CN106375082A - Pseudo random number generation method - Google Patents

Abstract

The invention discloses a pseudo random number generation method. The pseudo random number generation method comprises the following steps: inputting a block cipher algorithm key K with a length of n bits and an initial vector IV0 with a length of N bits; using an vector IVi as the input of an AXU-Hash function, and processing the vector IVi to obtain an output Si; encrypting the obtained Si by using a block cipher with a key K, and carrying out xor on the obtained result and the Si to output a pseudo random number sequence Ri, wherein i represents moment, and i is 1, 2, 3... M. By adoption of the method, based on the characteristics of the hash function and the block cipher, the randomness and the high security of the generated sequence are guaranteed, and the generated sequence can pass all of the 15 pieces of sequence randomness detection provided by the American National Institute of standards and technology.

Description

A kind of pseudo random number production method

Technical field

The present invention relates to technical field of cryptology, more particularly, to a kind of pseudo random number production method.

Background technology

At present, in stream cipher system, encryption is to obtain ciphertext using the means with the direct XOR of key stream in plain text, deciphering It is that ciphertext is obtained in plain text with same key stream XOR.In order to system safety it would be desirable to key stream have well with Machine property.But costly as key stream cost using true random number, so typically good with randomness in actual use Replacing true random number, pseudo random number is to be produced by pseudorandom number generator to pseudo random number, and it has good randomness with full The demand of sufficient cryptographic system.

In prior art, the pseudorandom number generator as standard has two classes, ansi x9.17 pseudorandom number generator And fips 186 prng (prng).Ansi x9.17 prng is the standard that bank uses now, for producing data encryption Key required for standard (des) algorithm and initial vector, and fips 186 prng is used to produce data signature algorithm (dsa) random number required for, but the production method of current pseudo-random number lacks efficiency, have impact on use demand.

Content of the invention

It is an object of the invention to provide a kind of pseudo random number production method, the method can while ensureing safety, Compare current standard generation method and have and higher realize efficiency.

A kind of pseudo random number production method, methods described includes:

Input length is the block cipher key k of the n-bit and initial vector iv of n-bit₀；

By vectorial iv_iAs the input of axu-hash function, obtain after process exporting s_i；

By obtained s_iIt is encrypted with the block cipher that key is k, and by obtained result and described s_iDifferent Or rear output obtains pseudo-random number sequence r_i；Wherein i is the moment, and i=1,2,3 ... m.

Length n of described block cipher key k is determined by block encryption algorithm, according to different algorithms using different Key length.

Described initial vector iv₀Length n determined by axu-hash function, specially n-bit or 2n bit.

When n-bit is mapped as n-bit by the axu-hash function using, described initial vector iv₀Length n be n ratio Special；

And in i=1, iv₁=iv₀, in other moment, iv_i=iv_i-1+1.

When 2n bit map is n-bit by the axu-hash function using, described initial vector iv₀Length n be 2n Bit；

And in i=1, iv₁=iv₀, in other moment, iv_i=(s_i-1,r_i-1).

Obtained pseudo-random number sequence r_iTotal length be mn bit.

As seen from the above technical solution provided by the invention, the spy based on hash function and block cipher for the said method It is ensured that the randomness of formation sequence and high security, formation sequence can pass through American National Standard technical research institute to point (nist) the whole 15 sequence randomness detections providing.

Brief description

In order to be illustrated more clearly that the technical scheme of the embodiment of the present invention, below will be to required use in embodiment description Accompanying drawing be briefly described it should be apparent that, drawings in the following description are only some embodiments of the present invention, for this For the those of ordinary skill in field, on the premise of not paying creative work, other can also be obtained according to these accompanying drawings Accompanying drawing.

Fig. 1 is provided pseudo random number production method schematic flow sheet by the embodiment of the present invention；

The schematic diagram that a kind of pseudo random number that Fig. 2 is enumerated by the embodiment of the present invention produces；

The schematic diagram that another kind of pseudo random number that Fig. 3 is enumerated by the embodiment of the present invention produces.

