cryptographic applications nowadays, is calculated. Finally the good randomness properties of the pGSSG output sequences are proven by the results of the statistical NIST test suite.

4.1. Period of pGSSG

Hence a 𝑝-ary LFSR sequence is with period 𝑇=𝑝^𝐿−1 then the pGSSG output sequence also is periodic. In fact after 𝑝(𝑝^𝐿−1) bits of the original sequence, the sequence of 𝑝-tuples 𝑎_𝑝𝑖,𝑎_𝑝𝑖+1,𝑎_𝑝𝑖+2,…,𝑎_{𝑝𝑖+(𝑝−1)} has been processed and the next 𝑝-tuple will be the same as first 𝑎₀,𝑎₁,𝑎₂,…,𝑎_𝑝−1. As is well known, the 𝑝-tuples occurs balanced in one 𝑝𝑚-sequence period. Therefore 1/𝑝 of all 𝑝-tuples will begin with bit 0,1/𝑝 of all will begin with 1 and so on 1/𝑝 of all will begin with 𝑝−1. Thus the 𝑝^𝐿−1  𝑝-tuples will be discarding because they begin with 0 bit. Remaining (𝑝−1)𝑝^𝐿−1  𝑝-tuples will produce an one bit in the output sequence because this 𝑝-tuples begin with nonzero bits. Consequently the period of the 𝑝-ary GSSG output sequence will be𝑇_𝑝GSSG=𝑝−1𝑝^𝐿−1 (12)𝑝-ary digits.

When pGSSG output sequence is transformed into balanced binary sequence the period will be𝑇_2GSSG=𝑇_𝑝GSSGlog₂𝑝−1 (13) bits.

4.2. Number of Elements in 𝑝-Ary GSSG Sequence

Since the 𝑝𝑚-sequence, produced by the 𝑝-ary LFSR is balanced and the pGSSG output sequence also is balanced the number of the each elements 0,1,…,𝑝−1 is equal to𝑁_𝑖=𝑝−1𝑝^𝐿−2,𝑖=0,1,…,𝑝−1. (14) After binary transformation the balanced property is in fact also, thus the number of zeros and ones are equal to𝑁_𝑏0=𝑁_𝑏1=𝑝−1𝑝^𝐿−2⋅log₂𝑝−1. (15) The experimental results for different pGSSG and their parameters are given in Table 4.

Table 4 

Results for simulated 3GSSG and 5GSSG.

4.3. Key for Encryption

The encryption key for the 𝑝GSSG is an initial state (𝑎₀,𝑎₁,…,𝑎_𝐿−1) of the pLFSR register. Thus the encryption key will be long 𝐿𝑝-ary digits.

One 𝑝-ary digit may be presented by ⌊log₂𝑝⌋ bits, where ⌊𝑥⌋ denote the smallest integer greater and equal to 𝑥. Consequently length of the encryption key is𝐿_Key=𝐿⋅log₂𝑝. (16) As one can see the greater 𝑝 is the longer the key is. Table 5 shows the minimum length of the used pLFSR register to guarantee a key length of 512 and 1024 bits, which are useful for cryptographic applications nowadays.

Table 5 

Minimum length of pLFSR to guarantee a given min key length.

4.4. Statistical Properties

To test statistical properties of the keystreams generated by the pGSSG with prime 𝑝 up to 257, 1000 sequences of length 10⁶ have been tested by the National Institute of Standards and Technology (NIST) statistical test suite [23]. Table 6 shows the NIST test results for two sets of 100 keystreams each of length 10⁶ for 𝑝=17 and 𝑝=257. To generate these 100 keystreams randomly chosen primitive polynomials and initial states are used.

Table 6 

Results from the NIST test suite for two sets of 100 keystreams of length 10⁶, generated by the pGSSG.

The results demonstrate that pGSSG keystreams have good randomness properties, that is, they are well balanced, uniform, scalable and uncompressible.

4.5. Implementation

Unfortunately, the hardware implementation of the pGSSG is not as simple as the original SSG, because the algebraic operations are performed in the GF(𝑝), 𝑝≥3. It takes ⌊log₂𝑝⌋ triggers to present one 𝑝-ary number. Hardware accelerators can perform the computationally intensive operations far quicker. Field-Programmable Gate Arrays (FPGAs) are well-suited for this application due to their reconfigurability and versatility.

The pGSSG is more suitable for software implementation. The cases with 𝑝=17 and 𝑝=257 are particularly suitable, because the binary output of the generator produces 4 or 8 bits at a time, respectively.

5. Cryptanalysis

The goal of the stream cipher attack based on a clock controlled generators is to recover the secret key that includes the initial state of the used LFSRs. For better security the key may contain the feedback polynomial of the LFSRs. In this section, the security of the pGSSG against the exhaustive search and entropy attacks are analysed.

The suggested from Maier and Staffelbach two general attacks named exhaustive search attack and entropy attack [11] recover the initial state of the SSG from the knowledge of the short segment of the generated keystream requiring respectively 𝑂(2^0.79𝑛) and 𝑂(2^0.75𝑛) computational steps.

