JP2007073012A - Random number generation system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a random number generation system capable of generating cryptologically safe random numbers by using a pseudo random number generation means. <P>SOLUTION: This random number generation system masks pseudo random numbers 222a, 222b, 222c and 222d generated from a certain pseudo number generation means CNN-2 (220) by a mask pattern 214 created based on a pseudo random number 212 generated from a pseudo random number generation means CNN-1 (210) in a distinct system and outputs the results 230a, 230b, 230c and 230d therefrom as a random number sequence. For instance, a chaos neural network CNN can be used for the pseudo random number generation means. By using the output random number sequence for an encryption system by a conventional encryption method, encryption further high in robustness can be executed. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a technique for generating cryptographically secure pseudorandom numbers.

In systems that perform encryption and decryption of digital data, a method called a stream encryption method has been widely used.
Stream encryption is a method of encrypting and decrypting plaintext every bit or every few bits, generating pseudorandom numbers called key sequences from the encryption key, and encrypting plaintexts sequentially using the pseudorandom numbers. This is an encryption method. Since pseudo-random numbers can be generated at a relatively high speed even by software, the encryption and decryption system based on the stream encryption method can perform high-speed processing even when realized by software. In this method, the pseudo random number generation method is very important and greatly affects the encryption strength.

The inventors have invented a neural network that is composed of ordinary artificial neurons used in hopfield networks, back propagation learning rules, etc., and can obtain chaos output. This unique neural network is called a chaos neural network. (Hereinafter referred to as CNN) (for example, Non-Patent Document 1, Patent Document 1, Patent Document 2). It has been clarified that by using CNN, a pseudo-random number having better randomness than the prior art can be generated (Patent Document 2).
The neuron model of the inventors' CNN is shown in FIG. 1 (a), Formula (1), and Formula (2).

Here, the nonlinear output function f _s represented by the expression (1) is not a singular function but a sigmoid function that is generally used. The other coefficients in FIG. 1 (a) and equations (1) and (2) are defined as follows.
x _j (t): output of neuron j at time t (t = 0, 1, 2,...)
u _j : Internal state x _{i of} neuron j (t−1): Input from neuron i at time t−1 w _ij : Connection load from neuron i to neuron j θ _j : Threshold value of neuron j I _j : Neuron j External input value to

In the natural world, there is a neuron that generates a single oscillating output. However, in the case of the above-described neuron used for the CNN, only one neuron does not oscillate. As an example of a neuron network, a configuration of a chaotic neural network (CNN) composed of four neurons is shown in FIG. FIG. 1B is composed of four neurons: a neuron 1 (N ₁ ) 121, a neuron 2 (N ₂ ) 122, a neuron 3 (N ₃ ) 123, and a neuron 4 (N ₄ ) 124. Since there is one neuron cycle as a feature of the structure, it is called cyclic-4nn (hereinafter C-4nn). Table 1 shows parameters of C-4nn (coupling load W, threshold value θ, and external input I _j ).

  Furthermore, the inventors have clarified that the lower bits of the output generated from the CNN have good randomness, which is more uniform than the conventional random number generation method and cannot be easily distinguished from the true random number. Invented a random number generation system capable of generating such random numbers (Patent Document 2).

S. Kawamura, H. Yoshida, M. Miura, and M. Abe: Implementation of Uniform Pseudo Random Number Generator and Application to Stream Cipher based on Chaos Neural Network, Proceedings of Papers, the International Conference on Fundamentals of Electronics, Communications and Computer Sciences, R-18, 2002. JP 2001-144746 A JP 2003-76272 A

  From the viewpoint of defending against attacks on the stream encryption method, a pseudo-random number generation method capable of realizing more robust encryption is desired. An object of the present invention is to propose a method (hereinafter referred to as a mask pattern method) that widens an encryption key space of an encryption system that can be used for a stream encryption method or the like in the generation of pseudo-random numbers, and to further enhance robust encryption. Is to make it possible.

