Computational Analysis of Interleaving PN-Sequences with Different Polynomials

  Citation: Cardell, S.D.; Requena, V.; Fúster-Sabater, A. Computational Analysis of Interleaving PN-Sequences with Different Polynomials. Cryptography 2022,6, 21. https://doi.org/10.3390/ cryptography6020021 Academic Editor: Josef Pieprzyk Received: 21 March 2022 Accepted: 21 April 2022 Published: 26 April 2022 Publisher’s Note: MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations. Copyright: © 2022 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https:// creativecommons.org/licenses/by/ 4.0/). cryptography Article Computational Analysis of Interleaving PN-Sequences with Different Polynomials Sara D. Cardell 1, Verónica Requena 2and Amparo Fúster-Sabater 3,* 1Centro de Matemática, Computação e Cognição, Universidade Federal do ABC (UFABC), Santo André 09210-580, Brazil; [email protected] 2Departament de Matemàtiques, Universitat d’Alacant, 03690 Alacant, Spain; [email protected] 3Instituto de Tecnologías Físicas y de la Información (ITEFI), C.S.I.C., 28006 Madrid, Spain *Correspondence: ampar[email protected] Abstract: Binary PN-sequences generated by LFSRs exhibit good statistical properties; however, due to their intrinsic linearity, they are not suitable for cryptographic applications. In order to break such a linearity, several approaches can be implemented. For example, one can interleave several PN-sequences to increase the linear complexity. In this work, we present a deep randomness study of the resultant sequences of interleaving binary PN-sequences coming from different characteristic polynomials with the same degree. We analyze the period and the linear complexity, as well as many other important cryptographic properties of such sequences. Keywords: PN-sequence; interleaved sequence; linear complexity; randomness 1. Introduction The rapid development and evolution of the internet have made possible the connectivity among many devices of daily use and, consequently, the irruption of the so-called Internet of Things (IoT). Moreover, many critical services as e-banking, e-govern, e-health or e-commerce are based on IoT infrastructures. As nowadays, the presence of such services grows exponentially, so do all risks associated with their security [ 1 ]. On the one hand, the IoT devices are currently characterized by their constrains in what processing power, size, memory and energy consumption are concerned [ 2 ]. On the other hand, they are also characterized by their minimum or non-existent security [ 3 ], since the vast majority of IoT devices have been designed without safety in mind. Combining the inherent lack of security of IoT infrastructures with their network dependability, the final effect is that IoT devices are a suitable target to compromise the whole network. This is the reason why 5G communications [ 4 ] or specific calls such as that of NIST for cryptography primitives [ 5 ] are addressing this essential topic. In this context, lightweight cryptography in general and stream ciphers in particular are the key stones on which certain communication protocols are being designed to guarantee security. Stream ciphers are related with the idea of pseudo-randomness. In fact, the purpose of Pseudo-Random Numbers Generators (PRNGs) is to produce sequences of numbers that seem to behave as if they were generated randomly from a specified probability distribution. These numbers are sometimes called pseudo-random numbers to underline the fact that they are not truly random. The PRNGs must be fast and easy to be implemented in a computer, displaying small memory requirements and good statistical properties. The bit-wise Exclusive-OR logic operation between the original message and a pseudo-random bit sequence (key-stream sequence) preserves the confidentiality of the message in the traditional procedure of stream cipher. Other important security features, such as the integrity or authentication of the message, require additional mechanisms such as an MAC (Message Authentication Code) function to guarantee that the message is authentic and Cryptography 2022,6, 21. https://doi.org/10.3390/cryptography6020021 https://www.mdpi.com/journal/cryptography Cryptography 2022,6, 21 2 of 22 consequently its integrity checked. In brief, they are two different algorithms (confidentiality and authentication–integrity) that sometimes can be unified in the same scheme; see the requirements of the NIST call [ 5 ] for lightweight primitives. For this reason, the application of pseudo-random number generators for IoT is increasingly being studied [ 6 , 7 ]. In this work, we focus exclusively on the key-stream sequence and, consequently, on the confidentiality of the message. Traditionally, the pseudo-random bit sequences with application in cryptography are generated by means of maximal-length Linear Feedback Shift Registers (LFSR) [ 8 ]. Their output sequences are the PN-sequences that exhibit good statistical properties. However, their linearity, i.e., their predictability, makes them vulnerable against cryptanalytic attacks. One common way to break this linearity is through irregular decimation, which has given rise to a wide family of decimation-based sequence generators. A representative element of this family is the shrinking generator, which decimates one PN-sequence according to the positions of the ones in another PN-sequence [ 9 ]. In [ 10 ], the authors proved that the output sequence of this generator, the so-called shrunken sequence, is made up of interleaving shifted versions of a single PN-sequence. Moreover, the shifts of the corresponding interleaved sequences can be easily deduced from the characteristic polynomials of the LFSRs, and this fact can be advantageously used to implement cryptanalytic attacks [11]. In [ 12 ], the authors proposed the interleaving of shifted versions of one single PNsequence considering these shifts (different from the ones used in the shrunken sequence) as part of the key. This idea makes even more difficult the cryptanalysis of such sequences. However, depending on the initial state of the LFSR, some of the resultant sequences showed a high predictability, i.e., a low linear complexity. A natural way to deal with the vulnerabilities of interleaving shifted versions of the same PN-sequence is to interleave different PN-sequences coming from different LFSRs. In this work, we propose a similar analysis to the one developed in [ 12 ] but considering the interleaving of different PN-sequences instead. The sequences here analyzed present the same pseudo-randomness properties as those of [ 12 ]; however, their linear complexity is quite higher. Furthermore, given several maximal-length LFSRs with the same length, the linear complexity of the resultant interleaved PN-sequences is fixed regardless of the initial states considered. We also perform a randomness analysis on the resultant sequences that shows that our sequences are better than the sequences obtained interleaving PN-sequences from the same LFSR, that is, interleaving shifted versions of the same PN-sequence. This paper is organized as follows. In Section 2, we recall some basic concepts related to binary sequences, which are needed to understand the rest of the paper. In Section 3, we study the linear complexity and the characteristic polynomial of the sequences obtained interleaving PN-sequences from different LFSRs. Furthermore, in Section 4, we compare our sequences with the ones obtained from other sequence generators with similar parameters. In Section 5, we perform a deep randomness analysis of the obtained sequences. Finally, the paper ends in Section 6with some conclusions and future work. 2. Preliminaries Let F2={ 0,1 } be the Galois field of two elements, i.e., the binary field. Let {ui}i≥0= {u0 , u1 , u2 , . . .