LFSR——二进制下线性反馈移位寄存器与Berlekamp-Massey算法

LFSR——二进制下线性反馈移位寄存器与Berlekamp-Massey算法

转载自:元暑期学校课件(侵删)

线性反馈移位寄存器(LFSR)

给定一个线性反馈移位寄存器(LFSR)的n个初始值 a 0 , a 1 , . . . , a n − 1 a_0,a_1,...,a_{n-1} a0,a1,...,an1,不断地加移位脉冲,n级LFSR就会输出一序列
a 0 , a 1 , a 2 , . . . a_0, a_1,a_2,... a0,a1,a2,...
a i ∈ F 2 = { 0 , 1 } a_i\in F_2=\{0,1\} aiF2={0,1}.

其中 a i + n a_{i+n} ai+n满足等式
a i + n = ∑ j = 1 n c j a i + n − j , c j ∈ F 2 . a_{i+n}=\sum^n_{j=1}c_ja_{i+n-j},c_j\in F_2. ai+n=j=1ncjai+nj,cjF2.
我们把这样的序列称为 (n级)线性反馈移位寄存器(LFSR)


特征 多项式与联接多项式

n级LFSR的**特征多项式(Characteristic Polynomial)**为
f ( x ) = x n + ∑ i = 1 n c i x n − i , f (x) = x ^ n + \sum _ {i = 1} ^ {n} c_ix ^ {n-i}, f(x)=xn+i=1ncixni,

其**联接多项式(Reciprocal Polynomial/Joint Polynomial)**为
f ‾ ( x ) = x n f ( 1 x ) = 1 + ∑ i = 1 n c i x i . \overline{f} (x) = x^n f(\frac{1}{x})= 1 + \sum _ {i = 1} ^ {n} c_ix ^ i. f(x)=xnf(x1)=1+i=1ncixi.

将满足递推关系式(2)的n级LFSR序列称为 f ( x ) f(x) f(x)产生的序列

G(f):由 f ( x ) f(x) f(x)产生的所有序列的全体组成的集合。


极小多项式

a F 2 F_2 F2上的一个周期序列,存在 F 2 F_2 F2上唯一的首一多项式 f ( x ) f(x) f(x)使得a ∈ G ( h ( x ) ) \in G(h(x)) G(h(x))当且仅当 f ( x ) ∣ h ( x ) f(x)|h(x) f(x)h(x)。这个多项式 f ( x ) f(x) f(x)称作a的极小多项式


Berlekamp-Massey算法

Berlekamp-Massey算法(简称BM算法):在已知二元序列的情况下求解其极小多项式和阶数。

(1) 设 n 0 n_0 n0是一个非负整数,满足
a 0 = a 1 = ⋯ = a n 0 − 1 = 0 , a n 0 ≠ 0. a_0=a_1=\cdots=a_{n_0-1}=0,a_{n_0}\neq 0. a0=a1==an01=0,an0̸=0.

d 0 = d 1 = ⋯ = d n 0 − 1 = 0 , d n 0 = a n 0 , d_0=d_1=\cdots=d_{n_0-1}=0,d_{n_0}=a_{n_0}, d0=d1==dn01=0,dn0=an0,

f 1 ( x ) = f 2 ( x ) = ⋯ = f n 0 ( x ) = 1 , f_1(x)=f_2(x)=\cdots=f_{n_0}(x)=1, f1(x)=f2(x)==fn0(x)=1,

l 1 = l 2 = ⋯ = l n 0 = 0. l_1=l_2=\cdots=l_{n_0}=0. l1=l2==ln0=0.


f n 0 + 1 ( x ) = 1 − d n 0 x n 0 + 1 , l n 0 + 1 = n 0 + 1. f_{n_0+1}(x)=1- d_{n_0}x^{n_0+1},l_{n_0+1}=n_0+1. fn0+1(x)=1dn0xn0+1,ln0+1=n0+1.
(2) 假设 ( f i ( x ) , l i ) , 1 ≤ i ≤ n ≤ N (f_i(x),l_i),1\leq i\leq n \leq N (fi(x),li),1inN 已经求得。而
l 1 = l 2 = ⋯ = l n 0 < l n 0 + 1 ≤ l n 0 + 2 ≤ ⋯ ≤ l n l_1=l_2=\cdots=l_{n_0}<l_{n_0+1}\leq l_{n_0+2}\leq \cdots \leq l_n l1=l2==ln0<ln0+1ln0+2ln
根据 f n ( x ) = 1 + c n , 1 x + ⋯ + c n , l n x l n f_n(x)=1+c_{n,1}x+\cdots+c_{n,l_n}x^{l_n} fn(x)=1+cn,1x++cn,lnxln,并计算
d n = a n + c n , 1 a n − 1 + ⋯ + c n , l n a n − l n . d_n = a_n + c_{n,1}a_{n-1}+\cdots+c_{n,l_n}a_{n-l_n}. dn=an+cn,1an1++cn,lnanln.
如果 d n = 0 d_n=0 dn=0,则取
f n + 1 ( x ) = f n ( x ) , l n + 1 = l n ; f_{n+1}(x)=f_n(x), l_{n+1}=l_n; fn+1(x)=fn(x),ln+1=ln;
d n ≠ 0 d_n\neq 0 dn̸=0,这时一定存在 1 ≤ m < n 1\leq m< n 1m<n,使
l m < l m + 1 = l m + 2 = ⋯ = l n , l_m<l_{m+1}=l_{m+2}=\cdots=l_n, lm<lm+1=lm+2==ln,

f n + 1 ( x ) = f n ( x ) − d n d m − 1 x n − m f m ( x ) , f_{n+1}(x)=f_n(x)-d_nd_m^{-1}x^{n-m}f_m(x), fn+1(x)=fn(x)dndm1xnmfm(x),

l n + 1 = m a x { l n , n + 1 − l n } . l_{n+1}=max\{l_n,n+1-l_n\}. ln+1=max{ln,n+1ln}.

