WO2015043855A2

WO2015043855A2 - Generation of random bits

Info

Publication number: WO2015043855A2
Application number: PCT/EP2014/068057
Authority: WO
Inventors: Markus Dichtl
Original assignee: Siemens Aktiengesellschaft
Priority date: 2013-09-30
Filing date: 2014-08-26
Publication date: 2015-04-02
Also published as: DE102013219768A1; WO2015043855A3

Abstract

The invention relates to a method and a device for generating random bits using an electronic circuit. The random signal is fed to at least two counter units in parallel within the electronic circuit. With the method described it is possible to detect random events in a time period. The amount of entropy that can be extracted from a signal at a point in a random number generator can be increased using the method described.

Description

description

Generating Random Bits The invention relates to a method and apparatus for generating random bits by means of an electronic circuit.

In security-relevant applications, for example in asymmetric authentication methods, random bit sequences are necessary as binary random numbers. Known measures to generate random numbers use analogous random sources. As analogue random sources, noise sources such as the noise of zener diodes are amplified and digitized. Digital is connected with analog circuit technology.

A source for generating random data is an important prerequisite for many security applications. Especially in the case of cryptographic methods, keys and once-used values, so-called nonces, are derived from the generated random bits. High demands are made on the quality of the random bits used for this purpose: ideal random bits must be distributed equally, and several bits must be statistically independent of one another. That is, the source for generating the random bits must have a high entropy.

Ring oscillator circuits, which include both classic ring oscillators, multi-track oscillators, Fibonacci ring oscillators, and Galois ring oscillators, are used to generate random numbers in which a number of logic gates are fed back. In this case, all the gates are in a feedback loop formed by the other gates, so that a signal change at the output of a gate can potentially return to an input of the gate after the path via the feedback loop formed from other gates. For example, in ring oscillator circuits, a random jitter results from fluctuating throughput times of the signals by inverters. This jitter, that is to say an irregular variation over time in changes in state of the signals sent by the inverters, can be accumulated in the case of multiple passes through the ring oscillator circuit, so that ultimately a random analog signal is produced.

For example, a multiplier random number generator uses a binary multiplication calculator present on an FPGA. Output or result bits are fed back to input bits, so that oscillations arise, resulting in practically random signal waveforms.

In feedback-less multi-track random number generators, there is no feedback loop such that a state change of at least one feedback output of one imaging device is supplied as a change in state of at least one input signal of another imaging device such that one or more output signals of the imaging device are affected by the state change of the feedback output signal.

The prior art discloses methods of generating true random numbers that gain these bits by bit. One bit is sampled, then waited for a sufficiently long time until one can assume a statistically independent state of the system from the previous state, and then again sampled one bit. This procedure is used iteratively.

It is known to sample oscillating feedback circuits at multiple locations simultaneously and to algorithmically compress the sampled bits into a single bit. For such a compression XOR operations of the bits are usually made. For example, such a circuit is disclosed in the paper by K. Wold, CH Tan, "Analysis and enhancement of random number generators in FPGA based on oscillator rings ", Proc. of ReconFig 2008, Cancun, 2008, pp. 385- 390. With high energy consumption, a low data rate is achieved here.

The goal of generating true random numbers is to gain as much entropy as random bits from a random event induced by a random number generator while keeping energy consumption low.

Against this background, it is an object of the present invention to provide a method and a device with particularly high energy efficiency in Randiesbiterzeugung.

This object is achieved by a method and apparatus for generating random bits. Advantageous embodiments and further developments are specified in the subclaims.

The advantages mentioned below need not necessarily be achieved by the subject-matter of the independent claims. Rather, it may also be advantages, which are achieved only by individual embodiments or developments.

According to the invention, a method for generating random bits by means of an electronic circuit configured to generate a random signal comprises the following steps: the random signal within the electronic circuit is fed to at least two counter units. By an edge of the random signal, a respective counter value of the at least two counter units is changed. The respective counter value is read out at a predefinable time. From the read out respective counter values, the random bits are formed. The electronic circuit is, for example, a random number generator such as a Fibonacci ring oscillator, a Gallois ring oscillator, a multi-track oscillator, a multiplier random number generator or a feedback-free multi-track random number generator.