} be a binary sequence, that is, each term satisfies that ui∈F2 , for all i≥ 0. The sequence {ui}i≥0 (or simply {ui} ) is said to be periodic if there exists a positive integer T such that ui+T=ui , for all i≥ 0. This number T is known as the period of the sequence. Let L be a positive integer and a0 , a1 , . . . , aL−1 elements of F2 . The sequence {ui} is a binary L-th order linear recurring sequence if it satisfies ui+L=aL−1ui+L−1+aL−2ui+L−2+· · · +a1ui+1+a0ui,i≥0 (1) The expression in Equation (1) is known as an L -th order linear recurrence relationship. The polynomial of degree Lgiven by p(x) = a0+a1x+a2x2+· · · +aL−1xL−1+xL∈F2[x], Cryptography 2022,6, 21 3 of 22 is called the characteristic polynomial of the linear recurrence relationship as well as the characteristic polynomial of {ui}. The generation of these linear recurrence sequences can be implemented by Linear Feedback Shift Registers (LFSRs) [ 8 ]. An LFSR of length L is a generator of binary sequence with L cell or stages interconnected. The terms {a0 , a1 , a2 , . . . , aL−1} are binary coefficients assigned to the corresponding stages. The initial state (stage contents at round zero) is the seed, and since the register operates in a deterministic form, the resultant sequence is completely determined by the initial state. At each clock pulse, the binary content of each stage shifts one position to the left, and one bit is output from the register. The input of each round is a bit resultant from applying a linear transformation function to a previous state (see Figure 1). If the characteristic polynomial p(x) is primitive, then the LFSR is said to be a maximal-length LFSR, and the resultant sequence, called a PN-sequence (or m -sequence), has period T=2L−1 (with 2L−1ones and 2L−1−1 zeros) [8]. Version April 20, 2022 submitted to Journal Not Specified 3 of 21 is called the characteristic polynomial of the linear recurrence relationship as well as the 81 characteristic polynomial of {ui}.82 The generation of these linear recurrence sequences can be implemented by Linear 83 Feedback Shift Registers (LFSRs) [ 8 ]. An LFSR of length L is a generator of binary sequence 84 with L cell or stages interconnected. The terms {a0 , a1 , a2 , . . . , aL−1} are binary coefficients 85 assigned to the corresponding stages. The initial state (stage contents at round zero) is 86 the seed, and since the register operates in a deterministic form, the resultant sequence is 87 completely determined by the initial state. At each clock pulse, the binary content of each 88 stage shifts one position to the left and one bit is output from the register. The input of each 89 round is a bit resultant from applying a linear transformation function to a previous state 90 (see Figure 1). If the characteristic polynomial p(x) is primitive, then the LFSR is said to be 91 a maximal-length LFSR and the resultant sequence, called PN-sequence (or m -sequence), 92 has period T=2L−1 (with 2L−1ones and 2L−1−1 zeros) [8]. 93 Figure 1. LFSR of length L(or LFSR with Lstages) ui+1ui+2ui+3· · · ui+L−1ui+L a0a1a2· · · aL−2aL−1 + + · · · + + ui The linear complexity of a sequence, denoted by LC , is defined as the length of the 94 shortest LFSR that generates such a sequence, i.e., the degree of its characteristic polynomial. 95 In cryptography, LC must be as large as possible. The expected value is approximately half 96 the period LC ≃T/ 2 (see [ 13 ]). Nowadays, values of T in the range T≥ 2 128 , i.e., LC ≃ 2 64 , 97 seem to be enough for cryptographic purposes (see specifications of the candidates in 98 the call of NIST for lightweight cryptography primitives [ 5 ]). Notice that all examples 99 included in this work are merely illustrative, since they do not achieve the required values 100 for cryptographic applications. PN-sequences produced by maximal-length LFSRs have 101 large period but their LC is very low. This is due to the inherent linearity of these sequences, 102 thus, we need to do something to break it. One possible approach is implementing irregular 103 decimation on the PN-sequences. 104 2.1. Shrinking generator 105 First, we need to recall the concept of decimation. The decimation of the sequence {si}106 by (distance) δ is the new sequence {ui}={sδ·i} , obtained by taking every δ -th term of 107 such a sequence [14]. 108 The binary sequence generator known as the Shrinking Generator (SG) [ 9 ] is made up of two maximal-length LFSRs, R1 and R2 , with lengths L1 and L2 , respectively, satisfying gcd(L1 , L2) = 1. Denote by pk∈F2[x] , with degree Lk , the characteristic polynomial of Rk , and Tk= 2 Lk− 1, the period of the corresponding PN-sequence, for k= 1,2. The PN-sequence {ai} generated by R1 decimates the PN-sequence {bi} produced by the other register R2 . The decimation rule satisfies the following: given ai and bi , i= 0,1,2, . . . , the output sequence {sj}is obtained as (If ai=1 then sj=bi. If ai=0 then biis discarded. The sequence {sj} is known as the shrunken sequence whose period is T= ( 2 L2− 1 ) 2 L1−1 . 109 Its linear complexity [ 10 ] satisfies the inequality L2 2 L1−2<LC ≤L2 2 L1−1 and its charac110 teristic polynomial has the form p(x)m , where 2 L1−2<m≤ 2 L1−1 and p(x) is a primitive 111 Figure 1. LFSR of length L(or LFSR with Lstages). The linear complexity of a sequence, denoted by LC , is defined as the length of the shortest LFSR that generates such a sequence, i.e., the degree of its characteristic polynomial. In cryptography, LC must be as large as possible. The expected value is approximately half the period LC ≃T/ 2 (see [ 13 ]). Nowadays, values of T in the range T≥ 2 128 , i.e., LC ≃ 2 64 , seem to be enough for cryptographic purposes (see specifications of the candidates in the call of NIST for lightweight cryptography primitives [ 5 ]). Notice that all examples included in this work are merely illustrative, since they do not achieve the required values for cryptographic applications. PN-sequences produced by maximal-length LFSRs have a large period, but their LC is very low. This is due to the inherent linearity of these sequences; thus, we need to do something to break it. One possible approach is implementing irregular decimation on the PN-sequences. 