JPH0769662B2 - Binary pseudorandom number generator - Google Patents

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a binary pseudo-random number generator in, for example, a Vernam-cipher generator.

The Vernam cipher is an encryption method that operates the same binary pseudo random number generator for both transmission and reception, calculates the exclusive OR of the output binary pseudo random number and input data, and performs encryption and decryption. is there.

2. Description of the Related Art Conventionally, as a binary pseudo-random number generator, there has been known one that is configured by using a plurality of linear random number generators that generate a binary periodic sequence and a combiner that non-linearly combines their outputs.
That is, Geffe (hereinafter referred to as GEFFE) method (Earl Geffe “How to Protect Data with Ciphers That's Really Hard to Break” Electronics / 1973.1.4 (R.GEFFE “How
to protect data with ciphers that are really hard
to break "Electronics / jan.4.1973)), the output bits of multiple linear feedback shift registers (hereinafter abbreviated as LFSR) are converted into a non-linear combination function composed of logical product, exclusive OR, and switch. This is a method of inputting and generating a binary pseudo random number bit.

The reason for including the non-linear element in the coupling function is to efficiently increase the linear complexity by the non-linear element and to use the method of the Berlekampoo Massey (hereinafter referred to as BERLEKAMP-MASSEY) (E.R. (ERBerlekamp “Alg
This is to make the analysis of the output sequence by ebraic Coding Theory “McGraw-Hill1968)) practically impossible.

Figure 3 shows the block diagram of the binary pseudo-random number generator proposed by GEFFE. Reference numeral 11 is the first LFSR, 12 is the second LFSR, and 13 is the LFSR in FIG. 14 is the first when the output of the second LFSR is 1.
AND gate that outputs the output value of LFSR of, and 15 is the second LFS
A gate that outputs the output value of the third LFSR when the output of R is 0, 16 is a gate that calculates the exclusive OR of the gates 14 and 15, and the output of this gate is a binary pseudorandom number sequence. To use. In other words, when the output of the second LFSR is used as a switch with the gates of 14, 15, and 16 and the value is 1, the output of the first LFSR is the binary pseudo random number bit, and when it is 0, the output of the third LFSR is It realizes a non-linear engagement function in which is a binary pseudo random number bit. However, the first, second, and third LFSRs operate on a common clock.

FIG. 4 shows a specific configuration example of the linear feedback shift register LFSR. In this example, the initial value is "000
1 ", 4-bit LFSR with minimum polynomial x ⁴ + x + 1 = 0. In the figure,""indicates exclusive OR. The 4-bit register value is {e3, e2, e1, e0. } The operation of this LFSR will be described for each clock as follows: The value of this register value indicates one example of the "internal state" of the binary periodic sequence generator in the claims. However, in the following description, “∧” indicates exclusive OR, “−” indicates negation, and “=” indicates substitution.

1 Substitute the initial value. {E3, e2, e1, e0} ＝ {0,0,0,1} 2 temp ＝ e1 ^∧ e0 e0 ＝ e1 e1 ＝ e2 e2 ＝ e3 e3 ＝ temp Therefore {e3, e2, e1, e0} ＝ { 1,0,0,0}.

Similar to 32, {e3, e2, e1, e0} = {0,1,0,0}.

4 Repeat from here onwards.

From the above, the output sequence becomes zi = e0 = {100010011 ...}. In particular, when the characteristic polynomial of LFSR is a primitive polynomial, the output sequence is the M sequence.

FIG. 5 shows a small example in which the LFSR (1) to LFSR (3) in the GEFFE binary pseudo-random number generator (FIG. 3) are specifically configured. The operation of the conventional example will be described using this example.