In these attacks we assume that the secret key consists only of the initial state of the 𝑝-ary GSSG.

5.1. Exhaustive Search Attack

Let 𝑧₀,𝑧₁,𝑧₂,… be a known portion of the binary keystream generated by pGSSG. As the prime 𝑝 is also known the attacker can divide it by ⌈log₂𝑝−1⌉ bits. Each portion of ⌈log₂𝑝−1⌉ bits presents one 𝑝-ary number.

Let then 𝑏₀,𝑏₁,𝑏₂,… be a known 𝑝-ary portion of the pGSSG. The 𝑝-ary number 𝑏_𝑗 for some 𝑗 is generated by the 𝑝-tuple 𝑎_𝑖,𝑎_𝑖+1,𝑎_𝑖+2,…,𝑎_{𝑖+(𝑝−1)} of the output pLFSR sequence 𝑎₀,𝑎₁,𝑎₂,…, 𝑎_𝑖∈[0,1,…,𝑝−1], where the index 𝑖 is unknown.

From the knowledge of the first 𝑝-ary number 𝑏₀ one can conclude that for the first 𝑝-tuple there is 𝑝−1 possible cases:1,𝑏₀,𝑎_𝑖+2,…,𝑎_{𝑖+(𝑝−1)},2,𝑎_𝑖+1,𝑏₀,…,𝑎_{𝑖+(𝑝−1)},⋯𝑝−1,𝑎_𝑖+1,𝑎_𝑖+2,…,𝑏₀. (17) For each case in (17) there are 𝑝^𝑝−2 possibilities for the 𝑝−2 unknown 𝑝-ary numbers. In other hand by definition 4 of the pGSSG algorithm for the 𝑝-ary number 𝑏₀ there are two possible cases: first, the one 𝑝-ary number from 1 to 𝑝−1, defined by (10) or second, the 𝑝-ary zero in its appearance by (11).

Therefore the number of possibilities for the first 𝑝-ary number 𝑏₀ is 2⋅(𝑝−1)⋅𝑝^𝑝−2.

For the next known 𝑝-ary number 𝑏₁ there are the same 2⋅(𝑝−1)⋅𝑝^𝑝−2 possible cases for the second 𝑝-tuple 𝑎_𝑝+𝑖,𝑎_𝑝+𝑖+1,𝑎_𝑝+𝑖+2,…,𝑎_{𝑝+𝑖+(𝑝−1)}:1,𝑏₁,𝑎_𝑝+𝑖+2,…,𝑎_{𝑝+𝑖+(𝑝−1)},2,𝑎_𝑝+𝑖+1,𝑏₁,…,𝑎_{𝑝+𝑖+(𝑝−1)},⋯𝑝−1,𝑎_𝑝+𝑖+1,𝑎_𝑝+𝑖+2,…,𝑏₁. (18) In addition to the above cases there are another 𝑝^𝑝−1 possibilities for which the output pGSSG sequence is shrunken0,𝑎_𝑝+𝑖+1,𝑎_𝑝+𝑖+2,…,𝑎_{𝑝+𝑖+(𝑝−1)}. (19) Hence all possible cases for the 𝑝-ary number 𝑏₁ are 𝑉=2⋅𝑝−1⋅𝑝^𝑝−2+𝑝^𝑝−1. (20) For each of these 𝑉 possibilities there are another 𝑉 possibilities for the next 𝑝-tuple and so on.

Therefore, for reconstructing 𝑚  𝑝-tuples, that is, 𝑛=𝑚⋅𝑝  𝑝-ary numbers, are needed𝑆=𝑉^𝑚−1≈𝑉^𝑛/𝑝 (21) possible states for the pLFSR.

Example 1 (𝑝=3). The known bit portion of the sequence 𝑧₀,𝑧₁,𝑧₂,… is equal to the known 𝑝-ary portion 𝑏₀,𝑏₁,𝑏₂,… of the pGSSG because ⌈log₂(3−1)⌉=1 bits. Every bit 0 can present the 3-ary bit 1 or the 3-ary zero. The bit 1 can present the 3-ary bit 2 or the 3-ary zero (see Table 1). From the known first bit 𝑏₀ there are two possible cases for the first triple 𝑎_𝑖,𝑎_𝑖+1,𝑎_𝑖+21,𝑏₀,𝑎_𝑖+2,2,𝑎_𝑖+1,𝑏₀. (22) Each 3-ary number 𝑎_𝑖∈[0,1,2], that is, the six possible cases are 1,𝑏₀,02,0,𝑏₀1,𝑏₀,12,1,𝑏₀1,𝑏₀,12,2,𝑏₀ (23) and another six possible cases in which 𝑏₀ is 3-ary zero are 1,0,02,0,01,0,12,1,01,0,12,2,0. (24) For the next triple 𝑎_𝑖+3,𝑎_𝑖+4,𝑎_𝑖+5 there are 12 possibilities of the same kind 1,𝑏₁,02,0,𝑏₁1,𝑏₁,12,1,𝑏₁1,𝑏₁,12,2,𝑏₁1,0,02,0,01,0,12,1,01,0,12,2,0 (25) and 9 possible cases 0,𝑎_𝑖+4,𝑎_𝑖+5 when the output is shrunken 0,0,00,1,00,2,00,0,10,1,10,2,10,0,20,1,20,2,2. (26) Therefore the possible cases are 𝑉=2⋅𝑝−1⋅𝑝^𝑝−2+𝑝^𝑝−1=2.3.3+3²=21, (27) which is listed above.
Then we calculate the possible pLFSR states𝑆≈𝑉^𝑛/𝑝≈21^𝑛/3=2^{(log221/3)𝑛}=2^1.464𝑛. (28)

