JPH09325881A - Pseudo-random number generator - Google Patents

Abstract

PROBLEM TO BE SOLVED: To generate pseudo-random numbers having high resistance to correlation attack in a comparatively simple circuit constitution by thinning the clocks to be inputted to a linear (nonlinear) feedback shift register which generates the pseudo random numbers. SOLUTION: Bit series held by a shift register 801 are supplied to an output terminal 813 and a nonlinear function circuit 803. An exclusive OR circuit 802 calculates the exclusive OR of the bit of a prescribed position among the bit series held by the register 801 and supplies this calculation result to the register 801. Then the circuit 803 calculates the nonlinear connection of the bit of a prescribed position among the bit series held by the register 801, and this calculation result is outputted as a pseudo random number via an output terminal 814. In such a constitution, it's possible to generate the pseudo random numbers suitable for the stream ciphering without increasing the number of stages and pieces of shift registers and by thinning the clock pulses even when a pseudo random number generator consists of a nonlinear feedback register.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a pseudo-random number generator, and more particularly to a pseudo-random number generator employed in a communication system or a computer system, in order to prevent unauthorized persons from illegally acquiring information. And a pseudo-random number generator used in a stream encryption device or the like for restoring original information by adding a pseudo-random number to the cipher by using an exclusive-OR to add a pseudo-random number to the cipher to convert it into a cipher.

[0002]

2. Description of the Related Art Conventionally widely known ciphers include:
There is something called a stream cipher. In this method, an exclusive OR of a pseudo-random number sequence generated by a pseudo-random number generator and an information sequence to be transmitted is transmitted as a cryptographic sequence. Note that, in general, the information series is "000.
The stream cipher is designed so that unauthorized decryption is not possible even if the information sequence is "0 ...".
In the case of "", illegally decrypting the information sequence from the cipher sequence output from the stream cipher is equivalent to estimating the internal state of the pseudorandom number generator from the pseudorandom number.
For this reason, in the following, instead of "the stream cipher being decrypted incorrectly," there is also a case where "the pseudorandom number generator is simply decrypted."

As a pseudo-random number generator that has been widely known, a plurality of linear feedback shift registers (Linear Feedback Shift Registers) has been proposed.
There is a method of generating pseudo-random numbers with higher non-linearity by non-linearly combining pseudo random numbers output from a register (hereinafter abbreviated as LFSR) by a non-linear function called a coupling function. Here, a non-linear combination is a combination that is not a linear combination, and a linear combination of bits x ₁ ,..., X _n (n is a positive integer, the same applies hereinafter) is y = x ₁ + x ₂ +.
Exclusive OR + such as _n or y = x ₁ + x ₂ +... x _n +1
Is to give the bit y. In other words, the non-linear combination of the bits x ₁ , ..., X _n is y = x
₁ * x ₂ + x ₂ * x ₃ + ... + x _n * x ₁ etc. is to give a bit y using both the logical product * and the exclusive OR, and how to transform the expression that gives y Even if it does not result in linear combination. The non-linearity of the non-linear coupling refers to the order of the equation giving y, and it is said that the higher the order of the equation, the higher the nonlinearity. Note that, of course, the more inputs to the join function, the more
Non-linear coupling with high non-linearity can be realized.

FIG. 6 is a block diagram showing a configuration of a conventional pseudorandom number generator. In the figure, n LFSR5
When “0” is supplied to the input terminal 511 and a path is input to the input terminal 510, the bit sequence referred to as an initial state supplied from the input terminal 512 is converted into an internal state. Keep as state. Note that different initial states are generally supplied to the respective LFSRs 501-1 to 501-n. Also,
When “1” is supplied to the input terminal 511, the LFSRs 501-1 to 501-n output pseudo-random numbers each time one pulse is input to the input terminal 510. The pseudo-random numbers output from the n LFSRs 501-1 to 501-n are input to the combination function circuit 502,
The output of 2 is output from the output terminal 513 as a pseudo random number.

In order to generate a pseudo random number in the pseudo random number generator of FIG. First, the initial state is supplied to the input terminal 512. Next, “0” is supplied to the input terminal 511, and one pulse (or clock) is input to the input terminal 510. And the input terminal 5
11 is supplied with “1”. Thereafter, every time one pulse is input to the input terminal 510, the output terminal 513
Gives a pseudo-random number.

