JP2002217898A - Pseudo random number generating system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a pseudo random number generating system by which estimating of a pseudo random number to be generated next is difficult, a period is long and bias in distribution is small. SOLUTION: The pseudo random number generating system 100 is provided with a linear feedback shift register 102, which makes a primitive irreducible polynomial to be a characteristic polynomial and outputs L-pieces of register value, corresponding to the primitive irreducible polynomial in synchronization with clock input, a linear transformation part 104 which linearly combines L-pieces of the register value and outputs n-bit linear coupled vector value which is smaller than L and is linear and mutually independent, and a bijection mapping generation part 106 which inputs the n-bit linear coupled vector value and outputs an n-bit binary vector bijection mapping.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a pseudorandom number generation system and method for generating pseudorandom numbers used in cryptographic communication and digital signatures in the field of information security.

[0002]

2. Description of the Related Art Conventionally, in order to prevent transmission information from being known to a third party other than a related person, an encryption technique for encrypting transmission information and a method for ensuring that transmission information is not falsified or forged. Digital signature technology is used. In addition, for example, in order to be able to confirm the legitimacy of a user who accesses a host device from a terminal device, it is common practice to assign an authentication password to each user and request the input of the authentication password at the time of access. Have been Generally, the encryption key used for these encryption techniques, the random number used for the digital signature technique, and the authentication password are often generated from pseudo-random numbers.

[0003] The pseudo random numbers are required to have the following properties. (1) The distribution of the generated pseudo-random numbers is less biased. (2) The period of the generated pseudo-random number is large. (3) It is difficult to estimate a pseudo random number to be generated next from the generated pseudo random number.

[0004] As a method of generating a pseudo random number, there is a method using a block cipher system. The block cipher system is one of the common key cryptosystems, and is a system in which a plaintext is decomposed into fixed-length blocks and encrypted in block units. As a representative block encryption method, for example, DES (Data Enc
ryption Standard) is known.

FIG. 4 shows OFB (Output FeedBack) which is a typical pseudo-random number generation method using a block encryption method.
1 shows a pseudorandom number generation system using a mode. The pseudo random number generation system 400 shown in FIG.
A block encryption function f for converting into a ciphertext of bits is used to generate N n-bit pseudorandom numbers.

Here, assuming that the encryption key is K and the seed of the n-bit pseudorandom number is S, the n-bit first pseudorandom number z
₁ is generated by encrypting the encryption key K seed S of n bits. That is, the block encryption unit 400-1 receives the seed S and an encryption key K n bits, and outputs a first pseudo-random number z ₁ of n bits.

The second pseudo random number z ₂ of n bits is
the first pseudo-random number z ₁ of n bits is generated by encrypting the encryption key K. That is, the block encryption unit 400-2 receives the first pseudo-random number z ₁ and the encryption key K of the n bits, and outputs a second pseudo-random number z ₂ of n bits.

Similarly, the n-bit i-th (3 ≦ i ≦ N) pseudo-random number z _i is generated by encrypting the n-bit i−1-th pseudo-random number z _i−1 with the encryption key K. Is done. That is, the block encryption unit 400-i inputs the (i-1) th pseudo random number z _{i-1 of} n bits and the encryption key K, and outputs the i th pseudo random number z _i of n bits.

FIG. 5 shows a pseudorandom number generation system using a counter mode, which is another pseudorandom number generation method using a block cipher system. The pseudo random number generation system 500 shown in FIG.
Similar to 00, a block encryption function f for converting an n-bit plaintext into an n-bit ciphertext is used to generate N n-bit pseudorandom numbers.

Here, assuming that the encryption key is K and the seed of the n-bit pseudorandom number is S, the n-bit first pseudorandom number z
₁ is generated by encrypting the n-bit seed S with the encryption key K. That is, the block encryption unit 500-1 receives the seed S and an encryption key K n bits, and outputs a first pseudo-random number z ₁ of n bits.

The second pseudo random number z ₂ of n bits is
The seed S is regarded as a binary non-negative integer, and is generated by encrypting a value S + 1 obtained by adding 1 to the seed S with the encryption key K. That is, the block encryption unit 500-2 receives the value S + 1 and the cryptographic key K obtained by adding 1 to the seed S, and outputs a second pseudo-random number z ₂ of n bits. However, when S + 1 is 2 to the power of n, it is set to 0.

[0012] Similarly, the value pseudo random number z _i of the n-bit first i (3 ≦ i ≦ N) is the seed S regarded as binary representations are non-negative integers, plus i-1 in the seed S S + i-1
Is generated by encrypting with the encryption key K.
That is, the block encryption unit 500-i inputs the value S + i-1 obtained by adding i-1 to the seed S and the encryption key K, and outputs the i-th pseudorandom number z _i of n bits. However, S + i-
If 1 is greater than or equal to 2 n, S + i−1 is calculated as 2 n
It is replaced by the remainder when raised to the power.

[0013]

However, it is not easy with these pseudorandom number generation methods to generate pseudorandom numbers that satisfy the above three properties. That is, OF
In the pseudo-random number generation method using the B mode, the period of the generated pseudo-random number changes depending on the encryption key K, and it cannot be guaranteed that the period of the pseudo-random number becomes large, and the distribution may be biased.

