JPH11224183A - Pseudo-random number generating device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a filter generator (pseudo-random number generating device) which can generate a cryptograph of a stream cryptographic system at a high speed wherein linear complexity is logically larger than a specific value by using a linear feedback shift register. SOLUTION: The pseudo-random number generating device has a linear feedback shift register 101, a nonlinear converting function circuit 102 which outputs 1-bit pseudo-random numbers for every synchronizing signal by nonlinearly converting respective register values of a linear feedback register 101 through the use of a nonlinear converting function having a term of the highest order constituted by ANDing the register values of a specific number of successive stages from the initial stage of the linear feedback shift register 101, an initial value setting terminal 104 which sets an initial value in the linear feedback shift register 101, and a synchronizing signal input terminal 105 which inputs the synchronizing signals to the linear feedback shift register 101.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a stream cryptographic pseudo-random number generator used in a cryptographic communication device in the field of voice and information communication.

[0002]

2. Description of the Related Art Conventionally, in communication systems such as telephones, wireless communication devices, and data communication devices, for example,
In order to prevent a third party other than the communicating parties at both ends of the communication system from knowing the information transmitted by the communication system, the transmission information transmitted by the communication system is encrypted. ing. Although various types of encryption methods are known, a stream encryption method can be used for high-speed data communication. Hereinafter, the stream encryption device will be described with reference to FIG. 2 which is a block diagram illustrating a schematic configuration of the stream encryption device. The stream encryption device 200 converts the input data stream into a pseudo-random number output from a pseudo-random number generator 201 described later and an exclusive-OR element 20 described later.
This is an encryption device that performs an exclusive OR operation at 2 and outputs the result as an encrypted output. The pseudo-random number generation device 201 is a device for generating a pseudo-random number in the stream encryption device 200. The pseudo-random number generation device 201 receives an input from an initial setting input terminal 203 and a clock input terminal 204, which will be described later, and outputs a pseudo random number. The exclusive OR operation element 202 performs an exclusive OR operation of the pseudorandom number output from the pseudorandom number generator 201 and the input data stream before being encrypted. The initial value setting input terminal 203 is a terminal for performing input for initial setting to the pseudorandom number generator 201 described above. The clock input terminal 204 is a terminal for inputting a clock signal as a synchronization input to the pseudorandom number generator 201. The plaintext input terminal 205 is a terminal to which a data stream signal (plaintext) before being encrypted is input. The encryption output terminal 206 is a terminal to which a data stream signal encrypted by the stream encryption device 200 is output. With this stream encryption device,
The plaintext data stream signal is encrypted and output by performing an exclusive OR operation on the pseudorandom number and bit by bit.

Next, the filter generator will be described with reference to FIG. 3, which is a block diagram showing the configuration of the filter generator, which is an example of the pseudorandom number generator 201 shown in FIG. As described above, the pseudo random number generation device 300 is a filter generator as an example of the pseudo random number generation device 201 shown in FIG. The linear feedback shift register 301 is a register for obtaining a numerical value serving as a source for generating a pseudo random number. The non-linear conversion function circuit 302 receives a value of each register of the linear feedback shift register 301 as an input, converts the value by a non-linear conversion function, and generates and outputs a pseudo random number. The shift register initial value setting input terminal 303 is an input terminal for setting an initial value to each register of the nonlinear feedback shift register 301. Clock input terminal 304
Is an input terminal for inputting a synchronization clock to the linear feedback shift register 301. The pseudorandom number output terminal 305 is a terminal that outputs the pseudorandom number sequence output from the non-linear conversion function circuit 302, and the output is input to, for example, the exclusive OR operation circuit 202 illustrated in FIG. . Here, the linear complexity which is one of the indexes indicating the cryptographic strength of the filter generator shown in FIG. 3 will be described. The linear complexity is determined by the pseudo random number output terminal 30.
5 is defined by the register length of an equivalent linear feedback shift register capable of imitating the output of the pseudo-random number sequence from No. 5. In addition, if the initial value of the linear feedback shift register can specify the value of a certain register in the linear feedback shift register by twice the register length of the linear feedback shift register, the initial value based on the specific value It can be determined by solving the following equation. Therefore, the pseudo-random number sequence of the filter generator having a small linear complexity defined by the register length also has a register value twice as long as the register length required for obtaining the initial value. Can be easily estimated and is difficult to use for encryption. Regarding the relationship between the register length of the linear feedback shift register and the value of one of the registers,
When the cycle in which the value of one register of the linear feedback shift register whose register length is L changes due to the clock input is repeated at 2 ^L −1, the periodic series of register values is assumed to be an m series. To tell. Then, an m-series register value at a certain time t is represented by s (t),
The linear complexity z (t) of the equation (Equation 1) is theoretically greater than or equal to the equation of the binomial coefficient (Equation 2).
"Analysis and Design of stream Cipher by Rueppel
s, "Springer-Verlag p84-86), provided that the highest order of f is less than k and that the greatest common divisor of the following equation (Equation 3) is satisfied. I have.

