JP6678926B2 - Random number generation device, random number generation method, and random number generation program - Google Patents

Description

  The present invention relates to a random number generation device, a random number generation method, and a random number generation program that generate random numbers that follow a discrete Gaussian distribution.

として、整数の集合に属する整数値uを確率

で出力した分布を、分散値がsの離散ガウス分布と呼ぶ。ここで、πは円周率を表し、expは自然対数の底を表す。 First, the discrete Gaussian distribution is defined. A function determined by the real value s belonging to the set of real numbers

Where the probability u is an integer value u belonging to the set of

The distribution output by is called a discrete Gaussian distribution with variance s. Here, π represents the pi and exp represents the base of the natural logarithm.

  Random numbers generated according to this discrete Gaussian distribution are used for lattice cryptography (see Non-Patent Document 1, for example). Lattice cryptography is a cryptographic system that is expected as quantum resistant cryptography, and is being studied as a cryptographic scheme with high computational efficiency and high functionality.

として

を離散ガウス分布の出力範囲とする。分布が出力する整数の範囲をこのように制限しても、格子暗号の安全性に影響を与えないことが知られている。 The discrete Gaussian distribution is a probability distribution that can take all integer values. When a discrete Gaussian distribution is used as a lattice cipher, the random variable range can be efficiently generated by limiting the range of integer values output by the distribution in a form that depends on the security parameter n, which belongs to the set of natural numbers, as follows. It often turns into. That is,

As

Let be the output range of the discrete Gaussian distribution. It is known that limiting the range of integers output by the distribution does not affect the security of lattice cryptography.

と定義するとき、分布が出力する整数の範囲を上述のように制限した離散ガウス分布は、

とおき、このΨ(x)を用いて、整数の集合に属する整数値uを確率Ψ(u)で出力する。 Normalization constant W

, The discrete Gaussian distribution that limits the range of integers output by the distribution as described above is

Then, using this Ψ (x), the integer value u belonging to the set of integers is output with probability Ψ (u).

であり、整数の集合に属する整数値uを確率Ψ(u)で出力する確率分布を指すものとする。 Therefore, in this specification, the range of integers output by the distribution is referred to as “discrete Gaussian distribution” below.

And the probability distribution that outputs the integer value u belonging to the set of integers with probability ψ (u).

を、「離散ガウス分布を定める函数」と呼ぶことにする。 Also, the function

Will be called a "function that determines the discrete Gaussian distribution".

とする。 As a random number generation method according to the discrete Gaussian distribution, two methods are known: a cumulative method and a rejection sampling method. Here, the function that determines the discrete Gaussian distribution is φ (x), and the generation range of the distribution is

And

  First, the cumulative method will be described based on the description in Non-Patent Document 2. As shown in FIG. 7, the random number generation device 200 according to the first related technique disclosed in Non-Patent Document 2 that follows the discrete Gaussian distribution is a storage device 210, a searcher 220, and a uniform random number generation device 230. It consists of and.

  The random number generation device 200 according to the discrete Gaussian distribution of the first related technique having such a configuration operates as follows.

を事前計算し、記憶装置２１０に記憶しておく。次に、一様乱数生成器２３０が実数値x∈［0,1］を出力する。一様乱数生成器２３０から出力された、実数の集合に属する実数値xは、探索器２２０に送られる。 First, the random number generation device 200

Is calculated in advance and stored in the storage device 210. Next, the uniform random number generator 230 outputs a real value xε [0,1]. The real number x belonging to the set of real numbers output from the uniform random number generator 230 is sent to the searcher 220.

を出力する。
以上が累積法による離散ガウス分布に従う乱数生成方法である。 The searcher 220 searches the values stored in the storage device 210 for an integer value z, which belongs to a set of integers, φ (z-1) ≦ x ≦ φ (z), and divides the sign sign = ± by one. And belong to a set of integers

Is output.
The above is the random number generation method according to the discrete Gaussian distribution by the cumulative method.

の数がtσに比例する。よって、累積法は、メモリ量が制限された装置上で、分散値σの大きい離散ガウス分布を生成することができないという問題がある。分散σは既存の格子暗号では大きな値になっている。具体的なメモリ量は、たとえば、非特許文献３では、下記の表１のようになっている。 Data stored in the storage device 210 in the cumulative method

The number of is proportional to tσ. Therefore, the cumulative method has a problem in that it is not possible to generate a discrete Gaussian distribution with a large variance value σ on a device with a limited amount of memory. The variance σ has a large value in the existing lattice cryptography. In the non-patent document 3, for example, the specific memory amount is as shown in Table 1 below.

  Lattice cryptography is also expected to be used in devices with small computing resources and storage capacity, such as sensor devices and mobile phones, because well-known cryptographic methods such as the RSA (Rivest-Shamir-Adleman) method have a small amount of calculation. ing. However, when the cumulative method is used to generate the discrete Gaussian distribution, which is a subroutine of lattice cryptography, a large storage capacity is used to store the data required by the cumulative method. Therefore, the lattice cipher cannot be used in such a device.