In the pseudorandom number generation method using the counter mode, the period is always 2 to the power of n. However, if n is not sufficiently large, the period of the pseudorandom number does not increase. Furthermore, since a pseudorandom number generated once has a property of not appearing again during a period of 2 n, the pseudorandom number generated next is limited as the number of generated pseudorandom numbers increases. Therefore, there is a problem that a clue for estimating a pseudorandom number to be generated next is given.

The present invention has been made to solve the above-mentioned conventional problems. It is an object of the present invention to make it difficult to estimate a pseudorandom number to be generated next, and to provide a pseudorandom number having a large period and a small distribution. An object of the present invention is to provide a random number generation system and method.

[0016]

In order to achieve the above object, a pseudorandom number generation system according to the present invention uses a primitive irreducible polynomial as a characteristic polynomial and synchronizes with a clock input with L elements corresponding to the primitive irreducible polynomial. Register value output means for outputting the register values of the above, linear conversion means for linearly combining the L register values, and outputting an n-bit linear combination vector value smaller than L which is linearly independent of each other; a binary vector bijective map generating means for inputting an n-bit linear combination vector value and outputting an n-bit binary vector bijective map.

The pseudorandom number generation method according to the present invention further comprises the steps of: using a primitive irreducible polynomial as a characteristic polynomial, outputting L register values corresponding to the primitive irreducible polynomial in synchronization with a clock input; Linearly combining the register values and outputting an n-bit linear combination vector value smaller than L, which is linearly independent of each other; and inputting the generated n-bit linear combination vector value to obtain an n-bit binary vector Outputting a bijective mapping.

In these cases, the binary vector bijective mapping requires that it is easy to generate an output from an input inside the system and it is difficult to restore the input from the output outside the system. Is done.

[0019]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail based on one embodiment shown in the drawings. FIG. 1 shows an example of a schematic configuration of a pseudo random number generation system according to the present invention. The pseudo random number generation system 100 shown in FIG. 1 includes an L-stage linear feedback shift register (LFSR) 102, a linear conversion unit 10
4. A bijective mapping generation unit 106 is provided. Hereinafter, a description will be given assuming that a vector sequence can be regarded as an integer value for convenience. For example, a sequence of n bits of 0 is represented as "0", and a sequence of n bits of 1 is represented as "2 ⁿ -1".

The L-stage linear feedback shift register 102 uses a primitive irreducible polynomial as a characteristic polynomial.
Unless all the register values are set to 0, the state is shifted in synchronization with an external clock input to output L register values (L bit sequence).

The L register values have a period of 2 ^L -1 since the characteristic polynomial is a primitive irreducible polynomial, and take 1 to 2 ^L -1 states once in the period.

The linear converter 104 linearly combines the L register values from the linear feedback register 102 to output n-bit linear combination vector values (bit strings) smaller than L, which are linearly independent of each other.

As described above, the L register values output from the linear feedback register 102 have a cycle of 2 ^L -1.
In the cycle, the state of 1 to 2 ^L −1 is changed to 1
Therefore, the n-bit linear combination vector value output by the linear conversion unit 104 has a period of 2 ^L −1, and when the period becomes 0 in that period, 2 ^Ln −1 times, from 1 other than 0 The case of 2 ⁿ −1 is taken 2 ^Ln times.

The bijective mapping generation unit 106 includes the linear transformation unit 1
Input the n-bit linear combination vector value from
The binary vector bijective mapping f of bits is output as a pseudorandom number. Here, an n-bit linear combination vector value g
And the n-bit binary vector bijective map f is f ₁
If ≠ f ₂ , there is a relationship that g ₁ ≠ g ₂ . That is, if the binary vector bijective maps f are different,
There is a relationship that the original linear combination vector value g also becomes a different value. In addition, it is easy to derive the binary vector bijection map f inside the system, but it is difficult to derive the original linear combination vector value g from the binary vector bijection map f outside the system. It has the property of

Further, since the binary vector bijective map f is a bijective map, the period coincides with the period 2 ^L -1 of the input linear combination vector value, and takes a certain value in one period. The case is 2 ^Ln -1 times, and the value other than that is 2 ^Ln times.

Therefore, by increasing L, it is possible to increase the period of the pseudorandom number and to eliminate the bias of the distribution. Further, since the binary vector bijective map f has the property that it is difficult to derive the original linear combination vector value from the binary vector bijective map f outside the system, the pseudorandom number outside the system is used. It is difficult to estimate a pseudorandom number generated next from a certain binary vector bijective map f.

FIG. 2 shows an example of a detailed configuration of a pseudo random number generation system according to the present invention. The pseudo-random number generation system 200 shown in the figure is a more specific example of the schematic configuration shown in FIG. 1, and includes a 127-stage linear feedback shift register (LFSR) 202, a bit extraction unit 204, and an encryption unit 206. .

