Pseudo-Random Sequence Generator

A random number generator (RNG) is an efficient device that transforms short random seeds into long pseudo-random strings. A classical RNG is the linear congruential generator (LCG) that is based on the recursion x.sub.i+1 =ax.sub.i +b(mod N). It is well known that the LCG passes certain statistical tests, e.g., for a clever choice of the parameters a,b,N it generates well mixed numbers (see Knuth 1980). There are more elaborate statistical tests which the LCG fails. Stern (1987) shows that the sequence generated by the LCG can be inferred even if the parameters a,b,N and the seed x.sub.0 are all unknown.

The concept of a perfect random number generator (PRNG) has been introduced by Blum, Micali (1982) and Yao (1982). A RNG is perfect if it passes all polynomial time statistical tests, i.e., the distribution of output sequences cannot be distinguished from the uniform distribution of sequences of the same length. So far, the proofs of perfectness for the known PRNG's are all based on unproven complexity assumptions. This is because superpolynomial complexity lower bounds cannot be proven.

Perfect random number generators have been established, for example, based on the discrete logarithm by Blum, Micali (1982), based on quadratic residuosity by Blum, Blum, Shub (1982), based on one way functions by Yao (1982), and based on Rivest/Shamir/Adleman (RSA) encryption and factoring by Alexi, Chor, Goldreich and Schnorr (1984). All these PRNG's are less efficient than the LCG. The RSA/RABIN-generators are the most efficient of these generators. They successively generate log N pseudo-random bits by one modular multiplication with a modulus that is N bit long.

Disclosure of the Invention

In accordance with the present invention, a random sequence generator generates a random sequence from a seed random sequence which is of substantially shorter length. Most likely, the seed would be truly random and the generated sequence would be pseudo-random, but the term "random" is used to include both random and pseudo-random sequences. The generator performs a tree operation by extending, at each node of a tree structure, a node input random sequence. A plurality of node output sequences of the tree structure together comprise a final random output sequence. The final random output sequence is preferably generated as successive leaves of the tree structure. The tree structure allows for direct access to any leaf as a starting leaf of a sequence. The parallel structure of the tree allows for generation of the sequence with parallel processors which, but for initial seeds, may operate independently of each other.

In a preferred embodiment, each node input sequence is extended by the RSA operation

where e, a.sub.e, a.sub.e-1, . . . , a.sub.0 and N are integers, the node input sequence represents x and the node output sequence represents y. In a preferred system, the RSA function is reduced by setting all a's equal to zero except one, a.sub.d, which is set to equal one. The greatest common divisor of d and Euler's Totient function .phi.(N) is equal to one. Specifically, N is the product of two large random primes p and q, and d is an integer that is relatively prime to (p-1) (q-1), preferably 3.

In either a sequential or a tree operation, the final sequence is generated in iterative steps. At each step, a new string of bits is obtained by applying a function to significantly less than all of the bits of a previous string. At least part of the bits of a previous string to which the function is not applied are utilized toward the output, either directly or with application of the function in a tree structure.

One application of the random sequence generator is in an encryption system. An encryption unit performs a transform between an encrypted message and a nonencrypted message using the random sequence generated by the random sequence generator. An index may be applied to the generator to indicate the leaf of the tree at which the sequence applied to the encryption unit begins.

FIG. 1 is a schematic illustration of a random sequence generator having an output sequence y greater in bit length than an input sequence x.

FIG. 2 is an illustration of a random sequence generator having a tree structure in accordance with the present invention, each node comprising a generator as illustrated in FIG. 1.

FIG. 3 illustrates a multiprocessor system for performing the tree structure of FIG. 2.

FIG. 4 illustrates an encryption system utilizing the generator of FIG. 2.

FIG. 5 illustrates a sequential polynominal generator.

FIG. 6 is another illustration of a sequential polynomial generator.

FIG. 7 is another illustration of a parallel polynomial generator.

FIG. 8 is an illustration of yet another parallel polynomial generator.

An electronic random number generator, or random sequence generator, takes an input sequence of some number of bits which represents an input x and extends that sequence to a sequence of bits which represents a number y, the number of bits representing y being greater than the number of bits representing x. There are many functions which can easily extend the number m of bits by a factor of about 2. Difficulties in designing random generators exist, however, when substantially longer output sequences are required from a given length seed sequence. At some length, degradation of the output, such that it can no longer be considered random, is encountered.