Specific embodiment

With reference to the accompanying drawing in the embodiment of the present invention, the technical scheme in the embodiment of the present invention is carried out clear, complete Ground description is it is clear that described embodiment is only a part of embodiment of the present invention, rather than whole embodiments.Based on this Inventive embodiment, the every other enforcement that those of ordinary skill in the art are obtained under the premise of not making creative work Example, broadly falls into protection scope of the present invention.

Below in conjunction with accompanying drawing, the embodiment of the present invention is described in further detail, is illustrated in figure 1 the present invention and implements The there is provided pseudo random number production method schematic flow sheet of example is it is characterised in that methods described includes:

Step 11: input length is the block cipher key k of the n-bit and initial vector iv of n-bit₀；

In this step, length n of described block cipher key k is determined by block encryption algorithm, according to different Algorithm adopts different key lengths.

For example be in the present embodiment can be using the now aes-128 as standard, it would however also be possible to employ other versions of aes or Other block ciphers；According to other versions, then need using different key lengths.

Above-mentioned initial vector iv₀Length n determined by axu-hash function, specially n-bit or 2n bit.

Specifically, when n-bit is mapped as n-bit by the axu-hash function using, described initial vector iv₀Length Degree n is n-bit；When 2n bit map is n-bit by the axu-hash function using, described initial vector iv₀Length n be 2n bit.

Step 12: by vectorial iv_iAs the input of axu-hash function, obtain after process exporting s_i；

In this step, the axu-hash function being used should have good property, for example:

1) if n-bit is mapped as n-bit by the axu-hash using, can be selected for function h₁={ h_a{ x }=a, function is One from { 0,1 } n to { 0- axuhash collection of functions；

2) if 2n bit map is n-bit by the axu-hash using, can be selected for function h₂={ h_a(x₁, x₂)=a x₁ +a², function is one from { 0,1, }²ⁿ{ to { 0 (2-^(n-1), 2-⁽ⁿ- axu hash collection of functions.

Step 13: by obtained s_iBe encrypted with the block cipher that key is k, and by obtained result with Described s_iAfter XOR, output obtains pseudo-random number sequence r_i.

Above-mentioned involved i is the moment, and i=1,2,3 ... m.

In implementing, according to initial vector iv₀The difference of length, the processing scheme being adopted is also different, specifically comes Say:

It is illustrated in figure 2 a kind of schematic diagram of pseudo random number generation that the embodiment of the present invention is enumerated, in this case, institute Using initial vector iv₀Length n be n-bit, that is, select h₁={ h_a(x)=a as axu-hash function, and in i=1 When, iv₁=iv₀, in other moment, iv_i=iv_i-1+ 1, the program is designated as htr scheme.In conjunction with Fig. 2, concrete processing procedure is:

1) input length is the block cipher key k of the n-bit and initial vector iv of n-bit₀；

2) in moment i=1,2 ... m, iv is obtained according to the recurrence relation of iv_i(in i=1, iv₁=iv₀, when other Carve, iv_i=iv_i-1+1)；

3) calculate s_t=h_a(s_t)=a, wherein a are the random number again chosen in each computing；

4) calculate r_t=e_k(s_t).

It is illustrated in figure 3 the schematic diagram of another kind of pseudo random number generation that the embodiment of the present invention is enumerated, in this case, The initial vector iv being adopted₀Length n be 2n bit, that is, select h₂={ h_a(x₁, x₂)=a x₁+a²As axu-hash letter Number, and in i=1, iv₁=iv₀, in other moment, iv_i=(s_i-1,r_i-1), the program is designated as hbc scheme.In conjunction with Fig. 3, have Body processing procedure is:

1) input length is the block cipher key k of the n-bit and initial vector iv of 2n bit₀, remember iv₀=(s₀, r₀)；

2) in moment i=1,2 ... m, obtain iv_i=(s_i-1,r_i-1)；

3) calculate s_t=h_a(s_t-1, r_t-1)=a s_t-1+a²., wherein a is again choose in each computing random Number；

4) calculate r_t=e_k(s_t).