Here, the L-stage linear feedback shift register includes, for example, as shown in FIG. 3, L-1 AND elements 302-1 to 302-L-1, and L-1 exclusive OR. Elements 304-1 to 304-L-1 and L D flip-flops 306-1 to 306-L are provided.

The input terminals c _{1 to} c _L-1 are for setting a binary fixed value. Output terminals x _{1 to} x _L output the values of D flip-flops 306-1 to 306-L.
In this circuit, L D flip-flops 306-
When at least one is set to 1 as an initial value of 1 to 306-L, the state is changed every time a clock is input to the clock terminal 308. At this time, the number of clocks required until the value of each of the D flip-flops 306-1 to 306-L returns to the initial value is called a cycle. This cycle can be changed by changing the value set for the input terminals c _{1 to} c _L. In particular, the following GF (2)
Characteristics of the above equation _{C (x) = C 0 +} C 1 x + C 2 x 2 + ···· CL -1 x L-1 +
It is known that when C _L × ^L , (c ₀ = 1) is irreducible and primitive on GF (2), its period is 2 ^L −1 and is maximum. Also,
When 2 ^L −1 is a prime number, the above characteristic equation is GF
(2) If it is irreducible and primitive, it is always primitive, and its cycle is 2 ^L −1, which is the maximum.

Returning to FIG. 2, the description will be continued. The 127-bit bit string output from the linear feedback shift register 202 is input to the bit extraction unit 204. The bit extraction unit 204 corresponds to the linear conversion unit 104 shown in FIG. 1, and extracts 64 bits from the input 127-bit bit sequence. This 64-bit bit string is an example of a linear combination of the outputs of the linear feedback shift register 202 and is linearly independent of each other.

The encrypting unit 206 corresponds to the bijective mapping generating unit 106 shown in FIG. 1, and encrypts an input 64-bit bit string using DES, which is a common key encryption algorithm. Specifically, the encryption unit 206
Encrypts an input 64-bit bit string using a 56-bit encryption key, and outputs a 64-bit pseudo-random number. By using DES, which is a common key encryption algorithm, the uniqueness of decryption is guaranteed, and it is difficult to recover data before encryption from data after encryption without knowing the encryption key. . Therefore, if the encryption unit 206 keeps the key secret in the system, it is easy to generate an output from the input inside the system, and it is difficult to restore the input from the output outside the system. It can be said that this realizes a certain binary vector bijective mapping f.

As described above, the pseudorandom number generation system 200
Then, every time a clock is input to the linear feedback shift register 202, a bit sequence of 127 bits is output from the linear feedback shift register 202, and the bit extraction unit 204 extracts 64 bits from the bit sequence of 127 bits, and By the part 206, 6
By encrypting the 4-bit bit string, a 64-bit pseudo-random number is generated.

The embodiment of the present invention has been described with reference to the drawings. However, it is apparent that the present invention is not limited to the matters described in the above embodiments, and that changes, improvements, and the like can be made based on the description in the claims.

[0034]

As described above, according to the present invention, it is difficult to estimate a pseudorandom number to be generated next, and it is possible to generate a pseudorandom number having a large period and a small distribution. .

[Brief description of the drawings]

FIG. 1 is a diagram showing an example of a schematic configuration of a pseudo random number generation system according to the present invention.

FIG. 2 is a diagram showing an example of a detailed configuration of a pseudo random number generation system according to the present invention.

FIG. 3 is a diagram illustrating an example of a configuration of a linear feedback shift register.

FIG. 4 is a diagram illustrating an example of a configuration of a pseudo-random number generation system using an OFB mode of a block cipher.

FIG. 5 is a diagram illustrating an example of a pseudo-random number generation system using a block cipher counter mode.

[Explanation of symbols]

 REFERENCE SIGNS LIST 100 pseudo-random number generation system 102 linear feedback shift register 104 linear conversion unit 106 bijective mapping generation unit 200 pseudo-random number generation system 202 linear feedback shift register 204 bit extraction unit 206 encryption unit 302-1 to 302-L-1 logical product Element 304-1 to 304-L-1 Exclusive OR Element 306-1 to 306-LD D flip-flop

Claims (3)

[Claims] 1. A register value output means for generating a primitive irreducible polynomial as a characteristic polynomial and outputting L register values according to the primitive irreducible polynomial in synchronization with a clock input; Linear conversion means for combining and outputting an n-bit linear combination vector value smaller than L, which is linearly independent of each other; and inputting the generated n-bit linear combination vector value and n-bit binary vector bijective mapping And a binary vector bijection map generating means for outputting a bijective mapping. 2. A method of converting a primitive irreducible polynomial into a characteristic polynomial and outputting L register values according to the primitive irreducible polynomial in synchronization with a clock input; and linearly combining the L register values; A step of outputting an n-bit linear combination vector value smaller than L that is linearly independent of each other; a step of inputting the generated n-bit linear combination vector value and outputting an n-bit binary vector bijective map; And a pseudo-random number generation method. 3. The binary vector bijective mapping according to claim 1, wherein it is easy to generate an output from an input inside the system, and it is difficult to restore the input from the output outside the system. The pseudorandom number generation system according to claim 1 or the pseudorandom number generation method according to claim 2.