FIG. 7 shows LFSRs 501-1 to 501-n.
It is a functional block diagram showing. In the figure, when “0” is supplied to the input terminal 611, when a pulse is input to the input terminal 610,
A bit sequence called an initial state supplied from the input terminal 612 is held as an internal state. When “1” is supplied to the input terminal 611 and one pulse is input to the input terminal 610, the shift register 601 shifts the held bit sequence by one bit to the right, The output of the exclusive OR circuit 602 is held as the leftmost bit of the bit sequence. The bit held at the right end of the bit sequence is discarded when the held bit sequence is shifted by one bit to the right.

Further, the bit sequence held in the shift register 601 is supplied to the output terminal 613.
The exclusive OR circuit 602 calculates the exclusive OR of the bit at a predetermined position in the bit sequence held in the shift register 601, and supplies the calculation result to the shift register 601. Exclusive OR circuit 602
Is also supplied to an output terminal 614, which outputs it as a pseudo-random number. LFSR501-1-50
1-n have the same structure, but the shift register 60
In general, the length of 1 and the position of the bit supplied to the exclusive OR circuit 602 among the bits stored in the shift register 601 are different for each LFSR. In addition,
The values input from the input terminals 510, 511, 512 of FIG. 6 are supplied to the input terminals 610, 611, 612, respectively, and the output of the output terminal 614 is supplied to the combination function 502 of FIG. The output of the output terminal 613 is not used in FIG.

[0008] The coupling function circuit 502 has a function of a coupling function for taking nonlinear coupling of input bits and outputting the result, and includes a logical function circuit and a read-on / off circuit.
It is represented by a memory (ROM) or a combination thereof. FIG. 8 is a functional block diagram showing an example of the 4-input combination function circuit 502. This is used in a pseudo-random number generator in which n = 4, and four LFSRs 50 are used.
Pseudo random numbers output from 1-1 to 501-4 are supplied to input terminals 701-1 to 701-4, respectively.

The AND circuit 701 has an input terminal 710-1.
And the value supplied to the input terminal 710-2 are calculated, and the result is output. AND circuit 7
02 calculates the logical product of the value supplied to the input terminal 710-1 and the value supplied to the input terminal 710-3, and outputs the result. The AND circuit 703 has an input terminal 710-
The logical product of the value supplied to 2 and the value supplied to the input terminal 710-3 is calculated, and the result is output. The exclusive OR circuit 704 includes an output of the AND circuit 701, an output of the AND circuit 702, an output of the AND circuit 703, and the input terminal 71.
The exclusive OR with the value supplied to 0-4 is calculated, and the calculation result is output from the output terminal 711. The output of the output terminal 711 is supplied to the output terminal 513 of FIG.

[0010] However, the initial state given to the LFSRs 501-1 to 501 -n of the conventional pseudo-random number generator often includes a correlation attack (corre).
It is estimated by a decryption method called the “ration attack”. That is, a certain LFSR501-j
If the conditional probability distribution of the output of the joint function circuit 502 is not uniform when conditioning with the outputs (j = 1 to n), an output sequence of the LFSR equivalent to the LFSR 501-j and the output sequence of the joint function circuit 502 By finding the initial state of the equivalent LFSR that maximizes the correlation with the output sequence on a brute force basis, the initial state given to the LFSR 501-j is found.

In general, when the conditional probability distribution of the output of the joint function circuit 502 is not uniform when conditioning is performed on the outputs of a certain t LFSRs, the t L
The initial state of the t equivalent LFSRs that maximizes the correlation between the output series of the t LFSRs equivalent to the FSR and the output series of the joint function circuit 502 is obtained by brute force and given to the t LFSRs. The obtained initial state is required. In addition,
In the above description, for the sake of convenience, the initial state of the LFSR is estimated from the output sequence of the joint function circuit 502. However, since the information sequence is not an ideal random number but has redundancy, the above operation is performed. In, the initial state of the LFSR can be estimated even if an encryption sequence is used instead of the output sequence of the combination function circuit 502. That is, the correlation attack can be executed even when the information sequence is not "0000 ...".

It should be noted that how many orders of correlation attack can be performed depends not only on the properties of the coupling function but also on the total number of t LFSR stages. For example, the total number of stages of t LFSRs is 6
If it is 4 bits, it is difficult to determine the initial state to be determined by brute force, so that the t-th correlation attack cannot be executed, but the total number of stages of t LFSRs is 20
If it is a bit, the t-th correlation attack can be easily performed.