求周期为8的序列 a ( 8 ) = 00101101 a^{(8)}=00101101 a(8)=00101101的极小多项式和阶数。

a 0 = 0 , a 1 = 0 , a 2 = 1 , a 3 = 0 , a 4 = 1 , a 5 = 1 , a 6 = 0 , a 7 = 1 a_0=0, a_1=0, a_2=1, a_3=0, a_4=1, a_5=1, a_6=0, a_7=1 a0=0,a1=0,a2=1,a3=0,a4=1,a5=1,a6=0,a7=1. 首先 n 0 = 2 n_0=2 n0=2,因此
d 0 = d 1 = 0 , d 2 = 1 , d_0=d_1=0,d_2=1, d0=d1=0,d2=1,

f 1 ( x ) = f 2 ( x ) = 1 , f 3 ( x ) = 1 − x 3 , f_1(x)=f_2(x)=1,f_3(x)=1-x^3, f1(x)=f2(x)=1,f3(x)=1x3,

l 1 = l 2 = 1 , l 3 = 3. l_1=l_2=1,l_3=3. l1=l2=1,l3=3.

计算 d 4 = a 4 − a 1 = 1 − 0 = 1 ≠ 0 d_4=a_4-a_1=1-0=1\neq 0 d4=a4a1=10=1̸=0,这时 l 2 < l 3 = l 4 l_2<l_3=l_4 l2<l3=l4,因此m=2,
f 5 ( x ) = f 4 ( x ) − d 4 d 2 − 1 x 4 − 2 f 2 ( x ) = 1 − x 3 − x 2 = 1 + x 2 + x 3 , f_5(x)=f_4(x)-d_4d_2^{-1}x^{4-2}f_2(x)=1-x^3-x^2=1+x^2+x^3, f5(x)=f4(x)d4d21x42f2(x)=1x3x2=1+x2+x3,

l 5 = m a x { l 4 , 4 + 1 − l 4 } = 3. l_5=max\{l_4,4+1-l_4\}=3. l5=max{l4,4+1l4}=3.

计算 d 5 = a 5 + a 3 + a 2 = 1 + 0 + 1 = 0 d_5=a_5+a_3+a_2=1+0+1=0 d5=a5+a3+a2=1+0+1=0,因此
f 6 ( x ) = f 4 ( x ) = 1 + x 2 + x 3 , l 6 = l 5 = 3. f_6(x)=f_4(x)=1+x^2+x^3,l_6=l_5=3. f6(x)=f4(x)=1+x2+x3,l6=l5=3.
计算 d 6 = a 6 + a 4 + a 3 = 0 + 1 + 0 = 1 ≠ 0 d_6=a_6+a_4+a_3=0+1+0=1\neq 0 d6=a6+a4+a3=0+1+0=1̸=0, 这时 l 2 < l 3 = l 4 = l 5 l_2<l_3=l_4=l_5 l2<l3=l4=l5,因此 m = 2 m=2 m=2
f 7 ( x ) = f 6 ( x ) − d 6 d 2 − 1 x 6 − 2 f 2 ( x ) = 1 + x 2 + x 3 − x 4 = 1 + x 2 + x 3 + x 4 , f_7(x)=f_6(x)-d_6d_2^{-1}x^{6-2}f_2(x)=1+x^2+x^3-x^4=1+x^2+x^3+x^4, f7(x)=f6(x)d6d21x62f2(x)=1+x2+x3x4=1+x2+x3+x4

l 7 = m a x { l 6 , 7 − l 6 } = 4. l_7=max\{l_6,7-l_6\}=4. l7=max{l6,7l6}=4.

计算 d 7 = a 7 + a 5 + a 4 + a 3 = 1 + 1 + 1 + 0 = 1 ≠ 0 d_7=a_7+a_5+a_4+a_3=1+1+1+0=1\neq0 d7=a7+a5+a4+a3=1+1+1+0=1̸=0,这时 l 6 < l 7 l_6<l_7 l6<l7,因此 m = 6 m=6 m=6
f 8 ( x ) = f 7 ( x ) − d 7 d 6 − 1 x 7 − 6 f 6 ( x ) = 1 + x 2 + x 3 + x 4 − x ( 1 + x 2 + x 3 ) = 1 + x + x 2 , f_8(x)=f_7(x)-d_7d_6^{-1}x^{7-6}f_6(x)=1+x^2+x^3+x^4-x(1+x^2+x^3)=1+x+x^2, f8(x)=f7(x)d7d61x76f6(x)=1+x2+x3+x4x(1+x2+x3)=1+x+x2

l 8 = m a x { l 7 , 8 − l 7 } = 4. l_8=max\{l_7,8-l_7\}=4. l8=max{l7,8l7}=4.

所以 a ( 8 ) = 00101101 a^{(8)}=00101101 a(8)=00101101的极小生成多项式为 1 + x + x 2 1+x+x^2 1+x+x2,阶数为4。

你可能感兴趣的:(计算机安全,CTF,Crypto)