2.1. Shrinking Generator First, we need to recall the concept of decimation. The decimation of the sequence {si} by (distance) δ is the new sequence {ui}={sδ·i} , which is obtained by taking every δ -th term of such a sequence [14]. The binary sequence generator known as the Shrinking Generator (SG) [ 9 ] is made up of two maximal-length LFSRs, R1 and R2 , with lengths L1 and L2 , respectively, satisfying gcd(L1 , L2) = 1. Denote by pk∈F2[x] , with degree Lk , the characteristic polynomial of Rk , and Tk= 2 Lk− 1, the period of the corresponding PN-sequence, for k= 1,2. The PN-sequence {ai} generated by R1 decimates the PN-sequence {bi} produced by the other register R2 . The decimation rule satisfies the following: given ai and bi , i= 0,1,2, . . . , the output sequence {sj}is obtained as (If ai=1 then sj=bi. If ai=0 then biis discarded. The sequence {sj} is known as the shrunken sequence whose period is T= ( 2 L2− 1 ) 2 L1−1 . Its linear complexity [ 10 ] satisfies the inequality L2 2 L1−2<LC ≤L2 2 L1−1 , and its charac- Cryptography 2022,6, 21 4 of 22 teristic polynomial has the form p(x)m , where 2 L1−2<m≤ 2 L1−1 and p(x) is a primitive polynomial of degree L2 [ 15 ]. Notice that here, p(x)m denotes the power of the polynomial p(x)with coefficients modulo 2. The shrunken sequence is almost balanced with 2 L1+L2−2 ones in its first period. This binary generator is suitable for applications in stream ciphers, since it is easy to implement and has nice cryptographic properties. Notice that the shrunken sequence is obtained by the irregular decimation of a PN-sequence according to the ones of another PN-sequence. Example 1. Consider R1 and R2 , LFSRs with characteristic polynomials p1(x) = 1 +x+x2 and p2(x) = 1 +x2+x3 , and initial states { 11 } and { 111 } , respectively. The shrunken sequence can be computed as R1: 110110110110110110110 R2: 1 1 A 101A 001A 110A 100A 111A 010A 0 {sj}: 1 1 1 1 1 1 0 0 0 1 1 1 0 0 0 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 0 0 0 The generated sequence has period 14, and it is easy to check that its characteristic polynomial is p(x)2= (1+x+x3)2, i.e., the linear complexity is LC =6. Let F2L2 denote the extension field of F2 , where α root of p2(x) , is a primitive element [ 16 ]. The next results state that the shrunken sequence can be obtained interleaving shifted versions of one single PN-sequence. Theorem 1 ( [10], Theorem 3.1 ) . The sequences obtained decimating by 2 L1−1 , the shrunken sequence, are PN-sequences with period T2 . We call these sequences the interleaved PN-sequences of the shrunken sequence. Theorem 2 ( [10], Theorem 3.3 ) . The primitive polynomial p(x) that generates the interleaved PN-sequences of the shrunken sequence can be computed as p(x) = (x+αT1)(x+α2T1)(x+α4T1)· · · (x+α2L2−1T1), where α∈F2L2is a root of p2(x). Corollary 1 ( [10], Corollary 1 ) . If L2=L1+ 1, then the polynomial p(x) is the reciprocal polynomial of p2(x). In order to illustrate the previous results, we consider now another example with larger parameters. Example 2. Let R1 and R2 be two LFSRs with characteristic polynomials p1(x) = 1 +x2+x3 and p2(x) = 1 +x3+x4 , with L1= 3and L2= 4, and initial states { 111 } and { 1111 } , respectively. The corresponding PN-sequences have periods T1= 7and T2= 15, respectively. The shrunken sequence is given by {sj}={111011010111011000111010000101011001101101001100001011111000}. It has period T= ( 2 L2− 1 ) 2 L1−1= 60 and characteristic polynomial p(x)16 = ( 1 +x+x4)4 , i.e., the linear complexity is LC = 16. If we decimate the shrunken sequence by δ= 4, then we obtain the following four PN-sequences: {s4·j}:{110001001101011} {s4·j+1}:{111100010011010} {s4·j+2}:{101111000100110} {s4·j+3}:{011010111100010} Cryptography 2022,6, 21 5 of 22 The characteristic polynomial of these four interleaving PN-sequences is p(x) = x+α7x+α14x+α28x+α56=1+x+x4 where α∈F2L2 is a root of p2(x) and p(x) is the reciprocal polynomial of p2(x) . Notice that the four PN-sequences are shifted versions of the same PN-sequence. The polynomial p(x) depends on L1 (the degree of p1(x) ) and p2(x) . Thus, every primitive polynomial with degree L1 produces the same polynomial p(x) , once the polynomial p2(x)is fixed. Notice that if p(x) generates the interleaved PN-sequences of the shrunken sequence, then p(x)2L1−1 generates such a sequence. Nonetheless, although p(x)2L1−1 always generates the shrunken sequence, it might not be the characteristic polynomial. Sometimes, the characteristic polynomial has the form p(x)m, with 2L1−2<m<2L1−1. 2.2. Shifted Versions of the Same PN-Sequence In Section 2.1, we saw that the shrunken sequence can be generated interleaving shifted versions of the same PN-sequence, and the characteristic polynomial of these PNsequences is obtained from the input polynomials of the shrinking generator. The shifts of the shifted versions can be also obtained via the input LFSRs (see [ 10 , 11 ]), and this fact is used to attack the SG [11]. One way to deal with this liability is to consider random shifts. In this section, we briefly comment on the results obtained in [ 12 ]. First, we need to introduce the concept of t -interleaved sequence. We say that the sequence {sj} is obtained interleaving the sequences {u(1) i} , {u(2) i} , . . . , {u(t) i} , all of them with period T , if it has the following form {sj}=nu(1) 0,u(2) 0, . . . , u(t) 0,u(1) 1,u(2) 1, . . . , u(t) 1, . . . , u(1) T−1,u(2) T−1, . . . , u(t) T−1o. We call this sequence a t-interleaved sequence. In [ 12 ], the authors consider that these t sequences {u(j) i} for j= 1,2, . . . , t , are PNsequences obtained from the same primitive polynomial, that is, shifted versions of the same PN-sequence. If the corresponding LFSR has length L , then the resultant t -interleaved sequence is almost balanced, and its number of 1s is t·2(L−1). The linear complexity for this sequence satisfies LC ≤t·L and its period T≤t· ( 2 L− 1 ) . For a fixed value of t , almost 90% of the t -interleaved sequences (running over all possible shifted versions) achieve the maximal LC and period. In [ 12 ], the authors study more deeply the cases where t= 2 l , and they perform a preliminary analysis on the randomness of these sequences. They also provide some tools to identify the cases where the LC is low and the sequences are not suitable for cryptographic purposes. More information about these sequences and some comparison with the sequences constructed in this