Long Period Pseudo Random Number Sequence Generator

1. Technical Field

The present invention relates to cryptography and, more particularly, to a circuit for generating a sequence of pseudo random numbers, {A.sub.k }, having a long period comprising, an exponentiator in GF(2.sup.m) for the normal basis representation of elements in a finite field GF(2.sup.m) each represented by m binary digits and having two inputs and an output from which the sequence {A.sub.k } of pseudo random numbers is taken, one of the two inputs being connected to receive the outputs {E.sub.k } of a maximal length shift register of n stages; a switch having a pair of inputs and an output, the switch output being connected to the other of the two inputs of the exponentiator, one of the switch inputs being connected for initially receiving a primitive element A.sub.0 in GF(2.sup.m); and, a delay circuit having an input and an output, the delay circuit output being connected to the other of the switch inputs, the delay circuit input being connected to the output of the exponentiator whereby after the exponentiator initially receives the primitive element A.sub.0 in GF(2.sup.m) through the switch the switch can be switched to cause the exponentiator to thereafter receive as its input a delayed output A.sub.k-1 from the exponentiator thereby generating {A.sub.k } continuously at the output of the exponentiator.

In the preferred embodiment, the exponentiator in GF(2.sup.m) comprises, a cyclic-shift circuit; a Massey-Omura multiplier; and, a control logic circuit all operably connected together to perform the function U.sub.i =.sub..alpha. 2.sup.i (for n.sub.i =1) or 1 (for n.sub.i =0).

2. Prior Art and Technical References

The following provide further information on the subject matter of the present invention and/or techniques and apparatus incorporated therein.

1. J. L. Massey and J. K. Omura, Patent Application on "Computational Method and Apparatus for Fine Field Arithmetic", now U.S. Letters Pat. No. 4,587,627.

2. C. C. Wang, et al., "VLSI Architectures for Computing Multiplications and Inverses in GF(2.sup.m)", IEEE Transactions on Computers, Vol. C-34, No. 8, August 1985.

3. R. C. Dixon, Spread Spectrum Systems, John Wiley & Sons, Inc., 1932.

4. F. J. MacWilliams and N. J. A. Sloane, The Theory of Error-Correcting Codes, North-Holland Publishing, New York, 1977.

5. M. Perlman, "Periodic Binary Sequence Generators: Very Large Scale Integrated (VLSI) Circuits Considerations", Jet Propulsion Laboratory (JPL) Publications 85-7, December, 1984.

The field of cryptography has undergone a step increase in its requirements for producing "unbreakable" code since the inception of the digital computer. When coded messages only existed and were transmitted in analog form (i.e. the written "word") as represented by FIGS. 1 and 2, the production of a code which was difficult to break was fairly easy and the breaking of the code of others was a laborous and time-consuming task as the work had to be done by human mental labor. For example, one could make a code table 10 as shown in FIG. 1 wherein a symbol is substituted for each letter of the normal alphabet, e.g., A becomes &. Messages written with the substituted alphabet are easily deciphered only with the help of a corresponding code table 10 in the hands of the receiver. Thus, only with a code table 10 can the receiver of the message "@&#%" understand it to be the word "FACE" as shown in FIG. 2. To break the code, one must use trial and error substitutions trying to find substitutions which make sense. Certain knowledge about common combinations make the process easier; but, it is still laborous at best.

With the advent of the digital computer with the ability to perform masses of combinations and permutations of trial and error data in a matter of seconds, mere substitution codes become relatively worthless. Additionally, the electronic transmission of data added to the problem. While the written analog cryptographer could devise his own symbols for substitution, the electronic cryptographer is faced with the use of "standard" binary electronic substitutions for the alphabetic (and associated) characters. Even the original Morse code employed with telegraph transmissions is a form of a binary code with fixed substitutions. For example, a "dash" can be thought of as a binary "1" while a "dot" is a binary "0". Thus, the letter G (i.e. Morse code dash, dash, dot) can be thought of as binary 110. Most digital devices associated with computers employ fixed numerical representations (such as so-called "ASCII") for the characters as input, transmitted, and printed. Thus, as represented by the drawing of FIGS. 3 and 4, the letter "A", for example, is represented by the number "01" (i.e. the eight bit binary byte 00000001) and the message "FACE" of FIG. 2 becomes "06010305" (in binary bytes) when transmitted within a binary system.