[0004]

(Equation 1)

[0005]

(Equation 2)

[0006]

(Equation 3) Next, the linear feedback shift register 301 shown in FIG. 3 will be described with reference to FIG. 4, which is a block diagram showing a schematic configuration of the linear feedback shift register. As described above, the linear feedback shift register 400 has been conventionally used in the filter generator (pseudo random number generation device 300) shown in FIG. Each register of the linear feedback shift register 400 shown in FIG.
The output of each D flip-flop element 402 is output to the next stage D flip-flop element 402 and is converted by a predetermined coefficient determined for each D flip-flop element to obtain an exclusive OR operation element 401 Then, the exclusive OR operation with the value calculated by the exclusive OR operation element 401 is sequentially performed from the last stage D flip-flop element. The value of each register of the linear feedback shift register shown in FIG. 4 is shown by the following equation (Equation 4).

[0007]

(Equation 4) In order to guarantee the above-mentioned linear complexity z (t) in the linear feedback shift register shown in FIG. 4, in the term of the highest order of the nonlinear function of Expression (Equation 4), δ satisfying Expression (Equation 3) is satisfied. If the linear feedback shift register is constituted by k registers that are continuous at intervals of, a complexity higher than the linear complexity described above can be obtained, which can be guaranteed. On the other hand, as a linear feedback shift register, one having a configuration other than that shown in FIG. 4 is known as shown in FIG. The linear feedback shift register shown in FIG. 5 can operate at a higher speed than that shown in FIG. The reason why the high-speed operation is possible is as follows. In order to compare the delay time due to the processing of the D flip-flop 502 constituting each register of the linear feedback shift register 500 with u and the delay time due to the processing of the exclusive OR operation element 501 between the D flip-flops 502 as v, The delay time due to the processing of the D flip-flop 402 constituting each register of the linear feedback shift register 400 shown in FIG. 4 is u, and the delay time due to the processing of the exclusive OR operation element 401 is also the same as that shown in FIG. In the case of the linear feedback shift register shown in FIG. 4, the portion where the delay occurs most between the registers is the last stage D flip-flop X _L (t) to L−1
This is a feedback path through the exclusive OR operation elements to the first stage D flip-flop X ₁ (t), and its delay time is represented by the following equation (Equation 5).

[0008]

(Equation 5) On the other hand, in the linear feedback shift register shown in FIG. 5, the portion where the delay occurs most between the registers is any one of the paths input from the last stage to each of the D flip-flops other than the first stage. The same applies only to the exclusive OR operation elements 501. The delay time in that case is the sum of the delay u due to the processing of one D flip-flop and the delay v due to the processing of one exclusive OR operation element, as shown in the following equation (Equation 6).

[0009]

(Equation 6) Here, the maximum clock interval for synchronization of the filter generator (pseudo-random number generator 300) shown in FIG. 3 is determined by the delay time of the portion where the most delay occurs, as described above. In the device, the use of the linear feedback shift register shown in FIG. 5 seems to be effective for generating a stream cipher at high speed.