LFSR (1) has an initial value of {a1, a0}, and x ² + x + 1 = 0 is a primitive polynomial M sequence generation LFSR, LFSR (2) has {b2, b1, b
0} as an initial value and x ³ + x + 1 = 0 as a primitive polynomial, M
Sequence generation LFSR, LFSR3 is {c4, c3, c2, c1, c0} initial value, x ⁵
This is an M-sequence generation LFSR in which + x ³ + 1 = 0 is a primitive polynomial.

LFSR (1) outputs y ¹ _i = {101101101101 ...} When {a1, a0} = {0,1} is an initial value. (Period: 3) LFSR (2) outputs y ² _i = {100101110010111001011 ...}, with {b2, b1, b0} = {0,0,1} as the initial value.
(Period: 7) LFSR (3) outputs {c4, c3, c2, c1, c0} = {0,0,0,0,1} initial value and outputs y ³ _i = {1000010101110110001111100110100 1000010101110110001111100110100 ……} And (Period: 31) Thus, the output sequence _{^{z i (= y 1 i ·}} y 2 i + y 3 i · - y 2 i) is as shown in FIG. 8 from the above. (800 samples) The general configuration of the conventional binary pseudo-random number generator described above is based on Leppel "Analysis and Design of Stream Ciphers" Springer-Valag, 1986 (R
UEPPEL “Analysis and Design of Stream Ciphers” Spri
nger-Verlag 1986) Chapters 5 and 4. LFS in Figure 6
The structure of a conventional general binary pseudo-random number generator using R is shown. 211 to 213 are N LFSRs. 221-223 is each of the above
N pieces of non-linear state filters (f1 to fN) that perform non-linear operation with the stored value of LFSR as an input, and 23 have a total of N bits of the output series of the N pieces of non-linear state filters as input and perform non-linear operation to this. It is a nonlinear coupling function (F) to be performed.

In particular, in order to generate a long-term binary pseudo-random number, each LFSR is often realized by an M-sequence generation LFSR whose orders are disjoint.
The key of the binary pseudo-random number generator is the initial value of LFSR211 to 213.

According to the literature (Okamoto, Nakamura, "A proposal for a nonlinear binary pseudo-random number generation method", National Conference of the Institute of Electronics and Communication Engineers, 1986), the following are the safety evaluation criteria for a binary pseudo-random number generator using LFSR. Has been raised.

(1) Be non-linear.

(2) The linear complexity is so high that analysis of BERLEKAMP-MASSEY is virtually impossible.

(3) Satisfy decorrelation.

(4) Satisfies long periodicity.

(5) The appearance frequency of 0 and 1 is the same.

The output (FIG. 8) of the binary pseudo-random number generator shown in FIG. 5 is evaluated along the respective items as follows.

(1) It is non-linear because AND gates 14 and 15 are included in the combination function.

(2) Linear complexity = (number of bits of LFSR1) x (number of bits of LFSR2) + (number of bits of LFSR3) x (number of bits of LFSR2 + 1) = 2 x 3 + 5 x 4 = 26 (3) Correlation is Not enough. (T. SIEGENTHALER “Decryphting a Clas.“ Decrypting A Class of Stream Ciphers Youthing Ciphertext Only ”I Triple I Transaction on Computer 1985 (T.SIEGENTHALER“ Decryphting a Clas
s of Stream Ciphers Using Ciphertext only "IEEE Tra
ns.on Computer1985)) (4) Period = 651 (5) One period 651 Sample occurrence frequency of "0": 392 times,
Occurrence frequency of “1”: 259 times Problem to be solved by the invention However, in the conventional binary pseudo-random number generator, each LF
If SR is composed of M-sequence generation LFSR and the key of the binary pseudo-random number generator is the initial value of LFSR, only the phase of binary pseudo-random number sequence zi changes even if the key changes, and it becomes a periodic sequence. Is the same. The reason for this will be described with reference to the general configuration shown in FIG.

(1) M sequence generation LFSR takes all internal states (S ₁ , ..., S _m ) that can be represented by the number of bits. The state of the LFSR is assumed to transit periodically in this order for each clock.