work can be found in Section 4. In this work, we consider t -interleaved sequences obtained interleaving PN-sequences from different primitive polynomials with the same degree. Note that these t -interleaved sequences can be seen as the output sequences of a keystream generator where, at each clock pulse, we obtain at the same time the output of t different LFSRs. That is, at each instant ti , the output bits are {u(1) ti , u(2) ti , . . . , u(t) ti} . Therefore, the interleaving method, in this case, could be considered as the concatenation of the output of t LFSRs at each instant of time. On the other hand, this interleaving method is very similar to the generation method of a DLFSR. A DLFSR (Dynamic Linear Feedback Shift Register) is a type of LFSR in which the characteristic polynomial changes at certain clock pulse [ 17 , 18 ]. In Figure 2, we represent a DLFSR that consists of a main LFSR and an additional control module. This module manages the characteristic polynomial used at each instant of time. The sequences generated by a DLFSR can be considered as the concatenation of segments of different PN- Cryptography 2022,6, 21 6 of 22 sequences. The purpose of a DLFSR is to generate sequences with larger periods and higher linear complexity than the ones produced by a single LFSR [ 19 , 20 ]. To carry out this task, the control module modifies different feedback parameters to generate a different sequence. Our interleaving method can be seen as a DLFSR where the characteristic polynomial changes depending on the counter module, i.e., at each clock pulse, we consider a different primitive polynomial. In Figure 3, we can check the generation of a four-interleaved sequence. At each clock pulse, one bit is generated from the corresponding LFSR in that instant, and then, we jump from the actual polynomial to the next one. Thus, we obtain our interleaved sequence concatenating the individual outputs of each one of the LFSRs at each instant of time. Version April 20, 2022 submitted to Journal Not Specified 6 of 21 Figure 2. DLFSR characteristic polynomial am−1am−2am−3· · · a0 Counter polynomial selection characteristic polynomial bL−1bL−2bL−3· · · b0 CLOCK CLOCK2 sj Module of feedback control Figure 3. The generation of a 4-interleaving sequence as a DFLSR u(2) 0u(2) 1u(2) 2· · · u(2) L−1u(3) 0u(3) 1u(3) 2· · · u(3) L−1u(4) 0u(4) 1u(4) 2· · · u(4) L−1 u(1) 0u(1) 1u(1) 2· · · u(1) L−1 Counter stst+1st+2st+3 CLK characteristic polynomial p1(x)characteristic polynomial p2(x)characteristic polynomial p3(x)characteristic polynomial p4(x) sequences. The purpose of a DLFSR is to generate sequences with larger period and higher 171 linear complexity than the ones produced by a single LFSR [ 19 , 20 ]. To carry out this task, 172 the control module modifies different feedback parameters to generate a different sequence. 173 Our interleaving method can be seen as a DLFSR where the characteristic polynomial 174 changes depending on the counter module, i.e., at each clock pulse we consider a different 175 primitive polynomial. In Figure 3, we can check the generation of a 4-interleaved sequence. 176 At each clock pulse, one bit is generated from the corresponding LFSR in that instant and 177 then we jump from the actual polynomial to the next one. Thus, we obtain our interleaved 178 sequence concatenating the individual outputs of each one of the LFSRs at each instant of 179 time. 180 3. Interleaving PN-sequences with different characteristic polynomials 181 In this section, we analyse the interleaving of PN-sequences obtained from different 182 polynomials with the same degree. 183 Consider t maximal-length LFSRs, notated R1 , R2 , . . . , Rt , with primitive characteristic 184 polynomials p1(x) , p2(x) , . . . , pt(x) , respectively, and all of them with degree L . Given the 185 PN-sequence {a(k) i} , generated by Rk , for k= 1,2, . . . , t , the corresponding t -interleaved 186 sequence {sj}is obtained as follows 187 Figure 2. DLFSR. Version April 20, 2022 submitted to Journal Not Specified 6 of 21 Figure 2. DLFSR characteristic polynomial am−1am−2am−3· · · a0 Counter polynomial selection characteristic polynomial bL−1bL−2bL−3· · · b0 CLOCK CLOCK2 sj Module of feedback control Figure 3. The generation of a 4-interleaving sequence as a DFLSR u(2) 0u(2) 1u(2) 2· · · u(2) L−1u(3) 0u(3) 1u(3) 2· · · u(3) L−1u(4) 0u(4) 1u(4) 2· · · u(4) L−1 u(1) 0u(1) 1u(1) 2· · · u(1) L−1 Counter stst+1st+2st+3 CLK characteristic polynomial p1(x)characteristic polynomial p2(x)characteristic polynomial p3(x)characteristic polynomial p4(x) sequences. The purpose of a DLFSR is to generate sequences with larger period and higher 171 linear complexity than the ones produced by a single LFSR [ 19 , 20 ]. To carry out this task, 172 the control module modifies different feedback parameters to generate a different sequence. 173 Our interleaving method can be seen as a DLFSR where the characteristic polynomial 174 changes depending on the counter module, i.e., at each clock pulse we consider a different 175 primitive polynomial. In Figure 3, we can check the generation of a 4-interleaved sequence. 176 At each clock pulse, one bit is generated from the corresponding LFSR in that instant and 177 then we jump from the actual polynomial to the next one. Thus, we obtain our interleaved 178 sequence concatenating the individual outputs of each one of the LFSRs at each instant of 179 time. 180 3. Interleaving PN-sequences with different characteristic polynomials 181 In this section, we analyse the interleaving of PN-sequences obtained from different 182 polynomials with the same degree. 183 Consider t maximal-length LFSRs, notated R1 , R2 , . . . , Rt , with primitive characteristic 184 polynomials p1(x) , p2(x) , . . . , pt(x) , respectively, and all of them with degree L . Given the 185 PN-sequence {a(k) i} , generated by Rk , for k= 1,2, . . . , t , the corresponding t -interleaved 186 sequence {sj}is obtained as follows 187 Figure 3. The generation of a four-interleaving sequence as a DFLSR. 3. Interleaving PN-Sequences with Different Characteristic Polynomials In this section, we analyze the interleaving of PN-sequences obtained from different polynomials with the same degree. Consider t maximal-length LFSRs, notated R1 , R2 , . . . , Rt , with primitive characteristic polynomials p1(x) , p2(x) , . . . , pt(x) , respectively, and all of them with degree L . Given the Cryptography 2022,6, 21 7 of 22 PN-sequence {a(k) i} , generated by Rk , for k= 1,2, . . . , t , the corresponding t -interleaved sequence {sj}is obtained as follows {sj}={a(1) 0,a(2) 0, . . . , a(t) 0,a(1) 1,a(2) 1, . . . , a(t) 1, . . . , a(1) L−1,a(2) L−1, . . . , a(t) L−1, . . .