Pseudo-random number sequence r obtained by above two scheme_iTotal length be mn bit.

Safety and randomness to the pseudo-random number sequence obtained by above two scheme detect below, first with For htr scheme, the definition according to pseudo-random generator is it is only necessary to judge following 2 conditions:

1) htr has spreading coefficient l；

2) sequence r that htr generates_iIt is pseudo-random sequence.

For condition 1, htr has spreading coefficient { 0,1, }²ⁿ→ 0,1, m, meet condition 1.For condition 2 it is assumed that htr gives birth to Become sequence be not pseudo-random sequence, that is, sequence with can distinguish in polynomial time, be wherein generally evenly distributed in 0, Independent random variable on 1 is all.According to the definition of undistinguishable, for the algorithm d of each probabilistic polynomial time, each is just Multinomial, and sufficiently large n, Wo Menyou:

|pr[d({r_mn, 1ⁿ)=1]-pr [d ({ u_mn, 1ⁿ)=1] | ＞ 1/p (n)

It is the formation sequence of htr, that is, againSo having

|pr[d({htr(u_2n), 1ⁿ)=1]-pr [d ({ u_mn, 1ⁿ)=1] | ＞ 1/p (n)

(hybrid) technology is proved according to apagogic principle and mixing, we will be concluded that block cipher e is not pseudo- Random function or pseudo-random permutation, i.e. e (u_2n) and u_nCan distinguish in polynomial time, detailed process is as follows:

1) for 0≤k≤m, we define a mixed function

$h_n^k=u_{kn}\·{\mathrm{pref}}_{(m-k)n}\left(htr\right(u_{2n}\left)\right),$

Wherein u_knIt is distributed across { 0,1 }^knOn independent random variable.And we can obtain:

$h_n^0=htr\left(u_{2n}\right)=r_{mn},h_n^m=u_{mn}$

2) 2 facts:With u_kn·e(u_2n)·pref_(m-k-1)n(htr (u_2n)) is same to be distributed,With u_kn·u_n· pref_(m-k-1)n(htr (u_2n)) is with distribution.

3) according to this 2 facts, in the case of average, we obtain

$\begin{array}{c}|\mathrm{pr}\[d\left(\right\{htr\left(u_{2n}\right)\},1^n)=1\]-\mathrm{pr}\[d\left(\right\{u_{mn}\},1^n)=1\]|\\ =|\underset{k=0}{\overset{m-1}{\σ}}\mathrm{pr}\[d\left(h_n^k\right)=1\]-\mathrm{pr}\[d\left(h_n^{k+1}\right)=1\]|\\ \≤m|\mathrm{pr}\[d\left(\right\{e\left(u_{2n}\right)\},1^n)=1\]-\mathrm{pr}\[d\left(\right\{u_n\},1^n)=1\]|\end{array}$

Therefore, Wo Menyou

|pr[d({e(u_2n), 1ⁿ)=1]-pr [d ({ u_n, 1ⁿ)=1] | >=1/ (m p (n))

This is pseudo-random function or pseudo-random permutation contradiction with block cipher e, so the htr scheme described in present example It is that pseudo random number generates scheme.

Htr solution security circle solution procedure is as follows:

The block cipher of hypothesis bottom is pseudo-random function or pseudo-random permutation, and Security Target is exactly the output that scheme obtains It is secret or pseudorandom, be undistinguishable with truly random being uniformly distributed.Assume that opponent a can do selection and attack in plain text Hit, then the advantage of opponent a attack option htr can portray for:

${\mathrm{adv}}_{htr}^{prg}\left(a\right)=\mathrm{pr}\[k\←key:a^{htr}=1\]-\mathrm{pr}\[a^{\$}=1\]$

Wherein ＄: { 0,1 }²ⁿ→ { 0,1, m is a random function.

