Binary Sequences Derived from Differences of Consecutive Quadratic

Home , Quadratic residue

arXiv:2005.08651v1 [math.NT] 7 May 2020 uin aiu re complexity order maximum bution, The Introduction 1 hretlna recurrence linear shortest ewrs udai eius eune,lna opeiy pat complexity, linear sequences, residues, quadratic Keywords. S 00 45,11T71 94A55, 2020. MSC iaysqecsdrvdfo ieecsof differences from derived sequences Binary iercomplexity linear eune ( sequences q modulo eune efidsm ucetcniin o tann the attaining for conditions ( sufficient complexity some linear find we sequences inl large ciently f( of aai ta.Hwvr ( However, al. et Caragiu ncnrs,( contrast, In en flength of terns ( t n n +1 t , o prime a For tdigtelna opeiyo ( of complexity linear the Studying d n n = +1 otisaot1 about contains ) ua nvriyo cec n Technology and Science of University Wuhan q t , . . . , p n opttoa n ple Mathematics Applied and Computational nicesn re.W td w ( two study We order. increasing in osctv udai residues quadratic consecutive s and 1 + d n lebresr 9 00Ln,Austria Linz, 4040 69, Altenbergerstr. n p + t n ( and ) . n n -al [email protected] e-mail: L + sntol setal aacdbtas l ogrpat- longer all also but balanced essentially only not is ) s reWinterhof Arne p s = utinAaeyo Sciences of Academy Austrian peresnilyeulyotni h etrsequence vector the in often equally essentially appear − ua 301 ue,China Hubei, 430081, Wuhan -al [email protected] e-mail: 1 L p ≥ 1 c ( oanRdnIsiuefor Institute Radon Johann ), t − L s t n n − let 5 n n 3) endby defined ) otherwise, 0 = fasqec ( sequence a of ) 1 2 s / 0 = / n d 2. olg fScience of College eo n 2 and zeros 3 + n q sntblne n eso htaperiod a that show we and balanced not is ) L 0 , q , − 1 , . . . , Abstract 1 1 q , . . . , + . . . 1 1 d ( p n n iiXiao Zibi and d − + ( n = n p / − a oiae yhuitc of heuristics by motivated was ) nsif ones 3 0 = 5) c s q 3) 0 n n / s / over ) ,frayfixed any for 2, 2 n + , n , 1 eteqartcresidues quadratic the be q , . . . , p n +1 − p F 0 = 3) ( o and 2 mod ssffiinl large. sufficiently is 2 p / − stelength the is -eidcbinary 2-periodic 2 , 1 5) . . . , / .Frboth For 2. s n suffi- and t maximal n if 1 = endistri- tern L fthe of with coefficients c0,...,cL−1 F2. It is an important measure for the unpre- dictability and thus suitability∈ of a sequence in cryptography. For surveys on linear complexity and related measures see [10, 11, 16, 17]. Caragiu et al. [2] suggested to study the linear complexity of the sequence of the parities of differences of consecutive quadratic residues modulo p. In particular, they calculated the linear complexities for the first 1000 primes p 5. More precisely, for a prime p 5 we identify the finite field F of p elements≥ ≥ p with the set of integers 0, 1,...,p 1 . Let q0,...,q(p−3)/2 be the quadratic residues modulo p in increasing{ order− 1} = q < q <...

The heuristic of Caragiu et al. for the linear complexity of (dn) shows that among the first 1000 primes p 5 there are 671 sequences (dn) with maximal linear complexity (p 3)/2. ≥ In Section 2, we− give some sufficient conditions on p for the maximality of L(dn) = (p 3)/2. Balancedness− is another desirable feature of a cryptographic sequence, that is, each period should contain about the same numbers of zeros and ones. We show in Section 3 that the sequence (dn) contains asymptotically 1/3 zeros and 2/3 ones in each period and is very unbalanced. Since (dn) is not balanced, we define a similar (p 3)/2-periodic sequence (tn) which is essentially balanced and defined by −

1, qn+1 = qn +1, tn = n =0, 1,..., (p 5)/2. (3) tndef 0, qn+1 = qn +1, − 6 In Section 4 we will show that (tn) is essentially balanced. Moreover, for s fixed length s each pattern (tn,tn+1,...,tn+s−1) = x 0, 1 appears for essentially the same number of n with 0 n (p 3)∈/2 { provided} that p is sufficiently large with respect to s. ≤ ≤ − Finally, we study the linear complexity of (tn) in Section 5 and provide a sufficient criterion for the maximality of L(tn). We also prove a lower bound on the Nth maximum order complexity of (tn) which implies a rather moderate but non-trivial and unconditional lower bound on the Nth linear complexity of (tn). We use the notation f(n) = O(g(n)) if f(n) cg(n) for some absolute constant c> 0. | | ≤

2 Linear complexity of (dn) hdnlci Our starting point to determine the linear complexity of a periodic sequence is [3, Lemma 8.2.1].