}. From now on, we only consider t -interleaved sequences obtained with different polynomials of the same degree. The following result provides the value of the LC for the t -interleaved sequences. Moreover, it allows us to obtain their characteristic polynomials. Theorem 3 ( [21], Theorem 1 ) . The linear complexity of the sequence generated interleaving t PNsequences produced by different primitive polynomials p1(x) , . . . , pt(x) of degree L is LC =t2L . Furthermore, the characteristic polynomial is p(x) = t ∏ i=1 pi(xt). It is worth noticing that the LC and period are not affected by the initial states. Example 3. Consider 3registers with primitive polynomials p1(x) = 1 +x2+x5 , p2(x) = 1 +x+x2+x4+x5 and p3(x) = 1 +x+x2+x3+x5 . We take the initial states { 11101 } , {10001}and {10101}, respectively. The corresponding PN-sequences are {a(1) i}:{1110101000010010110011111000110} {a(2) i}:{1000100101011000011100110111110} {a(3) i}:{1010100011101111100100110000101}. If we interleave these three PN-sequences, we obtain a sequence with period T= 93 and LC =45:{111100101000111000100010001011001110011001101 001101110010011100100111111100010010010111110001} Using the Berlekamp–Massey algorithm [ 22 ], it is possible to check that the characteristic polynomial of this sequence is p(x) = 1+x9+x24 +x27 +x39 +x42 +x45 =p1(x3)·p2(x3)·p3(x3) with p1(x3) = 1+x6+x15 = (x5+x4+x3+x+1)(x10 +x9+x7+x5+x2+x+1) p2(x3) = 1+x3+x6+x12 +x15 = (x5+x4+x3+x2+1)(x10 +x9+x7+x2+1) p3(x3) = 1+x3+x6+x9+x15 = (x5+x3+1)(x10 +x8+x6+x5+1) where all three polynomials of degree 5 are primitive and those of degree 10 are irreducible. The next result is a particular case of Theorem 3for the case in which t is a power of 2. Corollary 2. Let t be a power of two. Then, the characteristic polynomial of a t -interleaved sequence produced by t different primitive polynomials p1(x), . . . , pt(x)of degree L is p(x) = [p1(x)·p2(x)· · · pt−1(x)·pt(x)]t. Proof. Let t= 2 r for r be a positive integer. The result is an immediate consequence of the fact that pi(x2r) = pi(x)2rin F2. Cryptography 2022,6, 21 8 of 22 Next, we show different examples of the generation of t -interleaved sequences. We analyze their LC and their characteristic polynomials depending on the choice of the initial primitive polynomials. In the following example, we obtain a f our -interleaved sequence corresponding to two primitive polynomials and their corresponding reciprocal polynomials. Example 4. Consider f our registers with primitive polynomials p1(x) = 1 +x2+x5 , p2(x) = 1 +x3+x5 , p3(x) = 1 +x2+x3+x4+x5 and p4(x) = 1 +x+x2+x3+x5 . We observe that p2(x) and p4(x) are the reciprocal polynomials of p1(x) and p3(x) , respectively. We take the initial states { 01101 } , { 10001 } , { 10001 } , and { 00110 } , respectively. The corresponding PN-sequences are {a(1) i}:{0110111010100001001011001111100} {a(2) i}:{1000111110011010010000101011101} {a(3) i}:{1000101011010000110010011111011} {a(4) i}:{0011000010110101000111011111001}. If we interleave these four PN-sequences, we obtain a sequence with period T= 124 and LC =80: {01101000100100011110110011100100111100101001011101000001010010 01001001101000000110111001010000111111101111111111110000100111} Using the Berlekamp–Massey algorithm [ 22 ], it is easy to check that the characteristic polynomial of this sequence is p(x) = [p1(x)·p2(x)·p3(x)·p4(x)]4 = (1+x2+x5)4(1+x3+x5)4(1+x2+x3+x4+x5)4(1+x+x2+x3+x5)4 =1+x4+x8+x12 +x20 +x32 +x36 +x40 +x44 +x48 +x60 +x68 +x72 +x76 +x80. In this example, the LC does not depend on the initial states; its value is always 80. Moreover, if we consider different primitive polynomials of degree 5, the value of LC remains the same. The next example shows a case where there are no reciprocal polynomials. Example 5. Consider now four registers with primitive polynomials p1(x) = 1 +x+x7 , p2(x) = 1 +x3+x7 , p3(x) = 1 +x+x2+x3+x7 and p4(x) = 1 +x2+x3+x4+x7 , with initial states { 1010001 } , { 0111011 } , { 1101001 } , and{ 1100101 } ,respectively. If we interleave the four PN-sequences generated by the previous polynomials, we obtain a sequence with period 508 (the same as that of the SG with polynomials of degree 3 and 7) and LC = 112, which is four times higher than that of the SG: {10110111110001100001010011111110110010100001010010000110010100111010011010 101000011100111001101110100011100101111011001100101111101010111101110000011 000001101000010010111111110100101010000011011010001011111100011001110001001 001111011110000110000110110110000110100111101011100101101100111000010011010 111001100010110000110011010000101101010011001000111001010111000100100101111 010110011111100100100001101010001011011000110010111011100111110111000101010 11001100000100100000101010001010110110111010101001100100010}. The characteristic polynomial of the sequence is given by Cryptography 2022,6, 21 9 of 22 p(x) = [p1(x)·p2(x)·p3(x)·p4(x)]4 = [(1+x+x7)(1+x3+x7)(1+x+x2+x3+x7)(1+x2+x3+x4+x7)]4 = (1+x2+x5+x7+x8+x9+x11 +x12 +x15 +x16 +x17 +x18 +x24 +x25 +x28)4. The next example shows that the polynomials must be all different to achieve the maximal complexity. Example 6. Consider the primitive polynomials p1(x) = p2(x) = 1 +x2+x5 , p3(x) = 1 + x+x2+x3+x5 and p4(x) = 1 +x2+x3+x4+x5 and consider the initial states { 10111 } , { 11010 } , { 00011 } , and { 10110 } , respectively. The corresponding f our -interleaved sequence has the following form: {11010100100111111010011110000010101000100111001100001100001101 00110000111011110101010101110011111001101110100100011000011110} This sequence has period T= 124 and LC = 60, which is not the maximal vale (80) for this parameter. The characteristic polynomial is given by: p(x) = [p1(x)p3(x)p4(x)]4=1+x4+x8+x16 +x20 +x24 +x36 +x56 +x60 Notice that in this case, the primitive polynomial is not the product of all four polynomials; this is due to the fact that p1(x) = p2(x). In Table 1, we can check the values of the LC of t -interleaved sequences using PNsequences from different polynomials of degree L . It is worth recalling that there are only six primitive polynomials of degree 5 and six of degree 6. It means that when we construct seven-interleaved sequences or eight-interleaved sequences, we have to consider at least one repeated polynomial. Therefore, the values in red in Table 1are just upper bounds, since, as we saw in Example 6, when the polynomials are not different, we risk having a sequence without maximal LC. Table 1. LC of the interleaving sequences of tprimitive polynomials of degree L. XXXXXXXX X t L56789 4 80 96 112 128 144 5 125 150 175 200 225 6 180 216 252 288 324 7245 294 343 392 441 8320 384 448 512 576 4. Comparison with Other Sequence Generators In this section, we analyze briefly the advantages of our t -interleaved sequences compared with the sequences obtained from generators with similar parameters. 