$\begin{array}{c}{\mathrm{adv}}_{htr}^{prg}\left(a\right)=\mathrm{pr}\[k\←key|a^{htr}=1\]-\mathrm{pr}\[a^{\$}=1\]\\ =\mathrm{pr}\[k\←key|a^{htr}=1\]-\mathrm{pr}\[r\←random(2n,n):a^r=1\]\\ +\mathrm{pr}\[r\←random(2n,n):a^r=1\]-\mathrm{pr}\[a^{\$}=1\]\\ ={\mathrm{adv}}_e^{prf}\left(a\right)={\mathrm{adv}}_{htr\[r\]}^{prg}\left(a\right)\end{array}$

Because bottom block cipher e is pseudo-random function or pseudo-random permutation, only need to calculateUpper Dividing value.

First bottom block cipher e is substituted for random function r:{ 0,1 }²ⁿ→{0.Following proof part is all based on Game-playing technology.

Lemma: if game g and h is identical until bad games, a is an opponent, then opponent attacks game The advantage of g and h is:

Adv (a)=pr [a^g=1]-pr [a^h=1]≤pr [a^gSets bad]=pr [a^hsets bad]

According to identical-until-bad lemma, Wo Menyou:

${\mathrm{adv}}_{htr\[r\]}^{prg}\left(a\right)=\mathrm{pr}\[r\←random(2n,n):a^r=1\]-\mathrm{pr}\[a^{\$}=1\]\≤pr\[a^{\$}setsbad\]$

Need now to calculateThat is input in the domain of definition calculate r is needed to produce collision coll The probability of (domain (r)), obtains following result by the property of general Hash:

$\mathrm{pr}\[a^{\$}setsbad\]=\mathrm{pr}\[coll\left(domain\right(r\left)\right)\]=\left(\begin{array}{c}m\\ 2\end{array}\right)\&element;/2^n$

When ∈=^2-nWhen, the advantage of opponent a attack option htr is

${\mathrm{adv}}_{htr}^{prg}\left(a\right)\≤{\mathrm{adv}}_b^{prf-cpa}\left(a\right)+\left(\begin{array}{c}m\\ 2\end{array}\right)\&element;/2^n={\mathrm{adv}}_b^{prf}\left(a\right)+\left(\begin{array}{c}m\\ 2\end{array}\right)/2^{2n}$

When m takes 1024, block cipher length n is 128 bits, and the safety of htr scheme reduces 2logm-1=19 ratio Spy, is 109 bits.

Proving by the same methods obtains: htr scheme is also safe under chosen ciphertext attacks.When m takes 1024, block cipher length n For 128 bits, the safety of htr scheme reduces 2logm=20 bit, is 108 bits.

Pseudo-random sequence r more above-mentioned htr scheme being produced below_iCarry out randomness detection, packet adopted here Password is aes-128, and the form of axu-hash function is h₁={ h_a(x)=a x }, specifically:

The sequence randomness examination criteria being provided according to American National Standard technical research institute and detection external member are right here The sequence that htr scheme produces has carried out the randomness detection of whole 15, comprising: single-bit frequency detects (frequency Test), frequency detection (frequency test within a block) in block, distance of swimming sum detection (run test), in block The longest 1 Runs-test (test for the longest run of ones in a block), the detection of binary matrix order (binary matrix rank test), discrete Fourier transform detect (discrete fourier transform Test), non-overlapped module matching detection (non-overlapping template matching test), overlay module coupling Detection (overlapping template matching test), maurer general statistical detection (maurer ' s " universal statistical " test), linear complexity detection (linear complexity test), overlapping sub- sequence Row detection (serial test), approximate entropy detection (approximate entropy test), cumulative and detection (cumulative sum test), free Runs-test (random excursions test), free variable detection (random excursions variant test).