  Next, the rejection sampling method will be described. The rejection sampling method is applicable not only to the discrete Gaussian distribution but also to the generation of random numbers according to any discrete probability distribution. Therefore, first, a rejection sampling method for a random variable X according to a general discrete type probability distribution will be described according to Non-Patent Document 4. After that, the reject sampling method for generating random numbers according to the discrete Gaussian distribution will be described.

To generate random numbers that follow the discrete probability distribution p (X = x _i ) using the reject sampling method, do the following.

First, for all x _i , prepare a function t (x) satisfying t (x _i ) ≧ p (x _i ) that can efficiently calculate the function t (x), and normalize it. Let r (x) = t (x) / Σt (x _i ) performed.

By the following procedure, the random sampling rejection method according to the discrete distribution p (X = x _i ) (probability distribution function) for the random variable X is performed.
(Step 1) Generate a random number Y with probability distribution function r.
(Step 2) Generate a uniform random number U in the interval [0,1] independently of Y.
(Step 3) When U ≦ p (Y) / t (Y) is satisfied, X = Y is set as a random number. If not satisfied, return to (Step 1).

  Next, a method of generating random numbers according to the discrete Gaussian distribution will be described based on Non-Patent Document 5. In addition, in order to compare the method disclosed in Non-Patent Document 5 with that of the present invention described later, a device configuration for realizing the method disclosed in Non-Patent Document 5 will be additionally described.

  In Non-Patent Document 5, the above rejection sampling method is applied to the case where the function t (x) is identity 1.

  As shown in FIG. 8, a random number generation device 300 according to the second related technique disclosed in Non-Patent Document 5 that follows the discrete Gaussian distribution includes a rejection determination unit 310, a random number generation unit 320, and an output unit 330. Consists of. The random number generation device 300 according to the discrete Gaussian distribution of the second related technology having such a configuration operates as follows.

の範囲で、整数の集合に属する一様乱数u₁（整数値）を生成する。次に、乱数生成器３２０は、［0,φ(0)］の範囲で、実数の集合に属する実数値乱数u₂を生成する。 That is, the random number generator 320 belongs to a set of integers.

Generates a uniform random number u ₁ (integer value) belonging to the set of integers in the range. Next, the random number generator 320 generates a real number random number u ₂ belonging to the set of real numbers in the range of [0, φ (0)].

Next, the uniform random number u ₁ belonging to the set of integers and the real number random number u ₂ belonging to the set of real numbers are input to the rejection decision unit 310. Rejection determiner 310 compares φ (u ₁ ) with u ₂ belonging to the set of real numbers, and outputs u ₁ belonging to the set of integers if u ₂ ≦ φ (u ₁ ).

  Otherwise, the random number generation device 300 returns to the first step and repeats the same operation.

  The above is the random number generation method according to the discrete Gaussian distribution by the rejection sample method. The problem with this rejected sampling method is that the Gaussian distribution function has to be calculated each time it is rejected, so the calculation efficiency becomes poor.

  Further, prior art documents (patent documents) related to the present invention are also known.

  For example, Patent Document 1 discloses a correlation random number generation device that generates a correlation random number used in a secret key sharing cryptosystem. The correlated random number generating device disclosed in Patent Document 1 includes a driving irregular signal generating unit, a driving irregular signal transmitting unit, a first random number generating unit, and a second random number generating unit. The first random number generation unit includes an irregular signal generation unit for random numbers, a parameter value generation unit, and a quantization unit. The second random number generator also includes an irregular signal generator for random numbers, a parameter value generator, and a quantizer. The quantizer quantizes the random signal for random number and outputs a discretized random number.

  Patent Document 2 discloses a loss distribution calculation system that guarantees the accuracy of the obtained calculation result. The cumulative distribution function of the specified frequency distribution will be written as Pf (·). Also, the probability function (probability mass function) of Pf (•) will be written as pf (•). The cumulative distribution function of the specified scale distribution is written as Ps (·). If Ps (·) is a discrete distribution, its probability function (probability mass function) is ps (·), and if Ps is a continuous distribution, its probability density function is Ps (·). The loss distribution calculation system includes frequency distribution accumulating means, scale distribution accumulating means, scale distribution discretizing means, and discretized scale distribution accumulating means. The input frequency distribution information is stored in the frequency distribution storage means. The size distribution discretization means performs an upper discretization, a lower discretization, or both on the size distribution Ps (•) stored in the size distribution storage means, and an upper discretized scale distribution Us (•). ), Or the lower discretized scale distribution Ds (·), or both of them, and accumulates them in the discretized scale distribution accumulating means.

JP, 2008-070636, A International Publication No. 2011/037169

Regev “On lattices, learning with errors, random linear codes, and cryptography”, STOC 2005, ACM (2005), 84-93 Chris Peikert “An efficient and parallel Gaussian Sampler for lattices.”, CRYPTO, 2010, pages 80-97 DWARAKANATH, GALBRAITH “Sampling From Discrete Gaussians for Lattice-Based Cryptography on a Constrained Device” Tetsuaki Shitsuji “Probability Distribution Random Number Generation Method for Computer Simulation” Page 92-93 Craig Gentry, Chris Peikert, Vinod Vaikuntanathan “How to Use a Short Basis: Trapdoors for Hard Lattices and New Cryptographic Constructions”, STOC, 2008, pages 197-206

  As described above, the random number generation method according to the discrete Gaussian distribution includes the cumulative method and the reject sample method, and the respective problems will be described in order below.