1. Shrinking generator Given two primitive polynomials of degree L1 and L2 , the linear complexity of the shrunken sequence satisfies: 2 L1−2<LC ≤L2· 2 L1−1 and T= ( 2 L2− 1 ) 2 L1−1 . In this case, the sequence is obtained interleaving 2 L1−1 shifted versions of the same PN-sequence. If we interleave 2 L1−1 PN-sequences generated by different primitive polynomials of degree L2 , the linear complexity of the resultant sequence is LC =L2· 2 2(L1−1) , which Cryptography 2022,6, 21 16 of 22 2. POKER (SERIAL) TEST: Let m be an integer number such that bT mc ≥ 5 · 2 m and let k=bT mc . The sequence {si} is divided into k non-overlapping parts each one of length m , and let mi be the number of occurrences of the i -th type of sequence of length m , for 1 ≤i≤ 2 m . The Poker Test determines if each stream of length m appears approximately the same number of times in {si} , as would be expected for a random sequence. Note that for m= 1, the Poker Test is equivalent to the Frequency Test. 3. RUNS TEST: The incidences of runs (for both consecutive zeros and consecutive ones) of all lengths ( ≥ 1) in the sample stream should be counted and stored. The purpose of the Runs Test is to determine if the number of runs of different lengths in the sequence {si} is as expected for a random sequence. In particular, this test determines whether the oscillation between zeros and ones is too fast or too slow. 4. LONG RUNS TEST: A long run is defined to be a run of length 26 or more (of either zeros or ones). The focus of this test is the longest run of ones within M -bit blocks. Its purpose is to determine whether the length of the longest run of ones within the sequence is consistent with the length of the longest run of ones that would be expected in a random sequence. Note that one irregularity in the expected length of the longest run of ones implies that there is also an irregularity in the expected length of the longest run of zeros. Therefore, only a test for ones is necessary. 5. FREQUENCY TEST WITHIN A BLOCK: The focus of this test is the proportion of ones within M -bit blocks. The purpose is to determine whether the frequency of ones in an M -bit block is approximately M 2 , as would be expected under an assumption of randomness. For the block size M= 1, this test degenerates to the Frequency (Monobit) test. Frequency Test is defined to check the first postulate of Golomb. The second postulate of Golomb, about the number of runs in sequences, is analyzed in the Runs Tests. Finally, the third postulate gives information about similarities between the sequence and shifted versions of it. If {si} is a random sequence, the autocorrelation should be constant. •Maurer’s Universal Test The focus of this test is the number of bits between matching patterns (a measure that is related to the length of a compressed sequence). The purpose of the test is to detect whether or not the sequence can be significantly compressed without loss of information. A significantly compressible sequence is considered to be non-random. •Lempel–Ziv Compression Test The focus of this test is the number of cumulatively distinct patterns (words) in the sequence. The purpose is to determine how far the tested sequence can be compressed; it is considered to be non-random if it can be significantly compressed. A random sequence will have a characteristic number of distinct patterns. This test works by reading a sequence of symbols, grouping the symbols into strings, and converting the strings into codes. We get compression because the codes take up less space than the strings they replace. No data are lost when compressing. In Table 3, we present a small sample of the results obtained in the NIST tests here presented. All these values are the average of the results obtained for any sample of t-interleaved sequences studied. Cryptography 2022,6, 21 17 of 22 Table 3. p -values of some statistical tests of NIST for t -interleaved sequences with different characteristic polynomials of degree 20. hhhhhhhhhhhhh h Tests t-Interleaved 3 4 5 6 7 8 Monobit 0.4952 0.4740 0.0493 0.6213 0.5592 0.9745 Poker 0.9083 0.2742 0.5086 0.0488 0.9960 0.4902 Runs 0.5402 0.5160 0.4629 0.5946 0.6000 0.9840 Long Runs 0.5715 0.5823 0.6785 0.8791 0.1204 0.9719 Frequency block 0.4068 0.2167 0.3672 0.7633 0.3473 0.5089 Maurer’s 0.6623 0.4129 0.2069 0.8374 0.5539 0.4262 Lempel-Ziv 0.0931 0.9159 0.0531 0.2314 0.9069 0.9719 •Diehard Diehard battery of tests [ 32 ] is a reliable standard for evaluating the randomness of sequences of pseudo-random number generators. This tool is a powerful instrument for the practical evaluation process of cryptographic primitives. It cannot guarantee if your generator can be considered perfectly random, but if it does not pass the test suite, then it is not suitable for cryptographic applications. Diehard battery [ 32 ] consists of 15 different independent statistical tests, some of them repeated but with different parameters: 1. BIRTHDAY SPACINGS TEST: Choose random points on a large interval. The spacings between the points should be asymptotically exponentially distributed. 2. OPERM5 TEST: Analyze sequences of five consecutive random numbers. The 120 possible orderings should occur with statistically equal probability. 3. BINARY RANK TEST FOR 31 × 31 MATRICES: The leftmost 31 bits of 31 random integers from the test sequence are used to form a 31 × 31 binary matrix over the field { 0,1 } . The rank is determined. That rank can be from 0 to 31, but ranks less than 28 are rare, and their counts are pooled with those for rank 28. Ranks are found for 40,000 of such random matrices, and a chi-square test is performed on counts for ranks 31,30,29 and ≤28. 4. BINARY RANK TEST FOR 32 × 32 MATRICES: The rank of a random 32 × 32 matrix is identified. Ranks less than 29 are rare. Chi-square tests are performed on the ranks 32,31,30 and less than or equal to 29. This is repeated 40,000 times. 5. BINARY RANK TEST FOR 6 × 8 MATRICES: The rank of a random 6 × 8 matrix is identified. Ranks less than 4 are rare. Chi-square tests are performed on the ranks 6,5 and less than or equal to 4. This is repeated 100,000 times. 6. BITSTREAM TEST: Consider each bit as a single letter ( 0 or 1 ) . In a rolling group of 20 bits, count the number of 20-bit permutations out of 2 21 20-bit groups. As there are 2 20 possible 20-bit permutations, count how many are missing, which should be normally distributed. This test is repeated 20 times. 7. OPSO, OQSO and DNA TESTS: (a) OPSO TEST: This is the overlapping-pairs-sparse-occupancy test. Each set of 5 bits is considered a ’letter’; thus, there are 1024 letters in the ’alphabet’. Two-letter words are taken from each 32-bit integer and are counted. As there are 2 21 possible two-letter words, the missing words are identified and should be normally distributed. (b) OQSO TEST: A variant that uses four-letter words. (c) DNA TEST: A variant where there are only four letters in the alphabet, and each letter is two bits. 8. COUNT-THE-1s TEST: A specific byte from each integer is chosen to represent a letter. There are five possible letters, each chosen by counting the number of Cryptography 2022,6, 21 18 of 22 1’s in the byte: 0,1,2 =A ;3 =B ;4 =C ;5 =D ;6,7,8 =E . The five probabilities are therefore 37,56,70,56 and 37 over 256, respectively. Five integer sequences are selected on a rolling basis, and counts are made on word frequencies. A covariance matrix is formed. 