The electronic circuit comprises, for example, imaging devices, wherein, depending on the random number generator used, inverters, NAND gates, i. negated AND gates, NOR gates, i. negated OR gates, binary multiplication calculators, cascading gates such as XOR gates, i. exclusive OR gates, or XNOR gates, i. negated exclusive OR gates, etc. are used.

As components of the electronic circuit, analog elements such as inverting amplifiers can be installed. Furthermore, the use of completely digital components in the device for generating random bits is advantageous because a cost-effective implementation is possible.

Logical functions performed by the mapping devices can also be realized by look-up tables or so-called lookup tables. Lookup tables are particularly applicable to field programmable gate arrays, FPGAs for short. Instead of implementing gates with a corresponding desired functionality, in this case tables are stored, which look up the outputs in their memory depending on the input bits. For example, for a number of z input bits, the LUT has 2 ^Z addresses.

As the number of counter units, also called counters, two or more, for example, 3, 4, or 32 counters are used. Thus, the inputs of several counters are connected to a signal within the electronic circuit. The signal is derived at one point of the electronic circuit and fed to the counters as input. The counters are implemented in such a way that they change their counter value by a certain amount, for example by the value 1, on edges of the input signal, ie of the random signal supplied. The counter value is information that can be queried or read out by the counter. This information, for example, 0, stored until the occurrence of an edge in the random signal, ie a change from logic 0 to logical 1 or vice versa. The edge causes the counter value to change, for example from 0 to the value 1. The new counter value 1 is stored until the next edge occurs.

The described method enables detection of random events from a time interval. By contrast, in the case of conceivable sampling of signals, a time given by a clock would be decisive for the generation of the random bits. If the time when there is sufficient entropy from a signal is difficult to estimate, sampling at fixed times is disadvantageous. On the other hand, the method described is advantageously applicable to systems in which a time with random behavior is difficult to determine.

The entropy yield extractable from a signal at a location of a random number generator is increased by the described method.

According to one embodiment, at least one of the respective counter values is read out at predefinable times, in particular periodically or randomly.

Thus, during operation of the electronic circuit, random bits, for example at a distance of one microsecond or, for example, as a function of gate transit times of the installed imaging devices, random bits are generated as raw Zufauszahlen. The read may also be coupled to a restart of the random number generator. The time may depend in particular on a If the number of digits is selected, reading takes place at irregular, random intervals.

According to one embodiment, at least one of the respective counter values is reset after a readout.

In a subsequent readout is then not counted from the old count, which was present in the first read, but in at least one of the counter units counting from a defined initial state.

For example, one of the counter units or several of the counter units or all of the installed counter units is reset to a fixed value, for example the value 0.

According to one embodiment, a respective counter value of the at least two counter units is changed by an edge of predetermined direction of the random signal.

There are counters which change their counter value at each occurring edge, both with a negative and with a positive edge, that is, for example, both from a change from logical 0 to logical 1 and from logical 1 to logical 0.

Furthermore, counters can be used which change their counter value only at the edge of the predetermined direction, that is to say, for example, only with a positive edge or only with a negative edge.

According to a development, a post-processed random bit sequence is generated as a function of the read-out respective counter values with the aid of an algorithmic post-processing.

The raw Zufauszahlen be, for example, using the post-processing method, by A. Juels, M.

Jakobsson, E. Shriver, and B. Hillyer, in How to Turn Loaded Dice into Fair Coins "(IEEE Transactions on Information Theory, May 2000).

Furthermore, cryptographic algorithms are advantageous. An example of a suitable cryptographic function is the application of a cryptographic hash function (eg, KECCAK, see http://keccak.noekeon.org/) to the raw feed numbers. In this case, fewer bits are used by the hash value for generating the postprocessed random bit sequence than corresponds to the entropy contained in the counter readings.