をすべて記憶することができないからである。 The problem with the accumulation method is that it is inefficient to generate random numbers that follow a discrete Gaussian distribution with a large variance on a device with a limited storage area. The reason is that the value that should be stored in the storage area in a device with a limited storage area.

Because it cannot remember all.

  A problem with the rejected sampling method is that the generation rate of random numbers that follow the discrete Gaussian distribution is slow. The reason is that the Gaussian distribution function has to be calculated each time it is rejected, and the calculation efficiency becomes poor.

  Note that Patent Document 1 merely discloses a device that generates a random number according to a given probability distribution.

  Patent Document 2 merely discloses a technical idea of generating an upper discretized scale distribution, a lower discretized scale distribution, or both with respect to the scale distribution.

  An object of the present invention is to provide a random number generation device, a random number generation method, and a random number generation program that solve any of the problems described above.

  A random number generation device of the present invention is a random number generation device that generates random numbers according to a given probability distribution, and a random number generator that generates random number data; and a cumulative distribution function of the probability distribution above and below, respectively. One of the upper approximation function and the lower approximation function of the sandwiched form is possessed as the first approximation function, and the first rounding value obtained by taking the integer rounding by applying the inverse function of the first approximation function to the random number data A candidate calculator that calculates and outputs the first rounded value as output candidate data; owns the other of the upper approximation function and the lower approximation function as a second approximation function, receives the output candidate data, and outputs the random number. The inverse function of the second approximation function is applied to the data, a second rounding value obtained by taking integer rounding is calculated, it is determined whether the second rounding value is equal to the output candidate data, and the Rounding value When equal to said output candidate data, the first evaluation portion outputs the output candidate data as said random number; characterized in that it comprises a.

  The random number generation method of the present invention is a random number generation method for generating random numbers according to a given probability distribution, in which a random number generator generates random number data; a candidate calculation unit calculates a cumulative distribution function of the probability distribution. One of the upper approximation function and the lower approximation function sandwiched between the upper side and the lower side, respectively, is possessed as the first approximation function, and the inverse function of the first approximation function is applied to the random number data to obtain an integer rounding. A first rounding value to be calculated and output the first rounding value as output candidate data; the first evaluation unit owns the other of the upper approximation function and the lower approximation function as a second approximation function, and The output candidate data is received, the inverse function of the second approximation function is applied to the random number data, the second rounding value obtained by taking the integer rounding is calculated, and whether the second rounding value is equal to the output candidate data. Determine whether or not When serial second rounding value is equal to the output candidate data, and outputs the output candidate data as said random number, characterized in that.

  The random number generation program of the present invention possesses a computer, as a first approximation function, one of an upper approximation function and a lower approximation function that sandwich a cumulative distribution function of a probability distribution between the upper side and the lower side, respectively. A candidate calculation means for applying an inverse function of the first approximate function to the generated random number data to calculate a first rounded value obtained by rounding the integer, and outputting the first rounded value as output candidate data; and Owning the other of the upper approximation function and the lower approximation function as a second approximation function, receiving the output candidate data, applying the inverse function of the second approximation function to the random number data, and obtaining an integer rounding. The second rounded value is calculated, it is determined whether the second rounded value is equal to the output candidate data, when the second rounded value is equal to the output candidate data, the output candidate data, First evaluation means for outputting as a random number in accordance with the serial probability distribution; function as.

  According to the present invention, it is possible to efficiently generate random numbers that follow a discrete Gaussian distribution with a large variance even on a device with a limited storage area.

It is a block diagram which shows the structure of the random number generation apparatus which concerns on the 1st Embodiment of this invention. 3 is a block diagram showing a configuration of a candidate calculation unit used in the random number generation device shown in FIG. 1. FIG. FIG. 3 is a block diagram showing a configuration of a first evaluation unit used in the random number generation device shown in FIG. 1. It is a figure which shows the structure of the 2nd evaluation part used for the random number generation apparatus shown in FIG. 3 is a flowchart showing an operation of the random number generation device according to the first exemplary embodiment. It is a flowchart which shows operation | movement of the 2nd evaluation part of the random number generation apparatus which concerns on the 2nd implementation revision of this invention. It is a block diagram which shows the structure of the random number generation device which follows the discrete Gaussian distribution which concerns on a 1st related technique. It is a block diagram which shows the structure of the random number generator which follows the discrete Gaussian distribution which concerns on 2nd related technology.

[Problem solving method of the present invention]
The present invention is a random number generation device, a random number generation method, and a random number generation program for generating random numbers according to a discrete Gaussian distribution on a restricted device used for lattice cryptography and signature.

First, in order to facilitate understanding of the present invention, it will be described that random numbers according to a discrete Gaussian distribution can be generated as follows by using a cumulative distribution function for the discrete Gaussian distribution.
(Step 1) Take a real-valued uniform random number u ∈ [0,1].
(Step2) The real-valued uniform random number u is subjected to the inverse function of the cumulative distribution function of the discrete Gaussian distribution, and the integer rounding is performed.
(Step3) Select the sign (±) uniformly, attach it to the value obtained in (Step2), and output it.