9. PARKING LOT TEST: Randomly place unit circles in a 100 × 100 square. A circle is successfully parked if it does not overlap an existing successfully parked one. After 12,000 tries, the number of successfully parked circles should follow a certain normal distribution. 10. MINIMUM DISTANCE TEST: In a square of size 10,000 × 10,000, randomly select 8000 points. Find the minimum distance between the pairs. The square of this distance should be exponentially distributed with a mean close to 0.995. This is repeated for 100 random selections of 8000 points. 11. RANDOM SPHERES TEST: Randomly choose 4000 points in a cube of edge 1000. Center a sphere on each point, whose radius is the minimum distance to another point. The smallest sphere’s volume should be exponentially distributed with a certain mean. 12. SQUEEZE TEST: Multiply 2 31 by random floats on ( 0,1 ) until you reach 1. Repeat this 100,000 times. The number of floats needed to reach 1 should follow a chisquare distribution. 13. OVERLAPPING SUMS TEST: Generate a long sequence of random floats on ( 0,1 ) . Add sequences of 100 consecutive floats. The sums should be normally distributed with characteristic mean and variance. 14. RUNS TEST: Generate a long sequence of random floats on a [ 0,1 ) distribution. Ascending and descending runs should follow a certain covariance matrix. This is repeated 10 times for sequences of length 10,000. 15. CRAPS TEST: Play 200,000 games of craps, counting the wins and the number of throws per game. Each count should follow a chi-square distribution. Note that The Count-The-1s and the OPSO tests are both sometimes known as the Monkey Test. These statistical tests are designed to test the null hypothesis H0 , which states that the input sequence is randomly generated. If the hypothesis is not rejected in all the tests, then it is implied that the input sequences are random. Most of the tests in DIEHARD return a p -value or the KS p -value (given by the Kolmogorov–Smirnov test), which should be uniform on [ 0,1 ) if the input file contains truly independent random bits. It is considered that a bit stream really fails when it obtains p -values of 0 or 1 to six or more places. Testing Diehard battery of tests for a hundred eight-interleaved sequences with different polynomials of degree 24, we say that Diehard does not show any weakness. >From the results of Table 4of a particular sequence, we can check that all the values are in the appropriate range. Table 4. Diehard battery of tests results for an eight-interleaved sequence with different characteristic polynomials of degree 24. Test Name p-Value Result Test Name p-Value Result Birthday spacing 0.770936 Pass OQSO 0.8197 Pass 0.747460 0.1329 0.989202 0.5293 0.774785 0.6284 0.576802 0.7687 0.176450 0.0969 0.874796 0.7288 Cryptography 2022,6, 21 19 of 22 Table 4. Cont. Test Name p-Value Result Test Name p-Value Result 0.139735 0.9149 0.514557 0.9812 Overlapping 0.974948 Pass 0.7603 permutations 0.759794 0.6207 Binary ranks 31 ×31 0.752307 Pass 0.8554 Binary ranks 32 ×32 0.934338 Pass 0.3293 Binary ranks 6 ×8 0.445734 Pass 0.0179 0.76389 OQSO 0.7859 Pass 0.13337 0.4336 0.67455 0.1403 0.49876 0.7540 0.88496 0.3442 0.96748 0.1236 0.07041 0.1888 0.08609 0.8394 0.67958 0.6233 Bit stream 0.61726 Pass 0.1351 (Monkey tests) 0.78081 0.4005 0.61369 0.4097 0.80996 0.4941 0.88405 0.8206 0.35224 DNA 0.5756 Pass 0.62968 0.7611 0.53228 0.5149 0.17966 0.8418 0.02605 0.9799 0.16593 0.2000 OPSO 0.8834 Pass 0.6843 0.7423 0.8916 0.2625 0.2560 0.5394 0.2569 0.5394 0.0096 0.6175 0.2598 0.2614 0.1103 0.6739 0.2117 0.7986 0.5963 0.6588 0.3547 Cryptography 2022,6, 21 20 of 22 Table 4. Cont. Test Name p-Value Result Test Name p-Value Result 0.7102 0.4503 0.4069 0.5184 0.8906 0.9202 OPSO 0.4968 Pass DNA 0.0457 Pass 0.1266 0.8440 0.1259 0.9479 0.8229 0.6468 0.4243 0.3536 0.3429 0.6446 0.6911 0.0831 0.1838 0.7538 0.2961 0.7575 0.2145 0.9951 Count-the-1’s 0.476036 Pass 0.5849 (stream of bytes) 0.572657 0.2852 0. Parking lot 0.407931 Pass 0.453489 Minimum distance 0.752286 Pass 0.531694 3D Spheres 0.947691 Pass 0.476337 Squeeze 0.990622 Pass 0.115181 Overlapping sums 0.276467 Pass 0.238283 0.276783 0.248038 Runs 0.893007 Pass 0.170200 0.908305 0.595302 0.913183 0.167417 Craps 0.995956 Pass 0.574701 105,661 Count-the-1’s 0.384873 Pass (specific bytes) 0.944743 0.955924 0.210026 0.142320 0.717744 0.191102 0.728247 0.297792 0.971290 0.323464 0.408101 0.013264 0.859849 Cryptography 2022,6, 21 21 of 22 6. Conclusions Interleaving sequences is a way to increase the linear complexity of such sequences and to break the linearity just in case of working with PN-sequences. In this paper, we analyze the randomness of the sequences obtained by interleaving PN-sequences generated by different characteristic polynomials with the same degree. According to the obtained results, these sequences achieve the maximal possible linear complexity and, in terms of randomness, they are better than the sequences obtained interleaving PN-sequences with the same polynomial. Therefore, they seem to be suitable for applications in cryptography. As future work, we would like to apply more batteries of tests to our sequences and study what happens if we interleave PN-sequences with different periods. In this last case, we are not sure how the different periods can affect the resultant sequence. We need to perform a deep study in order to achieve some conclusions. Author Contributions: All authors contributed equally. All authors have read and agreed to the published version of the manuscript. Funding: This work was supported in part by the Spanish State Research Agency (AEI) of the Ministry of Science and Innovation (MICINN), project P2QProMeTe (PID2020-112586RB-I00/AEI/ 10.13039/501100011033). It was also supported by Comunidad de Madrid (Spain) under project CYNAMON (P2018/TCS-4566), co-funded by FSE and European Union FEDER funds. The work of the second author was partially supported by Spanish grant VIGROB-287 of the University of Alicante. Institutional Review Board Statement: Not applicable. Informed Consent Statement: Not applicable. Data Availability Statement: Not applicable. Acknowledgments: The authors would like to thank Fausto Montoya and Amalia B. Orúe for kindly sharing some of their visual programs, which were applied in the frame of this work to check the randomness of the sequences generated. They would also like to thank Miguel Beltrá for the help provided during the computational calculations. Conflicts of Interest: The authors declare no conflict of interest. The funders had no role in the design of the study; in the collection, analyses, or interpretation of data; in the writing of the manuscript, or in the decision to publish the results. Abbreviations The following abbreviations are used in this manuscript: IoT Internet of Things PRNG Pseudo-Random Number Generator LFSR Linear Feedback Shift Register LC Linear Complexity PN-sequence Pseudo Noise-sequence SG Shrinking Generator MAC Message Authentication Code References 1. Gallegos-Segovia, P.; Bravo-Torres, J.; Argudo-Parra, J. Internet of things as an attack vector to critical infrastructures of cities. In Proceedings of the 2017 International Caribbean Conference on Devices, Circuits and Systems (ICCDCS), Cozumel, Mexico, 5–7 June 2017, pp. 117–120. 