Multivariate Permutation Polynomial Systems and Nonlinear Pseudorandom Number Generators

0.16 MB·English

by  Alina Ostafe

MULTIVARIATE PERMUTATION POLYNOMIAL SYSTEMS AND
NONLINEAR PSEUDORANDOM NUMBER GENERATORS
0
1 ALINAOSTAFE
0
2
Abstract. In this paper we study a class of dynamical systems generated

n by iterations of multivariate permutation polynomial systems which lead to
a polynomial growth of the degrees of these iterations. Using these estimates
J andthesametechniquesstudiedpreviouslyforinversivegenerators,webound

0 exponential sums along the orbits of these dynamical systems and show that
1 they admit much stronger estimates “on average” over all initial values v ∈
Fmp+1thaninthegeneralcaseandthuscanbeofuseforpseudorandomnumber

] generation.
T
N
.
h
t 1. Introduction
a
m Let F ={f ,...,f } be a system of m+1 polynomials in m+1 variables over
0 m
[ an arbitrary field. One can naturally define a dynamical system generated by its

iterations, see [3, 21] and references therein for various aspects of such dynamical
5
systems, and consider the orbits obtained by such iterations evaluated at a certain
v
initial value (v ,...,v ). The statistical uniformity of the distribution (measured
4 0 m
5 by the discrepancy) of one and multidimensional nonlinear polynomial generators
8 over a finite field have been studied in [6, 7, 17, 18, 22]. However, almost all pre-
3 viouslyknownresults are nontrivialonly for those polynomialgeneratorsthat pro-
.
6 ducesequencesofextremelylargeperiod,whichcouldbehardtoachieveinpractice
0 (theonlyknownexceptionsaregeneratorsfrominversions[16],powerfunctions[4],
9
Dickson polynomials [5] and Redei functions [8]). The reason behind this is that
0
typically the degree of iterated polynomial systems grows exponentially, and that
:
v in all previous results the saving over the trivial bound has been logarithmic. Fur-
i
X thermore, it is easy to see that in the one-dimensional case (that is, for m = 0)
the exponential growth of the degree of iterations of a nonlinear polynomial is un-
r
a avoidable. One also expects the same behaviour in the multidimensional case for
“random” polynomials f ,...,f . However, as we saw in [19], for some specially
0 m
selected polynomials f ,...,f the degree may grow significantly slower.
0 m
In [19] we describe a rather wide class of polynomial systems with polynomial
growthofthedegreeoftheiriterations. Asaresultweobtainmuchbetterestimates
of exponential sums, and thus of the discrepancy, for vectors generated by these
iterations(afterscalingthemtotheunitcube),withasavingoverthetrivialbound
being a power of p.
Obtaining stronger results “on average” over all initial values v ∈ Fm+1 is an
p
interesting and challenging question. We remark that in the case of the so-called
inversive generator rather stronger estimates “on average” are available (see [16])
Key words and phrases. Pseudorandom number generators, permutation polynomials,
discrepancy.
1
2 ALINAOSTAFE
and also estimates for the averagedistribution of powers and primitive elements of
the inversive generators are considered in [1]. In this paper we study this problem
byfollowingthe sameargumentsintroducedforthe inversivegeneratorin[16]. For
this we define a special family of multivariate polynomial systems of [19], which
besidethepolynomialdegreegrowthalsoleadstopermutation polynomial systems.
Inturnthis allowsus tousethe approachof[16]to obtainastrongerboundonthe
discrepancy “on average”over initial values.
Furthermore, here we exploit the special structure of iterations of the polyno-
mial systems of [19] that allows us to replace the use of the Weil bound (see [12,
Chapter 5]) by a more elementary and stronger estimate on the corresponding ex-
ponential sums which in turn leads to a better final result and for more general
systems of congruences. In fact, since our construction can easily be extended to
polynomials over commutative rings, the new estimate can also be used to study
polynomials maps over residue rings (while the Weil bound does not apply there).