の逆函数を効率的に計算するのは困難であるので、上述した方法をそのまま用いる事はできない。 By the method described above, it is possible in principle to generate random numbers that follow a discrete Gaussian distribution. However, the cumulative distribution function of the discrete Gaussian distribution

Since it is difficult to efficiently calculate the inverse function of, the above method cannot be used as it is.

の逆函数を効率的に求める一手法として、整数の集合に属する定義域

の値を記憶領域に保存し、これらを用いて函数Ψの逆函数を求める、というものがある。この方法を用いれば、φ(k)を求めるのに必要な計算時間が省略できるので、函数Ψの逆函数を効率的に求めることができる。 So the function

As a method for efficiently finding the inverse function of, the domain belonging to the set of integers

There is a method in which the value of is stored in a storage area and the inverse function of the function Ψ is obtained using these. By using this method, the calculation time required to obtain φ (k) can be omitted, so that the inverse function of the function Ψ can be efficiently obtained.

  However, to use this method, all values of φ (k) must be stored in the storage area. Since the object of the present invention is to generate a random number according to a discrete Gaussian distribution with a large variance even on a device with a limited storage area, this method does not solve the problem.

Therefore, in the present invention, based on the following idea, the inverse function Ψ ⁻¹ (u) of the function Ψ can efficiently generate random numbers that follow a discrete Gaussian distribution with a large variance value, without consuming much storage space. Realize a possible sampling method. Here, the superscript -1 or {-1} means an inverse function.

[Characteristics of A and C]
First, the cumulative distribution function Ψ (x) for the discrete Gaussian distribution is sandwiched above and below. That is, as the real-valued functions A (x) and C (x) having the real number x in the domain, ones satisfying the following properties 1 to 4 are selected:
Property 1. For all non-negative real numbers x, A (x) ≧ Ψ (x) ≧ C (x)
Property 2. What is the integer rounding value of the inverse function A ^-1 (y) of the real-valued function A (y) for y and the integer rounding value of the inverse function C ^-1 (y) of the real-valued function C (y) for y , Many y match. (From Property 1, for these y, the integer rounding value of the inverse function Ψ ⁻¹ (y) also matches the integer rounding value of the inverse function A ⁻¹ (y).)
Property 3. The inverse function of A can be calculated efficiently.
Property 4. One of the following properties is met:
i. The inverse function of C can be calculated efficiently.
ii. C can be calculated efficiently.

  Hereinafter, the functions A (x) and C (x) will be referred to as the upper approximation function and the lower approximation function, respectively.

  In the present invention, the above-mentioned Steps 1, 2, and 3 are improved as follows by using these functions.

  First, in (Step 1), a real-valued uniform random number u ∈ [0, (1/2)] is taken as described above.

Next, in Step 2, instead of directly calculating the inverse function Ψ ⁻¹ (u) of the function Ψ, the inverse function A ⁻¹ (u) of the function A is calculated. Due to Property 1, the inverse function A ⁻¹ (u) can be calculated efficiently, and due to Property 2, for many u, the value of the integer rounding of the inverse function A ⁻¹ (u) is the inverse function Ψ ⁻¹ ( equals the integer rounded value of u).

This means that in the present invention, the integer rounding of the inverse function Ψ ⁻¹ (u) of the function Ψ can be efficiently calculated for many u.

As a sufficient condition for confirming that A ⁻¹ (u) = Ψ ⁻¹ (u) is actually established for the random number u obtained in (Step 1), in the present invention, the inverse function A ⁻¹ ( Confirm that the integer rounding value of u) and the integer rounding value of the inverse function C ⁻¹ (u) match.

From Property 1, if they match, the value of the integer rounding of the inverse function A ⁻¹ (u) is equal to the value of the integer rounding of the inverse function Ψ ⁻¹ (u), so the inverse function A ⁻¹ (u The value obtained by adding the sign of (Step 3) to () is used as the output value.

Here, the value of the integer rounding of the inverse function A ⁻¹ (u) (first rounding value) and the value of the integer rounding of the inverse function C ⁻¹ (u) (second rounding value) match. There are two ways to confirm.

The first method computes the inverse function C ⁻¹ (u) of the function C, and calculates the integer rounding value (first rounding value) of the inverse function A ⁻¹ (u) and the inverse function C ⁻¹ (u). It directly compares the integer rounded value (second rounded value). Since this method involves calculation of the inverse function C ⁻¹ (u), the property 4. This is a method that can be executed efficiently when i holds.

から分かる。 The second method computes C (i- (1/2)) when u is the integer rounding value (first rounding value) of the inverse function A ^{-1} (u), and u Compared with, if C (i- (1/2)) ≤ u, then the integer rounding values of the inverse function A ^{-1} and the inverse function C ^{-1} are the same. From (i- (1/2)) ≤ C ^{-1} (u),

I understand from.

  Since this method involves calculation of the function C (u), the property 4. This is a method that can be efficiently executed when ii holds.