(2) When the initial value set in the M sequence generation LFSR is A1
Compare the case of A2 (≠ A1). A1 is the same as S _i among all the internal states (S ₁ , ..., S _m ) that can be represented by the bits of LFSR. Therefore, LFSR when A1 is set to the initial value
Output sequence is (S _i , S _{i + 1} , ..., S _m , S ₁ , ..., S _i-1 ). A2
Is all internal states (S ₁ ,…,
It is the same as S _j (≠ S _i ) in S _m ). Therefore, A2
When LFSR is set to the initial value, the state transition of LFSR is (S _j , S _{j + 1} ,
…, S _m , S ₁ ,…, S _j-1 ).

(3) The memoryless non-linear state filter uniquely determines the output value t _k for the state S _k with LFSR. (T _k
= 0 or 1) Therefore, the state transition of the nonlinear state filter when A1 is substituted for the initial value of LFSR is (t _i , t _{i + 1} ,
…, T _m , t ₁ ,…, t _i-1 ) The output sequence of the nonlinear state filter when A2 is substituted for the initial value of LFSR is (t _j , t _{j + 1} , ..., t _m ,
t ₁ , ..., t _j-1 ). Therefore, the output sequences of the nonlinear state filters in the two cases differ only in the phase of the starting point and are the same as the periodic sequence itself.

(4) An output value (= two-dimensional pseudo-random number) of the memoryless nonlinear coupling function is uniquely determined by the output value of each nonlinear state filter. Therefore, from the above, the output sequences of the combination function in the two cases differ only in phase.

The above will be specifically described with reference to the example of FIG.
However, this example is an example in which the non-linear state filter in the general configuration (FIG. 6) of the conventional binary pseudo-random number generator is omitted.

As described in the section of the prior art, the keys in FIG. 5 are {a1, a0} = {0,1}, {b2, b1, b0} = {0,0,1}, {c4, c3, The output sequence when c2, c1, c0} = {0,0,0,0,1} is as shown in FIG. (800 samples) Similarly, the keys are {a1, a0} = {0,1}, {b2, b1, b0} = {0,0,1}, {c4, c3, c2, c1, c0} = {0 , 0,0,1,0} is shown in FIG. (800 samples) By comparing the output sequence of FIG. 8 with the output sequence of FIG. 9, it can be seen that the sequence of FIG. 9 is the sequence of FIG. 8 delayed by 63 bit positions.

If the key difference is reflected only in the phase of the output sequence in this way, there is the following risk, for example. It is a combination of multiple blocks of binary pseudo-random number sequences (the keys may be the same or different) obtained even for a decryption person who has the ability to obtain only a short binary pseudo-random number sequence at a time. Is a possibility that a long binary pseudo-random number sequence can be obtained. Therefore, it is desirable that not only the phase but also the binary pseudo-random number sequence itself be changed by the key.

In view of the point of the present invention, the binary pseudo-random number sequence in which the binary pseudo-random number sequence itself is changed by the key without deteriorating the characteristics of the cycle of the output sequence, the statistical values such as the appearance frequencies of 0 and 1 and the linear complexity. The purpose is to realize a generator.

Means for Solving the Problems According to the present invention, when N is a positive integer, an initial value of an internal state can be set, and N binary cycles whose output is a binary value uniquely determined by the internal state Sequence generator, N 1-bit memory that can be initialized, output value W ⁱ _{j at} time j in the i-th binary cycle sequence generator (i = 1 to N) and its i-th binary cycle A total of N gates, one for each i that is exclusive ORed with the memory stored value corresponding to the sequence generator, and N outputs of the exclusive OR gate are input to make them non-linear. A binary pseudo-random number generator having a combiner for combining.