For this reason, conventionally, the number of LFSR stages is increased so that the (t + 1) th order correlation attack cannot be executed, and the conditional probability distribution of the output of the coupling function when the output of t LFSRs is conditioned. Was used to prevent t-th order correlation attacks. Note that such a combination function is t
Next Correlation Immune
n immune). For example, when a four-input coupling function is used, it is known that the coupling function can be a first-order correlation immun.
The number of LFSR stages is selected so that a second-order correlation attack cannot be performed. It is known that the four-input coupling function circuit of FIG. 6 is a primary correlation immun.

The conventional pseudo-random number generator, correlation attack, and four-input coupling function are described in, for example, Japanese Patent Application Laid-Open No. 7-104976 and "Analysis. AND DESIGN OF STREAM
Cipher "(R.A. Rueppel, Anal
ysis and Design of Stream
Ciphers, Springer-Verla
g, 1986), pp. 92-141, Michio Shimada, "On the Uncorrelation of Joining Functions" (1st.
Proceedings of the 7th Symposium on Information Theory and Its Applications 1994
Year), there is a detailed explanation from page 53 to page 56.

[0015]

As described in the above-mentioned reference (Michio Shimada, "On the Uncorrelation of Coupling Functions"), the problem of the conventional pseudorandom number generator is the correlation immunity. This means that even with the use of a joint function, it can be decoded with a differential correlation attack. The reason can be understood, for example, by considering the four-input coupling function circuit of FIG. In the case of the four-input coupling function circuit of FIG. 8, since the inputs of the input terminal 710-4 are linearly coupled, the LF supplying the pseudo random number to the input terminal 710-4
Assuming that the period of the SR is L, by taking the difference between the output of the combined function at time t and the time L + t, the influence of the output of the LFSR can be prevented from appearing in the difference of the output of the combined function. Then, decoding a pseudo-random number generator based on a 4-input combination function with a first-order correlation attack results in decoding a pseudo-random number generator based on a 3-input combination function with a first-order correlation attack. Would. Since the 3-input combination function cannot be the first-order correlation immunity, it is easily decoded by the first-order correlation attack.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned drawbacks of the prior art. An object of the present invention is to control a clock signal supplied to an LFSR without increasing the number of stages and the number of LFSRs. An object of the present invention is to provide a pseudorandom number generator suitable for stream cipher.

[0017]

A pseudo-random number generator according to the present invention is an n-number (n is a positive integer, the same applies hereinafter) shift register that shifts in response to a clock input composed of a plurality of pulses. And a combinational function circuit for combining the outputs of the n shift registers to generate a pseudorandom number, and a clock for thinning out the pulses of the clocks input to the n shift registers. It is characterized by including thinning means.

[0018]

DESCRIPTION OF THE PREFERRED EMBODIMENTS The operation of the present invention is as follows.

By considering the above, it can be seen that the following two conditions are necessary for a successful correlation attack. That is, the first condition is that the reader has an LFSR equivalent to the LFSR of the pseudo-random number generator, and the reader appropriately sets the initial state of the equivalent LFSR so that the equivalent LFSR has the pseudo-random number in the equivalent LFSR. The same pseudo-random number sequence as that of the LFSR of the generator can be generated. The second condition is, as already described,
There is a correlation between the input and output of the combined function.

If these two conditions are not satisfied, the correlation attack cannot be executed. Conventionally, the correlation attack is prevented by breaking the second condition, that is, by preventing the correlation between the input and output of the coupling function.

Therefore, in the present invention, the correlation attack is prevented by breaking the first condition. That is, in the conventional pseudo-random number generator, each LFS
Although a clock signal was always supplied to R, in the present invention, the pattern of the clock signal was changed by thinning out the clock pulse. That is, conventionally, “00”
In the present invention, other binary sequences are also used as the clock signal, whereas the clock signal pattern "00..." Is used. For example, since the same pseudo-random number generation sequence as the LFSR of the pseudo-random number generator cannot be generated in the copied LFSR, the first condition is broken, and the correlation attack cannot be executed.

In the above description, the clock signal is expressed as a binary series, but the fact that the τth of the binary series is “0” means that there is a pulse at the τ unit time of the clock signal, The fact that the τ th of the binary sequence is “1” means that there is no pulse at the τ unit time of the clock signal (“0” and “1” may be interchanged,
This is done for convenience of explanation). Further, the unit time is the time measured by setting the time corresponding to the period of the clock signal, that is, the length of one pulse, as “1”.

