A method for designing a non-linear corrector for a true random number generator

Abstract

The application relates to a design method of a nonlinear corrector of a true random number generator. A kind of n input m output corrector function is constructed, and the technical scheme is: a group of bases of a finite field is selected, and an isomorphic mapping from to an [n-m, m, t] equidistant linear code is established. Component functions of the corrector are constructed so that each component function is cascaded by 2 m n-m element affine functions, the coefficients of the affine functions are one-to-one corresponding to 2 m vectors in the [n-m, m, t] equidistant linear code, and the constant term of each n-m element affine function cascaded by the i th component function is equal to the value of the i th input symbol. By using the design method, the algebraic degree of the obtained nonlinear corrector is m+1, the flexibility order is t-1, the correction order is currently optimal t, and the correction order is greater than the function flexibility order. The corrector obtained by the application has the ability to resist linear attack, correlation attack and algebraic attack, and has wide application prospects in cryptography and random simulation.

Description

Technical Field

[0001] This invention relates to the fields of communication and cryptography, and specifically to a design method for a nonlinear corrector of a true random number generator. Background Technology

[0002] True random number generators (TRNGs) have wide applications in communication systems, cryptography, and random simulation methods. In cryptography, random bit strings generated by TRNGs can be used as keys in cryptographic systems; for example, the RSA algorithm uses such random bit strings. Additionally, these random bit strings can also be used as initialization vectors for byte padding in block ciphers. A typical TRNG design method utilizes physical noise sources to generate the original sequence and then processes these sequences to eliminate their statistical properties. These noise sources are generally obtained through chaos, metastability, thermal noise, and clock jitter in the circuit. However, due to environmental influences, the original sequence usually lacks good randomness and deviates from the ideal statistical independence and uniform distribution. To improve the randomness of the output bit string of the TRNG and correct biased sequences, we need an effective post-processing operation, i.e., a corrector. Elasticity functions can be used to design correctors for TRNGs. An (n, m, t) elastic function is defined such that when any t input symbols are determined, the output array of length m has the same number of iterations when the remaining nt input symbols take all possible values. The concept of a corrector is essentially a generalization of the elastic function. A known (n, m, t) elastic function is equivalent to a corrector with n inputs, m outputs, and a correction order of t, often simply called an (n, m, t) corrector. However, conversely, an (n, m, t) corrector is not necessarily an (n, m, t) elastic function. In practical applications, the nonlinearity and algebraic order of a corrector determine its resistance to linear attacks, correlation attacks, and algebraic attacks. Lower nonlinearity and algebraic order make the corrector more vulnerable to attacks, reducing system security and increasing the risk of data leakage. Patrick Lacharme, in his article "Analysis and Construction of Correctors" (IEEE Transactions on Information Theory), proposed a corrector design method, but the resulting corrector is linear with zero nonlinearity. Furthermore, the corrector's correction order and elastic order are equal. These types of correctors are not resistant to linear attacks, correlation attacks, and algebraic attacks, and therefore cannot be widely applied in practice. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a method for designing an (n, m, t) corrector from the perspective of cryptographic function design. The obtained corrector is non-linear, and the non-linearity is 2 m , , , ,

[0011] , i ,

[0010] ,

[0009] -2 n-m , and has a relatively high algebraic degree. At the same time, the correction order of the corrector is greater than the resilience order of the function.

[0004] To achieve the above object, the technical solution of the present invention is implemented as follows:

[0005] 1) Step A: Select a [u, m, t] equidistant linear code C, where n = m + u and m < u. Construct an isomorphism mapping π from the finite field to C, including the following sub-steps:

[0006] Step A1: Select a set of bases {1, γ,..., γ } of the finite field m-1 where γ is a root of a primitive polynomial of degree m over F2. Any element in m γ m-1 can be expressed as e1 + e2γ +... + e i γ m-1

[0007] where e m ∈ F2, 1 ≤ i ≤ m; Step A2: Find a set of bases {θ1,..., θ m γ m-1} of C, and the constructed isomorphism mapping π maps the elements in the finite field m θ m .

[0008] 2) Step B: Construct the i-th component function f i of the vector Boolean function, including: f i (Y, X) = π(γ [Y]+i-1 ) · X + y i , where [Y] is the decimal representation of Y.

[0009] 3) Step C: Design the structure of the corrector as F(Y, X), where

[0010] F(Y, X) = (f1(Y, X), f2(Y, X),..., f m (Y, X)).