In order to solve the above problems, the present invention provides a random number generation system for generating a random number,
Two pseudo-random number generating means for outputting pseudo-random numbers, a mask pattern generating means for generating a mask pattern using the pseudo-random numbers output from one of the pseudo-random number generating means, and an output from the other pseudo-random number generating means A random number generation system comprising: random number output means for outputting a result of masking the mask pattern with a pseudo-random number.
In this random number generation system, the mask pattern may be characterized in that 0 and 1 are the same number.
The pseudo-random number generation means may be a chaotic neural network, and the pseudo-random number may be a lower bit of an output from the chaotic neural network.
An encryption system comprising: the random number generation system described above; and an encryption unit that calculates an input plaintext and a random number from the random number output unit and outputs an encrypted text. It is an invention.
A program for causing the computer system to construct the function of the random number generation system and a program for causing the computer system to construct the function of the encryption system are also the present invention.

In the random number generation system using the mask pattern method proposed in the present invention, a pseudo random number generated from a certain pseudo random number generating means is generated with a mask pattern created based on pseudo random numbers from a pseudo random number generating means of a different system. Mask and use the resulting random number sequence as a pseudo-random number for encryption. Therefore, the number of encryption keys that can be generated can be increased as necessary, and the encryption key space can be expanded. As a result, pseudorandom numbers that are cryptographically safer than before can be generated, and the encryption system can be made robust.
In particular, by using the mask pattern method of the present embodiment with pseudo-random output lower bits generated from the CNN, which is the technique of the inventors, encryption without lowering the excellent randomness of the lower bits of the CNN output. The key space can be expanded. Specifically, the above-described mask pattern method is applied to the existing techniques of the inventors (see Non-Patent Document 1, Patent Document 1, and Patent Document 2) using the same number of mask patterns of 0 and 1. Then, the encryption key space could be improved ¹⁰⁴⁸ times as a standard. Thus the time required for decryption may be extended to more than 10 ²⁹ years. Originally, the encryption method by CNN, which is the existing technology of the inventors, is faster and more robust than Rijndael, which is the next generation standard encryption in the United States, but according to the method of the present invention, this can be further strengthened.

Hereinafter, an example of an embodiment of the random number generation system of the present invention will be described in detail. First, the main attack methods considered to be an outline of the stream encryption method will be described, and then a mask pattern method which is the method of the present embodiment will be proposed as a method for dealing with these attacks.
<1. Encryption>
In the present embodiment, a random number used for encryption is generated from a pseudo-random number generated by CNN using a mask pattern method, which is a new method proposed in the present embodiment, and a system for performing encryption using the above-described stream encryption method is implemented. The case will be described as an example, but other pseudo-random number generation means may be used.
In the following, an overview of the stream encryption method and the main possible attack methods will be described for the implementation of this encryption system.

(1-1. Stream encryption method)
As the encryption to be used, the above-described stream encryption method, which is a kind of secret key encryption method (common key encryption method), is used. The characteristics are shown below.
-Encrypt and decrypt every 1 bit.
・ In general, speed is more important than robustness.

(1-2. Overview of encryption)
An overview of encryption and decryption of the stream encryption method used in the present embodiment will be described.
(1) Encrypted plaintext XOR random number sequence = ciphertext (3.1)
(2) Decrypted plaintext XOR random number sequence = plaintext (3.2)
Here, the plaintext is unencrypted data, and the plaintext is encrypted data that cannot be read as it is.

(1-3. Main attack methods)
On the other hand, the main methods for attacking stream ciphers include (1) known plaintext attack, (2) selected plaintext attack, and (3) differential attack.
(1) Known plaintext attack An attack method when an attacker is in a position where both plaintext and plaintext can be obtained.
Plain text XOR Secret text = Random number sequence (3.3)
A random number sequence will be acquired by Formula (3.3). If this is repeated, the next random number sequence may be predicted.

(2) Selected plaintext attack An attack method when the attacker is in a position to freely select the contents of plaintext. In equation (3.1), by clearing all the plaintext contents to 0,
0 XOR random number sequence = secret text (3.4)
Random number sequence = secret text (3.5)
Thus, the contents of the random number sequence appear in the secret as it is, and the random number sequence is acquired.

