On ideal $ t $-tuple distribution of orthogonal functions in filtering de bruijn generators

Uniformity in binary tuples of various lengths in a pseudorandom sequence is an important randomness property. We consider ideal \begin{document}$ t $\end{document} -tuple distribution of a filtering de Bruijn generator consisting of a de Bruijn sequence of period \begin{document}$ 2^n $\end{document} and a filtering function in \begin{document}$ m $\end{document} variables. We restrict ourselves to the family of orthogonal functions, that correspond to binary sequences with ideal 2-level autocorrelation, used as filtering functions. After the twenty years of discovery of Welch-Gong (WG) transformations, there are no much significant results on randomness of WG transformation sequences. In this article, we present new results on uniformity of the WG transform of orthogonal functions on de Bruijn sequences. First, we introduce a new property, called invariant under the WG transform, of Boolean functions. We have found that there are only two classes of orthogonal functions whose WG transformations preserve \begin{document}$ t $\end{document} -tuple uniformity in output sequences, up to \begin{document}$ t = (n-m+1) $\end{document} . The conjecture of Mandal et al. in [ 29 ] about the ideal tuple distribution on the WG transformation is proved. It is also shown that the Gold functions and quadratic functions can guarantee \begin{document}$ (n-m+1) $\end{document} -tuple distributions. A connection between the ideal tuple distribution and the invariance under WG transform property is established.