This estimate can also be used to improve and generalise the main result of [19].
Finally, we note that we also hope that our results may be of use for some
applications in polynomial dynamical systems.
Throughout the paper, the implied constants in the symbols ‘O’ and ‘≪’ may
occasionally, where obvious, depend on some integer parameter s ≥ 1 and are
absolute otherwise. We recall that the notations A = O(B) and A ≪ B are all
equivalent to the assertion that the inequality |A| ≤ c|B| holds for some constant
c>0.
2. Permutation Polynomial Dynamical System with Slow Degree
Growth
2.1. General construction. We recall and modify the construction of [19] of
multivariate polynomial systems with slow degree growth. Let F be an arbitrary
field and let the polynomials g ,h ∈ F[X ,...,X ], i = 0,··· ,m−1, satisfy-
i i i+1 m
ing the following conditions: each polynomial g has a unique leading monomial
i
Xsi,i+1...Xsi,m, that is,
i+1 m
(1) g (X ,...,X )=Xsi,i+1...Xsi,m +g (X ,...,X ),
i i+1 m i+1 m i i+1 m
where e
(2) deg g <s , deg h ≤s ,
Xj i i,j Xj i i,j
for i=0,...,m−1, j =i+1,e...,m.
Throughout,weuse deg todenotethe totaldegreeofamultivariatepolynomial.
POLYNOMIAL DYNAMICS AND NONLINEAR PSEUDORANDOM NUMBERS 3
We construct now a system F = {f ,...,f } of m+1 polynomials in the ring
0 m
F[X ,...,X ] defined in the following way:
0 m
f (X ,...,X )=X g (X ,...,X )+h (X ,...,X ),
0 0 m 0 0 1 m 0 1 m
f (X ,...,X )=X g (X ,...,X )+h (X ,...,X ),
1 0 m 1 1 2 m 1 2 m
(3) ...
f (X ,...,X )=X g (X )+h (X ),
m−1 0 m m−1 m−1 m m−1 m
f (X ,...,X )=aX +b,
m 0 m m
where
a,b∈F, a6=0, and g ,h ∈F[X ,...,X ], i=0,...,m−1,
i i i+1 m
are defined as above.
For each i = 0,...,m we define the k-th iteration of the polynomials f by the
i
recurrence relation
(4) f(0) =X , f(k) =f (f(k−1),...,f(k−1)), k =0,1,... .
i i i i 0 m
(k)
The following result shows the exact form of the polynomials f and also the
i
polynomial growth of the degrees of the polynomials X g , i = 0,...,m, under
i i
iterations.
Lemma 1. Let f ,...,f ∈ F[X ,...,X ] be as in (3), satisfying the condi-
0 m 0 m
tions (1) and (2). Then for the polynomials f(k), k = 1,2,..., given by (4) we
i
have
f(k) =X g (X ,...,X )+h (X ,...,X )
i i i,k i+1 m i,k i+1 m
where g ,h ∈F[X ,...,X ] and
i,k i,k i+1 m
1
degg = km−is ...s +ψ (k), i=0,...,m−1,
i,k i,i+1 m−1,m i
(m−i)!
degg = 0,
m,k
where ψ (T)∈Q[T] is a polynomial of degree degψ <m−i.
i i
Proof. We have
f(k) =f(k−1)g f(k−1),...,f(k−1) +h f(k−1),...,f(k−1) .
i i i i+1 m i i+1 m
(cid:16) (cid:17) (cid:16) (cid:17)
Thus an easy inductive argument implies that
(k)
f =X g (X ,...,X )+h (X ,...,X )
i i i,k i+1 m i,k i+1 m
for some polynomials g ,h ∈ F[X ,...,X ], with degg ≥ degh , where
i,k i,k i+1 m i,k i,k
i=0,...,m, k=1,2,....
For the asymptotic formulas for the degrees of the polynomials g see [19,
i,k
Lemma 1] where it is given in the equivalent form for degf(k) =degg +1. ⊓⊔
i i,k
4 ALINAOSTAFE
2.2. Permutation polynomial systems. In order to be able to apply the tech-
nique introduced in [16] for inversive pseudorandom number generators, we need
to work with systems of multivariate polynomials in F [X ,...,X ] which induce
p 0 m
maps that permute the elements of Fm+1. Lidl and Niederreiter [12, 13] call such
p
systems orthogonal polynomial systems, but we here refer to them as permutation
polynomial systems.
Let the polynomial system F = {f ,...,f }, m ≥ 1, be defined by (3) and
0 m
satisfy the conditions (1) and (2). It is obvious that this system is a permutation
system if and only if the polynomials g , i=0,...,m, do not have zeros over F .
i p
We note that a “typical” absolute irreducible polynomial in m ≥ 2 variables
over F always has lots of zeros. By a special case of the Lang-Weil theorem [11]
p
a polynomial F in m ≥ 2 variables over F always has rpm−1 +O(pm−3/2) zeros
p
where r is the number of absolutely irreducible factors of F (with the implied
constant depending only on degF), see also [20]. That is why we seek “atypical”
polynomials, as the example below shows.
One of the attractive choices of polynomials which would lead to a fast PRNG
is
m−i