2 hcdri Lemma 1. Let (sn) be a T -periodic sequence over F2 and

T −1 n S(X)= snX . n=0 X

Then the linear complexity L(sn) of (sn) is

L(s )= T deg(gcd(XT 1,S(X))). n − −

We write the period of the sequence (dn) in the form p 3 T = − =2sr 2 with integers s 0 and odd r. Then we have ≥ s XT 1 = (Xr 1)2 . − − We have to determine gcd(XT 1,D(X)), where − (p−5)/2 n D(X)= dnX . n=0 X First we study whether D(X) is divisible by (X 1), that is, we determine the value of D(1) F . According to the deﬁnition of− the sequence (d ), we get ∈ 2 n (p−5)/2 (p−5)/2 D(1) = d q +2 q + q 1+ q mod 2. n ≡ 0 i (p−3)/2 ≡ (p−3)/2 n=0 i=1 X X Since 1 is a quadratic residue modulo p if and only if p 1mod4 and 2 is a quadratic− residue modulo p if and only if p 1 mod 8,≡ the largest quadratic ≡ ± residue q(p−3)/2 modulo p is

p 1, p 1 mod 4, q = (p−3)/2 p − 2, p ≡ 3 mod 8. − ≡ In the remaining case p 7 mod 8, both 1 and 2 are quadratic non-residues. Hence, the largest quadratic≡ residue modulo− p is−p u for some u> 2. Assume u =2m for some positive integer m. Since u and 2− are both quadratic residues modulo p, m p m mod p is quadratic− residue modulo p as well, a contradiction to the− maximality≡ − of p u. Hence, u is odd. So, the largest quadratic residue modulo p is −

p 1 0 mod 2, p 1 mod 4, − ≡ ≡ q = p 2 1 mod 2, p 3 mod 8, (p−3)/2  p − u ≡ 0 mod 2, p ≡ 7 mod 8.  − ≡ ≡  3 Thus we have 0, p 3 mod 8, D(1) = (4) S1 1, p ≡ 3 mod 8. 6≡ We return now to a general binary sequence (sn) of period T . The following provides a necessary condition for S(β) = 0 for a primitive rth root of unity β in some extension ﬁeld of F2. hSbetai Lemma 2. Let r be an odd prime divisor of T such that 2 is a primitive root modulo r. Let β be any primitive rth root of unity in some extension ﬁeld of F2. If S(β)=0, then we have

T/r−1 s = S(1), h =0, 1,...,r 1. h+jr − j=0 X Proof. Since 2 is a primitive root modulo r, the cyclotomic polynomial

1+ X + ... + Xr−1

is irreducible over F2, and thus the minimal polynomial of β. In particular we have r−2 βr−1 = βh hX=0 and 1,β,...,βr−2 are linearly independent. Since βr = 1 we get

T −1 r−1 T/r−1 n h S(β) = snβ = sh+jrβ n=0 j=0 X hX=0 X r−2 T/r−1 T/r−1 = s s βh.  h+jr − r−1+jr j=0 j=0 hX=0 X X   Assume S(β) = 0. Then we get

T/r−1 T/r−1 s = s , h =0, 1,...,r 2. h+jr r−1+jr − j=0 j=0 X X Hence, since r is odd and

r−1 T/r−1 T/r−1 T/r−1 S(1) = sh+jr = r sr−1+jr = sr−1+jr, j=0 j=0 j=0 hX=0 X X X the result follows. ✷

Now we are ready to prove a suﬃcient condition on p for (dn) having maximal linear complexity L(d ) = (p 3)/2. n −