Introduce every kind of test purpose, the selection of test parameter and obtained test result in turn below.

For each class detection method, single test list entries length is 1024000 bits, tests 1000 times (at random Runs-test and free variable are detected as 625 times), the sequence number by this kind of detection for the statistics.

For each detection method, pass through if there are no less than 980 detections in 1000 tests, just say that this sequence is led to Cross the detection of this randomness.If total number measured is 625, needs to pass through no less than 611 tests, could illustrate that sequence is passed through This test.

1. single-bit frequency detection

A kind of statistic mixed-state project, whether the number for detecting in sequence to be checked 0 and 1 is close.

Test result: 991/1000, by this detection.

2. frequency detection in piece

A kind of statistic mixed-state project, whether the number for detecting in the m seat sequence (referred to as " block ") of sequence to be checked 1 connects Nearly m/2.

Parameter selects: piecemeal length m=128

Test result: 994/1000, by this detection.

3. distance of swimming sum detection

A kind of statistic mixed-state project, whether the sum for detecting the distance of swimming in sequence to be checked obeys randomness requires.

Test result: 993/1000, by this detection.

4. the longest 1 Runs-test in piece

A kind of statistic mixed-state project, for detecting the distribution of maximum " 1 " distance of swimming in each grade long sub-sequence of sequence to be checked Whether obey randomness requirement.

Test parameter: sub-sequence length m=10000

Test result: 995/1000, by this detection.

5. binary matrix order detection

A kind of statistic mixed-state project, for detecting the linear independent between the subsequence of given length in sequence to be checked.

Test result: 992/1000, by this detection.

6. discrete Fourier transform detection

A kind of statistic mixed-state project, for detecting that sequence to be checked carries out obtaining abnormal peak value number after Fourier transform Whether exceed permissible value.

Test result: 989/1000, by this detection.

7. non-overlapped module matching detection

A kind of statistic mixed-state project, for detecting that the number of times a certain given m bit long target strings b in sequence to be checked is No obedience randomness requires.In detection process, when not finding target strings, window moves one afterwards every time and continues search for；When matching During target strings, count and window moves directly to target strings next bit and continues search for.

Test parameter: sub-sequence length m=128000, piecemeal length m=9

Test result: test selects 148 kinds of b values altogether, minima is 984/1000, by this detection.

8. overlay module matching detection

A kind of statistic mixed-state project, for detecting that the number of times a certain given m bit long target strings b in sequence to be checked is No obedience randomness requires.In detection process, when not finding target strings, window moves one afterwards every time and continues search for；When matching During target strings, count and window only moves one afterwards and continues search for.

Test parameter: sub-sequence length m=1032, piecemeal length m=9

Test result: 992/1000, by this detection.

9.maurer general statistical detects

A kind of statistic mixed-state project, for detecting that can sequence to be checked be compressed (lossless compress).

Test result: 990/1000, by this detection.

10. linear complexity detection

A kind of statistic mixed-state project, whether the distribution for detecting the linear complexity of sequence to be checked is random.

Test parameter: piecemeal length m=500

Test result: 992/1000, by this detection.

11. overlapping subsequence detections

A kind of statistic mixed-state project, for detect m position in sequence to be checked can each of overlapping subsequence pattern number Whether close.

Test parameter: piecemeal length m=16

Test result: 987/1000, by this detection.

12. approximate entropy detections

A kind of statistic mixed-state project, by compare m position can the frequency of overlapping subsequence mode and m+1 position can overlapping subsequence The frequency of pattern is detecting its randomness.

Test parameter: piecemeal length m=10

Test result: 985/1000, by this detection.

13. cumulative and detections

A kind of statistic mixed-state project, peak excursion in each subsequence of sequence to be checked should be had by it with random sequences Whether some peak excursions compare, excessive or too small with the peak excursion that judges sequence to be checked.

Test result: 988/1000 (positive), 988/1000 (reverse), by this detection.