[0011] Based on the above content, since the component functions f i of the (n, m, t) corrector of the present invention are all composed of 2m The cascade of u-ary affine functions is obtained, and the linear combination of the component functions is still derived from 2... m The corrector is obtained by cascading u-ary affine functions, therefore the resulting corrector is nonlinear, with a nonlinearity of 2. n-1 -2 n-m Furthermore, the elastic functions of the cascaded affine functions are all of order t-1, and the resulting corrector is also an elastic function of order t-1.

[0012] The corrector obtained by this invention is a nonlinear function with high nonlinearity, algebraic degree, and correction order. Furthermore, the correction order is greater than the elasticity order. The corrector designed using this invention will be able to resist linear attacks, correlation attacks, and algebraic attacks, thereby improving the security of data information. Attached Figure Description

[0013] Figure 1 The design flow of the nonlinear corrector of this invention is as follows. Detailed Implementation

[0014] The invention will now be further described in conjunction with specific implementation methods. First, an introduction to the relevant background knowledge of cryptographic functions will be given.

[0015] Let F2 be a finite field of two variables, and n be a positive integer. Let F2 be an n-dimensional vector space. Then from... The mapping to F2 is called an n-ary Boolean function, denoted as:

[0016] The algebraic normal form of the Boolean function f is: Where λ b ∈F2, Different algebraic normal forms correspond to different Boolean functions. The corrector functions obtained in this invention are all represented by algebraic normal forms.

[0017] The Walsh spectrum of an n-ary Boolean function f is defined as:

[0018] Viewing the corrector as a multi-output Boolean function, i.e., from... arrive The mapping is called an (n, m) function, which consists of m component functions, denoted as: F(x) = (f1(x), ... f2(x)). m (x)). The algebraic degree of the corrector is the minimum algebraic degree among the non-zero linear combinations of all its component functions. The nonlinearity of the corrector is the minimum nonlinearity among the non-zero linear combinations of all its component functions. The corrector is a t-order elastic function if and only if the non-zero linear combinations of all its component functions are t-order elastic functions.

[0019] The elasticity order of a corrector is an indicator of its resistance to related attacks; the smaller the elasticity order, the easier it is to carry out an attack. For elastic functions, the following important theorem applies: For a Boolean function f(x), The elastic order of f(x) is t if and only if for any α, 0 ≤ wt(α) ≤ t, we have W f (α)=0.

[0020] Nonlinearity refers to the minimum Hamming weight of a function to all affine functions, denoted as N. f The higher the nonlinearity of the corrector, the stronger its ability to resist linear attacks. Linear correctors are the type of correctors with the weakest ability to resist linear attacks.

[0021] For an isometric linear code C of [nm, m, t], any non-zero codeword α in C satisfies wt(α) = t. Furthermore, any codeword in C can be obtained through an m×(nm) generator matrix G, and the m rows of matrix G can serve as a basis for the isometric linear code C.

[0022] From a set M to a set isomorphism mapping If and only if the mapping It is a bijective and preserves operation. That is, for any a∈M, set M and The operations in are respectively and satisfy

[0023] Based on the above theoretical knowledge, the implementation steps of the nonlinear corrector designed in this invention are as follows:

[0024] 1) Step A: To obtain the coefficients of the cascaded affine functions, first select an isometric linear code C of [u,m,t], where n = m + u, m < u. Construct from the finite field The mapping π to C is such that the coefficients of the concatenated affine functions correspond one-to-one with the codewords in the isometric linear code C. Step A includes:

[0025] Step A1: Select a finite field A set of bases {1, γ, ..., γ m-1}, where γ is a root of an irreducible polynomial of degree m over F2. Any element in the expression can be represented by a polynomial containing γ as e1 + e2γ + ... + e m γ m-1 , where e i ∈F2, 1≤i≤m;

[0026] Step A2: Find a generator matrix for the isometric linear code C, and use the m row vectors of the generator matrix of code C as a basis {θ1, ..., θ2} for C. m The constructed mapping π will be a finite field. The elements in the map are mapped to the isometric linear code C, and the mapping π is an isomorphic mapping. Specifically, the mapping method is π(e1+e2γ+…+e...). m γ m-1 )=e1θ1+e2θ2+...+e m θ m .

[0027] 2) Step B: Construct the i-th component function f of the vector Boolean function i ,include:

[0028] Each component function of the corrector is composed of 2 m The cascaded affine functions are obtained where the constant term of each nm-ary affine function in the cascaded i-th component function is equal to the value of the i-th input symbol. The corrector structure is designed as f. i (Y, X) = π(γ) [Y]+i-1 )·X+y i ,in [Y] is the decimal representation of Y.