g (X ,...,X )= (X2 −a )
i i+1 m i+j i,j
j=1
Y
and
h (X ,...,X )=b
i i+1 m i
where a are quadratic nonresidues and b are any constants in F .
i,j i p
Even simpler, one can take
g (X ,...,X )=(X2 −a )
i i+1 m i+1 i
where a are quadratic nonresidues.
i
3. Polynomial Pseudorandom Number Generators
3.1. Construction. LetF ={f ,...,f }beapermutationpolynomialsystemin
0 m
F [X ,...,X ]defined asinSection2. We fix avectorv∈Fm+1 andconsiderthe
p 0 m p
sequence defined by a recurrence congruence modulo a prime p of the form
(5) u ≡f (u ,...,u ) (mod p), n=0,1,...,
n+1,i i n,0 n,m
with the initial values (u ,...,u ) = v. We also assume that 0 ≤ u < p,
0,0 0,m n,i
i=0,...,m, n=0,1,....
In particular, for any n,k ≥0 and i=0,...,m we have
(6) u (v)=f(k)(u (v),...,u (v)).
n+k,i i n,0 n,m
Using the following vector notation
u (v)=(u (v),...,u (v))
n n,0 n,m−1
POLYNOMIAL DYNAMICS AND NONLINEAR PSEUDORANDOM NUMBERS 5
we have the recurrence relation
u (v)=(f(k)(u (v),...,u (v)),...,f(k) (u (v),...,u (v))).
n+k 0 n,0 n,m m−1 n,0 n,m
We show that for almost all initial values v∈Fm+1, the sequence
p
u (v) u (v)
n,0 n,m−1
(7) ,..., , n=0,...,N −1,
p p
(cid:18) (cid:19)
is uniformly distributed for all N ≥ (logp)2+ε, any fixed ε > 0 and sufficiently
large p.
3.2. Exponential Sums. We put
e (z)=exp(2πiz/m).
m
Our second main tool is the following bound on exponential sums which is
strongerthantheoneimmediatelyimpliedbytheWeilbound(see[12,Chapter5]).
Lemma 2. Let f ,...,f ∈ F [X ,...,X ] be as in (3), satisfying the condi-
0 m p 0 m
tions (1) and (2). If s ...s 6=0, then there is a positive integer k depend-
0,1 m−1,m 0
ingonlyonthedegreesofthepolynomials inF suchthatforanyintegersk >l≥k
0
and any nonzero a=(a ,...,a )∈Fm, for the polynomial
0 m−1 p
m−1
Fa,k,l = ai fi(k)−fi(l) ,
Xi=0 (cid:16) (cid:17)
we have
p
ep(Fa,k,l(x0,...,xm)) ≪kmpm.
(cid:12) (cid:12)
(cid:12)x0,..X.,xm=1 (cid:12)
(cid:12) (cid:12)
Proof. Let s ≤ m−(cid:12)1 be the smallest integer such t(cid:12)hat a 6= 0. By Lemma 1 we
(cid:12) (cid:12) s
have
p
ep(Fa,k,l(x0,...,xm))
x0,..X.,xm=1
p m−1
= e a (x (g −g )+(h −h ))
p i i i,k i,l i,k i,l
!
x0,..X.,xm=1 Xi=0
p m−1
=ps e a (x (g −g )+(h −h ))
p i i i,k i,l i,k i,l
!
xs,..X.,xm=1 Xi=s
p m−1
=ps e h −h + a (x (g −g )+(h −h ))
p s,k s,l i i i,k i,l i,k i,l
!
xs+1,X...,xm=1 i=Xs+1
p
e (a x (g −g )).
p s s s,k s,l
xXs=1
6 ALINAOSTAFE
Then the sum over the variable x is nonzero only if its coefficient
s
g (x ,...,x )−g (x ,...,x )≡0 (mod p),
s,k s+1 m s,l s+1 m
see [13, Equation (5.9)].
WeseefromLemma1thatifk >l≥k forasufficientlylargek theng −g is
0 0 s,k s,l
a nontrivialpolynomialmodulo p ofdegree O(km−s)=O(km). A simple inductive
argument shows that a nontrivial modulo p polynomial in r variables of degree D
may have only O(Dpr−1) zeros modulo p, which concludes the proof. ⊓⊔
We note that we do not include the linear polynomials fm(k) and fm(l) in Fa,k,l
as generally speaking in this case such a linear combination may vanish even for
nontrivial coefficients (note that it is possible that f(k) =f(l) for k 6=l).
m m
Wefollowtheschemepreviouslyintroducedin[16]forestimatingtheexponential
sum introduced below, and thus the discrepancy of a sequence of points.
For a vector a = (a ,...,a ) ∈ Fm and integers c,M,N with M ≥ 1 and
0 m−1 p
N ≥1, we introduce
2
N−1 m−1
Va,c(M,N)= (cid:12) ep ajfj(n)(v0,...,vm)eM(cn)(cid:12) .
v0,..X.,vm∈Fp(cid:12)(cid:12)nX=0 Xj=0 (cid:12)(cid:12)
(cid:12)   (cid:12)
Note that as in Lemma 2 we d(cid:12)o not include polynomials f(n) in the abo(cid:12)ve expo-
(cid:12) m (cid:12)
nential sum.
Lemma 3. Let the permutation polynomial system of m + 1 polynomials F =
{f ,...,f }∈F [X ,...,X ] of total degree d≥2 of the form (3), satisfying the
0 m p 0 m
conditions (1) and (2). Then for any positive integers c,M,N and any nonzero
vector a=(a ,...,a )∈Fm we have
0 m−1 p
Va,c(M,N)≪A(N,p),
where
Npm+1 if N ≤p1/(m+1),
A(N,p)=
N2pm(m+2)/(m+1) if N >p1/(m+1).
(cid:26)
Proof. We have
N−1
Va,c(M,N)= eM(c(k−l))
k,l=0
X
m−1
e a f(k)(v ,...,v )−f(l)(v ,...,v )
p j j 0 m j 0 m 
v0,..X.,vm∈Fp Xj=0 (cid:16) (cid:17)
 