In addition, the integer rounding value of the inverse function A ⁻¹ (u) of the function A (first rounding value) and the integer rounding value of the inverse function C ⁻¹ (u) of the function C (second rounding value) are the same. In the case where this is not done, in the present invention, the inverse function Ψ ⁻¹ (u) of the function Ψ is directly obtained, and the value with the sign of (Step 3) is taken as the output value.

Here, since the calculation of Ψ ⁻¹ (u) of the function Ψ is not efficient, the calculation time is required in this case. However, due to the nature 2, this case rarely occurs in the first place, and therefore the expected value of the calculation time required by the present invention can be small.

  Specific forms of the upper approximation function A (x) and the lower approximation function C (x) will be described in [Embodiment of the Invention] below.

The upper approximation function A (x) may be obtained by any method, for example, by performing Taylor expansion of the upper approximation function A (x) and calculating up to sufficient terms to obtain the necessary significant figures. I can do things. The same applies to the lower approximation function C (x), the inverse function A ⁻¹ (u), and the inverse function C ⁻¹ (u).

  In the present invention, the data needed to compute the upper approximation function A (x) and the lower approximation function C (x) (or its inverse) are the coefficients of the first few terms of the Taylor expansion of these functions. ) Only should be saved in the storage area. Therefore, according to the present invention, it is possible to efficiently generate random numbers according to the discrete Gaussian distribution on a device with a small storage capacity.

In the above, the present invention is realized by using the functions A and C that satisfy the properties 1 to 4, but instead of the properties 3 and 4, the functions A and C that satisfy the following properties 5 and 6 are used. Can realize the present invention.
Property 5. The inverse function of C can be calculated efficiently.
Property 6. One of the following properties is met:
i. The inverse function of A can be calculated efficiently.
ii. A can be calculated efficiently.

  Property 5 and property 6 are obtained by replacing A and C in property 3 and property 4. Therefore, if A and C are interchanged in the above-described idea of the present invention, the present invention can be applied to A and C satisfying the properties 5 and 6.

  As described above, the object of the present invention can be achieved. A specific method will be described in the embodiments described later.

  Next, the effect of the present invention will be described.

  The first effect is that random numbers that follow a discrete Gaussian distribution can be generated even on a device with limited memory capacity, that is, storage capacity.

の値を100bitで記憶する。 In the cumulative method

The value of is stored in 100 bits.

  In the reject sampling method, the coefficients in the polynomial approximation formula of Gaussian function are stored.

  On the other hand, in the present invention, the coefficient in the polynomial approximation formula of the Gaussian function, the inverse function of the upper approximation function, and the coefficient in the polynomial approximation formula of the inverse function of the lower approximation function are stored.

  Therefore, according to the present invention, it is possible to generate a discrete Gaussian distribution having a large variance even on a device with a limited amount of memory. Therefore, by using the present invention with a lattice cryptographic subroutine, it is expected to be used in a device such as a sensor device or a mobile phone having a small computational resource or storage capacity.

  The second effect is that the calculation efficiency can be improved.

  The cumulative method requires a binary search calculation amount for one output value.

を必要とする。 In the rejection sampling method, for one output value,

Need.

  On the other hand, according to the present invention, since the calculation of the inverse function of the upper approximation function is + (the calculation of the inverse function of the lower approximation function) with high probability, a random number can be efficiently generated for one output value. Can be expected to generate.

[Embodiment of the invention]
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In addition, the same elements may be denoted by the same reference numerals, and redundant description may be omitted.

[First Embodiment]
[Description of configuration]
Referring to FIG. 1, a random number generation device according to a first exemplary embodiment of the present invention includes a computer (central processing unit; processor; data processing device) 90 that operates under program control, and a uniform random number within a range of [0.1]. The uniform random number generation unit 100 which is generated in 1. and the output device 140 are provided.

  The computer 90 includes a candidate calculation unit 110, a first evaluation unit 120, and a second evaluation unit 130. The output device 140 includes a code determination unit 141.

here,

  As shown in FIG. 2, the candidate calculation unit 110 includes a random number input unit 111 and an upper approximation inverse function calculation unit 112.

  As shown in FIG. 3, the first evaluation unit 120 includes a candidate data input unit 121 and a lower approximate inverse function calculation unit 122.

  As shown in FIG. 4, the second evaluation unit 130 includes a rejection determination unit 131 and a random number generation unit 132.

  The operation of the random number generation device shown in FIG. 1 will be described with reference to FIG.

  The uniform random number generation unit 100 outputs random number data uε [0, (1/2)] (step S501).

  Next, the random number data u belonging to the set of real numbers output by the uniform random number generation unit 100 is sent to the random number input unit 111 of the candidate calculation unit 110.

  In the operation of the candidate calculation unit 110 and the first evaluation unit 120 described below, consider the following two functions. One function is a function that is truly larger than the cumulative distribution function of the discrete Gaussian distribution (hereinafter referred to as "upper approximation function", referred to as A (x)). The other function is a function that is truly smaller than the cumulative distribution function (hereinafter referred to as "lower approximation function", referred to as C (x)).

を考え、下側近似函数として

を考える。 For example, as an upper approximation function

As a lower approximation function

think of.