However, if the clock signal pattern is simply selected at random, there is a risk that the period of the pseudo-random number output from the pseudo-random number generator becomes extremely short. For example, if any LFSR outputs a period sequence of period T bits as a pseudo random number sequence, the pseudo random number sequence output from the pseudo random number generator also becomes a period sequence of period T bits. If the period of the pseudo-random number sequence is short, for example, the entire pseudo-random number sequence obtained by eavesdropping is stored in a memory,
By adding it to the cryptographic sequence by exclusive OR, it is easily illegally decrypted.

Therefore, the present invention prevents the period of the pseudo-random number from being shortened by the following measures. That is, a plurality of n sets composed of n binary sequences having the same length and the same Hamming weight are selected in advance as a clock signal, and one n set is randomly selected from the plurality of n sets. A set is selected, and each of the selected n sets of binary sequences is sequentially supplied to each of the n LFSRs. For example, when n = 4, the following is performed.

First, (0001,00)
(10,0100,1000) (4 units of time), (10
00, 0100, 0010, 0001) and (4 unit time) (0, 0, 0, 0) (1 unit time). Then, if the first quadruplet is selected at a certain time, the length of the binary sequence of the quadruplet is “4”. , "0001" and "001" in the LFSR 501-2.
0 ", LFSR501-3," 0100 "
"1000" is supplied to the SR 501-4 as a clock signal. Then, in the case of "1", the clock pulse is thinned out, and by the next 4 unit time, which LF
Three pulses are also supplied to the SR. This means that if you look only at the results, any LFSR will have "000"
This is equivalent to the clock signal supplied. That is, in the case of “0”, the LFSR performs a shift operation,
In the case of "1", no shift operation is performed. In addition, each LFS
Since the positions of "1" of the clock signal supplied to R are different from each other, only one of the pulses input to each LFSR at the same time is thinned out.

As described above, the internal state of the LFSR of the pseudorandom number generator changes at least at a specific time in the same manner as the internal state of the LFSR of the conventional pseudorandom number generator. Therefore, the period of the pseudo-random number sequence output from the pseudo-random number generator does not become shorter than the period of the pseudo-random number generation sequence output from the pseudo-random number generator.

However, if the n-piece set consisting of binary sequences having the same length and Hamming weight are used as the clock signal, there is still a risk that the data will be easily illegally decrypted. Because in the example above,
For example, the Hamming weight is “3” (1110, 11
This is because if a quadruple set of binary sequences (01, 1011, 0111) is used, a correlation may be generated between the pseudo random number output at one time and the pseudo random number output at the next time. That is, the four-input coupling function is at most a primary correlation immun, and if the Hamming weight of the clock signal is "3", the outputs of the three LFSRs may be equal at a certain time and the next time. Because there is.

Therefore, in the present invention, if the coupling function is a t-th order correlation immun, only a binary sequence whose Hamming weight is Lt / n is used as a clock signal of length L. For example, when n = 4, if the coupling function is a primary correlation immun, “0001”, “0010” such that the Hamming weight is “1” is used as a clock signal of length “4”. "," 010
Only binary sequences in which the positions of “1” such as “0” and “1000” are different from each other are used as n-elements, so that the output is always equal between a certain time and the next time. Is only one LFSR, so by using the first order correlation / immune coupling function,
It is possible to prevent a correlation between the pseudo random number output at a certain time and the pseudo random number output at the next time.

Next, embodiments of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a block diagram showing a configuration of an embodiment of a pseudorandom number generator according to the present invention, and portions equivalent to those in FIG. 6 are denoted by the same reference numerals.

In the figure, a pseudo-random number generator according to the present embodiment includes n LFSRs 501-1 to 501-n that generate 1-bit pseudo-random numbers each time a clock is input, and outputs of the n LFSRs. A t-th order correlation / immune combination function circuit for nonlinearly combining pseudo-random numbers to generate bits, and a predetermined part or all of the bits stored in n LFSRs. A signal selection circuit 102 for performing a non-linear conversion and outputting a predetermined number of bits, and n signals having a length L and a Hamming weight of Lt / n or less depending on the output of the signal selection circuit 102 Signal generation circuit 103 which sequentially outputs the binary sequence of (1) in synchronization with an externally input clock.
And an externally input clock and a signal generation circuit 103
And the result of the operation is n n L
N OR circuits 10 to be supplied as clocks to the FSR
1-1 to 101-n, the pseudo-random number is output from the combination function circuit 502 in synchronization with a clock input from the outside.