2. Biryukov, A.; Perrin, L. State of the Art in Lightweight Symmetric Cryptography. Cryptology ePrint Archive, Report 2017/511, 2017. Available online: https://ia.cr/2017/511 (accessed on 3 April 2022 ). 3. Chin, W.; Li, W.; Chen, H. Energy big data security threats in IoT-based smart grid communications. IEEE Commun. Mag. 2017 , 55, 70–75. [CrossRef] 4. Mavromoustakis, C.; Mastorakis, G.; Batalla, J. Internet of Things (IoT) in 5G Mobile Technologies; Springer: Berlin/Heidelberg, Germany, 2016. Cryptography 2022,6, 21 22 of 22 5. National Institute of Standards and Technology (NIST). NIST Lightweight Cryptography Project. Technology Administration. 2022. Available online: https://csrc.nist.gov/Projects/Lightweight-Cryptography (accessed on 3 April 2022 ). 6. Zia, U.; McCartney, M.; Scotney, B.; Martinez, J.; Sajjad, A. A novel pseudo-random number generator for IoT based on a coupled map lattice system using the generalised symmetric map. SN Appl. Sci. 2022,4, 48. [CrossRef] 7. Kietzmann, P.; Schmidt, T.C.; Wählisch, M. A Guideline on Pseudorandom Number Generation (PRNG) in the IoT. ACM Comput. Surv. 2021,54, 1–38 . [CrossRef] 8. Golomb, S.W. Shift Register-Sequences; Aegean Park Press: Laguna Hill, CA, USA, 1982. 9. Coppersmith, D.; Krawczyk, H.; Mansour, Y. The shrinking generator. In Advances in Cryptology—CRYPTO’93; Stinson, D., Ed.; Springer: Berlin/Heidelberg, Germany, 1994; Volume 773, pp. 22–39. [CrossRef] 10. Cardell, S.D.; Fúster-Sabater, A. Modelling the shrinking generator in terms of linear CA. Adv. Math. Commun. 2016 ,10, 797–809. [CrossRef] 11. Cardell, S.D.; Climent, J.J.; Fúster-Sabater, A.; Requena, V. Representations of Generalized Self-Shrunken Sequences. Mathematics 2020,8, 1006. [CrossRef] 12. Cardell, S.D.; Fúster-Sabater, A.; Requena, V. Interleaving Shifted Versions of a PN-Sequence. Mathematics 2021 ,9, 687. [CrossRef] 13. Pichler, F. (Ed.) Linear Complexity and Random Sequences. In Lecture Notes in Computer Science; Springer: Berlin/Heidelberg, Germany, 1986; Volume 219. 14. Duvall, P.F.; Mortick, J.C. Decimation of Periodic Sequences. SIAM J. Appl. Math. 1971,21, 367–372. [CrossRef] 15. Fúster-Sabater, A.; Caballero-Gil, P. Linear solutions for cryptographic nonlinear sequence generators. Phys. Lett. A 2007 , 369, 432–437. [CrossRef] 16. Lidl, R.; Niederreiter, H. Introduction to Finite Fields and Their Applications; Cambridge University Press: New York, NY, USA, 1986. 17. Mita, R.; Palumbo, G.; Pennisi, S.; Poli, M. Pseudorandom bit generator based on dynamic linear feedback topology. Electron. Lett. 2002,28, 1097–1098. [CrossRef] 18. Ali Eljadi, F.M.; Taha Al Shaikhli, I.F. Dynamic linear feedback shift registers: A review. In Proceedings of the 5th International Conference on Information and Communication Technology for The Muslim World (ICT4M), Kuching, Malaysia, 17–18 November 2014; pp. 1–5. [CrossRef] 19. Peinado, A.; Munilla, J.; Fúster-Sabater, A. Improving the Period and Linear Span of the Sequences Generated by DLFSRs. In Proceedings of the International Joint Conference SOCO’14-CISIS’14-ICEUTE’14, Advances in Intelligent Systems and Computing, Bilbao, Spain, 25–27 June 2014; de la Puerta, J.G., Ferreira, I.G., Bringas, P.G., Klett, F., Abraham, A., de Carvalho, A.C., Herrero, Á., Baruque, B., Quintián, H., Corchado, E., Eds.; Springer International Publishing: Cham, Switzerland, 2014; Volume 299, pp. 397–406. [CrossRef] 20. St˛epie´n, R.; Walczak, J. Comparative analysis of pseudo random signals of the LFSR and DLFSR generators. In Proceedings of the 20th International Conference Mixed Design of Integrated Circuits and Systems—MIXDES 2013, Gdynia, Poland, 20–22 June 2013; pp. 598–602. 21. Xiong, H.; Qu, L.; Li, C.; Fu, S. Linear complexity of binary sequences with interleaved structure. IET Commun. 2013 ,7, 1688–1696. [CrossRef] 22. Massey, J.L. Shift-register synthesis and BCH decoding. IEEE Trans. Inf. Theory 1969,15, 122–127. [CrossRef] 23. Golomb, S.W.; Parker, M.; Pott, A.; Winterhof, A. In Proceedings of the Sequences and Their Applications—SETA 2008, Lexington, KY, USA, 14–18 September 2008; Volume 5203. 24. National Institute of Standards and Technology. FIPS 140-2: Security Requirements for Cryptographic Module. Federal Information Processing Standards Publication; U.S. Department of Commerce: Washington, DC, USA, 2001. Available online: https://nvlpubs. nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf (accessed on 3 April 2022 ). 25. Barnsley, M. Fractals Everywhere, 2nd ed.; Academic Press: Cambridge, MA, USA, 1988. 26. Peitgen, H.; Jurgens, H.; Saupe, D. Chaos and Fractals: New Frontiers of Science; Springer: Berlin/Heidelberg, Germany, 2004. 27. Orúe, A.; Fúster-Sabater, A.; Fernández, V.; Montoya, F.; Hernández, L.; Martín, A. Actas de la XIV Reunión Espa ˜ n ola sobre Criptología y Seguridad de la Información, RECSI XIV. Available online: https://alarcos.esi.uclm.es/DocumentosWeb/2016 -RECSI-Moreno.pdf (accessed on 3 April 2022 ). 28. Romera, M. Técnica de Los Sistemas Dinámicos Discretos. Textos Univ. CSIC 1997,27, 50–58. 29. Álvarez, G.; Montoya, F.; Romera, M.; Pastor, G. Cryptanalyzing an improved security modulated chaotic encryption scheme using ciphertext absolute value. Chaos Solitons Fractals 2005,23, 1749–1756. [CrossRef] 30. National Institute of Standards and Technology (NIST). A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications. 2010. Available online: http://csrc.nist.gov/publications/nistpubs800/-22rec1/SP8 00-22red1.pdf (accessed on 3 April 2022 ). 31. Maurer, U. A universal statistical test for random bit generators. J. Cryptol. 1992,5, 89–105. [CrossRef] 32. Marsaglia, G. The Marsaglia Random Number CDROM Including the Diehard Battery of Tests of Randomness. 1995. Available online: https://web.archive.org/web/20160125103112/http://stat.fsu.edu/pub/diehard/ (accessed on 3 April 2022 ).