  In the following description, it is assumed that the candidate calculation unit 110 includes the upper approximation function and the first evaluation unit 120 includes the lower approximation function. However, the candidate calculation unit 110 may include the lower approximation function and the first evaluation unit 120 may include the upper approximation function.

The upper approximation inverse function calculation unit 112 of the candidate calculation unit 110 has an upper approximation function. The upper approximation inverse function calculation unit 112 finally calculates the inverse function A ^{-1} (u) of the upper approximation function A (u) for the random number data u received from the random number input unit 111. Two [A ^{-1} (u)] and [A ^{-1} (u)]-1 are output as the output candidate data 113 of the integer value (first rounded value) to be output (step S502).

  The output candidate data 113 is sent to the first evaluation unit 120.

The lower approximation inverse function calculation unit 122 of the first evaluation unit 120 rounds the inverse function C ^{-1} (u) of the lower approximation function C (x) to the random number data u (second value). Rounding value) [C ^{-1} (u)], then determine whether the integer values [C ^{-1} (u)] and [A ^{-1} (u)] are equal Yes (step S503).

Here, there are two types of determination methods of [A ^{-1} (u)] = [C ^{-1} (u)].
The first method is to calculate [A ^{-1} (u)] and [C ^{-1} (u)] and check the agreement.
The second method compares the magnitude relation between u and C ([A ^{-1} (u)]-(1/2)), and u ≥ C ([A ^{-1} (u)] If (-1/2)), it can be determined that [C ^{-1} (u)] = [A ^{-1} (u)], and if not, it is a method of determining that the values are different.

  Which of these two methods is selected depends on how to select the upper approximation function A (x) and the lower approximation function C (x) (see the above [property of A, C]).

In this determination, if the integer values [C ^{-1} (u)] and [A ^{-1} (u)] are equal, the first evaluation unit 120 determines that the integer value [A ^{-1} (u) )] = [C ^{−1} (u)] is transmitted to the output device 140.

The code determination unit 141 of the output device 140 determines the code ±, outputs a code by adding a code to [A ^{-1} (u)] = [C ^{-1} (u)] (step S504).

If the values are different, the first evaluation unit 120 transmits the integer value [A ^{-1} (u)] to the second evaluation unit 130.

を比較し、

a-1を出力し、そうでなければaを出力装置１４０へ送信する（ステップＳ５０５）。 The rejection determination unit 131 of the second evaluation unit 130, when a = [A ^{-1} (u)],

Compare

a-1 is output, and otherwise a is transmitted to the output device 140 (step S505).

  The output device 140 transmits the sent data to the code determination unit 141. The code determination unit 141 attaches a code (±) to the data sent by the output device 140 and outputs the data (step S506).

[Description of Effect of First Embodiment]
Next, the effect of the first embodiment will be described.

  In the first embodiment, first, the output candidates are efficiently generated, and the first evaluation unit 120 efficiently and with high probability narrows down to one, so that efficient sampling can be performed. Furthermore, since only the polynomial of the inverse function of the error function needs to be stored, a random number according to the discrete Gaussian distribution can be generated even on a device with a small storage capacity.

[Second Embodiment]
[Description of configuration]
Next, a second embodiment of the present invention will be described in detail with reference to the drawings.

  The random number generation device according to the second embodiment is substantially the same in configuration as the random number generation device according to the first embodiment illustrated in FIGS. 1 to 4, but only the operation of the second evaluation unit 130 is performed. Is different.

[Description of operation]
Next, with reference to FIG. 6, the operation of the second evaluation unit 130 according to the second embodiment will be described.

  The second evaluation unit 130 receives the output candidate data a and performs the rejection sampling method using the function φ (x + 1) and the function φ (x).

First, in step S601, the random number generation unit 132 generates a random number u ₁ (real number) belonging to the set of real numbers in the real number range of 0 to a−1, and further sets {k + ( 1/2)} takes a recent integer value k from the random number u ₁ .

Next, in step S602, the random number generation unit 132 generates a random number u ₂ in the real number range of 0 to φ (0).

であるかを判定する。もし

でない場合は、棄却判定部１３１は、ステップＳ６０１に戻る。もし

であるなら、棄却判定部１３１は、ステップＳ６０４へ進み、

であるか否かを判定する。もし

であるなら、棄却判定部１３１はaを出力し（ステップＳ６０５）、そうでなければ、棄却判定部１３１は、a-1を出力する（ステップＳ６０６）。 Next, in step S603, the rejection determination unit 131 of the second evaluation unit 130

Is determined. if

If not, the rejection determination unit 131 returns to step S601. if

If so, the rejection determination unit 131 proceeds to step S604,

Is determined. if

If it is, the rejection determination unit 131 outputs a (step S605). If not, the rejection determination unit 131 outputs a-1 (step S606).

[Explanation of Effect of Second Embodiment]
Next, the effect of the second embodiment will be described.

  In the second embodiment, the output candidates are first efficiently generated, and the first evaluation unit is efficiently and highly probable, so that the output can be efficiently sampled. Furthermore, since only the polynomial of the inverse function of the error function needs to be stored, it is possible to generate random numbers that follow the discrete Gaussian distribution even on a device with a small storage capacity.