4 Theorem 1. Let p = 2s+1r + 3 be a prime with s 0, 1 and either r = 1 or r an odd prime such that 2 is a primitive root modulo∈ { r}. Then the linear complexity of the sequence (dn) deﬁned by (1) and (2) is maximal, p 3 L(d )= − . n 2 Proof. Since p =2s+1r+3 with s 0, 1 and r is odd, we have p 3 mod 8. It follows from (4) that D(1) = 1. ∈{ } 6≡ s If r = 1, that is T = (p 3)/2=2s, we have XT 1 = (X 1)2 , T − p−3 − − gcd(D(X),X 1)= 1 and L(dn)= 2 by Lemma 1. Now let r be− an odd prime such that 2 is a primitive root modulo r. Next we prove that D(β) = 0 for any primitive rth root of unity β. Assume D(β) = 0.6 If s = 0, we get

d0 = d1 = ... = dr−1 = D(1) = 1 by Lemma 2. However, each n with 1 n p 3 and ≤ ≤ − n n +1 n +2 , , = (1, 1, 1), p p p − . where . denotes the Legendre symbol, corresponds to some (qi, qi+1) = (n,n+ 2) and thus d n + n +2 0 mod 2. By [4, Proposition 2] there are at least i ≡ ≡ p √p 15 > 0, p> 25, 8 − 4 − 8 such n, a contradiction for p > 25. The only remaining primes p 25 of the ≤ form p =2r + 3 with odd r > 1 are p = 13 and 17. For p = 13 we have q0 =1 and q1 = 3, that is, d0 = 0, a contradiction. For p = 17 we get r = 7 but 2 is a quadratic residue modulo 7 and thus not a primitive root modulo 7. If s = 1, we have p 7 mod 8, p 23, and we get from Lemma 2 ≡ ≥

d0 + dr = d1 + dr+1 = ... = dr−1 + d2r−1 = S(1) = 1.

Hence, (dn) is balanced. However, the number of pairs of consecutive quadratic residues is (p 3)/4, see for example [3, Proposition 4.3.2], and the number of n with 1 n −p 4 and ≤ ≤ − n n +1 n +2 n +3 , , , = (1, 1, 1, 1) (5) legcond p p p p − − is at least p 5 39 √p > 0, p> 169, 16 − 8 − 16 by [4, Proposition 2]. Hence we have at least p 3 p 5 39 p 3 − + √p > − , p> 169, 4 16 − 8 − 16 4

5 diﬀerent n with 0 n (p 5)/2 and dn = 1, a contradiction for p > 169. It remains to≤ check≤ that− there is an n satisfying (5) for any prime p 7 mod 8 for which r = (p 3)/4 is a prime and 23 p < 169, that is,≡ p 23, 31, 47, 71, 79, 127, 151−, 167 . We can delete p =≤ 31, 71, 127, 167 from this∈ list { since for these values of r =} (p 3)/4 it is easy to verify that 2 is not a primitive root modulo r. We can choose− n from the following table, p 23 47 79 151 . n 9 9 5 5 Thus, we obtain gcd(XT 1,S(X)) = 1, and the result follows. ✷ −

3 Imbalance of (dn) himbalancei In this section we show that, for sufficiently large p, the sequence (dn) is imbalanced. More specifically, about 2/3 of the sequence elements are equal to 1. Theorem 2. Let N(0) and N(1) denote the number of 0s and 1s in a period of the sequence (dn), respectively. Then we have p N(0) = + O p1/2(log p)2 6 and p N(1) = + O p1/2(log p)2 . 3 Proof. We first prove a lower bound on N(1). We need a well known result about the pattern distribution of Legendre symbols. For s 1 and ε ,ε , ,ε 1, 1 , set ≥ 1 2 ··· s ∈ {− } j + i N(ε , ,ε )= j =1, 2,...,p s : = ε , i =0,...,s 1 . 1 ··· s − p i+1 −

From [4, Proposition 2] we get for s 3, ≥ p N(ε , ,ε )= + O sp1/2 . (6) e2 1 ··· s 2s Note that (6) is also true for s = 1, since we have each (p 1)/2 quadratic residues and non-residues modulo p, and for s = 2, see for example− [3, Proposi- tion 4.3.2]. For a non-negative integer k, let Nk denote the number of j with 1 j p 2 k satisfying ≤ ≤ − − j j +1 j + k j + k +1 , , , , = (1, 1, , 1, 1). (7) jk p p ··· p p − ··· − Each pair (j, k) satisfying (7) corresponds to an n with (qn, qn+1) = (j, j +k+1), that is, d q + q k +1 mod 2. Hence for any positive integer m, n ≡ n n+1 ≡ m p m N(1) N = 4−k + O m2p1/2 ≥ 2k 4 Xk=0 kX=0