The LFSRs 501-1 to 501-n are supplied from the input terminal 112 when a pulse is supplied from the OR circuits 101-1 to 101-n when "0" is supplied to the input terminal 111. A bit sequence called an initial state is held as an internal state. In addition, LFS
R501-1 to 501-n output "1" to the input terminal 111.
Is supplied, the OR circuits 101-1 to 101-1
Each time a pulse is supplied from 01-n, the internal state is updated and a pseudo random number is output. And LFSR5
The pseudo-random numbers output from 01-1 to 501-n are input to the combination function circuit 502, and the output of the combination function circuit 502 is output from the output terminal 113 as pseudo-random numbers. L
The internal states of the FSRs 501-1 to 501-n are supplied to the signal selection circuit 102. LFSR501-
The internal states of 1 to 501-n are output via the output terminal 613 of FIG.

As will be described later in detail, the signal selection circuit 102 performs a predetermined non-linear conversion on the internal states of the LFSRs 501-1 to 501-n to generate a predetermined number of bits. The signal generation circuit 103 generates a predetermined clock signal in accordance with the output of the signal selection circuit 102 and supplies it to the OR circuits 101-1 to 101-n. The logical sum circuits 101-1 to 101-n take the logical series of the pulse sequence supplied from the input terminal 110 and the clock signal supplied from the signal generation circuit 103 to obtain the pulse sequence corresponding to the clock signal. The pulse sequences are generated and supplied to the LFSRs 501-1 to 501-n, respectively.

In order to generate a pseudo random number in the pseudo random number generator of FIG. 1, the following is performed. First, input terminal 1
12 is supplied with the initial state. Next, “0” is supplied to the input terminal 111 to input one pulse to the input terminal 110. Then, “1” is supplied to the input terminal 111. After that, every time one pulse is input to the input terminal 110, a pseudo random number is obtained from the output terminal 113.

FIG. 2 is a functional block diagram showing an example of the basic configuration of the signal selection circuit 102 used in the pseudo-random number generator of FIG. 1 where n = 4. In the figure, the LFS of FIG.
Outputs of R501-1 to 501-4 are supplied to input terminals 210-1 to 210-4, respectively. Wiring 201
Is a predetermined wiring, and the input terminals 210-1 to 210-1
A predetermined part or all of the signal supplied from 210-4 is output allowing duplication. The output of the wiring 201 is composed of u (u is a positive integer, the same applies hereinafter) AND circuit 2
The outputs of 02-1 to 202-u are supplied to the wiring 203.

The wiring 203 is a predetermined wiring.
A predetermined part or all of the signals supplied from the AND circuits 202-1 to 202-u are output while allowing duplication. The output of the wiring 203 is supplied to five exclusive OR circuits 204-1 to 204-5, and the outputs of the exclusive OR circuits 204-1 to 204-5 are output from an output terminal 211. Then, the output of the output terminal 211 is supplied to the signal generation circuit 103 of FIG. Since the output of the signal selection circuit 102 depends on the outputs of the LFSRs 501-1 to 501-4, a third party who does not know all the initial states of the LFSRs 501-1 to 501-4 can Cannot be easily estimated.

FIG. 3 is a functional block diagram showing an example of the basic configuration of the signal generation circuit 103 used in the pseudo random number generation circuit of FIG. 1 where n = 4. In the figure, a signal input from an input terminal 110 in FIG. 1 is supplied to an input terminal 320, a signal input from an input terminal 111 in FIG. 1 is supplied to an input terminal 321 and an output of the signal selection circuit 102 in FIG. Are supplied to the input terminal 322. Counter 307
When "0" is supplied to the input terminal 321 and the pulse is supplied from the OR circuit 302, the count value is set to zero. When “1” is supplied to the input terminal 321, the counter 307 increases the count value by “1” every time a pulse is supplied from the OR circuit 302. The value is supplied to the OR circuit 306 and the decoder 309.
Note that when the count value increases from 3 by “1”, the count value returns to “0”.