14. free Runs-tests

Test result: 8 kinds of states correspond to 8 groups of test results

Minima is 617/625, by this detection.

15. free variable detections

Test result: 18 kinds of states correspond to 18 groups of test results

State x	Test result
		-9	622/625
-8	621/625
		-7	622/625
-6	623/625
		-5	622/625
-4	620/625
		-3	620/625
-2	619/625
		-1	619/625
1	621/625
		2	618/625
3	619/625
		4	618/625
5	620/625
		6	618/625
7	621/625
		8	621/625
9	620/625

Minima is 618/625, by this detection.

Above-mentioned 15 kinds of test result summary sheets are following (the selection minima of multigroup test result):

From the above results: the pseudo-random sequence that htr scheme produces has passed through the randomness detection of whole 15, has Random nature well.

The pseudo-randomness of the produced sequence of another kind of scheme (hbc) and safety analysiss process and above-mentioned htr scheme Safety analysiss process is consistent, is not repeated herein.

Again, being detected, packet adopted here is close to the randomness of the pseudo-random sequence that this hbc scheme produces below Code is aes-128, and the form of axu-hash function is h₂={ h_a(x₁, x₂)=a x₁+a², specifically:

The sequence randomness examination criteria being provided according to American National Standard technical research institute and detection external member, to hbc The pseudo-random sequence that scheme produces has carried out the randomness detection of whole 15, comprising: frequency inspection in the detection of single-bit frequency, block Survey, distance of swimming sum detection, the longest 1 Runs-test, the detection of binary matrix order, discrete Fourier transform detection, non-overlapped mould in block Block- matching detection, overlap template matching detect, maurer general statistical detects, linear complexity detects, overlapping subsequence detects, Approximate entropy detection, cumulative and detection, the detection of free Runs-test, free variable.

In test, selected parameter is identical with parameter selected by test in embodiment 1, and test result is as follows.

For each class detection method, single test list entries length is 1024000 bits, tests 1000 times (at random Runs-test and free variable are detected as 620 times), the sequence number by this kind of detection for the statistics.

For each detection method, pass through if there are no less than 980 detections in 1000 tests, just say that this sequence is led to Cross the detection of this randomness.If total number measured is 620, needs to pass through no less than 606 tests, could illustrate that sequence is passed through This test.

1. single-bit frequency detection

Test result: 990/1000, by this detection.

2. frequency detection in piece

Test result: 995/1000, by this detection.

3. distance of swimming sum detection

Test result: 991/1000, by this detection.

4. the longest 1 Runs-test in piece

Test result: 991/1000, by this detection.

5. binary matrix order detection

Test result: 991/1000, by this detection.

6. discrete Fourier transform detection

Test result: 986/1000, by this detection.

7. non-overlapped module matching detection

Test result: test selects 148 kinds of b values altogether, minima is 984/1000, by this detection

8. overlay module matching detection

Test result: 992/1000, by this detection.

9.maurer general statistical detects

Test result: 983/1000, by this detection.

10. linear complexity detection

Test result: 990/1000, by this detection.

11. overlapping subsequence detections

Test result: 982/1000, by this detection.

12. approximate entropy detections

Test result: 995/1000, by this detection.

13. cumulative and detections

Test result: 991/1000 (positive), 991/1000 (reverse), by this detection.

14. free Runs-tests

Test result: 8 kinds of states correspond to 8 groups of test results

State x	Test result
		-4	611/620
-3	613/620
		-2	615/620
-1	611/620
		1	617/620
2	614/620
		3	615/620
4	608/620

Minima is 608/620, by this detection.

15. free variable detections

Test result: 18 kinds of states correspond to 18 groups of test results

State x	Test result
		-9	616/620
-8	613/620
		-7	612/620
-6	617/620
		-5	618/620
-4	614/620
		-3	611/620
-2	616/620
		-1	616/620
1	615/620
		2	613/620
3	617/620
		4	614/620
5	613/620
		6	614/620
7	615/620
		8	615/620
9	616/620

Minima is 611/620, by this detection.