Introduction
Theoretically ensuring uniformity in producing binary tuples from a source is a fundamental problem in the areas of communication, complexity theory, cryptography and statistics. It is regarded as one of the important randomness properties of a bit generator. In complexity theory, a deterministic randomness extractor is a deterministic function which makes a non-uniform source to a uniform or close to uniform source [1]. For instance, the input source of a randomness extractor is a physical source, which may include a noisy diode based on quantum effects, ring oscillator, and biased or correlated input source. On the other hand, a pseudorandom generator is a deterministic function that accepts a short truly random input and outputs a bit stream usually of longer length. The quality of a pseudorandom generator is characterized by the randomness properties such as long period, balance, equal distribution of runs, uniform tuple distribution, ideal 2-level autocorrelation, and high linear span [19,20,21]. In particular, the ability of producing uniformly distributed bit sequences of various lengths is one of the desirable properties of a pseudorandom generator. The goal of producing uniformly distributed binary tuples of certain lengths by a pseudorandom generator is the same as that of a randomness extractor. Feedback shift register is a tool for generating pseudorandom sequences, which are of two types namely linear feedback shift registers (LFSRs) and nonlinear feedback shift registers (NLFSRs) [20].
We consider an NLFSR that generates a binary sequence of period 2 n as a uniform source of producing bit sequences. An n-stage NLFSR that generates a sequence of period 2 n is known as a de Bruijn sequence generator [3,20], which guarantees long period 2 n , uniformity on occurrence of -bit sequences (1 ≤ ≤ n), known as ideal n-tuple distribution, and high linear complexity, at least 2 n−1 + n [6]. In particular, the ideal tuple distribution ensuring uniformity is an important property of a pseudorandom generator for cryptographic applications such as digital signature [9], where each number should occur uniquely or equally likely. Although de Bruijn sequences have good randomness properties, they cannot be directly used because of the invertible property of its feedback function, which leads to recovering the seed and that is not permissible in many applications such as cryptographic applications. In this article, we consider the problem of converting a uniformly distributed sequence produced by the NLFSR source to another uniformly distributed source. More precisely, we apply a filtering function to the NLFSR and try to make binary tuples uniformly distributed in the filtering sequence for a suitable choice of a filtering function. A filtering de Bruijn generator consists of an NLFSR generating a de Bruijn sequence as a source of generating a bitstream/sequence and a filtering function distilling the sequences from the source. Of course, the maximum length on the uniformly distributed bit sequences or the ideal tuple distribution will be less than or equal to n. In general, any filtering function cannot be used to achieve the uniformity in binary tuples of various lengths in the filtering sequence for large values of (≤ n). Like a randomness extractor [1], a suitable filtering function can make a uniformly distributed sequence to another uniformly distributed sequence provided that the input source is uniformly distributed. If the NLFSR source is not uniform, that means it does not generate a de Bruijn (span n) sequence, then even for a suitable choice of a filtering function, the filtering source or sequence will not be uniform. We emphasize that we are interested in those filtering functions whose properties will also be known, which may be suitable for cryptographic applications.
1.1. Problem statement and highlights of our results. A vast amount of effort has been put to generate sequences with the properties long period, balance, 2-level autocorrelation and high linear span for communication and cryptographic applications. For details, see [21]. Let f be a function from F 2 m to F 2 . The function f is called orthogonal if and only if the exponential sum x∈F 2 m (−1) f (x)+f (λx) = 0 for all 1 = λ ∈ F 2 m . Any orthogonal function corresponds to a binary sequence with 2-level autocorrelation by mapping a i = f (α i ), i = 0, · · · , 2 m − 2 where α is a primitive element in F 2 m [21].
A Welch-Gong (WG) transformation sequence is to apply transform W G f (x) = f (x + 1) + Tr (1) where Tr(x) is the trace function from F 2 m to F 2 , and f (x) yields a 5-term sequence with 2-level autocorrelation. WG-transformation sequences were discovered by Golomb, Gong and Gaal, together with the other two classes jointly published in [33]. This transform is termed as the Welch-Gong (WG) transformation by Solomon Golomb and appeared in [33] as well. WG transformation sequences with 2-level autocorrelation was first conjectured in 1997 [33]. In their milestone paper [11], Dillon and Dobbertin constructed a general class of two-level autocorrelation sequences and proved all known conjectured two-level autocorrelation sequences including WG transformation sequences. A detailed investigation of cryptographic properties of WG sequences is presented in [23]. In 2005, Nawaz and Gong proposed the WG stream cipher and submitted to the eStream project in 2005 [14,32], and completed analysis of security and hardware implementation costs are presented in [31,42,35,16] in sequel. Moreover, the WG stream ciphers have provable randomness properties such as long period, balance, 2-level autocorrelation, known linear complexity, and ideal -tuple distribution. Since then, a tremendous research on the other parameters, cryptanalysis and hardware implementation of WG stream ciphers are reported in the literature [34,12,13,25,36,35,42,15].
In this paper, we consider orthogonal functions over binary (extension) finite fields as filtering functions over NLFSRs that generate de Bruijn sequences where the orthogonal functions (not necessarily) ensure 2-level autocorrelation sequences, and we study uniformity in tuple distribution in output filtering sequences. In a WG stream cipher, the WG transformation is used as a filtering function over an LFSR over an extension field. Here we consider a WG transformation as a filtering function over binary NLFSRs where the WG transformations generate 2-level autocorrelation sequences. We also consider the Kasami power functions (defined in Section 2) as filtering functions over NLFSRs as the properties such as Hadamard transform, 2-level autocorrelation of the KPFs are well-studied and which is a rich source of APN functions and almost bent functions.
It is rather surprising that we have found a new property of the WG transformation when we study the uniformity of tuple distributions of those sequences. Note that the WG transformation is involution. What we discovered is that, for odd is the WG transform of either a 5-term sequence, denoted as T 5(x) or a 3-term sequence, denoted as T 3(x) for a unique decimation number d with Hamming weight greater than one. Specifically, f (x) is invariant under the WG transform (WG-invariance) Those decimations are unique. Note that W G T 3 (x) does not have 2-level autocorrelation (decimation does not change the autocorrelation).
In order to show that the decimated WG transformation function is invariant under the WG transformation, we use the properties of the Hadamard transform of the WG transformation functions. For the three-term case, we conjecture that the WG transform of the three-term function is invariant under the WG transform (see Section 3). It is turned out that that the above decimations are the same decimations in [39] where Yu and Gong studied their respective Hadamard transforms of W G T 5 (x d ) and T 3(x d ). Using this result, we are able to establish that the uniformity in binary tuples of various lengths in the filtering sequences. We show that f ∈ {W G T 5 (x d ), W G T 3 (x d )} guarantees the ideal tuple distribution in the filtering sequences. For the theory of 2-level autocorrelation sequences, i.e., orthogonal functions and their known constructions, the reader is referred to [21].
1.2. Related work. Ideal tuple distributions of LFSR-based nonlinear filtering generators have been studied in the literature [18,4,38,31]. Siegenthaler, Forré and Kleiner in [38] studied the ideal tuple distribution of binary sequences where an LFSR defined over a finite field and the nonlinear filtering function is also defined over the same field. The necessary and sufficient condition for generating a filtering sequence with uniform tuple distribution is that the filtering function is balanced [38]. Golić [18] investigated the properties of the filtering functions for achieving uniform distribution for LFSR-based filtering generators and proposed a necessary condition and a conjecture on the sufficient condition for the filtering function. Canteaut [4] proved the Golić conjecture for the sufficient condition. Smyshlyaev in [41] also proved the Golić conjecture. Recently, Mandal et al. [29] studied the ideal tuple distributions of purely NLFSR-based filtering generators where they employ an NLFSR generating a de Bruijn sequence as a generator and studied the properties of the filtering function for achieving the ideal tuple distribution in the filtering sequence. As a summary, we see that for both LFSR and NLFSR-based filtering generators, the necessary and sufficient conditions for the filtering functions for ensuring the ideal tuple distribution are the same.
1.3. Our contribution. We put our effort to seek for filtering functions of a filtering de Bruijn generator (FDBG) that can guarantee ideal tuple distribution as well as have good and proven cryptographic properties. We first mathematically study the orthogonal functions namely WG transformations, three-term functions and some quadratic functions under a new property called WG-invariance property of a Boolean function. We then apply the WG-invariance orthogonal functions in a FDBG to achieve the ideal tuple distribution in a filtering sequence. Our contributions in this article are summarized as follows: -WG-invariance property of WG transformations and three-term functions. We introduce a new property called invariant under the Welch-Gong (WG) transform or WG-invariance property of a Boolean function, and provide a connection between the x 0 -independence form and the WGinvariance property. We prove that there exists a WG transformation over F 2 m with decimation d = 2 m−k+1 − 1 that has the invariant under the WG transform property where k is such that 3k ≡ 1 mod m and m is odd. We next define the WG transform of the three-term function over F 2 m with m = 2k − 1 and determine the Hadamard transform of the WG transform of three-term functions, which is 5-valued. We conjecture that the WG transform of the three-term function also has the invariance property for the decimation d = 2 k − 1. The results on the nonlinearity of both the WG transformation and the WG transform of the three-term functions with the above two decimations are presented. -Achieving ideal tuple distribution from WG transformations and the WG transform of three-term functions. We prove that, for odd m, the WG transformations over F 2 m with the invariance property guarantee the ideal tuple distribution in the filtering de Bruijn generator (FDBG). This proof solves the conjecture of Mandal et al. in [29]. Based on the conjecture on the WG transform of three-term functions, we showed the WG transforms of three-term functions have the ideal tuple distribution in the FDBG. For completeness, we consider the quadratic functions and show that the Gold function and quadratic functions are WG-invariant, thus can also be used to achieve ideal tuple distributions in the FDBG. and different input lengths of KPFs (8 ≤ m ≤ 13). Our experimental results show that there are no KPFs, along with their WG transforms including all decimations that give the ideal tuple distribution in the FDBG. We conjecture that only the WG transformation and three-term functions have the WG-invariance property in the KPF class.