Function The present invention substitutes a part of the key into the N 1-bit memories having the above-described configuration. By changing the key stored in the memory, the output binary random number sequence itself changes. Furthermore, since the output of the binary periodic sequence generator and each bit value of the memory are connected by exclusive OR, the output sequence of exclusive OR is originally the cycle and statistics of the binary periodic sequence generator. Properties and linear complexity are preserved.

Therefore, the binary pseudo-random number obtained by inputting these N sequences in the combiner does not deteriorate the characteristics related to the security of the conventional binary pseudo-random number, and moreover the key (= initial state) causes the phase of the starting point of the output sequence. Not only that, the periodic series itself changes.

Embodiment FIG. 1 is a block diagram of a binary pseudo-random number generator in an embodiment of the present invention. In FIG. 1, reference numerals 111 to 113 denote N LFSRs, N nonlinear state filters (f1 to fN) that perform a nonlinear operation using the stored values of the respective LFSRs as inputs, 3 is an N-bit register, 41, 42, 43. Is a gate for taking the exclusive OR of each output of the non-linear state filters f1 to fN and the corresponding bit of the register, and 5 is a non-linear coupling function F for non-linearly coupling the outputs of the gate as inputs.

In this configuration, the key is the initial value of LFSR (1) to LFSR (N)
key (1) to key (N) and the value stored in the N-bit register ke
It is y (0). Make key (0) the same, key (1) to key
When (N) is changed, only the phase of the output sequence changes and the sequence itself does not change as in the conventional case. When key (0) is changed, the output sequence itself changes. Therefore, there are 2 ^N output sequences.

An example in which the LFSR and the non-linear function are specifically shown in the configuration shown in FIG. 1 is shown in FIG. FIG. 2 shows the point of the present invention in a conventional GEFFE binary pseudo-random number generator (FIG. 4). A register 6 for storing a key and exclusive ORs 7, 8 and 9 of each bit and the output value of the LFSR are added.

The key in this binary pseudo-random number generator is key (1) = {a1, a0} = {0,1} key (2) = {b2, b1, b0} = {0,0,1} key (3) = {C4, c3, c2, c1, c0} = {0,0,0,0,1} key (0) = {d2, d1, d0} = {0,0,1}. The operation of the binary pseudo random number generator in this case will be described below.

The output sequences y ¹ _i y ² _i , y ³ _i of LFSR1, LFSR2, LFSR3 are y ¹ _i = {101101101101 ……} y ² _i = {100101110010111001011 ……} y ³ _i = {1000010101110110001111100110100 1000010101110110001111100110100 ……} . Since the value of the register 6 is {d2, d1, d0} = {0,0,1}, the outputs of the exclusive ORs 7,8,9 are as follows.

u ¹ _i = y ¹ _i d2 = y ¹ _i “0” = y ¹ _i = {101101101101 ……} u ² _i = y ² _i d1 = y ² _i “0” = y ² _i = {100101110010111001011 ……} _{^{u 3 i = y 3 i d0}} = y 3 i "1" = - y 3 i = {0111101010001001110000011001011 0111101010001001110000011001011 ......} Therefore, the output sequence _{^{zi (= u 1 i · u}} 2 i + u 3 i · - u 2 i) Is Table 1
It becomes as follows.

FIG. 7 is clearly different from the binary pseudo random number sequence of the conventional example shown in FIGS. 8 and 9. That is, the binary pseudo-random number sequence itself changes by changing the value of the register 6.

In addition, regarding the sequence of FIG. 7, as in the case of the conventional example (Okamoto, Nakamura, “One Proposal of Nonlinear Binary Pseudo Random Number Generation Method”, Showa 61)
The following is an evaluation based on the safety evaluation criteria by the IEICE National Conference).

(1) It is non-linear because it includes an AND gate.

(2) Linear complexity = 30 (3) The decorrelation is not sufficient. (Similar to the conventional example) (4) Cycle = 651 (5) One cycle 651 Sample occurrence frequency of "0": 268 times,
Frequency of appearance of "1": 383 times This is compared with the characteristic of the binary pseudo-random number sequence of the conventional example shown in FIG.

