JPS61239328A - Random number generator - Google Patents

Abstract

PURPOSE:To generate highly stable random number sequence at a high speed when bits of random number sequence are obtained, by performing four operations of y=[a(y2-y1)(mod q)]p+y1 by using a remainder theorem instead of operating y=x<2>(mod n). CONSTITUTION:Selectors 101 and 104 respectively store given y0 and z0 in registers 102 and 105 under the initial state and outputs of square remainder circuits 103 and 106 in the registers 102 and 105 after the initial state. The square remainder circuits 103 and 106 respectively count yi=yi-1<2>(mod p) and zi=zi-1<2>(mod q) against integers yi-1 and zi-1 stored by the registers 102 and 105 by using prime numbers (p) and (q). An arithmetic circuit 107 calculates 'the lowest-order bit of bi=[a(zi-yi)(mod q)]p+y1' from yi and zi by using the prime numbers (p) and (q) and an integer (a) and outputs the lowest-order bit.

Description

[Detailed description of the invention] (Industrial application field) The present invention relates to a random number generator used in cryptographic communications and the like.

(Prior art and its problems) Random number sequences used in encrypted communications etc. must be generated up to a certain point in time, and the random numbers to be generated after that point cannot be easily determined from only the t random number sequence.In 1983, ADVANCES IN CLIFTOLOGY (ADVANCE) published by PLENUMPRES8
A random number sequence that satisfies this condition is published on pages 61 to 78 of SIN CRYPTOLOGY. That is, the random number sequence is (bl.

Je...), then bit bi stile bi = [
Xi least significant bit J (n=1.2゜...) However, xj= x, -1 (mod n) (n=
1e 2*・-"), xo: An initial integer given arbitrarily by the user, n = p-q (p, q': is a prime number). However, n'g: The same effort is required when factoring. It is shown in the above literature that bi+1' can be calculated from only bi by multiplying b1*Js..., bi. It is necessary to make the length in bits, but in this case x (mod
The disadvantage is that the calculation of n) is time-consuming.

(Object of the Invention) It is an object of the present invention to eliminate the above-mentioned drawbacks and generate highly secure random numbers at high speed compared to conventional methods.

(Structure of the invention) The random number generator of the present invention has a first integer input yi-□.

(n=1.2.3...) and the first prime number p
a first calculation means for calculating yi=fcyi-0)Cmod p) using a first function af from to obtain a first integer output yi; a second integer input Xi-□ and a second prime number; a second calculation means for calculating z = f (zH - t) (mod q) from q using the first function to obtain a second integer output zi; The initial integer y0 is stored and output as the initial value of the first integer input difference (-□, and updated to this output every time the first calculation means outputs the first integer output y. a first storage means for storing and outputting the first integer input y; storing a second initial integer Zok in an initial state and outputting the second integer input Z as an initial value of □; a second storage means for updating and storing the second integer output zi to a 00 output each time the second arithmetic means outputs the second integer output zi and outputting it as the second integer input "i-1"; One integer output Yi, second integer output zi, one prime p, second prime q and third integer a
1((a(zi-yi)(m
od q)) p+yH)- and third calculation means for calculating and outputting the result.

(Operation/principle of the present invention) The aforementioned random number sequence (b1* b2* bSm...)
When obtaining the bits bi of , the operation that takes the most time is expressed as a general formula: y=x 2 (moQjin5). However, since n=p-q, using the Chinese remainder theorem, y is given by the following equation.

Y=apYs ”1)(1)'t (mod n
) (1) However, )'t =X
(nod p)7, ==X (nod q) gl p + b q = 1 (
2) The Chinese remainder theorem is, for example, 3 of the 5th edition of "Coding Theory" published by Shokodo (written by Miyayo, Iwadare, and Imai, 5F3, 1954).
It is listed on pages 11 to 312. Now, the formula (1) is replaced by the formula (
2), Y=a()'x −3't )p”Yl (mod
n), and considering dividing by %n=1)-(l,
y=(a(Y2-'/t)(modq))p+
y1 (mod n). By the way, (aO'z-
'11)(mod q))1)")'t is already smaller than nx, because 0 < acYz - Yx ) (m
od q)riQ-10<yx<p-i ga>'3 0 < (a(Yx -3't) (mod q))
p+y ward ('!-+)P+P-t =Pya (because 纔-1 is indicated. Therefore, y is)'=[a('!z -7t) (mod q))
・p+yt(3) However, Yx =X (mod
p) (4)yH=x (mod q
) is given by (5). Equation (3), (4
) and (5), it can be executed using four arithmetic operations with numbers less than or equal to max(ptq), so it is faster to calculate as y==x (mod n). Equations (3), (4), (5
Random number sequence using 1e (bl, b snow, b3...)
Note bi is the least significant bit of b゛=rxi''! However, x-=(a(z--y)(mod q)'Jp4-Vj
J jJ two characters 3' jY J -1(rno d p)z-=z
2 (mod q) J J-1 YosZo is an integer given by the user a=p (mod q) 0 The present invention is a random number generator that generates a random number sequence based on this principle.