Background
In this section, we present some basic definitions on Boolean functions, a definition of the WG transformation, and a description of the filtering de Bruijn generator and a result on the ideal tuple distribution from [29]. Notations. We use the following notations throughout the paper.
• F 2 m denotes the finite field defined by the primitive element α with 2 m elements where p(α) = 0 and p(x) is a primitive polynomial. • F m 2 denotes the vector space of dimension m over F 2 . • Tr(x) = x + x 2 + · · · + x 2 m−1 denotes the trace function from F 2 m to F 2 .
• n denotes the length of an NLFSR and m denotes the input size of the filtering function.
2.1. Basic definitions on boolean functions. An m-variable Boolean function is a mapping from F m 2 to F 2 . If λ = (λ 0 , · · · , λ m−1 ) and x = (x 0 , · · · , x m−1 ) belong to F m 2 , the inner product of λ and x, denoted by λ·x, is given by There is a one-to-one correspondence between a Boolean function and its univariate polynomial representation defined in Section 2.1.1 [21]. Note that the summation is in a finite field either F 2 or F 2 m . We use f to represent a Boolean function in m variables and its univariate polynomial representation from F 2 m to F 2 .
When f is defined over F 2 m , the Walsh-Hadamard transform or Hadamard transform of the Boolean function f is defined aŝ The nonlinearity of f is defined as where t i is a coset leader modulo 2 mi − 1 and m i |m.
which is the Boolean representation of f . In the present article, we take only the polynomial basis {1, α, · · · , α m−1 } of F 2 m and consider the functions with the trace representation. We emphasize that at many places in this article we will use the term Boolean representation of f (x), we actually mean it by we are interested only in the variable x 0 and its coefficient in its ANF representation.