[0010]

However, the operation of the linear feedback shift register shown in FIG.
And the values of the registers other than the first stage are also complicated, so that the magnitude of the linear complexity can be theoretically guaranteed, and
The configuration of the non-linear conversion function circuit corresponding to the non-linear conversion function circuit 302 shown in FIG. 3 using the linear feedback shift register shown in FIG. 5 is not known.
In the filter generator using the linear feedback shift register shown in FIG.
A method for performing the above has not been known. In the present invention, in view of the above-described problem, a filter capable of generating a stream cipher cipher whose linear complexity is theoretically equal to or more than the above equation (Equation 2) using the linear feedback shift register shown in FIG. An object of the present invention is to provide a generator (pseudo random number generator).

[0011]

In order to achieve the above object, according to the present invention, there are provided a plurality of stages of registers operating in synchronization with a synchronization signal, and an exclusive OR operation element between the registers. After setting the initial value in the register, a feedback value of the logical product of the set value of the final stage register and a predetermined value set for each of the exclusive OR elements is input to the exclusive OR element, The exclusive-OR element performs an exclusive-OR operation on the output value of the previous-stage register and the feedback value and outputs the result to the next-stage register, and a predetermined number of stages that are continuous from the first stage of the linear feedback register. Each register value of the linear feedback register is non-linearly converted to 1 bit using a non-linear conversion function having the highest order term formed by a logical product of the register values. A non-linear conversion function circuit that outputs a pseudo random number output for each synchronization signal, an initial value setting unit that sets an initial value in the linear feedback register, and a synchronization signal input unit that inputs a synchronization signal to the linear feedback register. By providing a non-linear conversion function circuit capable of supporting the linear feedback shift register, a high-speed stream cipher can be generated.

[0012]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing the configuration of one embodiment of the present invention. The pseudorandom number generator 100 includes a linear feedback shift register 101 of the same type as that shown in FIG.
2 is a pseudo-random number generator. The value of each register in the linear feedback shift register 101 is represented by the following equation (Equation 7).

[0013]

(Equation 7) Here, assuming that the value x1 (t) of the first-stage register is s (t), the value of each register in FIG. 1 is represented by the following equation (Equation 8).

[0014]

(Equation 8) Further, the lowermost equation of this equation (Equation 8), that is, the generator polynomial of the first-stage equation of the linear feedback shift register is represented by Equation (Equation 9).

[0015]

(Equation 9) If the equation (Equation 9) is an irreducible polynomial whose root is a primitive root (primitive element), it indicates that the register value s (t) at a certain time t is an m-sequence. The value can be represented by a linear combination of this s (t) time delay term. In the linear feedback shift register 101 of FIG. 1, in order to satisfy the lower limit equation (Equation 2) of the linear complexity described above, the values of k registers consecutive from the first-stage register in the equation (Equation 8) are obtained. A logical product is generated, and the generated value is set to the highest order term of the nonlinear conversion function circuit 103. K consecutive from the actual first stage register
The logical product of the values of the registers is given by the following equation (Equation 10).

[0016]

(Equation 10) Note that O (k-1) in the equation (Equation 10) represents all of the following terms following k-1. Also, s (t−
α) s (t−α) = s (t−α). By configuring the nonlinear conversion circuit as described above, it is possible to configure a filter generator (pseudo-random number generator) whose linear complexity is theoretically equal to or more than the mathematical expression (Equation 2) as shown in FIG.

