Cryptographic properties of the Welch-Gong transformation sequence generators

Abstract

Welch-Gong (WG) transformation sequences are binary sequences of period 2 1 with two-level autocorrelation. These sequences were discovered by Golomb, Gong, and Gaal in 1998 and they verified the validity of their construction for 5 20. Later, No, Chung, and Yun found another way to construct the WG sequences and verified their result for 5 23. Dillon first proved this result for odd in 1998, and, finally, Dobbertin and Dillon proved it for even in 1999. In this paper, we investigate a two-faced property of the WG transformation sequences for application in stream ciphers and pseudorandom number generators. One is to present the randomness or unpredictability of the WG transformation sequences. The other is to exhibit the security properties of the WG transformations regarded as Boolean functions. In particular, we prove that the WG transformation sequences, in addition to the known two-level autocorrelation and three-level cross correlation with-sequences, have the ideal 2-tuple distribution, and large linear span increasing exponentially with. Moreover, it can be implemented efficiently. This is the first type of pseudorandom sequences with good correlation, statistic properties, large linear span, and efficient implementation. When WG transformations are regarded as Boolean functions, they have high nonlinearity. We derive a criterion for the Boolean representation of WG transformations to be-resilient and show that they are at least 1-resilient under some basis of the finite field GF (2). An algorithm to find such bases is given. The degree and linear span of WG transformations are presented as well.

On ideal $ t $-tuple distribution of orthogonal functions in filtering de bruijn generators

“…To prove f (x) is invariant under the WG transform, we show that the Walsh spectra of f (x) and W G f (x) at every point are identical. In the following, we prove this result, but before that we state two results on the Hadamard transform of the WG transformation from [10,23,39]. In [39], Yu and Gong presented the Hadamard transform of W G(x d ) when m = 3s ± 1, but the values of λ for which the Hadamard transform value equals zero or nonzero were not known.…”

“…In their milestone paper [11], Dillon and Dobbertin constructed a general class of two-level autocorrelation sequences and proved all known conjectured two-level autocorrelation sequences including WG transformation sequences. A detailed investigation of cryptographic properties of WG sequences is presented in [23]. In 2005, Nawaz and Gong proposed the WG stream cipher and submitted to the eStream project in 2005 [14,32], and completed analysis of security and hardware implementation costs are presented in [31,42,35,16] in sequel.…”

A practical key recovery attack on the lightweight WG-5 stream cipher

“…The WG family of stream ciphers uses the same structure, which is mainly made up of a linear feedback shift registers (LFSR) and a Welch-Gong filtering transformation. As shown in [10] , the keystream generated by the filtering transformation is theoretically proven to provide random properties. Besides, based on this filtering transformation, a new lightweight sponge-based authenticated cipher called WAGE was proposed in [11] .…”

Some properties of the cycle decomposition of WG-NLFSR

“…Let h(x) = x + x q1 + x q2 + x q3 + x q4 be a function from F 2 t to F 2 t and the exponents are given by q 1 = 2 k + 1, q 2 = 2 2k + 2 k + 1, q 3 = 2 2k − 2 k + 1, q 4 = 2 2k + 2 k − 1. Then the function WGP(x) = h(x + 1) + 1 is called the WG permutation in [5,8]. The condition t > 1, t mod 3 = 0 and 3k ≡ 1 mod t for some integer k is to make sure WGP(x) is a permutation from F 2 t to F 2 t , for more details one can refer to [3].…”

“…Let Tr(x) = x+x 2 +x 2 2 +· · ·+x 2 t−1 be the trace function mapping from F 2 t to F 2 . Then the function from F 2 t to F 2 defined by WG(x) = Tr(WGP(x)) is called the WG transformation in [5,8].…”