As cryptographic functions for post-processing also block ciphers come into question.

According to one embodiment, a modulo counter is installed as counter unit, where m is a natural number greater than one.

Binary counters common in random number generators are modulo m counters without additional circuitry, where m is a power of two whose exponent is given by the number of flipflops in the binary counter.

According to one embodiment, a toggle flip-flop is installed as the counter unit.

A particularly simple form of modulo-2 counter is a toggle flip-flop which inverts its one-bit count, in particular at each positive edge of its input signal.

The invention further relates to an apparatus for generating random bits comprising

an electronic circuit for generating a random signal,

at least two counter units for detecting the random signal within the electronic circuit and for supplying ehern a respective counter value m depending on an edge of the random signal;

a respective output node of the respective counter unit for picking up the respective counter value at a predetermined time;

a processing unit for generating random bits from the tapped respective counter values.

The proposed device allows a large

Entropy yield, that is, a high rate of random generation. As a result, a random number generator with low energy consumption is advantageously realized. At the same time, hardware costs are low

According to one embodiment, at least one of the respective counter values can be tapped off at a predetermined time, in particular periodically.

According to one embodiment, at least one of the respective counter values can be reset after tapping.

According to one embodiment, the at least two Zählerein units for storing a respective counter value in response to an edge of predetermined direction of the random signal are formed.

According to a development, the processing unit for carrying out an algorithmic postprocessing is suitable for generating a postprocessed random bit sequence from the tapped respective counter values.

According to one embodiment, a modulo counter is installed as the counter unit.

According to one embodiment, a toggle flip-flop is installed as the counter unit. The invention will be explained in more detail below with exemplary embodiments with reference to the figures. FIG. 1 shows a schematic representation of an apparatus for generating random bits according to a first exemplary embodiment of the invention;

Figure 2 is a schematic representation of an apparatus for generating random bits according to a second embodiment of the invention;

Figure 3 is a schematic representation of an apparatus for generating random bits according to a third embodiment of the invention;

Figure 4 is a schematic representation of an apparatus for generating random bits according to a fourth embodiment of the invention.

In the figures, functionally identical elements are provided with the same reference numerals, unless stated otherwise.

FIG. 1 shows a multi-track random number generator as an electronic circuit 10 suitable for generating a random signal ZS. In a multitrack random number generator, there are several channels or tracks which are fed to a respective mapping device K1, K2,..., K100. Each mapping device has inputs defined by the number of tracks. Signals from the channels are combined for each imaging device and evaluated, for example, with lookup tables, or LUTs for short. Each lookup table provides an output bit, with the output bit of each lookup table being affected by a change in a logic state on one of the input signals. This duplicates a jitter that is used as a random source. The multi-track random number generator has the length 100, ie consists of 100 imaging devices K1, K2,..., K100, which are realized, for example, via look-up tables LUT. To an output bit of a feedback-free 4-track random number generator with the random signal ZS 32 toggle flip-flops as counter units 101, 102, ..., 132 are attached in parallel. The counter values of the toggle flip-flops, ie the respective state of each toggle flip-flop, are input to the input at a time after a transition from the input "0000", ie 4 zero bits as input bits for the four tracks of the 4-track random number generator. 1111 ", ie 4 bits as input bits.

The transition is made repeatedly and the toggle flip-flops are reset to 0 before each transition.

After the 4698035-fold repetition of the process are present in 86.6 percent unique values of the toggle flip-flops, that is, in these cases all toggle flip-flops have the value 0 or all the value 1. This is the stored by the toggle flip-flop counter value. The tapping of the stored counter values takes place via a respective output node 201, 202,..., 232 of the respective counter unit 101, 102,..., 132. The respective counter values are transmitted to a processing unit 20, which performs an algorithmic postprocessing of the tapped respective counter values performs. The remaining fraction in the series increases the entropy of the output to 2.3998 bits per trial. This entropy is used to generate the random bits.