[0029] 3) Step C: Design the corrector structure as F(Y, X), where

[0030] F(Y,X)=(f1(Y,X), f2(Y,X),…,f m (Y, X))

[0031] Any nonzero linear combination of the component functions of F(Y, X) is composed of 2 m The affine functions are concatenated to obtain the codewords in the equidistant linear code C.

[0032] This leads to the (n, m, t) corrector F(Y, X) = (f1(Y, X), f2(Y, X), ... f m (Y, X) complete structure.

[0033] The theoretical principles and preferred embodiments of the present invention will be described below.

[0034] Each component function of the corrector F(Y, X) is composed of 2 m The cascade of affine functions yields a non-zero linear combination f of component functions. c have

[0035]

[0036] set up Then Substituting into the above formula, we have

[0037]

[0038] Thus, we obtain the non-zero linear combination function formula of the component function, f c The spectrum magnitude at the point (β, α) is where The spectrum magnitude is calculated as follows:

[0039]

[0040] When 0 ≤ wt(β, α) ≤ t - 1, 0 ≤ wt(α) ≤ t - 1, and the code C is an equidistant linear code, we have So A linear function must be a balanced function. In this case<http: / / www.w3.org / 1998 / Math / MathML">

[0041]

[0042] Thus f c ​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​c )≤m+1. And the coefficients of all these affine functions are 2 in the code C. u Among all vectors, excluding the case where b = 0, x is the coefficient of all affine functions. i The number of times it appears is 0 or 2 u-1 So in f c It must appear in the algebraic normal form This term, and thus the function f c The algebraic degree is m+1.

[0048] The maximum absolute value of the spectrum of function F at any point is: F is a nonlinear function, and the degree of nonlinearity N f =2 n-1 -2 n-m .

[0049] To better illustrate the specific embodiments of the present invention, preferred embodiments are as follows:

[0050] To design a 5-input 2-output corrector F, let γ be a primitive polynomial x over the finite field F2. 2 The roots of +x+1. Let θ1 = (011), θ2 = (110), and {θ1, θ2} be a basis of the isometric linear code C of [3, 2, 2], then C = {000, 011, 110, 101}. Establish a foundation from the finite field... The isomorphism relation to the isometric linear code C is π(1)=(011), π(γ)=(110), π(γ) 2 )=(101). Based on the design provided by this invention, the constructed component function is:

[0051] f1(y1,y2,x1,x2,x3)=(y1+1)(y2+1)(x2+x3)+(y1+1)y2(x1+x2)+y1(y2+1)(x1+x3)+y1y2(x2+x3)+y1

[0052] f2(y1,y2,x1,x2,x3)=(y1+1)(y2+1)(x1+x2)+(y1+1)y2(x1+x3)+y1(y2+2)(x1+x3)+y1y2(x1+x3)+y2

[0053] The truth table of the non-zero linear combination function of the component functions is as follows:

[0054] f 10 : 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1

[0055] f01 : 0, 0, 1, 1, 1, 1, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 0, 1, 1

[0056] f 11 : 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 1, 0

[0057] Where f 10 =f1,f 01 =f2,f 11 =f1+f2.

[0058] After verification, f c It is a (5, 1, 2) corrector and also a (5, 1, 1) elastic function, which indicates that the designed function F is a (5, 2, 2) corrector and also a (5, 2, 1) elastic function. Also, f c The algebraic degree of the function is 3, therefore the algebraic degree of the corrector is 3. The nonlinearity of function F is 2. n-1 -2 n-m The corrector is nonlinear. The above are merely preferred embodiments of the present invention and are not intended to limit the invention.

[0059] The present invention has been described in detail above with reference to specific examples, but the present invention is not limited to the specific embodiments described above. Within the scope of knowledge possessed by those skilled in the art, some modifications can be made to it.

Claims

1. A method for designing a nonlinear corrector for a true random number generator, characterized in that, The method includes: Step A: Select an equidistant linear code C of [u, m, t]. A basis of C is {θ1, …, θ m}, where n = m + u, m < u. Select a basis of the finite field as {1, γ, …, γ m-1}, where γ is a root of a primitive polynomial of degree m over F2. Any element in is represented as e1 + e2γ + … + e m γ m-1 , where e i ∈ F2, 1 ≤ i ≤ m. Construct an isomorphism mapping π from the finite field to C as π(e1 + e2γ + … + e m γ m-1 ) = e1θ1 + e2θ2 + … + e m θ m ; Step B: Construct the i-th component function f of the vector Boolean function i f i (Y, X) = π(γ) [Y]+i-1 )·X+y i , 1≤i≤m, where [Y] is the decimal representation of Y; Step C: Design the corrector structure as F(Y, X) = (f1(Y, X), f2(Y, X), ..., f m (Y, X)).

Images