Faced with this problem, cryptographers (where the term "cryptographer" includes persons who develop methods for securing data a programs within the digital computers themselves) found that an effective method of encrypting data, programs, and messages was to add a pseudo random number sequence thereto on the transmitting end and to subtract the same pseudo random number sequence therefrom on the receiving end as shown in FIG. 5. Since there is no constant substitution factor, the trial and error method of code breaking is ineffective, even at computer speeds.

The generation of a periodic sequence of pseudo random numbers finds use in a number of applications such as spread spectrum communications and cryptographic systems as well as in other signal processing applications such as noise generation, ranging code generation, and test data sequence generation. The pseudo random number sequence addition/subtraction technique has been applied to varying levels of security requirements from the simple prevention of unauthorized disclosure of valuable coding within otherwise accessible computer programs and data to the incryption of data highly sensitive to the national security. The differentiating factor, in each case, being the complexity of the generator for the pseudo random number sequence. The shorter the period of the sequence (i.e. the number of pseudo random numbers in the sequence before the sequence begins to repeat), the less costly the generator and the more regular (i.e. less random) resultant sequence. As can be appreciated in this regard when considered in the ridiculous extreme, a pseudo random sequence of 02, 05, 03, 02, 05, 03, . . . would approach the adding of a constant to any data and would be fairly easily recognized whereas a sequence with an infinite period (e.g. which never repeated) would be virtually impossible to recognize.

The typical prior art approach to the generation of a pseudo random number sequence is shown in simplified form in FIG. 6. A modular multiple-tap sequence generator as developed is described in reference 3 and has been considered in the art as a very powerful and simple pseudo random number generator. A VLSI circuit for that generator has also been developed and is reported in reference 5. In general, there is a n-position shift register 12. An initial value is loaded into the register 12 over the input line 14. The value is then shifted through the register 12 by one position for each pseudo random number to be generated. The register 12 is a wraparound register in that the bit being shifted out at the output end 16 is shifted into the input end 18 via the feedback or wraparound line 20. The pseudo random number sequence is taken out from a number of taps 22 into the register 12 since the number of positions "n" of the register 12 is typically much larger than the number of bits in each "number" of the sequence.

The period of the pseudo random number sequence produced by the prior art apparatus of FIG. 6 is determined by the number of positions "n" of the register 12. Since an initialization value of "zero" is never employed (for obvious reasons), the period is equal to the quantity 2.sup.n -1 and is known as the "maximal length" achievable by this approach. By way of example, the period of a 17-stage maximal length shift register operating in the prior art manner of FIG. 6 is 131,071. To get a larger period, more positions must be added to the register 12--and the increase is not substantial. For example, the period of a 19-stage maximal length shift register is only 449,113. This may seem substantial; however, it is small in circumstances of extreme criticality where an infinite period would be more desirable and beneficial.

This invention is primarily directed at a method and apparatus for generating a random number sequence whose period is longer than 2.sup.n -1 when n shift registers are used. It incorporates a simple VLSI implementable device to perform exponentiation in GF(2.sup.m) by using a Massey-Omura multiplier and is capable of generating a very long pseudo random sequence when 2.sup.m -1 is a Mersenne prime. While the sequence generated by the present invention may not have a flat spectrum as does the sequence generated by the prior art maximal length shift register as described earlier herein, the increase of the period is very significant and makes its sequence very desirable in some applications wherein period length is of paramount importance.

FIG. 1 is a substitution table as used in the prior art for encrypting written messages.

FIG. 2 is an example of an encrypted message using the table of FIG. 1.

FIG. 3 is a table showing how numbers are employed to represent characters in the electronic input, transmission, and printing of characters.