The following first table indicates the frequencies of the 20 most frequently occurring bit patterns in the described embodiment of the device. On the left side of each line is the number of occurrences of the pattern in the total of 4698035 attempts, on the right the pattern in hexadecimal

Notation: Table 1 :

2064137 FFFFFFFF

2005595 00000000

50019 14500025

45097 EBAFFFDA

39828 FBFFFFFF

36053 04000000

17829 00200000

13563 EBAFFDDA

11986 FFDFFFFF

10656 14500225

10329 555D4775

8009 FBFFFFDF

7616 EBA7FC9A

7551 14504365

7274 AAA2B88A

6720 EBA37C9A

6654 E9A37C9A

6439 28A15802

6269 14500365

6186 04000020

Figure 2 shows a second embodiment for carrying out the method. On the feedback-free 4-track

Random number generator according to the first embodiment are now attached to an output bit with the random signal ZS four 8-bit counter as counter units 101, 102, 103, 104. With 2263571 times random bite extraction, the 20 patterns listed in the second table are most frequently observed. According to the first table, the decimal frequency is on the left and the pattern on the right. Each count is represented by two consecutive hexadecimal characters.

Table 2: 361907 04040404 226367 03030303

187768 05050505

129439 05040505

87592 04030404

77225 05060505

69854 06050606

62520 06060606

51156 02020202

43673 05020505

40178 04010404

39038 04070404

37145 05080505

32084 06070606

29205 00070404

25254 05010505

23302 03020303

22061 06020606

21901 05070505

20857 01080505

19475 09020505

The patterns where all counters consistently counted 4, 3 and 5 positive signal edges are the most common. In 39.74 percent of all passes, the 4 meters agree. From the obtained distribution of the frequency patterns one obtains an entropy of 5,954,258 bits per experiment.

In both embodiments, the input signal from the ringless 4-track oscillator does not meet the requirements for flip-flops or counters, in both cases, the necessary hold times are likely to be violated, so that the behavior of the flip-flop or the counter is not is determined and itself serves as a source of chance. FIG. 3 shows a third exemplary embodiment of the invention in which eight modulo-4 counters are counted as count counter to each of the four last LUTs of the feedback-free 4-track random number generator from the exemplary embodiments described above. units 101, 102, ..., 132 were connected. 6194205 random number generation cycles were performed by changing the input of the 4-track random number generator from the bit pattern "0000" to the bit pattern "1111". The modulo-4 counters were reset to 0 before each attempt.

Evaluation of the frequency of observed bit patterns revealed an entropy of 12.66 bits per trial. Compared with the almost ideal entropy yield of 3.99998 bits per 4-bit sample, if you only ever one on the last four gates

Toggle flip flop, so you get an increase in the entropy yield by a factor of 3.16.

Feedback-free multitrack random number generators require far less energy to generate a random bit than other known methods. The combination of the feedback-free multitrack random number generators and the proposed method or the proposed device achieves particularly high energy efficiency in generating random numbers.

Energy efficient generation of random numbers is important for many mobile applications. In particular, the device and / or the method of great importance in batteryless RFID tags with crypto functionality.

In a fourth embodiment of the invention, a chaotically oscillating Fibonacci ring oscillator, also called FIRO for short, of length 32 is used as the electronic circuit 10. FIG. 4 shows imaging devices K1, K2,..., K32, in this case inverters, as well as logic XOR gates XI, X2,..., X31, which form the feedback. At an output of the FIRO, 32 toggle flip-flops are connected in parallel as counter units 101, 102,..., 132. Before each restart of the FIRO, all 32 toggle flip-flops are reset to 0.

After a vibration phase of, for example, one millionth of a second, during which the FIRP oscillates chaotically, the counter value of the 32 toggle flip-flops is stored and Native output node 201, 202, ..., 232 of the respective counter unit 101, 102, ..., 132 provided.

In the case of a 5814784 repetition, 2702970 different 32-bit patterns appear in the toggle flip-flops.

This very large number of different patterns shows that the individual toggle flip-flops very often behave differently, so that a high entropy yield is to be expected. Due to the large number of observed different 32-bit patterns, a reliable statistical estimate of the entropy contained in the 32-bit patterns is hardly possible. Alternatively, the last 16 of the toggle flip-flops are evaluated.