Example 2 (𝑝=5). The number of possible cases for the 5-tuples are 𝑉=2⋅𝑝−1⋅𝑝^𝑝−2+𝑝^𝑝−1=2.4.5³+5⁴=1625 (29) and states of the used pLFSR are 𝑆≈𝑉^𝑛/𝑝≈1625^𝑛/5=2^{(log21625/5)𝑛}=2^2.133𝑛. (30)

5.2. Entropy Attack

The entropy of the 𝑝-tuples will be calculated. As mentioned above for the 𝑝-tuple 𝑎_𝑝+𝑖,𝑎_𝑝+𝑖+1,𝑎_𝑝+𝑖+2,…,𝑎_{𝑝+𝑖+(𝑝−1)} there are 𝑉 possibilities, where 2⋅(𝑝−1)⋅𝑝^𝑝−2 are in the form (18). In the half of these possibilities 𝑝-ary number 𝑏₁∈[1,2,…,𝑝−1] and the probability of each of them is (𝑝−1)/𝑝^𝑝. In the other half 𝑏₁=0 and each of them has probability 1/𝑝^𝑝. The other 𝑝^𝑝−1 possibilities of the form (19) also have probability 1/𝑝^𝑝.

Therefore, the entropy of the 𝑝-tuple is𝐻=−𝑝−1⋅𝑝^𝑝−2⋅𝑝−1𝑝^𝑝log₂𝑝−1𝑝^𝑝−𝑝−1⋅𝑝^𝑝−2⋅1𝑝^𝑝log₂1𝑝^𝑝−𝑝^𝑝−1⋅1𝑝^𝑝log₂1𝑝^𝑝=−𝑝−1²𝑝²⋅log₂𝑝−1𝑝^𝑝−𝑝−1𝑝²⋅log₂1𝑝^𝑝−1𝑝⋅log₂1𝑝^𝑝=−𝑝−1²𝑝²⋅log₂𝑝−1𝑝^𝑝−𝑝−1𝑝²+1𝑝⋅log₂1𝑝^𝑝. (31) Because the entropy per one 𝑝-ary number is 𝐻/𝑝, the entropy search among all different cases would require 2^{𝑛⋅𝐻/𝑝} steps.

For 𝑝=3 the entropy of 3-tuples is𝐻_𝑝=32=−6.27⋅log₂2127−15⋅27log₂127=4.3104. (32) Hence, the complexity of the entropy attack is 𝑂(2^{𝑛⋅𝐻/𝑝})=𝑂(2^1.43684𝑛).

The complexity of exhaustive search and entropy attack of the pGSSG for primes up to 17 is compared to the SSG and recently proposed MSSG [8] in Table 7.

Table 7 

A comparison of the complexity of the used attack for SSG, MSSG and pGSSG.

The results show that the pGSSG is more secure than SSG and MSSG against exhaustive search and entropy attack. The complexity of the used pGSSG attack increases with increasing the prime 𝑝.

6. Conclusions and Future Works

In this paper the generalization of the self-shrinking generator in Galois Field GF(𝑝^𝑛) for arbitrary prime 𝑝 is proposed. The architecture of the new 𝑝-ary Generalized Self-Shrinking Generator is suggested. It is proved that the pGSSG has large period and good statistical properties. The experimental results analysis shows that the sequence generated by pGSSG is well balanced, uniform, scalable, uncompressible and unpredictable.

The complexity of the exhaustive search and entropy attack of the pGSSG is established. It is shown that the pGSSG is more secure than SSG and MSSG against exhaustive search and entropy attack. It is proven that the complexity of the used pGSSG attack increases with increasing the prime 𝑝.

Above-mentioned properties give the reason to consider the pGSSG as a pseudorandom generator that can be useful as a part of modern stream ciphers.

However, there are some theoretical and practical issues that need to be addressed. From a theoretical point of view, improved cryptanalysis of the pGSSG keystream sequences is necessary to be done and the complexity of other known self-shrinking attacks like attack using long keystream segment, BDD-based attack and guess-and-determine attack, must be investigated.

On the practical side, the hardware FPGA implementation of the pGSSG generator must be designed. It will provide faster execution of the algebraic operations in the GF(𝑝) for any prime number 𝑃≥3.

Acknowledgment

The authors would like to thank the referees for their helpful comments.