The operation of the configuration shown in FIG. 1 is as follows. First, an initial value is input from the initial value setting terminal 104 to the D flip-flops 107 to 111 in the linear feedback shift register 101 and set. Then, when the clock input from the clock input terminal 105 enters the linear feedback shift register 101, each D flip-flop takes the logical product of the value stored in the last D flip-flop 111 and the predetermined value a _i . The logical sum of the value and the value stored in the preceding D flip-flop is generated and stored by each of the exclusive OR elements 112 to 114. The first stage D flip-flop 107 has
Exceptionally, the value stored in the last D flip-flop 111 is stored as it is. Nonlinear transformation function circuit 1
02, in the output of each register of the linear feedback shift register 101, the first stage D flip-flop 10
The inputs of the k D flip-flops are input to the logical operation element 116 continuously from step 7, and the k-th logical product output is obtained from the logical product operation element 116. On the other hand, in the nonlinear conversion function circuit 103 whose order is less than the k-th order, each register (D flip-flop) of the linear feedback shift register 101
And outputs a 1-bit nonlinear conversion value. The k-th AND output from the AND operation element 116 and the non-linear conversion value from the non-linear conversion function circuit 103 are subjected to exclusive-OR operation in the exclusive-OR operation element 106 to generate pseudo-random numbers. Is output. With the configuration and operation as described above, using the linear feedback shift register of FIG. 5 (FIG. 1), a high-speed stream cipher cipher whose linear complexity is theoretically equal to or more than the above equation (Equation 2) is obtained. To provide a filter generator (pseudo-random number generation device) capable of generating.

[0018]

As described above, according to the present invention, a plurality of stages of registers operating in synchronization with a synchronization signal and an exclusive OR operation element between the registers are provided. The feedback value of the logical product of the set value of the register of the stage and the predetermined value set for each exclusive OR operation element is input to the exclusive OR operation element. Using a linear feedback register that performs an exclusive OR operation on the output value and the feedback value and outputs the result to the next-stage register, the highest-order logical product of the register values of a predetermined number of successive stages from the first stage of the linear feedback register Nonlinear conversion for nonlinearly converting each register value of a linear feedback register using a nonlinear conversion function having a term and outputting a 1-bit pseudorandom number output for each synchronization signal The number circuit, fast, and can provide a pseudo-random number generator safely used for encryption.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of an embodiment of the present invention.

FIG. 2 is a block diagram illustrating a schematic configuration of a stream encryption device.

FIG. 3 is a block diagram showing a configuration of a filter generator.

FIG. 4 is a block diagram illustrating a schematic configuration of a linear feedback shift register.

FIG. 5 is a block diagram illustrating a schematic configuration of a linear feedback shift register different from FIG. 4;

[Explanation of symbols]

100, 201, 300... Pseudorandom number generator, 10
1, 301, 400, 500 ... linear feedback shift register, 102, 103, 302 ... nonlinear conversion function circuit, 104, 203 ... input terminal for initial value setting, 105, 204, 304, ... ..Clock input terminals, 106 and 305... Pseudorandom number output terminals, 1
07 to 111, 402, 502... D flip-flop elements, 112 to 115, 202, 401, 501,.
An exclusive OR operation element, 116, an AND operation element, 200, a stream encryption device, 205, a plaintext input terminal, 206, a ciphertext output terminal, 303
・ Input terminal for shift register initial value setting

[Procedure amendment]

[Submission date] August 12, 1998

[Procedure amendment 1]

[Document name to be amended] Statement

[Correction target item name] 0003

[Correction method] Change

[Correction contents]