(3) Differential attack An attack method in the case of being in a position where a plurality of sets of plaintext and secrettext can be held.
Plain text 1 XOR random number sequence 1 = cipher text 1 (3.6)
Plaintext 2 XOR random number sequence 2 = ciphertext 2 (3.7)
(Plaintext 1 XOR plaintext 2) XOR (random number sequence 1 XOR random number sequence 2) = (ciphertext 1 XOR secrettext 2) (3 · 8)
At this time, if there is a possibility that the random number sequence 1 and the random number sequence 2 are equal,
Random number sequence 1 XOR Random number sequence 2 = 0 (3.9)
From the equations (3.8) and (3.9),
Plaintext 1 XOR Plaintext 2 = Crypt 1 XOR Cotext 2 (3.10)
It becomes. From equation (3.10), if the same random number sequence is used, it is canceled regardless of the content of the random number sequence.

<4. Mask pattern method>
(4-1. Purpose)
As described above, the low-order bits of the chaos output are excellent in randomness (see Patent Document 2). However, in the present embodiment, in order to further strengthen the countermeasure against the above-described attack in the encryption system, the following description will be given. The “mask pattern method” is proposed. In the present embodiment, the case where the above-described CNN is used as the pseudo-random number generating means for generating pseudo-random numbers will be described as an example, but other pseudo-random number generating means may be used.

(4-2. Overview)
The mask pattern method of the present embodiment refers to a pseudorandom number from a certain pseudorandom number generation means (here, CNN will be described as an example), and from a different system of pseudorandom number generation means (here, CNN will be described as an example). This is a method of generating cryptographically secure pseudo-random numbers by masking with a mask pattern created based on the pseudo-random numbers. The flow of processing of the mask pattern method of this embodiment is shown in FIG.
In the random number generation system of the present embodiment, pseudo random numbers for use in random number generation are generated by pseudo random number generation means. As described above, in the present embodiment, an example using the inventors' chaos neural network (CNN) is described as an example of the pseudo random number generation means, but other pseudo random number generation means may be used. The mask pattern is generated by mask pattern generation means. A process for generating and outputting a random number used for encryption by masking the pseudo-random number from the pseudo-random number generation means with a mask pattern is performed by the random-number output means.
Hereinafter, the mask pattern method proposed in this embodiment will be described in detail with reference to FIGS. 2 (a) and 2 (b).

(4-3. Generation of pseudo-random numbers)
As shown in FIG. 2A, the mask pattern method uses pseudo random numbers (222a, 222b, 222c, 222d,. 1 210) is masked by the mask pattern 214 created based on the pseudo-random number 212 generated from step 210), and is more robust.
These pseudo random numbers are generated by a pseudo random number generating means. Here, an example using the inventors' CNN as the pseudo-random number generation means will be described, but other pseudo-random number generation means may be used.
An example of outputting pseudo random numbers from CNN is shown in FIG. As shown in FIG. 2B, for example, a register 240 capable of storing a double type variable is prepared, and an output generated in time series is extracted from the neurons constituting the CNN as shown in FIG. Stored in 240. Next, the lower x bits of the mantissa part are extracted from the register 240. The extracted bit string is a random number. This random number may be extracted from any neuron (N ₁ 121 to N ₄ 124 in FIG. 1B) as long as it is a neuron constituting the CNN. In addition, even when the number representation is other than the IEEE 754 format, this method can be applied when the floating point or fixed point representation is used. (For details, see Patent Document 2). In the present embodiment, the lower 24 bits of the mantissa are extracted from the register 240 because the lower 24 bits are highly random.