N−1 m−1
≤ e a f(k)(v ,...,v )−f(l)(v ,...,v ) .
(cid:12) p j j 0 m j 0 m (cid:12)
kX,l=0(cid:12)(cid:12)v0,..X.,vm∈Fp Xj=0 (cid:16) (cid:17) (cid:12)(cid:12)
(cid:12)  (cid:12)
(cid:12) (cid:12)
(cid:12) (cid:12)
POLYNOMIAL DYNAMICS AND NONLINEAR PSEUDORANDOM NUMBERS 7
For O(N) values ofk andl whichare equal, we estimate the inner sum trivially by
pm+1.
For the other values, by Lemma 2 getting the upper bound O(Nmpm) for the
inner sum for at most N2 sums. Hence,
(8) Va,c(M,N)≪Npm+1+Nm+2pm.
BecauseF is a permutationpolynomialsystem andusing (6), for anyinteger L we
obtain
2
L+N−1 m−1
e a f(n)(v ,...,v ) e (cn)
(cid:12) p j j 0 m  M (cid:12)
v0,..X.,vm∈Fp(cid:12)(cid:12) nX=L Xj=0 (cid:12)(cid:12)
(cid:12)   (cid:12)
= (cid:12) (cid:12)
(cid:12) (cid:12)
v0,..X.,vm∈Fp
2
N−1 m−1
e a f(n) f(L)(v ,...,v ),...,f(L)(v ,...,v ) e (cn)
(cid:12) p j j 0 0 m m 0 m  M (cid:12)
(cid:12)(cid:12)nX=0 Xj=0 (cid:16) (cid:17) (cid:12)(cid:12)
(cid:12)  2  (cid:12)
(cid:12) N−1 m−1 (cid:12)
= (cid:12) (cid:12) ep ajfj(n)(v0,...,vm)eM(cn)(cid:12) =Va,c(M,N). (cid:12)
v0,..X.,vm∈Fp(cid:12)(cid:12)nX=0 Xj=0 (cid:12)(cid:12)
(cid:12)   (cid:12)
Therefore, for any(cid:12) positive integer K ≤ N, separating the i(cid:12)nner sum into at most
(cid:12) (cid:12)
N/K+1 subsums of length at most K, and using (8), we derive
Va,c(M,N)≪(Kpm+1+Km+2pm)N2K−2 =N2(K−1pm+1+Kmpm).
Thus,selectingK =min{N, p1/(m+1) }andtakingintoaccountthatN−1pm+1 ≥
Nmpm for N ≤p1/(m+1), we obtain the desired result. ⊓⊔
(cid:4) (cid:5)
Note thatthe estimates for Va,c(M,N)worknot only overprime fields, but also
over any finite field.
We also need the identity (see [9])
0 if b6≡0 (mod m),
(9) e (ab)=
m m if b≡0 (mod m).
−(m−1)X/2≤a≤m/2 (cid:26)
Then we have the following inequality
L+Q
m m m
(10) e (cr)≪min Q, ≪min m, ≪
m
|c| |c| |c|+1
r=L+1 (cid:26) (cid:27) (cid:26) (cid:27)
X
which holds for any integers c, Q and L with |c| ≤ m/2, and m ≥ Q ≥ 1, see [9,
Bound (8.6)].
8 ALINAOSTAFE
3.3. Discrepancy. Given a sequence Γ of N points
(11) Γ= (γ ,...,γ )N−1
n,0 n,s−1 n=0
inthe s-dimensionalunit cube [(cid:8)0,1)s it is naturalto m(cid:9)easurethe levelofits statis-
tical uniformity in terms of the discrepancy ∆(Γ). More precisely,
T (B)
Γ
∆(Γ)= sup −|B| ,
N
B⊆[0,1)s(cid:12) (cid:12)
(cid:12) (cid:12)