Kasami power function (KPF) construction.
Let m be a positive integer and k and k be such that kk ≡ 1 mod m, k < m and gcd(k, m) = 1. Let R(x) be a permutation polynomial over F 2 m , which is recursively defined as [11,21] (1) where A i (x) and V i (x) are defined below: is a permutation over F 2 m . This is known as a Kasami power function construction.

The Welch-Gong (WG) transformation and its generalization.
Let m be a positive integer and k be a positive integer such that 3k ≡ 1 mod m. Denoting The trace representation of the WG transformation is given in Facts 1 and 2. Let d be a positive integer such that gcd(d, 2 m − 1) = 1 and d ≤ 2 m − 2. The d-th decimation of W G(x) is given by W G(x d ).

Fact 1. [28]
Let k be a positive integer such that 3k ≡ 1 (mod m) and m ≡ 2 (mod 3). Then [28] Let k be a positive integer such that 3k ≡ 1 (mod m) and m ≡ 1 (mod 3). Then In [33], an alternative representation of the WG transformation can be found, which is given in Fact 3. However, we use the representations of WG in Facts 1 and 2. Note that in general u(
where Tr m (x) is the trace function from F p m to F p . This is referred to as a WG transform of g(x), denoted by W G g (x). When p = 2 and a = b = 1, it becomes the original WG transformation.
The WG transform of R k (x) over F 2 m is given by and A i (x) and V k (x) are defined in Section 2.2. In this article we consider Tr(R k (x)) and the WG transform of Tr(R k (x)). For k = 2 and 3, R k (x) gives the 3-term, T 3(x) = Tr(R 2 (x)), sequences, and the 5term, T 5(x) = Tr(R 3 (x)), sequences with 2-level autocorrelation, respectively. Note that only the WG transform sequence of T 5(x) (i.e, W G R3 (x)) has 2-level autocorrelation, but not the others. In this paper, we keep the term "WG transformation" for the WG transform of the 5-term functions.

Filtering de Bruijn generators.
We describe the construction of the filtering de Bruijn sequence generator (FDBG) and the condition on the filtering function for achieving the ideal t-tuple distribution of the filtering sequence from [29].
2.4.1. Description of the FDBG. Let a = {a i } i≥0 be a binary de Bruijn (DB) sequence generated by a nonlinear feedback shift register (NLFSR) of length n, whose recurrence relation is given by where F (x 0 , x 1 , · · · , x n−1 ) is the feedback function defined from F n 2 to F 2 . Efficient implementation of an NLFSR of any length that generates a de Bruijn sequence can be found in [27,43].
be the tap position of the NLFSR. We construct m-tuples from a by selecting m bits from the positions (i 0 , · · · , i m−1 ) of the NLFSR as a We call sequence b a filtering de Bruijn sequence. As the period of sequence a is 2 n , the period of b is also 2 n . Figure 1 depicts a block diagram of a filtering de Bruijn generator. As the NLFSR generates uniformly distributed t-tuples with 1 ≤ t ≤ n (a), which is a uniform source, we are interested in uniformity on the binary t-tuple distribution of b.
Note that if the filtering function f (·) is balanced, then the sequence b is balanced, i.e., it has 1-tuple distribution. Lemma 2.7 states the condition on the filtering function for having ideal t-tuple distribution of b with t ≥ 1 and the maximum value of t. We extensively use this result to guarantee the ideal tuple distribution of a filtering sequence. In this article we always consider the last m positions of the NLFSR as the input to the filtering function.