[Explanation of effects of the invention]
Next, the effect of the present invention will be described.

The first effect is that it is possible to generate random numbers that follow a discrete Gaussian distribution even on a device with a limited memory capacity, that is, a storage capacity.
The second effect is that the calculation efficiency can be improved.

  The present invention is not limited to the above embodiments as they are, and can be embodied by modifying the constituent elements within a range not departing from the gist of the invention in an implementation stage. Further, various inventions can be formed by appropriately combining a plurality of constituent elements.

  Each unit of the random number generation device may be realized by using a combination of hardware and software. In a form in which hardware and software are combined, a random number generation program is developed in a RAM (random access memory), and hardware such as a control unit (CPU (central processing unit)) is operated based on the random number generation program. Each part is realized as various means. Further, the random number generation program may be recorded in a recording medium and distributed. The random number generation program recorded in the recording medium is read into the memory via a cable, wireless, or the recording medium itself, and operates the control unit and the like. Incidentally, examples of the recording medium include an optical disk, a magnetic disk, a semiconductor memory device, and a hard disk.

  To describe the above-described embodiment in another way, the computer that operates as the random number generation device is based on the random number generation program loaded in the RAM, and the candidate calculation unit 110, the first evaluation unit 120, and the second evaluation unit 130. Can be realized by operating as.

  Further, the specific configuration of the present invention is not limited to the above-described embodiments, and modifications within the scope of the present invention are included in the present invention.

  Although the present invention has been described with reference to the exemplary embodiments, the present invention is not limited to the above-described exemplary embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

  The whole or part of the exemplary embodiments disclosed above can be described as, but not limited to, the following supplementary notes.

(Supplementary Note 1) A random number generation device for generating random numbers according to a given probability distribution,
A random number generator for generating random number data,
One of the upper approximation function and the lower approximation function sandwiching the cumulative distribution function of the probability distribution on the upper side and the lower side, respectively, is possessed as a first approximation function, and the inverse function of the first approximation function is applied to the random number data. And calculating a first rounded value obtained by taking integer rounding, and outputting the first rounded value as output candidate data,
Owning the other of the upper approximation function and the lower approximation function as a second approximation function, receiving the output candidate data, applying the inverse function of the second approximation function to the random number data, and obtaining an integer rounding. A second rounded value that is calculated to determine whether the second rounded value is equal to the output candidate data, and when the second rounded value is equal to the output candidate data, the output candidate data is the random number. The first evaluation section that outputs as
A random number generation device comprising:

の累積分布函数であることを特徴とする、付記１に記載の乱数生成装置。 (Supplementary Note 2) The cumulative distribution function is a discrete Gaussian distribution with variance s.

The random number generation device according to appendix 1, wherein the random number generation device is a cumulative distribution function of.

であり、
前記下側近似函数は、

であることを特徴とする、付記２に記載の乱数生成装置。 (Supplementary note 3) The upper approximation function is

And
The lower approximation function is

The random number generation device according to appendix 2, wherein

(Supplementary note 4) The supplementary note 4 further includes a second evaluation unit that generates the random number by using a reject sampling method when the second rounded value is not equal to the output candidate data. Random number generator.

(Supplementary note 5) The random number generation device according to Supplementary note 4, wherein the second evaluation unit calculates an integer Gaussian value as the random number.

(Supplementary note 6) A random number generation method for generating a random number according to a given probability distribution,
A random number generator generates random number data,
The candidate calculation unit has one of an upper approximation function and a lower approximation function that sandwiches the cumulative distribution function of the probability distribution on the upper side and the lower side, respectively, as the first approximation function, and the random number data includes the first approximation function. , The first rounding value obtained by taking the integer rounding, and outputting the first rounding value as output candidate data,
The first evaluation unit owns the other of the upper approximation function and the lower approximation function as a second approximation function, receives the output candidate data, and applies an inverse function of the second approximation function to the random number data, Calculating a second rounding value obtained by taking an integer rounding, determining whether the second rounding value is equal to the output candidate data, when the second rounding value is equal to the output candidate data, Output candidate data is output as the random number,
A random number generation method characterized in that.

の累積分布函数であることを特徴とする、付記６に記載の乱数生成方法。 (Supplementary note 7) The cumulative distribution function is a discrete Gaussian distribution with variance s.

7. The random number generation method according to appendix 6, characterized in that the cumulative distribution function of

であり、
前記下側近似函数は、

であることを特徴とする、付記７に記載の乱数生成方法。 (Supplementary Note 8) The upper approximation function is

And
The lower approximation function is

The random number generation method according to appendix 7, characterized in that

(Supplementary note 9) The supplementary statement according to any one of Supplementary notes 6 to 8, wherein when the second rounded value is not equal to the output candidate data, the second evaluation unit generates the random number by using a rejection sampling method. Random number generation method.

(Supplementary note 10) The random number generation method according to supplementary note 9, wherein the second evaluation unit calculates an integer Gaussian value as the random number.