FIG. 4 is an example of the numeric representation of the message of FIG. 2 employing the numeric substitutions of the table of FIG. 3.

FIG. 5 is a block diagram showing a prior art technique employed in the protection and encrypting of data represented numerically wherein a pseudo random number sequence is added to the data for transmission or storage and then subtracted out for use.

FIG. 6 is a block diagram of a prior art maximal length shift register employed for generating pseudo random number sequences.

FIG. 7 is a simplified representation of a finite field containing points identifiable in a co-ordinate system.

FIG. 8 is a simplified diagram of a cyclic-shift circuit for achieving .sub..alpha. 2.sup.i by operating on the normal basis representation of .sub..alpha. 2.sup.i-1.

FIG. 9 is a flow chart of the method of the present invention for realizing the exponentiation in GF(2.sup.m) by using a cyclic-shift circuit, a Massey-Omura multiplier, and a control logic circuit performing the function U.sub.i =.sub..alpha.2.sup.i (for n.sub.i =1) or 1 (for n.sub.i =0).

FIG. 10 is a VLSI implementable circuit according to the present invention for performing the recursive algorithm for computing exponentiation in GF(2.sup.4).

FIG. 11 is a block diagram of the system structure of the circuitry of FIG. 10 for a general field GF(2.sup.m).

FIG. 12 is a block diagram of a mechanism according to the present invention which can generate pseudo random numbers, A.sub.k.

With reference to FIG. 7 as a starting point, assume that there is a field 24 containing a number of points 26. designated as P.sub.1, P.sub.2, . . . P.sub.n. The field and the points therein can be described with respect to any of a number of co-ordinate systems such as that indicated as 28. One such representation system well known in the prior art is the "normal basis" system.

Recently, Massey and Omura [as described in reference 1] invented a new algorithm to multiply in the finite field GF(2.sup.m). In their invention, they utilize a normal basis of the form a, a.sup.2, a.sup.4, . . . , .sub.a 2.sup.m -1 to represent elements of the field. Employing a normal basis representation, each element in the finite field GF(2.sup.m) can be represented by m binary digits. Also, in employing a normal basis representation, squaring of an element in GF(2.sup.m) is readily shown to be a simple cyclic shift of its binary digits [as described in references 1 and 2]. Also, multiplication requires the same logic circuitry for any one digit of the product as it does for any other [as also described in references 1 and 2]. Adjacent product digit circuits differ only in their inputs, which are cyclically shifted versions of one another. In reference 2, the inventor herein and others presented a VLSI architecture to implement this Massey-Omura multiplier in GF(2.sup.m). Both sequential-type and parallel-type Massey-Omura multipliers have been illustrated. They are shown to be simple and regular. A VLSI architecture for computing inverses in GF(2.sup.m) was also developed in reference 2 by using a parallel-type Massey-Omura multiplier.

Exponentiation in the finite field GF(2.sup.m) is necessary in the implementation of some error-correcting coders, such as Reed-Soloman codes. The conventional method for computing exponents in a finite field uses a lookup table. This method cannot be realized efficiently in a VLSI circuit. As will be described herein shortly, the inventor herein has devised a recursive pipeline exponentiation circuit using a Massey-Omura multiplier. The architecture of that circuit is similar to that of the inversion circuit mentioned above, is regular and expandable, and, hence, naturally suitable for VLSI implementation.