Invariance of the WG transformation
In this section, we introduce the concept of the invariance under the WG transform (or WG-invariant) of a Boolean function. We consider the WG transformations and the WG transform of three-term functions. We use the Hadamard transform of Boolean functions as a tool. Then, we present some results on the x 0 -independence of a Boolean function, and finally find a relation with the WG-invariance property.
3.1. Relation between the hadamard transforms of f and W G f . We first define the invariant under the WG transform. Let f (x) be a Boolean function with the trace representation from F 2 m to F 2 . Notice that we denote the WG transform of a function f by W G f (x) = f (x + 1) + Tr (1). From now on, when we write a function f in the subscript of W G, i.e., W G f , we mean it by the WG transform of f .
As the WG transform of a Boolean function is another Boolean function, we shall find a relation between the Hadamard transforms of the Boolean function f and W G f , and use that to study the invariance property and determine the nonlinearity of W G f . Lemma 3.2. Let f (x) be a function from F 2 m to F 2 and W G f (x) be the WG transform of f , i.e., W G f (x) = f (x + 1) + Tr (1). Then Furthermore, for m odd, the following conditions are equivalent: f is WG-invariant, i.e., Proof. The Hadamard transform of a Boolean function f is defined aŝ The Hadamard transform of W G f (x) is given by The conditions (1) and (2) are equivalent by definition. For odd m, Tr(1) = 1. Whenf (λ) = 0, W G f (λ) =f (λ) implies Tr(λ + 1) = 0 and hence Tr(λ) = 1.
The lemma asserts that the range of the Hadamard transform (absolute) values for the Boolean function and its WG transform is the same. Next, we investigate the invariance property of the WG transformations.

3.2.
x 0 -Independence of boolean functions. We now exhibit a general form of a Boolean function in terms of variable x 0 . A special form of a Boolean function in x 0 , called x 0 -independence, is defined below. Definition 3.3. Let f be a Boolean function in m variables. We say f (x) has x 0 -independence form if f (x) can be written as f (x) = x 0 + g(x 1 , · · · , x m−1 ) where g is independent of x 0 .
In terms of the truth table, the x 0 -independence can be interpreted as follows: Without loss of generality f (x) can be written as (7) f where g(z), h(z) are functions in only z-variable, which is independent of x 0 . When x = z and x = 1 + z, Eq. (7) can be written as Summing Eqs. (8) and (9), g(z) can be written as g(z) = f (z) + f (1 + z).
Substituting the values of g(z) and h(z) in Eq. (7), f (x) can be written as where W G f (x) = f (x + 1) + Tr(1) is the WG transform of f . Hence the proof.
We now establish a relation between the x 0 -independence form and the WGinvariance property of a Boolean function as follows. Proof. Let f (x) have the x 0 -independence form. Then f (x) can be written as f (x) = x 0 + g(x 1 , · · · , x n−1 ) for some g. The WG transform of f (x) is given by as for odd m, Tr(1) = 1. This proves the necessary condition.
Conversely, we assume that f is invariant under the WG transform. According to Proposition 1, for odd m, f (x) can be written as , and hence f (x) = x 0 + g(x 1 , · · · , x m−1 ) where g(x 1 , · · · , x m−1 ) = f (z), which is independent of x 0 . Hence the result is established.
In Section 2.3, we mentioned that there are two ways to define the WG transformations (see Facts 1 and 2 and Fact 3) where the exponents are calculated using either m = 3s ± 1 or 3k ≡ 1 mod m. In [39], Yu and Gong proved the Hadamard transform of the decimated WG transformation (see Fact 5) where the decimation is d 1 = 2 2s −2 s +1 2 s +1 . We provide a connection between the decimations d 1 and d defined by Eq. (10) for both definitions of the WG transformation in the following proposition.
Proposition 2. Let m be odd and m = 3s ± 1. Define d 1 = 2 2s −2 s +1 2 s +1 . Let 3k ≡ 1 mod m. The relation between d 1 and d is given by Proof. There are two cases to consider for odd values of m. Case 1. m ≡ 2 mod 3. When m = 3s − 1 and 3k ≡ 1 mod m, we have k = s. The exponent d can be written as d = 2 2k − 1. Furthermore, we have . To prove f (x) is invariant under the WG transform, we show that the Walsh spectra of f (x) and W G f (x) at every point are identical. In the following, we prove this result, but before that we state two results on the Hadamard transform of the WG transformation from [10,23,39]. In [39] Lemma 3.5. For m = 3s ± 1 and W G(x) = Tr(v(x + 1) + 1), the Hadamard transform of the WG transformation with decimation d 1 = e 2 s +1 , e = 2 2s − 2 s + 1, denoted by W G (d1) (x) = W G(x d1 ), is given by if Tr(λ) = 1.
Using Eq. (6), the Hadamard transformation of h(x) can be written as  As a consequence of Theorem 3.6, we have the following result on the nonlinearity of the WG transformation when its exponents are defined using k satisfying 3k ≡ 1 mod m. 3.4. Invariance of the WG transform of three-term function. In this section, we first present a definition of the WG transform of the three-term (T3) function and its decimation. We then determine the Hadamard transform and investigate the invariance property of the WG transform of the three-term function.
3.4.1. WG transform of three-term function. Three-term functions (T3) are constructed by setting k = 2 in R k (x) defined in Section 2.2. Let m = 2k − 1, k ≥ 2 and R 2 (x) = x + x q1 + x q2 where q 1 = 2 k + 1 and q 2 = 2 k − 1 and k = m+1 2 . The three-term function (T3) is defined as [11] (11) An alternative definition of the three-term function is where r = 2 m−1 2 + 1 [22,33]. Note that w(x) = T 3(x 2 k +1 ) [11,21]. The WG transform of T 3(x), denoted by W G T 3 (x), is defined as Let d be a positive integer such that gcd(d, 2 m − 1) = 1. The decimated W G T 3 (x) with d-th decimation is defined as Note that the functions W G T 3 (x) and its decimation W G T 3 (x d ) do not ensure 2-level autocorrelation.