In accordance with the present invention, a random sequence need only be expanded by a factor of about 2 in the generator 12. With such a short output sequence, the output can be considered near perfectly random. In accordance with the present invention, that perfectly random output is further extended in successive operations of the same generator 12 in a data processor tree structure illustrated in FIG. 2. The initial input sequence is first expanded by a factor of about 2 in a generator 12A. Portions of the output sequence from generator 12A are applied to respective inputs of generators 12B and 12C. Each of those generators then further expands the random sequence. For example, portions of the output from generator 12B are applied to the inputs of respective generators 12D and 12E.

It will be recognized that the output sequence of the generator need not have exactly twice the number of bits of the input sequence. Some bits from a larger output sequence may be ignored, or there may be overlap in the bits applied to the respective generators if the number of bits in the output y is less than twice the number of bits in the input x. Also, no particular portion of the output sequence need be passed on to each successive generator. Further, although a binary tree is most convenient, tertiary and wider trees may be used.

It is recognized that for a short output sequence y.sub.0, y.sub.1, y.sub.2 . . . , the binary tree adds unnecessary operations in the overall generation. With a tree of K levels of generators, K operations would be required to generate the bit sequence y.sub.0. However, any sequence y.sub.i of the y.sub.(2 K-1.sub.) sequences can be accessed with the same number of operations, and for a very long sequence the tree becomes efficient because each simple generator operation in the tree supports generation of plural sequences y.sub.i provided at the leaves of the tree. Thus, to provide a final sequence formed of 2.sup.K-1 leaves, each of a predetermined bit length, the tree need only perform (2.sup.K -1) operations through K generator levels. This process can be made very rapid by the use of parallel processors, as illustrated by FIGS. 2 and 3.

FIG. 3 illustrates four random generators G.sub.0, G.sub.1, G.sub.2 and G.sub.3 which may operate independently of each other. Each generator receives a sequential node input sequence from a respective random access memory, RAM.sub.0, RAM.sub.1, RAM.sub.2, RAM.sub.3, and outputs a longer sequence which is itself stored in the respective RAM for application to the generator at successive nodes of the tree. At the first node of the tree, only generator G.sub.0 performs an operation. A portion of its output is retained in RAM.sub.0, and a portion is transferred by the CPU to RAM.sub.2. In the next level of the tree, generators G.sub.0 and G.sub.2 perform their respective operations to provide extended node output sequences. A portion of the output from G.sub.0 is again stored in RAM.sub.0, and another portion is stored in RAM.sub.1. Similarly, a portion of the output from generator G.sub.2 is stored in RAM.sub.2, and a portion is stored in RAM.sub.3. Output sequences from the nodes need only be stored until input to both nodes of a lower level. From FIG. 2, it can be seen that, in all levels of the tree below the third, the processors and associated RAMs may operate independently. It can be seen that four processors reduce the processing time for a full length sequence almost to one-fourth the processing time of a single generator. Additional processors will of course further reduce the processing time of a large binary tree.

In some applications, such as in cryptography, it may be desirable to have a very long random sequence available but to be able to select a different starting point within the sequence for each encoding operation. The binary tree structure of FIG. 2 allows any subsequence y.sub.i to be accessed in K operations by simply defining the path through the binary tree to that leaf. Successive leaves may then be generated with relatively few additional operations because of the shared nodes through the tree. In other applications, a more rapid output of the initial subsequences may be desired. In that case, the initial subsequences may be output from nodes other than the leaves at the lower level of FIG. 2.

FIG. 5 illustrates an encryption system utilizing the random sequence generator of FIG. 2. In the system, a message M is encrypted in a sending unit 14, transferred over publicly accessible communications link 16 as an encrypted message C and decrypted to readable form at a receiving unit 18. Each of the sending and receiving units comprises an encryption unit, the encrypter 20 of the sending unit 14 and the decrypter 22 of the receiving unit. The two units also have identical random sequence generators 24 and 26 which are of the form illustrated in FIG. 2.