For an arbitrary .alpha. in the finite field GF(2.sup.m) and an integer N, (where 1.ltoreq.N.ltoreq.2.sup.m -1), and .alpha.=.beta..sup.N, clearly, .beta. is in GF(2.sup.m). When N is represented in binary form as (n.sub.0, n.sub.1, n.sub.2, . . . n.sub.m-1).sub.I, it can be proved mathematically (proof omitted in the interest of simplicity and the avoidance of redundancy) that exponentiation in the finite field GF(2.sup.m) can be accomplished by successive multiplication. From the teachings of references 1 and 2 it is known that, in normal basis, .sub..alpha. 2.sup.i can be achieved by a cyclic-shift circuit as shown in FIG. 8 operating on the normal basis representation of .sub..alpha. 2.sup.i-1. The exponentiation in GF(2.sup.m) can, therefore, be realized by using a cyclic-shift circuit, a Massey-Omura multiplier, and a control logic circuit performing the function U.sub.i=.sub..alpha. 2.sup.i (for n.sub.i =1) or 1 (for n.sub.i =0). The algorithm of this structure is shown in FIG. 9 and can be described as follows:

(i) Let A=.alpha.

If n.sub.0 =1, let B=A

Otherwise, let B=1

Let C=1 and k=0

(ii) Multiply B and C to obtain Z=B C

Set k=k+1

(iii) Replace A with the cyclic shift (CS) of A

If k=m, Z=.alpha..sup.N, Stop

If k<m, C=Z and B=A if n.sub.k =1,

Otherwise B=1

(iv) Go back to step (ii)

This recursive algorithm for computing exponentiation in GF(2.sup.4) can be realized by the circuit 30 shown in FIG. 10. In the circuit of FIG. 10, a parallel-type Massey-Omura multiplier of GF(2.sup.4) is utilized. The architecture is somewhat similar to that shown in FIG. 9 of reference 2 as used for computing the inverses in GF(2.sup.4); but, it has an additional input for the exponent N and only one control signal, Ld. By way of illustration of its operation, let the exponent N be represented by (n.sub.3, n.sub.2, n.sub.1, n.sub.0).sub.I such that N is equal to the sum from i=0 to 4 of n.sub.i 2.sup.i, where n.sub.0 =0 or 1. If one follows the progress of the computation, it will be found that at the end of the third clock cycle, the complementary values of a.sub.1, a.sub.2, and a.sub.3 are stored in the input buffer flip-flops B.sub.1, B.sub.2, and B.sub.3, respectively. During the fourth clock cycle, Ld=1. Then the complementary values of a.sub.0, a.sub.1, a.sub.2, and a.sub.3 are simultaneously shifted into R.sub.1, R.sub.2, R.sub.3, and R.sub.4, respectively. At the same moment, buffer flip-flops B.sub.7, B.sub.8, B.sub.9, and B.sub.10 are fed with the values of n.sub.3, n.sub.2, n.sub.1, and n.sub.0, respectively, and registers R.sub.5, R.sub.6, R.sub.7, and R.sub.8 are also fed with the values "0". Notice that, actually, the complementary representation of .alpha. and 1 are entering the buffers R for multiplication. This is due to the fact that the "AND" function required in the Massey-Omura multiplier developed in reference 2 is achieved by using an "OR" function operating on the complements of multiplicand and multiplier.

A parallel-type GF(2.sup.4) Massey-Omura multiplier simultaneously yields four product components d.sub.0, d.sub.1, d.sub.2, and d.sub.3. Therefore, during the next four clock cycles, while n.sub.i (i=0, 1, 2, 3) controls the entering of either .sub..alpha. 2.sup.i or 1 to the multiplier, four successive multiplications are performed for the exponentiation. When the fourth multiplication is completed, Ld=1. Thus, the first digit, b.sub.3, of the normal basis representation of .alpha..sup.N is shifted out of the circuit. At the same time, the other three digits, b.sub.0, b.sub.1, and b.sub.2, of are fed into the output buffer flip-flops B.sub.4, B.sub.5, and B.sub.6, respectively. These are sequentially shifted out of the circuitry during the next three clock cycles.

The above-described method of computing exponentiation in GF(2.sup.4) takes four clock cycles. During this four clock cycles, the circuit of FIG. 10 allows the bits of the next element (following .alpha.) to be fed into it and the bits of the previous element to be shifted out of it, simultaneously. The circuit, therefore, provides a full pipeline capability so that the same operation can be performed continuously. As mentioned earlier, the pipelined exponentiation circuitry for GF(2.sup.4) of FIG. 10 is well-suited for VLSI implementation. The system structure of this circuitry 30' for a general field GF(2.sup.m) is shown in FIG. 11.