3.4.2.
Hadamard transform of W G T 3 (x d ). In [11], Dillon and Dobbertin proved that the Hadamard transform of w(x) is 3-valued. In [7], Chang et al. proved that the dual of the code {(Tr(ax+bx r +cx r 2 )) : a, b, c ∈ F 2 m } is a triple-error correcting cyclic code, and its weight distribution is at most 5-valued. In [39], Yu and Gong presented the result on the Hadamard transform of T 3(x) and decimated T 3(x), i.e., T 3(x d ) with d = 2 k − 1, which is presented in Fact 6. We here determine the Hadamard transform of f (x) = W G T 3 (x d ) with decimation d = 2 k − 1 in Theorem 3.8, before that we present the Hadamard transform values of the WG transforms of T 3 (x), w(x), and T 3(x d ).   Proof. According to Lemma 3.2, the Hadamard transform of W G h (x) is W G h (λ) = (−1) Tr(λ+1)ĥ (λ) for any h. This implies that the Hadamard transform value level of W G h (x) is upper bounded by that of h(x). Since, according to [21], the Hadamard transform of w(x) is 3-valued, the Hadamard transform of W G w (x) is 3-valued. According to [11] and [39], the Hadamard transform of g(x) is at most 5-valued, therefore the Hadamard transforms of W G g (x) is at most 5-valued. Hence the proof.
In [7], Chang et al. proved that the dual code of C = {Tr(ax + bx r + cx r 2 )|a, b, c ∈ F 2 m } where r = 2 k + 1 is a triple-error correcting cyclic code, which has the 5level weight distribution {0, ±2 We summarize the Hadamard transform values of the three-term functions and their (decimated) WG transforms in Table 1. Note that the Hadamard transforms of both T 3(x d ) and W G T 3 (x d ) are 5-valued. The following theorem states the nonlinearity of the WG transform of the three-term function and with its decimation.  Table 1. A summary of the Hadamard transform values of threeterm functions.

Functions
Hadamard Transform values Ref.
at most 5-valued Theorem 3.8 Proof. According to Theorem 3.8, the Walsh spectra of W G T 3 (x) and . We now present a conjecture about the invariance property of the WG transform of the three-term function.
We have experimentally checked the invariance under the WG transform property of other decimations of W G T 3 for 5 ≤ m ≤ 15, none of them has the invariance property except the one in Conjecture 1.