6 and m p m N(0) N = 4−k + O m2p1/2 ≥ 2k+1 8 Xk=0 kX=0 by (6). Choosing m = log p we get ⌊ ⌋

p 1 m+1 N(1) 1 + O m2p1/2 ≥ 3 − 4 ! p = + O p1/2(log p)2 3 and m p p N(0) 4−k + O(m2p1/2)= + O p1/2(log p)2 . ≥ 8 6 kX=1 Now since N(0) + N(1) = (p 3)/2 we get − p p N(0) = + O(p1/2(log p)2) and N(1) = + O(p1/2(log p)2). 6 3

Therefore, the sequence (dn) is imbalanced for suﬃciently large p. ✷

4 Pattern distribution of (tn)

pat h i The number N(1) of 1s in a period of the sequence (tn) deﬁned by (3) is equal to the number of elements of the set j j +1 j =1, 2,...,p 2 : = =1 . − p p Then it follows from [3, Proposition 4.3.2] that

(p 3)/4, p 3(mod 4), N(1) = (8) e5 (p − 5)/4, p ≡ 1(mod 4). − ≡ So this sequence is balanced when p 3 mod 4 and almost balanced when p 1 mod 4. ≡ ≡Now we consider longer patterns. hthmpatti Theorem 3. For a prime p 5 let (t ) be the (p 3)/2-periodic sequence ≥ n − deﬁned by (3). For any positive integer s and any pattern x = (x0,...,xs−1) 0, 1 s the number N (x) of n with 0 n (p 5)/2 and ∈ { } s ≤ ≤ −

(tn,tn+1,...,tn+s−1)= x

satisﬁes p N (x)= + O sp1/2(log p)s+1 . s 2s+1

7 Proof. Each pattern of Legendre symbols j j +1 j + k + ... + k + s , ,..., 0 s−1 p p p = (1, 1,..., 1, 1, 1,..., 1, 1,..., 1, 1,..., 1, 1), − − − − − − k0 k1 ks−1 j =1, 2,...,p 1 k|0 ...{z k}s−1 | s,{z corresponds} to a| pattern{z (}tn,...,tn+s−1) with − − − − − 1, ki =0, tn+i = i =0,...,s 1, 0, ki > 0, − for some n with 0 n p−5 s. Assume ≤ ≤ 2 − m max 1, k , k ,...,k . ≥ { 0 1 s−1} Then the number of such j is p + O(smp1/2) 2s+1+k0+...+ks−1 by (6). Assume that the pattern x contains r zeros. Then for r 1 we have ≥ m p N (x) 2−(ℓ1+...+ℓr) + O smr+1p1/2 s ≥ 2s+1 ℓ1,...,ℓXr=1 p = (1 2−m)r + O smr+1p1/2 . 2s+1 − Choosing m = log p 1 we get ⌊ ⌋− p N (x) + O sp1/2( 1 + log p)r+1 . (9) Nsabs s ≥ 2s+1 − For r =0 we get p N (1, 1,..., 1)= + O sp1/2 . s 2s+1 s Using | {z } p 3 Ns(x) − Ns(y) ≤ 2 − Fs y∈X2\{x} s p 3 p s − (2s 1) + O sp1/2 ( 1 + log p)r+1 ≤ 2 − − 2s+1 r − r=0 ! p X = + O sp1/2(log p)s+1 2s+1 we get the result. ✷

Using [9, Theorem 3] instead of [4, Proposition 2] we get a local analog of Theorem 3 exactly the same way.

8 Corollary 1. For a prime p 5 let (tn) be the (p 3)/2-periodic sequence deﬁned by (3). For any positive≥ integer s, any N with− 1 N (p 5)/2 s ≤ ≤ − and any pattern x = (x0,...,xs−1) 0, 1 the number Ns(x,N) of n with 0 n N 1 and ∈ { } ≤ ≤ − (tn,tn+1,...,tn+s−1)= x satisﬁes N N (x,N)= + O sp1/2(log p)s+2 . s 2s+1 We also get an analog of the lower bound (9), N N (x,N) + O sp1/2(log p)r+2 , (10) new s ≥ 2s+1 where r is the number of zeros of x 0, 1 s. ∈{ }