Above-mentioned 15 kinds of test result summary sheets are as follows to (the selection minima of multigroup test result):

Sequence number	Test item	Test result	Whether pass through
				1	Single-bit frequency detects	990/1000	Pass through
2	Frequency detection in block	995/1000	Pass through
				3	Distance of swimming sum detection	991/1000	Pass through
4	The longest 1 Runs-test in block	991/1000	Pass through
				5	Binary matrix order detects	991/1000	Pass through
6	Discrete Fourier transform detects	986/1000	Pass through
				7	Non-overlapped module matching detection	982/1000	Pass through
8	Overlay module matching detection	992/1000	Pass through
				9	Maurer general statistical detects	983/1000	Pass through
10	Linear complexity detects	990/1000	Pass through
				11	Overlapping subsequence detection	982/1000	Pass through
12	Approximate entropy detects	995/1000	Pass through
				13	Add up and detect	991/1000	Pass through
14	Random Runs-test	608/620	Pass through
				15	Free variable detects	611/620	Pass through

From the above results: the pseudo-random sequence that hbc scheme produces has passed through the randomness detection of whole 15, has Random nature well.

In sum, the feature based on hash function and block cipher for the embodiment of the present invention it is ensured that formation sequence with Machine and high security, whole 15 sequences that formation sequence can be provided by American National Standard technical research institute are random Property detection；On the other hand, based on the method, each moment only needs to call a block cipher, the ansi of comparison with standard X9.17prng each moment calls block cipher twice to have and higher realizes efficiency.

It should be noted that those skilled in the art can be understood that above-described embodiment can be real by software Now it is also possible to the mode by software plus necessary general hardware platform to be realized.Based on such understanding, above-described embodiment Technical scheme can be embodied in the form of software product, and this software product can be stored in a non-volatile memory medium In (can be cd-rom, u disk, portable hard drive etc.), including some instructions with so that a computer equipment (can be personal Computer, server, network equipment etc.) execution each embodiment of the present invention described in step.

The above, the only present invention preferably specific embodiment, but protection scope of the present invention is not limited thereto, Any those familiar with the art in the technical scope of present disclosure, the change or replacement that can readily occur in, All should be included within the scope of the present invention.Therefore, protection scope of the present invention should be with the protection model of claims Enclose and be defined.

Claims (6)

1. a kind of pseudo random number production method is it is characterised in that methods described includes:

Input length is the block cipher key k of the n-bit and initial vector iv of n-bit₀；

By vectorial iv_iAs the input of axu-hash function, obtain after process exporting s_i；

By obtained s_iIt is encrypted with the block cipher that key is k, and by obtained result and described s_iAfter XOR Output obtains pseudo-random number sequence r_i；Wherein i is the moment, and i=1,2,3 ... m.

2. according to claim 1 pseudo random number production method it is characterised in that

Length n of described block cipher key k is determined by block encryption algorithm, is adopted different close according to different algorithms Key length.

3. according to claim 1 pseudo random number production method it is characterised in that

Described initial vector iv₀Length n determined by axu-hash function, specially n-bit or 2n bit.

4. according to claim 3 pseudo random number production method it is characterised in that methods described also includes:

When n-bit is mapped as n-bit by the axu-hash function using, described initial vector iv₀Length n be n-bit；

And in i=1, iv₁=iv₀, in other moment, iv_i=iv_i-1+1.

5. according to claim 3 pseudo random number production method it is characterised in that methods described also includes:

When 2n bit map is n-bit by the axu-hash function using, described initial vector iv₀Length n be 2n bit；

And in i=1, iv₁=iv₀, in other moment, iv_i=(s_i-1,r_i-1).

6. according to one of them described pseudo random number production method of claim 1-5 it is characterised in that

Obtained pseudo-random number sequence r_iTotal length be mn bit.