When a pulse is supplied from the OR circuit 301, the register 308 holds the five bits supplied to the input terminal 322, and performs a logical OR operation on the leftmost bit among the held five bits. The other four bits are supplied to a transposition circuit 310. If the output of the counter 307 is “x”, the decoder 309 outputs four bits such that the “x” th bit from the right is “1”. That is, the decoder 309 sets x = “0”,
“000” for “1”, “2”, and “3” respectively
1 "," 0010 "," 0100 ", and" 1000 "The transposition circuit 310 outputs the transposition of the output bits of the decoder 309 (that is, the transposed one) in accordance with the output of the register 308. Note that what kind of transposition is performed is determined in advance.

The selector 311 selects and outputs the output of the transposition circuit 310 if the output of the AND circuit 304 is "0", and outputs the output if the output of the AND circuit 304 is "1".
"0000" is output. Then, the output of the selector 311 is output from the output terminal 323. The output terminal 3
23 are output from the OR circuits 101-1 to 101- 1 of FIG.
5 is supplied.

The OR circuit 306 calculates a logical OR of a total of 3 bits of the output of the counter 307 and the leftmost bit of the output of the register 308, and outputs the result. NOT circuit 3
05 inverts the output of the OR circuit 306 and outputs the result. The logical product circuit 303 calculates the logical product of the signal supplied from the input terminal 321 and the output of the logical sum circuit 306, and outputs the result. The logical product circuit 304 calculates the logical product of the signal supplied from the input terminal 321 and the output of the NOT circuit 305, and outputs the result. The OR circuit 301 calculates the logical sum of the signal supplied from the input terminal 320 and the output of the AND circuit 303, and outputs the result. The logical sum circuit 302 calculates the logical sum of the signal supplied from the input terminal 320 and the output of the logical product circuit 304, and outputs the result.

The operation of the signal generation circuit shown in FIG.
It looks like this: When a pulse is supplied to the input terminal 320 while “0” is supplied to the input terminal 321,
The count value of the counter 307 is set to “0”, and the five bits supplied to the input terminal 322 are held in the register 308. Then, “1” is supplied to the input terminal 321, the count value of the counter 307 is “0”, and the leftmost bit of the five bits held in the register 308 is “0”. For example, “0000” is output from the selector 311 and the input terminal 3
When one pulse is input to 20, the register 308 holds the new 5 bits supplied from the input terminal 322. On the other hand, if “1” is supplied to the input terminal 321, the count value of the counter 307 is “0”, and the leftmost bit of the five bits held in the register 308 is “1”. For example, until the count value of the counter 307 becomes “0” again after the next four unit times, the output terminal 323 sets the hamming weight to “1”.
The bits are output.

FIG. 4 is a functional block diagram showing an example of the basic configuration of the transposition circuit 310 used in the signal generation circuit 103 of FIG. 3 where n = 4. In the figure, the input terminal 41
The output of the decoder 309 of FIG. 3 is supplied to 0-1 to 410-4, and the register 30 of FIG.
The right 4 bits of the output of 8 are provided. Input terminal 41
Signals supplied to 0-1 to 410-4 are connected to a wiring 401-
Input to 1. Wiring 401-j (j = 1, 2, 3,
In 4), two different predetermined transpositions are performed on a 4-bit input by two predetermined wirings. Then, the respective transposition results are output to the left and right sides in the figure, and supplied to the left and right sides of the selector 402-j, respectively.

The selector 402-j (j = 1, 2, 3,
4), one of the four bits supplied to the input terminal 411 is supplied, and the left or right input is selected and output according to the value of the bit. The output of the selector 402-j (j = 1, 2, 3) is
The signal is input to the wiring 401- (j + 1) and the selector 402-
4 are output from the output terminals 412-1 to 412-4. The four bits output from the output terminals 412-1 to 412-4 are supplied to the left input of the selector 311 in FIG.

Incidentally, a nonlinear feedback shift register may be used in place of the linear feedback shift registers 501-1 to 501-n in FIG. FIG.
FIG. 3 is a block diagram showing a configuration example of a non-linear feedback shift register. In the figure, shift register 8
01 has the same structure as the LFSR 501 of FIG. 7. The shift register 801 in FIG.
When a pulse is input to the input terminal 810 while “0” is supplied to 1, a bit sequence called an initial state supplied from the input terminal 812 is held as an internal state. The shift register 801 has an input terminal 811
When "1" is supplied to the input terminal 810, when one pulse is input to the input terminal 810, the held bit sequence is shifted to the right by one bit, and the exclusive OR circuit 80 is shifted.
2 is held as the leftmost bit of the bit sequence.
The bit held at the right end of the bit sequence is discarded when the held bit sequence is shifted by one bit to the right.