The use of exponentiation in a finite field GF(2.sup.m) to simply and easily generate a pseudo random number sequence having a period which is orders of magnitude longer than that possible with the prior art maximal length shift register approach will now be described.

First, if E.sub.1, E.sub.2, E.sub.3, . . . is a sequence of integers generated by a maximal length shift register of n stages, it is well known that E.sub.k is in the set S 1, 2, 3, . . . , 2.sup.n -1; and, that the sequence E.sub.k, where k=1, 2, 3, . . . , is a periodic sequence with period 2.sup.n -1. Furthermore, the subsequence of E.sub.k within on period is a permutation of elements in S.

Now, by way of background and introduction, if A.sub.0 is a primitive element in GF(2.sup.m), where m.gtoreq.n (the "n" specified in the previous paragraph), then, 2.sup.m -1 is the smallest positive integer L, the so-called order of A.sub.0 such that A.sub.0.sup.L =1. Hence, for any two distinct numbers E.sub.i, E.sub.j (i, j.ltoreq.2.sup.n -1) in the sequence {E.sub.k }, .sub.A.sbsb.0.sup.E i.noteq..sub.A.sbsb.o.sup.E j. If A.sub.i =.sub.A.sbsb.o.sup.E k, then {A.sub.k } is a periodic sequence of elements in GF(2.sup.m) with the same period as the sequence {E.sub.k }, 2.sup.n -1. Although {A.sub.k } is a collection of elements in GF(2.sup.m), the representation of every A.sub.k in some basis of GF(2.sup.m) presents a binary representation of an integer in [1, 2.sup.m -1]. Therefore, the sequence of {A.sub.k } can be regarded as a periodic sequence of positive integers. By generating the sequence {A.sub.k } as described above, however, one cannot increase the periodicity of the sequence {E.sub.k }. The manner in which this approach can be employed to increase the periodicity of the resultant sequence will now be described.

A random number sequence {A.sub.k } can be generated by letting A.sub.k =.sub.A.sbsb.k-1.sup.E k. Putting it differently, {A.sub.k } can be expressed as: ##EQU1## where P=(2.sup.n -1)! mod(2.sup.m -1).

In the interest of simplicity and the avoidance of redundancy, it will be taken as true that the following can be mathematically proved: ##EQU2##

From (3), the algorithm given in (1) as to using exponentiation in the finite field GF(2.sup.m) with 2.sup.m -1 being a Mersenne prime has been proved to be able to generate a pseudo random number sequence with period (2.sup.n -1)r. This period is, in general, much greater than the period of a maximal length sequence for the same n-stage shift register. FIG. 12 shows a mechanism which can generate such pseudo random numbers, A.sub.k, in simplified block diagram form. The circuitry consists of an exponentiator 30' in GF(2.sup.m) as developed above herein. One of the two inputs to the exponentiator 30' is the outputs {E.sub.k } of a maximal length shift register of n stages (not shown) according to the prior art as described above. The other input is initially fed by a primitive element A.sub.0 in GF(2.sup.m) and then switched by means of switch 32 to the delayed output A.sub.k-1 from the exponentiator 30' through delay circuit 34. It can be seen and appreciated that the pipeline structure of the exponentiator 30 as describe above is necessary in order to generate A.sub.k continuously.

It is worthy of note at this time by way of comparison that with m=19 and n=17 the period of 131,071 of a prior art maximal length shift register of 17 stages is increased by 262,143 times to a period of 3,435,934,513 with the pseudo random number generator according to the present invention as shown in FIG. 12. In fairness, it should be pointed out that the pseudo random number sequence generated by maximal length shift registers has good autocorrelation properties and some other periodicity properties which do not exist for the sequence {A.sub.k } described herein as produced by the present invention. For applications in cryptography, for example, these properties are not important and the vast gain in period length more than compensates for the losses in these properties.