Ideal tuple distribution of
In this section, we study the ideal tuple distribution property of the decimated WG transformations and the WG transform of three-term functions in the filtering de Bruijn generator (FDBG).

WG transformations in FDBG.
The main result of this subsection is the proof of the conjecture on the ideal tuple distribution for the WG transformation in Theorem 4.2 by Mandal et al. in [29], which establishes the ideal tuple distribution property of the decimated WG transformation. Before proving the main result, we first show the x 0 -independence of W G(x d ).
We are now ready to prove Theorem 4.2. Note that we determined the exact value of the decimation in Theorem 4.2.   The WG transformation over F 2 5 is given by 5 as a filtering function in the FDBG where F 2 5 is defined using α 5 + α 3 + 1 = 0. The de Bruijn sequence of period 2 7 is given by a =1111111000111010001000010110010001100110001010000000100101110110

0000110111101110010101001001111001110000111110101011011010011010.
The filtering sequence with filtering function f (x) over a is given by b =0001111100101100101101100001101000111111101000010101001011111001 0110100101000110111001011000011011011100000100111110110010000100.
The sequence b has an ideal up to 3-tuple distribution, i.e., all possible binary tuples of length up to 3 occur equally likely.
variables and is independent of x 0 and hence the filtering de Bruijn sequence b with W G T 3 (x d ) as filtering function in the FDBG has an ideal -tuple distribution where = (n − m + 1) and n is the length of the NLFSR generating a de Bruijn sequence.
Proof. The proof directly follows from Lemma 2.7 and Conjecture 1.

Quadratic functions as filtering functions in FDBG
In this section, we use quadratic functions as filtering functions in the FDBG and present the results on the ideal tuple distribution. Thus, the Gold function is invariant under the WG transform. When the Gold function is used as a filtering function, we have the following theorem for the ideal tuple distribution. and gcd(k, m) = 1, the filtering de Bruijn sequence with the Gold function as a filtering function, the filtering sequence b has an ideal t-tuple distribution where t = (n − m + 1) and n is the length of the NLFSR generating a de Bruijn sequence.
Then Tr(x d ) can be written as as Tr(z) = Tr(z 2 k ). Therefore the Gold function G(x) can be written as G(x) = x 0 + G (x 1 , · · · , x m−1 ) where G (x 1 , · · · , x m−1 ) = Tr(z 2 k +1 ). Applying Lemma 2.7 on the Gold function G(x) as a filtering function, the filtering sequence b has an ideal (n − m + 1)-tuple distribution.

Quadratic functions.
Let m be a positive integer. The quadratic Boolean function over F 2 m is defined as where Tr ri 1 (x) is a trace function from F 2 r to F 2 and r i |m, and x 2 i +1 is a function over F 2 r and a i ∈ F 2 r . For proper choices of parameters m, i, j, a i and c, Q(x) can generate the Gold-like sequences introduced by Boztas and Kumar [2] and the sequences of Yu and Gong [40]. For specific definitions of the quadratic function Q(x) in [2,40], the results on the Hadamard transform can be found in [2,40], respectively.
Moreover, when m is odd and Q(x) is WG-invariant, Q(x) has the x 0 -independence form.
We have the following result about the ideal tuple distribution when Q(x) is used as a filtering function. Proof. The proof follows from the fact that, according to Eq. (14) in Lemma 5.2, Q(x) can be written as Q(x) = x 0 + g(x 1 , · · · , x m−1 ) when Q(x) has the WGinvariance property, and applying Lemma 2.7 where Q(x) is the filtering function.
Remark 3. We note that not all quadratic functions are orthogonal functions. For instance, the Gold or Gold-like functions are orthogonal functions. However, we presented a general result on the ideal tuple distribution for quadratic functions.