The bit sequence held in the shift register 801 is output to the output terminal 813 and the nonlinear function circuit 8.
03. The exclusive OR circuit 802 calculates the exclusive OR of the bit at a predetermined position in the bit sequence held in the shift register 801, and supplies the calculation result to the shift register 801. The non-linear function circuit 803 calculates a non-linear combination of bits at a predetermined position in the bit sequence held in the shift register 801. That is, a logical operation other than a predetermined exclusive OR is performed on a bit at a predetermined position. Then, the calculation result is output from the output terminal 814 as a pseudo random number.

In short, even when a pseudo-random number generator is configured using a non-linear feedback register instead of a linear feedback shift register, it is suitable for stream encryption without increasing the number and number of shift registers by thinning out clock pulses. It is possible to generate pseudo random numbers.

As described above, if pseudo random numbers are generated using the present apparatus, a third party who does not know the initial state of all LFSRs can know at what timing the internal state of the LFSR changes. Since it cannot be guessed, it is possible to generate a pseudo-random number that is strong against a correlation attack and a differential correlation attack even when a commonly used four-input coupling function circuit is used. As a result, it is possible to realize a pseudo-random number generator suitable for stream cipher with a relatively simple structure.

In this apparatus, not only the nonlinear conversion is performed in the coupling function circuit, but also the nonlinear conversion is performed in the signal selection circuit, and pseudorandom numbers are generated depending on the conversion result. Even if a commonly used four-input coupling function circuit is used, pseudo-random numbers with high non-linearity can be generated. Thereby, a pseudorandom number generator suitable for stream cipher can be realized.

In short, according to the present apparatus, the shift operation is performed according to the input of a clock composed of a plurality of pulses.
It includes a number of shift registers and a combination function circuit that combines the outputs of the n number of shift registers to generate a pseudo-random number, and thins out clock pulses input to the n number of shift registers. As a result, it is possible to generate a pseudo-random number suitable for stream cipher with a relatively simple configuration.

[0050]

As described above, the present invention thins out the input clock to the linear (non-linear) feedback shift register for generating a pseudo-random number, so that a third party who does not know the initial state of the register can use the shift register. It is not possible to estimate at what timing the internal state changes, and it is possible to generate a pseudo-random number strong against correlation attack with a relatively simple circuit configuration.

[Brief description of drawings]

FIG. 1 is a block diagram showing a configuration of a pseudorandom number generator according to an embodiment of the present invention.

FIG. 2 is a block diagram illustrating an example of an internal configuration of a signal selection circuit in FIG. 1;

FIG. 3 is a block diagram illustrating an example of an internal configuration of a signal generation circuit in FIG. 1;

FIG. 4 is a block diagram showing an example of an internal configuration of a transposition circuit in FIG. 3;

FIG. 5 is a block diagram showing an example of an internal configuration of a nonlinear feedback register used in place of the LFSR in FIG. 1;

FIG. 6 is a block diagram showing a configuration of a conventional pseudorandom number generator.

FIG. 7 is a block diagram showing an example of the internal configuration of the LFSR in FIG. 6;

FIG. 8 is a block diagram showing an example of an internal configuration of a coupling function circuit in FIG. 6;

[Explanation of symbols]

 102 signal selection circuit 103 signal generation circuit 501-1 to 501-n LFSR 502 coupling function circuit

Claims (5)

[Claims] 1. An n number (n is a positive integer, each of which shifts according to an input of a clock composed of a plurality of pulses,
The same applies hereinafter), and a pseudo-random number generator including a combination function circuit that combines the outputs of the n shift registers to generate pseudo-random numbers, and is input to the n shift registers. A pseudo-random number generator characterized by including clock thinning means for thinning a clock pulse. 2. The pseudo random number generator according to claim 1, wherein the clock thinning means thins out only one of the pulses input to the n shift registers at the same time. 3. The combination function circuit is a t-th order (t is a positive integer, the same applies hereinafter) correlation immunity, and the clock decimating means has a length L (L is a positive integer; N different from each other not more than L × t / n
2 types of binary sequences are used as clocks to be input to the n shift registers, and the shift registers are input 2
3. The pseudo random number generator according to claim 1, wherein the shift operation is performed when the value of the value series is "0". 4. The shift register is a linear feedback shift register.
3. The pseudo random number generator according to any one of 3 above. 5. The shift register is a non-linear feedback shift register.
The pseudo-random number generator according to any one of 1 to 3.