(4-4. Generation of Mask Pattern)
Next, a method for generating the mask pattern 214 used in the present embodiment will be described with an example.
The mask pattern 214 is generated by the mask pattern generation means of the random number generation system of this embodiment. Note that the mask pattern generation method described here is an example, and may be generated by other methods.
The mask pattern 214 used in the present embodiment has a length of 24 bits. Here, as an example, a case where 0 and 1 are the same number (0 is 12 bits, 1 is 12 bits) and the mask pattern is configured is shown. In the mask pattern method of the present embodiment, 0 and 1 do not necessarily have to be the same number, but when 0 and 1 are the same number, the number of mask pattern combinations is maximized and the robustness is maximized. is there. Eight mask patterns are generated and 192 bits are used as one set.
A random number sequence (230a, 230b, 230c, 230d,...) Obtained as a result of masking pseudo-random numbers (222a, 222b, 222c, 222d,...) From CNN-2 220 with this set of mask patterns is encrypted. Used as a random number sequence for
Here, the number of possible combinations of 24-bit mask patterns is ₂₄ C ₁₂ ≈10 ⁶ . Considering a set of mask patterns (192 bits), the number of possible mask patterns is ₁₀₆ P ₈ ≈10 ⁴⁸ .

  As described above, in the present embodiment, a 24-bit mask pattern is created so that the number of 0s and 1s is the same, and eight of them are generated to form one set (192 bits) mask pattern. Here, in order to make the number of 0s and 1s equal, for example, a pair of bits is sequentially determined within 24 bits, and 0 is put in one and 1 is put in the other. Hereinafter, as an example of mask pattern generation, a method for determining a pair of bits and determining which of the paired bits is 0 and which is 1 using the pseudo random number 212 generated from CNN-1 210. explain. Note that the mask pattern generation method is not limited to this, and other methods may be used. Further, as described above, 0 and 1 may not be the same number.

(1) Determination of Bits to be Paired In the example of the present embodiment, a 24-bit pseudo random number 212 is generated from CNN-1 210, and pairs are sequentially determined one by one using the value of the pseudo random number. In order to generate a 24-bit mask pattern, 12 pairs are determined.
In generating a 24-bit mask pattern, a pseudo random number x _n from the CNN-1 210 (n = 1, 2,..., 12 in the case of 24 bits) is used to indicate the number y _n ( The processing for determining n = 1, 2,..., 12) in the case of 24 bits is expressed by the following equation (4).

なお、式（４）において［ａ］はガウス記号であり、実数ａを超えない最大の整数であることを示している。

In equation (4), [a] is a Gaussian symbol, indicating that it is the maximum integer that does not exceed the real number a.

Hereinafter, an example of processing for determining a pair of bits will be described with reference to Expression (4).
First, a bit to be paired with the first bit of the 24-bit mask pattern is determined (determination of the first pair). Using the 24-bit pseudo random number x ₁ from CNN-1 210, the bit paired with the first bit is determined.
Specifically, the number that can be represented by 24bit (i.e., 2 ²⁴ numbers from 0 to 2 ^{24 -1),} and is still to have not the number of bits (here the determination of the mask pattern excluding the first bit The number is divided by a number 23) and divided into groups of the number of bits (23 in this case), and group_1, group_2,... On the other hand, bits that have not yet been determined (here, 23 bits excluding the first bit) are sequentially referred to as bit_1, bit_2,.
Next, find the group _y ₁ that contains the value of the pseudo-random number _{x 1} of 24bit. Then, the bit _y ₁ is y ₁ th bit to determine the bits to 1 bit pair.

Similarly, in the second and subsequent sets, the first bit is selected from the bits that have not yet been determined from the mask pattern (24-2 (n-1) bits remain in the n set), and the bits that are paired with this bit To decide. The next pseudo random number x _n is generated from CNN-1 210, and the number of bits that can be expressed in 24 bits is determined as in the first set as described above (the number n of the nth set is 23-2 (n− 1)) and divided into groups, and a pair of bits is determined depending on which group the pseudo-random number _xn is included in.
The above process is repeated until all pairs are determined. Since the last (12th) pair is the remaining 2 bits, it is not necessary to perform the pair determination process, and only the bit value determination (determination of 0 or 1) to be described next needs to be performed. .

(2) determine n-th group of bits paired values (the case of 24bit n = 1, 2, ..., 12) If the bits are determined pair, the least significant bit of the pseudo-random number _{x n,} n sets Determine which of the bits in the eye is 0 and which is 1. In the present embodiment, for example, when the least significant bit of the pseudo random number _xn is 0, the first bit (the first bit that has not yet been determined) is set to 0, and the bit determined to be a pair is set to 1. . Conversely, when the least significant bit of the pseudorandom number _xn is 1, the previous bit is set to 1, and the bit determined as a pair is set to 0. Decide like this.
One mask pattern is generated by the processes (1) and (2).
Further, the processing up to this point is repeated a total of 8 times to obtain a set of 192-bit mask patterns. The number of bits of the mask pattern may be other than 24 bits, and the number of mask patterns in one set may be other than 8.