5 Linear complexity of (tn) hLti In this subsection we discuss the linear complexity of the sequence (tn). We now put (p−5)/2 n T (X)= tnX . n=0 X According to (8), the number N(1) of 1s in a period of (tn) is equal to (p 3)/4 if p 3 mod 4 and (p 5)/4 if p 1 mod 4. Thus, − ≡ − ≡ (p−5)/2 1, p 1 mod 8, T (1) = t = n 0, p ≡±3 mod 8. n=0 X ≡± For the case p 1 mod 4, the period T = r = (p 3)/2 of the sequence (tn) is an odd number.≡ If we suppose that r is a prime− such that 2 is a primitive root modulo r, then Lemma 2 implies either T (β) = 0 or th = T (1) for all h. Now 2 can be only a primitive root modulo r if it6 is not a square modulo r, that is, r 3 mod 8 and thus p 9, 13 mod 16, in particular, we have p 13 ≡± ≡ ≥ and (th) is not constant by (8). Hence, T (β) = 0 for any primitive rth root of unity β. We obtain the following result. 6 Theorem 4. Let p be a prime with p 9 or 13 mod 16 such that r = p−3 is an ≡ 2 odd prime and 2 is a primitive root modulo r. Then the linear complexity L(tn) of the sequence (tn) deﬁned by (3) is

p−3 2 , p 9 mod 16, L(tn)= ≡ p−5 , p 13 mod 16. 2 ≡ The maximum order complexity M(sn) of a binary sequence (sn) is the smallest positive integer M with

sn+M = f(sn+M−1,...,sn), n =0, 1,...,

9 for some mapping f : FM F . Obviously, we have 2 7→ 2 L(s ) M(s ) n ≥ n and each lower bound on M(tn) is also a lower bound on L(tn). In particular we have the trivial lower bound log((p 3)/2) L(t ) M(t ) − , n ≥ n ≥ log 2 see [7, Proposition 3.2]. For a positive integer N the Nth maximum order complexity M(sn,N) is the local analog of M(sn), that is, the smallest M with s = f(s ,...,s ), n =0, 1,...,N M 1, n+M n+M−1 n − − for some f. We prove also a lower bound on M(tn,N) which is nontrivial for N of order of magnitude at least p1/2 log4 p. hmaxordi Theorem 5. For the Nth maximum order complexity M(tn,N) of the sequence (tn) deﬁned by (3) we have

log(N/p1/2) 4 log log p M(t ,N) + O(1), N =1, 2,..., (p 5)/2. n ≥ log 2 − log 2 −

Proof. For s 1 and x 0, 1 the number Gs,x(N) of n with 0 n N s satisfying ≥ ∈{ } ≤ ≤ − (tn,tn+1,...,tn+s−2,tn+s−1)=(1, 1,..., 1, x) (11) pm s−1 satisﬁes | {z } N N G (N) + O sp1/2(log p)3 = + O p1/2(log p)4 for s log p s,x ≥ 2s+1 2s+1 ≤ by (10). Hence, there is a constant c> 0 such that for

log(N/p1/2) 4 log log p s c ≤ log 2 − log 2 −

we have Gs,x > 0 for x 0, 1 and both patterns in (11) of length s appear at least once. Assume ∈{ } log(N/p1/2) 4 log log p M c (12) M ≤ log 2 − log 2 − and that there is a recurrence of the form

t = f(t ,...,t ), n =0, 1,...,N M 1. (13) trek n+M n+M−1 n − − However, there are n and n with 0 n

10 a contradiction to (13). Hence, (12) is not true and the result follows. ✷

Remark. Theorem 5 is in good correspondence to the result of [7] that the maximum order complexity of a random sequence of length N is of order of magnitude log N. For some recent papers on the maximum order complexity see [5, 6, 8, 12, 13, 14, 15, 18]. The correlation measure C2(sn) of order 2 of a sequence (sn) of length N is deﬁned by M−1 sn+d +sn+d C2(sn)= max ( 1) 1 2 , M,d1,d2 − n=0 X where the maximum is taken over all integers M, d1, d2 with 0 d1 < d2 ≤ ≤ N M. There exist d1 and d2 with 0 d1 < d2 with sn+d1 = sn+d2 for n =0− , 1,...,M(s ) 2 and we get ≤ n − C (s ) M(s ) 1. (14) cm 2 n ≥ n − A large correlation measure C2(sn) of order 2 is undesirable for cryptographic applications since the expected value of C2(sn) is of order of magnitude N 1/2(log N)1/2, see [1], and a cryptographic sequence should not be distinguishable from a random sequence. These results on expected values and (14) suggest that a good cryptographic sequence of length N should have maximum order complexity of order of magnitude between log N and N 1/2+ε.