where T (B) is the number of points of Γ(cid:12)inside the bo(cid:12)x
Γ (cid:12) (cid:12)
B =[α ,β )×...×[α ,β )⊆[0,1)s
1 1 s s
and the supremum is taken over all such boxes, see [2, 10].
We recall that the discrepancy is a widely accepted quantitative measure of
uniformity of distribution of sequences, and thus good pseudorandom sequences
should (after an appropriate scaling) have a small discrepancy, see [14, 15].
For an integer vector a=(a ,...,a )∈Zs we put
0 s−1
s−1
|a|= max |a |, r(a)= max{|a |,1}.
j j
j=0,...,s−1
j=0
Y
Typically the bounds on the discrepancy of a sequence are derived from bounds
of exponential sums with elements of this sequence. The relation is made explicit
in the celebrated Erdo˝s-Turan-Koksma inequality, see [2, Theorem 1.21], which we
present in the following form.
Lemma 4. For any integer L > 1 and any sequence Γ of N points (11) the dis-
crepancy ∆(Γ) satisfies the following bound:
N−1 s−1
1 1 1
∆(Γ)<O + exp 2πi a γ .
L N r(a)(cid:12)  j n,j(cid:12)
0<X|a|≤L (cid:12)(cid:12)nX=0 Xj=0 (cid:12)(cid:12)
 (cid:12)  (cid:12)
Now, as in [16], combining Lemma 4 wi(cid:12)th the bound obtained in(cid:12)Lemma 3 we
(cid:12) (cid:12)
obtain stronger estimates for the discrepancy “on average”over all initial values.
Theorem 5. Let 0 < ε < 1 and let the sequence {u } be given by (5), where the
n
permutation system of m+1 polynomials F = {f ,...,f } ∈ F [X ,...,X ] of
0 m p 0 m
total degree d ≥ 2 is of the form (3), satisfying the conditions (1) and (2), and
such that s ...s 6= 0. Then for all initial values v ∈ Fm+1 except at most
0,1 m−1,m p
O(εpm+1) of them, and any positive integer N ≤ pm+1, the discrepancy D (v) of
N
the sequence (7) satisfies the bound
D (v)≪ε−1B(N,p),
N
where
N−1/2(logN)m+1logp if N ≤p1/(m+1),
B(N,p)=
p−1/2(m+1)(logN)m+1logp if N >p1/(m+1).
(cid:26)
POLYNOMIAL DYNAMICS AND NONLINEAR PSEUDORANDOM NUMBERS 9
Proof. Without loss of generality we can assume that N ≥2. From Lemma 4 with
G=⌊N/2⌋ we derive
N−1 m−1
1 1 1
D (v)≪ + e a u (v) .
N N N r(a)(cid:12) p j n,j (cid:12)
0<|aX|≤N/2 (cid:12)(cid:12)nX=0 Xj=0 (cid:12)(cid:12)
(cid:12)  (cid:12)
Let m = 2ν, ν = 0,1,..., and define k ≥ 1(cid:12) by the condition m (cid:12)< N ≤ m .
ν (cid:12) k−1(cid:12) k
From (9) we derive
N−1 m−1
e a u (v)
p j n,j
 