The most common 16-bit pattern appears 196383 times. 4544 patterns never occur in this case, 5568 occur only once. The frequencies of the 16-bit patterns give an entropy of 10.9777 bits per 16-bit sample.

The respective counter unit, imaging device or processing unit can be implemented in hardware and / or software technology. In a hardware implementation, the respective unit can be designed as a device or as part of a device, for example as a computer or as a microprocessor. In a software implementation, the respective unit may be designed as a computer program product, as a function, as a routine, as part of a program code or as an executable object.

Although the invention has been further illustrated and described in detail by the embodiments, the invention is not limited by the disclosed examples, and other variations can be derived therefrom by those skilled in the art without departing from the scope of the invention.

Claims

claims

1. A method for generating random bits (Z) by means of an electronic circuit (10) configured to generate a random signal (ZS),

- wherein the random signal (ZS) within the electronic circuit (10) at least two counter units (101, 102, ..., 132) is supplied;

- Wherein by an edge of the random signal (ZS) a respective counter value of the at least two counter units (101, 102, ..., 132) is changed;

- Wherein the respective counter value is read out at a predefinable time;

- Wherein the random bits (Z) are formed from the read out respective counter values.

2. The method of claim 1, wherein the electronic circuit as a Fibonacci ring oscillator, a Gallois ring oscillator, a Mehrspurringoszillator, a

Multiplier random number generator or a feedback-free multi-track random number generator is formed.

3. The method according to any one of claims 1 or 2, wherein at least one of the respective counter values at predetermined times, in particular periodically or randomly, is read out.

4. The method according to any one of the preceding claims, wherein at least one of the respective counter values is reset after a read.

5. The method according to any one of the preceding claims, wherein a respective counter value of the at least two counter units (101, 102, ..., 132) is changed by an edge of predetermined direction of the random signal (ZS).

6. The method according to any one of the preceding claims, wherein in dependence on the read-out respective counter values with Help of an algorithmic post-processing a post-processed random bit sequence is generated.

7. The method according to any one of the preceding claims, wherein as a counter unit (101, 102, ..., 132) a modulo m counter is installed, where m is a natural number greater than one.

8. The method according to any one of the preceding claims, wherein as a counter unit (101, 102, ..., 132), a toggle flip-flop is installed.

9. Apparatus for generating random bits (Z) comprising

an electronic circuit (10) for generating a random signal (ZS),

- At least two counter units (101, 102, ..., 132) for detecting the random signal (ZS) within the electronic circuit (10) and for storing a respective counter value in response to an edge of the random signal (ZS);

- A respective output node (201, 202, ..., 232) of the respective counter unit (101, 102, ..., 132) for tapping the respective counter value at a predetermined time;

- A processing unit (20) for generating random bits (Z) from the tapped respective counter values.

10. The apparatus of claim 9, wherein the electronic circuit is a Fibonacci ring oscillator, a Gallois ring oscillator, a Mehrspurringoszillator, a

Multiplier random number generator or a feedback-free multitrack random number generator.

11. The apparatus of claim 9 or 10, wherein at least one of the respective counter values at a predetermined time, in particular periodically, can be tapped.

12. Device according to one of claims 9 to 11, wherein at least one of the respective counter values can be reset after tapping.

13. Device according to one of claims 9 to 12, wherein the at least two counter units (101, 102, ..., 132) for storing a respective counter value depending on an edge of predetermined direction of the random signal (ZS) are formed.

The apparatus of any one of claims 9 to 13, wherein the processing unit (20) for performing algorithmic post-processing is adapted to generate a post-processed random bit sequence from the retrieved respective counter values.

15. Device according to one of claims 9 to 14, wherein as a counter unit (101, 102, ..., 132) a modulo meter counter is installed.

16. Device according to one of claims 9 to 15, wherein as a counter unit (101, 102, ..., 132) a toggle flip-flop is installed.