(4-5. Generation of random number sequence used for encryption)
Next, a method for generating a pseudo-random number used for encryption using the mask pattern set 214 generated above will be described. This random number is generated and output by the random number output means of the random number generation system of this embodiment.
A CNN (CNN-2 220) of a system different from the CNN-1 210 used when generating the mask pattern 214 is used, and eight 24-bit pseudorandom numbers (222a, 222b, 222c, 222d,...) Are extracted. This is masked by one set (eight) mask patterns 214 generated as described above. In the present embodiment, for example, bits with a mask of 0 are discarded, and only bits with a mask of 1 are taken out. As a result, the output (230a, 230b, 230c, 230d,...) Becomes one set 96 bits (= 12 bits × 8). This is used as a random number sequence for encryption.
Here, the number of mask patterns to be combined does not necessarily have to be eight as described above, so if i bits of 24 bits are used, a mask pattern of 24i bits is obtained, and the number of possible combinations is 10 6i. Become a square. That is, the number of random number sequences that can be generated is 10 6i.
Thus, for example, if i = 100, the number can be increased to 10 600, and if i = 1000, the number can be increased to 10 6000.

(4-6. Encryption system using mask pattern method)
As described above in (1-2. Overview of Encryption), the encryption and decryption methods using the stream encryption method are as follows.
(1) Encrypted plaintext XOR random number sequence = ciphertext (3.1)
(2) Decrypted plaintext XOR random number sequence = plaintext (3.2)
Here, the input plaintext is encrypted and decrypted by using the random number sequence obtained by applying the mask pattern of the present embodiment as the random number sequence of the operations (3.1) and (3.2). be able to.

(4-7. Effect of mask pattern method)
By using the mask pattern method of this embodiment, the number of encryption keys that can be generated can be increased as necessary (encryption key space expansion), and a safe stream encryption method can be realized. For example, when the above mask pattern method is applied to CNN (see Non-patent Document 1, Patent Document 1, and Patent Document 2), which is the existing technology of the inventors, the encryption key space is improved to ¹⁰⁴⁸ times as a standard. We were able to. Thus the time required for decryption may be extended to more than 10 ²⁹ years. Originally, the encryption method according to the existing technology of the inventors is faster and more robust than Rijndael, which is the next generation standard encryption in the United States. However, according to the method of this embodiment, this can be further strengthened. In addition, the encryption system such as DES which is the current US standard is a code that can be decrypted in tens of hours, whereas the use of this technology is advantageous in that it can construct a cryptographic system that cannot be theoretically decrypted. is there.

(A) CNN neuron model. (B) It is a model figure of the chaos neural network (C-4nn) comprised from four neurons. (A) It is a figure which shows the flow of a process of the mask pattern method of this embodiment. (B) It is a figure which shows the process which takes out a pseudorandom number from a CNN output.

Claims (6)

A random number generation system for generating random numbers,
Two pseudo-random number generating means for outputting pseudo-random numbers;
Mask pattern generating means for generating a mask pattern using the pseudo random number output from one of the pseudo random number generating means;
And a random number output unit that outputs a result of masking the mask pattern on the pseudo-random number output from the other pseudo-random number generator. The random number generation system according to claim 1,
The mask pattern has the same number of 0s and 1s. The random number generation system according to claim 1 or 2,
The pseudorandom number generating means is a chaotic neural network, and the pseudorandom number is a lower bit of an output from the chaotic neural network. The random number generation system according to any one of claims 1 to 3,
An encryption system comprising: encryption means for computing an input plaintext and a random number from the random number output means and outputting an encrypted text. The program which makes a computer system construct | assemble the function of the random number generation system in any one of Claims 1-3. The program which makes a computer system build the function of the encryption system of Claim 4.

Images