n=0 j=0
X X
 
1 mk−1 m−1 N−1
= e a u (v) e (c(n−r)).
m p j n,j  mk
k
nX=0 Xj=0 −(mk−1)X/2≤c≤mk/2 Xr=0
 
Since m /2=m , from (10) we obtain
k k−1
N−1 m−1
e a u (v)
(cid:12) p j n,j (cid:12)
(cid:12)n=0 j=0 (cid:12)
(cid:12)X X (cid:12)
(cid:12)  (cid:12)
(cid:12) 1 mk(cid:12)−1 m−1
(cid:12) ≪ (cid:12) e a u (v) e (cn) .
|c|+1(cid:12) p j n,j  mk (cid:12)
|c|≤Xmk−1 (cid:12)(cid:12) nX=0 Xj=0 (cid:12)(cid:12)
(cid:12)   (cid:12)
It follows that (cid:12) (cid:12)
(cid:12) (cid:12)
(12) D (v)≪∆ (v),
N k
where
1 1 1 1
∆ (v) = +
k N m r(a) |c|+1
k 0<|aX|≤mk−1 |c|≤Xmk−1
mk−1 m−1
· e a u (v) e (cn) .
(cid:12) p j n,j  mk (cid:12)
(cid:12) n=0 j=0 (cid:12)
(cid:12) X X (cid:12)
(cid:12)   (cid:12)
Now (cid:12) (cid:12)
(cid:12) (cid:12)
pm+1 1 1 1
∆ (v)= +
k N m r(a) |c|+1
v=(v0,..X.,vm)∈Fmp+1 k 0<|aX|≤mk−1 |c|≤Xmk−1
mk−1 m−1
· e a f(n)(v ,...,v ) e (cn) .
(cid:12) p j j 0 m  mk (cid:12)
v0,..X.,vm∈Fp(cid:12)(cid:12) nX=0 Xj=0 (cid:12)(cid:12)
(cid:12)   (cid:12)
(cid:12) (cid:12)
(cid:12) (cid:12)
10 ALINAOSTAFE
Applying the Cauchy inequality, from Lemma 3 we derive
mk−1 m−1
e a f(n)(v ,...,v ) e (cn) ≪p(m+1)/2A(m ,p)1/2.
(cid:12) p j j 0 m  mk (cid:12) k
v0,..X.,vm∈Fp(cid:12)(cid:12) nX=0 Xj=0 (cid:12)(cid:12)
(cid:12)   (cid:12)
Therefore (cid:12) (cid:12)
(cid:12) (cid:12)
pm+1 p(m+1)/2A(m ,p)1/2 1 1
∆ (v)≪ + k
k N m r(a) |c|+1
v0,..X.,vm∈Fp k 0<|aX|≤mk−1 |c|<Xmk−1
p(m+1)/2A(m ,p)1/2(logm )m+1
k k
≪ ,
m
k
where we used the standard bound for partial sums of the harmonic series in the
last step. Thus, for each k =1,..., log(pm+1) , the inequality
A(m ,p)1/2((cid:6)logm )m+1(cid:7)logp
(13) ∆ (v)≥ k k =ε−1B(m ,p)
k εm p(m+1)/2 k
k
canholdforatmostO(εpm+1/logp)valuesofv ,...,v ∈F . Thereforethenum-
0 m p
ber of v ,...,v ∈F for which (13) holds for at least one k =1,..., log(pm+1)
0 m p
is O(εpm+1). For all other v ,...,v , we get from (12),
0 m (cid:6) (cid:7)
D (v)≪∆ (v)<ε−1B(m ,p)≪ε−1B(N,p)
N k k
for 1≤N ≤pm+1, where we used m =2m <2N in the last step. ⊓⊔
k k−1
4. Remarks and Open Questions
As we have mentioned, one of the attractive choices of polynomials (3), which
leads to a very fast pseudorandom number generator is
g (X ,...,X )=X2 −a and h (X ,...,X )=b
i i+1 m i+1 i i i+1 m i
for some quadratic nonresidues a and any constants b , i = 0,...,m−1. The
i i
corresponding sequence of vectors is generated at the cost of two multiplications
per component. This naturally leads to a question of studying in what cases the
periods of such sequences generated by such polynomial dynamical systems are
maximal.
We also note that it is natural to consider the joint distribution of several con-
secutive vectors
(u (v),...,u (v)), n=0,1,... ,
n n+s−1
in the sm-dimensional space. It seems that the scheme used in [19] can be also
applied to derive such a result.