(Embodiment) FIG. 1(a) is a block diagram showing a first embodiment of the present invention. In the figure, selectors 101 and 104 are initialized to a given y, and yz
, are stored in registers 02 and 105, respectively, and after the initial state, outputs of squared remainder circuits 103 and 106, which will be described later, are stored in registers 02 and 105, respectively.

The square remainder circuits 103 and 106 use the prime number ptq to calculate the integer Yi-x stored in the registers 102 and 105.
, "i-□, respectively )'i")'i-□'(m
od p) and “i=”l-1” (mod ct)
! Count. The arithmetic circuit 107 calculates from the Yi and Xi using the prime numbers p, q and the integer a: b i = "(a(zi-yi)(mod q)) p+yi
Calculates and outputs the least significant bit of .

The arithmetic circuit 107 [81 is illustrated in the block diagram shown in FIG. 81(b). In the figure, the subtraction circuit 108 inputs yi and zi
zi−Yi is calculated from , and the multiplication/division circuit 109 calculates a(
zH-yH) (mod q) and multiplier circuit 110
Then, p is further added, and the adder circuit 111 further adds the above-mentioned yi. As a result, Its (a(zH-yi)(mod
q))-p+yi, but the selector 112 extracts this lowest pip)f and outputs it.

It is the 9th block diagram which shows the Example of the hawk 2 of this invention in a wcz diagram. In the figure, in the initial state, selectors 201 and 204 select the respective input y o *Zo', and after the initial state, selectors 201 and 204 select the register 205 to be described later.
and the output of the squared remainder circuit 203 are selected and stored in the registers 202 and 205, respectively. Squared remainder circuit 203 [Squares the number stored in the register 202 and calculates p
Or output the remainder after dividing by q. The order in which p and q are used is as follows. First use rz p 1c, then use q and repeat the following. The arithmetic circuit 206 is operated only at time t when the remainder square circuit 203 uses pt. to this,
Just before this point, enter yi and z in registers 202 and 205.
This is because i is stored. Arithmetic circuit 206 is exactly the same as arithmetic circuit 107 described above.

Therefore, the output is also the same bi.

In the above explanation, even if p and qtl are exchanged, the output is exactly the same.

In the above explanation, an example was described in which random numbers are generated using the polynomial yi = yi-1, but this need not be limited to Yi = 3'i, -0, and y = f.
Cyi).

Furthermore, in the above description, in the selector 112,
(a(zi-yi)(mod q))-p+yi f
) Friend mentioning the configuration in which the least significant bit is taken out.

But this ttl CaCz--y-)Cmod q
)) ・The configuration may be such that p+yil decreases. In this case, the selector 112 will be replaced by a comparator.

(Effects of the Invention) As described above in detail, according to the present invention, highly secure random numbers can be generated at high speed compared to conventional methods.

[Brief explanation of drawings]

FIG. 1(a) is a block diagram showing the first embodiment of the present invention, FIG. 1(b) is a block diagram showing the arithmetic circuit of FIG. 1(a), and FIG. 2 is a block diagram showing the first embodiment of the present invention. It is a block diagram showing an example of. In the figure, 101, 104, 112, 201°204
is a selector, 102, 105, 202゜205 is a register, 103, 106, 203 is a square remainder circuit, 107,
206 is an arithmetic circuit, 108 is a subtraction circuit, 109 is a multiplication/division circuit, 110 is a multiplication circuit, and 111 is an addition circuit. Figure 1 (of) lθ4 1o! ; 1, Q ya~ -1≧b N

Claims (1)

[Claims] First integer input y_i_-_1 (i=1, 2, 3,...
) and the first prime number p to the first function f
a first calculation means that calculates y_i=f(y_i_-_1) (mod p) using , and obtains a first integer output y_i; a second calculation means for calculating z_i=f(z_i_-_1) (mod q) using the first function f to obtain a second integer output z_i; and storing the first initial integer y_o in an initial state. is output as the initial value of the first integer input y_i_-_1, and each time the first calculation means outputs the first integer output y_i, it is updated to this output and stored, and the first integer is Input y_
a first storage means for outputting as i_-_1; a second calculating means for storing a second initial integer z_o in an initial state and outputting it as an initial value of the second integer input z_i_-_1; Every time the second integer output z_i is output, it is updated to this output and stored, and the second integer input z
a second storage means for outputting as _i_-_1; and a second function from the first integer output y_i, the second integer output z_i, the first prime number p, the second prime number q and the third integer a. Using g, g{[a(z_i-y_i)[mod
q)] third calculation means for calculating and outputting p+y_i}.