-Linear complexity is increasing. This is u ^{3 in} Fig. 2.
_This is because the linear complexity of _i increases by 1 compared to y ³ _i because d0 is “1”.

・ The cycle is the same as the conventional one because the value stored in the register is kept constant for one cycle.

・ In the case of GEFFE method, the appearance frequency of "0" and "1" in the output is
It is changed by the additional circuit of the present invention. By the way, the non-linear combination function F is designed so that when the frequencies of appearance of 0 and 1 in the input sequence are the same, the frequencies of occurrence of 0 and 1 in the output sequence are also the same. For example, considering F as the one that outputs the exclusive OR of each input, this condition is satisfied.
Then, the M series or the negation of the M series (both have the same appearance frequency of 0 and 1 in one cycle) is input to F from each LFSR, so that the 0, 1 balance of the output series is satisfied.

From the above, it can be seen that the additional circuit of the present invention does not deteriorate the safety characteristics of the conventional binary pseudo random number generator.

As described above, according to this embodiment, the binary pseudo-random number sequence itself can be changed by the key by adding some circuits. In addition, this does not deteriorate the safety property of the binary pseudo random number generator.

Although the register 6 is simply added in the above embodiment, this portion may be configured by LFSR or the like. However, in order to ensure that the safety-related properties of the binary pseudo-random number generator are not deteriorated, when configured with LFSR, the shift is performed once per cycle of the output sequence (1 cycle per 651 clocks in the previous example).
It is necessary to consider the timing, such as "times".

Further, in the embodiment, it is assumed that the key is assigned only to the initial value of each LFSR and the register, but the key may control the LFSR coupling, the non-linear state filter, and the non-linear coupling function.

The non-linear state filters f (1) to f (N) of the embodiment shown in FIG. 1 may be omitted as in the example in which the present invention is applied to the binary pseudo random number generator of GEFFE.

As described above, according to the present invention, the N number of 1-bit memories are added to the conventional configuration by adding some circuits of N number of 1-bit memories and N number of exclusive OR gates. The periodic sequence itself of the binary pseudo-random number sequence can be changed by the key stored in. Furthermore, this additional circuit does not degrade the properties such as linear complexity, period, and 0,1 balance. Therefore, its practical effect is great.

[Brief description of drawings]

FIG. 1 is a block diagram of a binary pseudo-random number generator of one embodiment of the present invention, FIG. 2 is a block diagram of an example in which the present invention is specifically applied to a GEFFE method, and FIG. 3 is a GEFFE method. Configuration diagram, FIG. 4 is a specific configuration example of LFSR, FIG. 5 is a specific configuration example of GEFFE method, FIG. 6 is a general configuration diagram of a conventional binary pseudo-random number generator, and FIG. FIG. 8 is a data diagram showing an example of an output sequence in the embodiment, and FIGS. 8 and 9 are data diagrams showing an example of an output sequence by the GEFFE method. 111,112,113,11,12,13,211,212,213 …… LFSR, 121,122,
123,221,222,223 …… Nonlinear state filter, 3,6 ……
Register, 41,42,43,7,8,9,14,15,16 …… Gate, 5,23
…… Nonlinear coupling function.

Claims (1)

[Claims] 1. When N is a positive integer, an initial value of an internal state can be set, and N binary periodic sequence generators that output binary values uniquely determined by the internal state, and N 1-bit memory corresponding to the respective initial settable said two yuan periodic sequence generator, i-th binary periodic sequence generator (i = 1 to N) the output value W ⁱ _j time j in its A total of N gates, one for each i to obtain an exclusive OR with the stored value of the memory corresponding to the i-th binary periodic sequence generator, and N outputs of the exclusive OR gate A binary pseudo-random number generator characterized by comprising a combiner for connecting these in a non-linear fashion with the input as input.