Next, the filter generator will be described with reference to FIG. 3, which is a block diagram showing the configuration of the filter generator, which is an example of the pseudorandom number generator 201 shown in FIG. As described above, the pseudo random number generation device 300 is a filter generator as an example of the pseudo random number generation device 201 shown in FIG. The linear feedback shift register 301 is a register for obtaining a numerical value serving as a source for generating a pseudo random number. The non-linear conversion function circuit 302 receives a value of each register of the linear feedback shift register 301 as an input, converts the value by a non-linear conversion function, and generates and outputs a pseudo random number. The shift register initial value setting input terminal 303 is an input terminal for setting an initial value to each register of the nonlinear feedback shift register 301. Clock input terminal 304
Is an input terminal for inputting a synchronization clock to the linear feedback shift register 301. The pseudorandom number output terminal 305 is a terminal that outputs the pseudorandom number sequence output from the non-linear conversion function circuit 302, and the output is input to, for example, the exclusive OR operation circuit 202 illustrated in FIG. . Here, the linear complexity which is one of the indexes indicating the cryptographic strength of the filter generator shown in FIG. 3 will be described. The linear complexity is determined by the pseudo random number output terminal 30.
5 is defined by the register length of an equivalent linear feedback shift register capable of imitating the output of the pseudo-random number sequence from No. 5. In addition, if the initial value of the linear feedback shift register can specify the value of a certain register in the linear feedback shift register by twice the register length of the linear feedback shift register, the initial value based on the specific value It can be determined by solving the following equation. Therefore, the pseudo-random number sequence of the filter generator having a small linear complexity defined by the register length also has a register value twice as large as the register length required for obtaining the initial value. Can be easily estimated and is difficult to use for encryption. Regarding the relationship between the register length of the linear feedback shift register and the value of one of the registers,
When the cycle in which the value of one register of the linear feedback shift register whose register length is L changes due to clock input is repeated at 2 ^L −1, the periodic series of register values is assumed to be an m series. To tell. Then, an m-series register value at a certain time t is represented by s (t),
The linear complexity of the equation (Equation 1) is theoretically greater than or equal to the equation of the binomial coefficient (Equation 2).
ueppel, "Analysis and Des
ignof stream Ciphers, "Spr
inger-Verlag p84-86). However, the condition is that the highest order of f is less than k and the greatest common divisor of the following equation (Equation 3) is satisfied.

[Procedure amendment 2]

[Document name to be amended] Statement

[Correction target item name] 0007

[Correction method] Change

[Correction contents]

[0007]

## EQU4 ## In order to guarantee the above-mentioned linear complexity in the linear feedback shift register shown in FIG. 4, in the term of the highest order of the nonlinear function of equation (4), δ satisfying the above equation (3) If the linear feedback shift register is constituted by k registers that are continuous at intervals of, a complexity higher than the linear complexity described above can be obtained, which can be guaranteed. On the other hand, as a linear feedback shift register, one having a configuration other than that shown in FIG. 4 is known as shown in FIG. The linear feedback shift register shown in FIG. 5 can operate at a higher speed than that shown in FIG. The reason why the high-speed operation is possible is as follows. In order to compare the delay time due to the processing of the D flip-flop 502 constituting each register of the linear feedback shift register 500 with u and the delay time due to the processing of the exclusive OR operation element 501 between the D flip-flops 502 as v, The delay time due to the processing of the D flip-flop 402 constituting each register of the linear feedback shift register 400 shown in FIG. 4 is u, and the delay time due to the processing of the exclusive OR operation element 401 is also the same as that shown in FIG. In the case of the linear feedback shift register shown in FIG. 4, the portion where the delay occurs most between the registers is the last stage D flip-flop _XL (t) to L-1
This is a feedback path through the exclusive OR operation elements to the first stage D flip-flop X ₁ (t), and its delay time is represented by the following equation (Equation 5).

Claims (1)

[Claims] An exclusive OR operation element is provided between a plurality of registers operating in synchronization with a synchronization signal and each register.
After setting the initial value in each of the registers, a feedback value of a logical product of the set value of the register in the final stage and a predetermined value set for each of the exclusive OR elements is input to the exclusive OR element. The exclusive-OR operation element performs an exclusive-OR operation on the output value of the previous-stage register and the feedback value, and outputs the result to the next-stage register. Each register value of the linear feedback shift register is non-linearly converted by using a non-linear conversion function having the highest order term formed by a logical product of register values of a predetermined number of stages, and a 1-bit pseudo random number output is output for each of the synchronization signals. A non-linear conversion function circuit for outputting to the initial value setting means for setting an initial value in the linear feedback register; Pseudorandom number generator and having a synchronization signal input means for inputting a synchronizing signal to form a feedback shift register.