6 Conclusion

We showed that the sequence (dn) of the parities of diﬀerences of quadratic residues modulo p is very unbalanced. Hence, (dn) is, despite of a high linear complexity (at least in some cases), not suitable in cryptography. We introduced an alternative sequence (tn) which is not only balanced but also longer patterns appear essentially equally often. Moreover, we proved that (tn) has in some cases a very high linear complexity and obtained a moderate but nontrivial lower bound on the Nth maximum order complexity of (tn). All these results indicate that (tn) is an attractive candidate for applications in cryptography.

Acknowledgments

The ﬁrst author is partially supported by the Austrian Science Fund FWF Project P 30405-N32. The second author is supported by the Chinese Scholar- ship Council. We wish to thank the anonymous referees for their careful study of our paper and their very useful comments.

11 References

al [1] N. Alon, Y Kohayakawa, C. Mauduit, C.G. Moreira, V. Rödl, Measures of pseudorandomness for finite sequences: typical values. Proc. Lond. Math. Soc. (3) 95 (2007), no. 3, 778–812. catekam [2] M. Caragiu, S. Tefft, A. Kemats, T. Maenle, A linear complexity analysis of quadratic residues and primitive roots spacings. Far East J. Math. Ed. 19 (2019), no. 1, 27–37.

cudire [3] T.W. Cusick, C. Ding, A. Renvall, Stream ciphers and number theory. Revised edition. North-Holland Mathematical Library, 66. Elsevier Science B.V., Amsterdam, 2004.

di [4] C. Ding, Pattern distributions of Legendre sequences. IEEE Trans. Inform. Theory 44 (1998), no. 4, 1693–1698.

ge [5] O. Geil, F. Ozbudak,¨ D. Ruano, Constructing sequences with high nonlinear complexity using the Weierstrass semigroup of a pair of distinct points of a Hermitian curve. Semigroup Forum 98 (2019), no. 3, 543–555.

iwi [6] L. I¸sık, A. Winterhof, Maximum-order complexity and correlation measures. Cryptography 1 (2017), no. 1, 1–7.

ja [7] C.J.A. Jansen, Investigations on nonlinear streamcipher systems: Con- struction and evaluation methods. Thesis (Dr.)–Technische Universiteit Delft (The Netherlands), 1989.

lu [8] Y. Luo, C. Xing, L. You, Construction of sequences with high nonlinear complexity from function ﬁelds. IEEE Trans. Inform. Theory 63 (2017), no. 12, 7646–7650.

masa [9] C. Mauduit, A. Sárközy, On finite pseudorandom sequences of k symbols. Indag. Math. (N.S.) 13 (2002), no. 1, 89–101.

mewi [10] W. Meidl, A. Winterhof, Linear complexity of sequences and multise- quences, in G. L. Mullen, D. Panario (eds.), Handbook of ﬁnite ﬁelds. Discrete Mathematics and its Applications, pp. 324–336, CRC Press, Boca Raton, FL, 2013.

ni [11] H. Niederreiter, Linear complexity and related complexity measures for sequences. Progress in cryptology—INDOCRYPT 2003, 1–17, Lecture Notes in Comput. Sci., 2904, Springer, Berlin, 2003.

pe [12] J. Peng, X. Zeng, Z. Sun, Finite length sequences with large nonlinear complexity. Adv. Math. Commun. 12 (2018), no. 1, 215–230.

suwi0 [13] Z. Sun, A. Winterhof, On the maximum order complexity of the Thue- Morse and Rudin-Shapiro sequence. Unif. Distr. Th. 14 (2019), no. 2, 33– 42.

12 suwi [14] Z. Sun, A. Winterhof, On the maximum order complexity of subsequences of the Thue-Morse and Rudin-Shapiro sequence along squares. Int. J. Com- put. Math. Comput. Syst. Theory 4 (2019), no. 1, 30–36.

szlh [15] Z. Sun, X. Zeng, C. Li, T. Helleseth, Investigations on periodic sequences with maximum nonlinear complexity. IEEE Trans. Inform. Theory 63 (2017), no. 10, 6188–6198.

towi [16] A. Topuzo˘glu, A. Winterhof, Pseudorandom sequences. Topics in geome- try, coding theory and cryptography, 135–166, Algebr. Appl., 6, Springer, Dordrecht, 2007.

wi [17] A. Winterhof, Linear complexity and related complexity measures. Selected topics in information and coding theory, 3–40, Ser. Coding Th. Cryptol. 7, World Sci. Publ., Hackensack, NJ, 2010. xzxlj [18] Z. Xiao, X. Zeng, C. Li, Y. Jiang, Binary sequences with period N and nonlinear complexity N 2. Cryptogr. Commun. 11 (2019), no. 4, 735– 757. −