(Appendix 11)
Computer,
One of the upper approximation function and the lower approximation function sandwiching the cumulative distribution function of the probability distribution on the upper side and the lower side, respectively, is owned as the first approximation function, and the first approximation function is added to the random number data generated from the random number generator. Of the first rounded value obtained by taking the integer rounding, and outputting the first rounded value as output candidate data, and the upper approximation function and the lower approximation function of Owning the other as a second approximation function, receiving the output candidate data, applying the inverse function of the second approximation function to the random number data, calculating a second rounding value obtained by taking integer rounding, (1) determining whether a second rounded value is equal to the output candidate data and outputting the output candidate data as a random number according to the probability distribution when the second rounded value is equal to the output candidate data; Evaluation means,
Random number generation program to function as.

の累積分布函数であることを特徴とする、付記１１に記載の乱数生成プログラム。 (Supplementary Note 12) The cumulative distribution function is a discrete Gaussian distribution with a variance value of s.

14. The random number generation program according to attachment 11, which is a cumulative distribution function of

であり、
前記下側近似函数は、

であることを特徴とする、付記１２に記載の乱数生成プログラム。 (Supplementary note 13) The upper approximation function is

And
The lower approximation function is

14. The random number generation program according to attachment 12, wherein:

(Supplementary note 14) Any one of supplementary notes 11 to 13, further causing the computer to function as second evaluation means for generating the random number by using a rejection sampling method when the second rounded value is not equal to the output candidate data. The random number generation program according to item 1.

(Supplementary Note 15) The random number generation program according to Supplementary Note 14, wherein the second evaluation means calculates an integer Gaussian value as the random number.

  INDUSTRIAL APPLICABILITY The present invention can be applied to the application of random number generation according to a discrete Gaussian distribution used for lattice cryptography and signature.

90 computer (central processing unit; processor; data processing unit)
100 uniform random number generation unit 110 candidate calculation unit 111 random number input unit 112 upper approximation inverse function calculation unit 113 candidate data 120 first evaluation unit 121 candidate data input unit 122 lower approximation inverse function calculation unit 130 second evaluation unit 131 rejection judgment Part 132 Random number generator 140 Output device 141 Code determiner

Claims (10)

A random number generation device for generating random numbers according to a given probability distribution,
A random number generator for generating random number data,
One of the upper approximation function and the lower approximation function sandwiching the cumulative distribution function of the probability distribution on the upper side and the lower side, respectively, is possessed as a first approximation function, and the inverse function of the first approximation function is applied to the random number data. And calculating a first rounded value obtained by taking integer rounding, and outputting the first rounded value as output candidate data,
Owning the other of the upper approximation function and the lower approximation function as a second approximation function, receiving the output candidate data, applying the inverse function of the second approximation function to the random number data, and obtaining an integer rounding. A second rounded value that is calculated to determine whether the second rounded value is equal to the output candidate data, and when the second rounded value is equal to the output candidate data, the output candidate data is the random number. The first evaluation section that outputs as
A random number generation device comprising: The cumulative distribution function is a discrete Gaussian distribution with variance s.

The random number generator according to claim 1, wherein the random number generator is a cumulative distribution function of. The upper approximation function is

And
The lower approximation function is

The random number generation device according to claim 2, wherein   The random number generation according to claim 1, further comprising a second evaluation unit that generates the random number by using a rejection sampling method when the second rounded value is not equal to the output candidate data. apparatus.   The random number generation device according to claim 4, wherein the second evaluation unit calculates an integer Gaussian value as the random number. A random number generation method for generating a random number according to a given probability distribution,
A random number generator generates random number data,
The candidate calculation unit has one of an upper approximation function and a lower approximation function that sandwiches the cumulative distribution function of the probability distribution on the upper side and the lower side, respectively, as the first approximation function, and the random number data includes the first approximation function. , The first rounding value obtained by taking the integer rounding, and outputting the first rounding value as output candidate data,
The first evaluation unit owns the other of the upper approximation function and the lower approximation function as a second approximation function, receives the output candidate data, and applies an inverse function of the second approximation function to the random number data, Calculating a second rounding value obtained by taking an integer rounding, determining whether the second rounding value is equal to the output candidate data, when the second rounding value is equal to the output candidate data, Output candidate data is output as the random number,
A random number generation method characterized in that. The cumulative distribution function is a discrete Gaussian distribution with variance s.

7. The random number generation method according to claim 6, which is a cumulative distribution function of. The upper approximation function is

And
The lower approximation function is

The random number generation method according to claim 7, wherein   The random number generation method according to claim 6, wherein when the second rounded value is not equal to the output candidate data, the second evaluation unit generates the random number by using a rejection sampling method. . Computer,
One of the upper approximation function and the lower approximation function sandwiching the cumulative distribution function of the probability distribution on the upper side and the lower side, respectively, is owned as the first approximation function, and the first approximation function is added to the random number data generated from the random number generator. Of the first rounded value obtained by taking the integer rounding, and outputting the first rounded value as output candidate data, and the upper approximation function and the lower approximation function of Owning the other as a second approximation function, receiving the output candidate data, applying the inverse function of the second approximation function to the random number data, calculating a second rounding value obtained by taking integer rounding, (1) determining whether a second rounded value is equal to the output candidate data and outputting the output candidate data as a random number according to the probability distribution when the second rounded value is equal to the output candidate data; Evaluation means,
Random number generation program to function as.

Images