Experimental results on KPFs
In hope of successfully finding the ideal (n − m + 1)-tuple distribution for the WG transformations and the WG transform of three-term functions with decimation d = 2 m−k+1 − 1, we consider to check the ideal tuple distribution property of the Kasami power function (KPF) construction (see Section 2.2) in the FDBG, as it is a generalization of the five-term and three-term functions. The reader is referred to [21,11] for the details about the KPF construction. We denote by KP F the set of all KPFs for different k . Following the notations in Section 2.2, we consider the cases k = 4 and 5 and the KPFs h(x) = Tr(R k (x)), h(x d ), and the WG transform of the KPFs W G h (x d ) including decimations over F 2 m with 9 ≤ m ≤ 19. We use the KPFs for the above cases as filtering functions in the filtering de Bruijn generator described in Section 2.4 and examined the ideal tuple distribution of the filtering sequences (see Table 2). Unfortunately, we could not find any KPF and the WG transform of KPFs (including decimations) that give ideal -tuple distribution with ≥ 3 for any length of the NLFSR. We present a conjecture about the ideal tuple distribution of the KPFs in Conjecture 2. Table 2. Experimental results for ideal t-tuple distributions of the WG transform of the Kasami power functions for k = 3, 4 and 5. When k = 3, W G R3 (x d ) over F 2 m is the WG transformation functions. experimental results on the five-term functions (Tr(R 3 (x))) as filtering functions in the FDBG show that there is no five-term function with a decimation that ensures the ideal t-tuple distribution property with t = (n − m + 1).
We further considered the power functions f (x) = Tr(x e ) and W G f (x) where e is a Kasami, Welch, Niho, inverse, or Dobbertin exponent with all decimations. None of them have the ideal tuple distribution property, except those decimations leading to the Gold (exponents) functions.

Conclusions and discussions
We have established a connection between the WG-invariance property and the ideal tuple distribution in the FDBG model. A filtering function in the FDBG can ensure the ideal tuple distribution iff the (Boolean) filtering function has the x 0 -independence form. For cryptographic applications, the filtering function should have strong cryptographic properties such as high nonlinearity. In terms of sequences generated by an orthogonal function, the orthogonal property is equivalent to the auto-correlation property of the sequence. Note that any random function with x 0 -independence form can be used in the FDBG to ensure ideal tuple distribution, but it is hard to guarantee its increased nonlinearity, low-valued correlation property, and orthogonal property. Especially, for a random function, it is hard to ensure low-valued (absolute) Walsh spectrum. Thus, we have started with orthogonal functions such as WG transforms and KPFs whose Hadamard transforms and other properties are well-studied and known, and investigated their ideal tuple distributions in the FDBG. Figure 2 depicts relations among Hadamard transform (HT), WG-invariance (WG-inv), x 0 -independence, and ideal tuple distribution properties. In Figure 2, we can observe that there is a relation between the Hadamard transform and the WG-invariance property (see Lemma 3.2). However, given any Boolean function f over F 2 m , it is not easy to theoretically determine the set {λ : Tr(λ) = 1 whenf (λ) = 0}.  In this article, we have considered the problem of converting a uniformly distributed pseudorandom sequence into another uniformly distributed sequence where the distribution of binary tuples of various lengths up to n is taken into consideration. We introduced the invariant under the WG transform property of a Boolean function over a finite field and studied this property on the orthogonal functions. We proved that the decimated WG transformation with d = 2 m−k+1 − 1 has the invariance under the WG transform property, which results in an ideal t-tuple distribution of a filtering sequence up to t = (n − m + 1) where n is the length of the NLFSR and m is the input size of the filtering function. We conjectured that the WG transform of a three-term function with decimation d = 2 k − 1 has the invariance property. Moreover, the ideal tuple distribution of the quadratic functions are studied. The Hadamard transform of the WG transform of a three-term function and the decimated one is determined, which is 5-valued. The results on the nonlinearity of these filtering functions with the above decimations are presented.

Low-valued HT
In the future work, we shall prove the conjectures on the invariance property of W G T 3 (x d ) and the KPFs. We will also develop (algorithmic) techniques to efficiently check whether a Boolean function is invariant under the WG transform. More specifically, given a function f (x) : F 2 m → F 2 with univariate polynomial representation, how to efficiently determine whether the function is invariant under the WG transform. From a differential cryptanalysis point of view, the invariance under the WG transform of a Boolean function means its differential at 1 is constant. An interesting question is to investigate how to use the (complementary) WGinvariance property of a (filtering) Boolean function to launch an attack on stream ciphers.