Conventional encryption systems utilize a random sequence, which is shared by both the sending and receiving units but is unknown to the public, to first encrypt the message and then decrypt the message. The random sequences must be transferred from one unit to another in a secure fashion for later use. To maintain the security of the system, longer sequences are best used with each encryption, and different sequences are best used in successive encryptions. This ordinarily requires that either a very long random sequence be transferred, or that only a seed x be transferred and that a random sequence generator be used to extend the seed x.

A drawback of conventional random sequence generators is that they are sequential in nature, and thus the sequence must be generated from the beginning to access a subsequence within the overall sequence. An advantage of the sequence generator of FIG. 2 is that the leaves y.sub.i are individually accessible by merely specifying the path to that sequence through the tree as by an index i. Thus, in the system of FIG. 4, an index i is applied to the sequence generator 24 at the sending unit to access a sequence which begins at y.sub.i. That index is also communicated to the receiving unit so that the same sequence beginning at y.sub.i can be generated for decryption. Thus, by securely transferring a short seed x and providing each of the units with an identical sequence generator, any extended portion of the entire sequence y.sub.0, y.sub.1, . . . , y.sub.(2 K.sub.) can be accessed by an index i, and the first subsequence of the accessed sequence is obtained in K operations.

A preferred generator for use at each node of the tree of FIG. 2 is a simplified RSA generator in which the input sequence is extended by the modular operation y=ax.sup.d (mod N), where N is the product of two large random primes p and q, and d is an integer that is relatively prime to (p-1) (q-1). Preferably, a equal 1, d=3, and the bit length of x is short relative to the bit length of N. For example, the bit length of x may be 2/3 that of N.

The full RSA function, presented by Rivest et al. in U.S. Pat. No. 4,405,829, is as follows:

where e, a.sub.e, a.sub.e-1, . . . , a.sub.0 and N are integers. For security, there should be at least one a.sub.d of a.sub.e, a.sub.e-1, . . . , a.sub.3 which is not equal to zero, and the greatest common divisor of d and Euler's Totient function .phi.(N) is equal to one. One such d is 3.

The advantage of the function y=x.sup.3 (mod N) where x is short relative to N is that the output sequence is near twice the length of the input sequence with only two multiplications by x and a division by N to determine the remainder. The same number of operations would be required for d=4, but the output would not be so perfectly random unless some bits of (information about) y=x.sup.d (mod N) are discarded. Even so, the output would be longer than the input sequence.

In prior uses of the RSA function in random generators, an extended output from a seed is generated by iterative operations of the function while outputing a limited number of bits from each operation. Therefore, with each operation of the RSA function, a number of bits less than the number of input bits would be output in the output sequence. A longer output sequence is obtained only by continued iterations of the RSA operation. Subsequences y.sub.i are not accessible directly, and multiple processors cannot perform independently in parallel to more rapidly generate the sequence. In the present system, the full output of a single RSA operation, or at least a number of bits greater than the number of bits in the input, is applied to the next level of the binary tree. Subsequences are directly accessible, and parallel processing can be used to great advantage.

As noted above, from each operation of the generator G, a number of bits greater than the number of bits in the input to the generator are utilized toward the final output. Because of the security of the particular RSA function utilized in the generator, even sequential generators having this feature may be designed as illustrated in FIG. 5. In this figure, each of the generators G may perform the RSA function y=x.sup.d (mod N). The bit length of each output y of each generator is significantly longer than the bit length of each input. Thus, less than all of the bits output from each generator are applied to the next generator. A significant number of bits, particularly those not applied to the next generator, are available for output.

This sequential generator allows for the very rapid generation of a relatively long sequence. It is much more rapid than the usual generators based on the RSA function because such generators reapply the full output sequence from each generator to the next generator in the iterative process, and only a few bits are output from each step of the process. Because of the high security of the particular RSA function chosen in the present application, fewer bits need be applied to each generator, for more rapid processing at individual generators, and a larger number of bits may be output from each individual generator, for more rapid output of the full random sequence. The sequential generator of FIG. 5 does suffer the disadvantage of the typical RSA generator in that individual subsequences of the output are not directly accessible.

A more theoretical discussion of the function used in the generator G and of the parallel tree structure and sequential generator follows.

We extend and accelerate the RSA-generator in various ways. We give evidence for more powerful complexity assumptions that yields more efficient generators. Let N=pq be product of two large random primes p and q and let d be a natural number that is relatively prime to .phi.(N)=(p-1)(q-1). We conjecture that the following distributions are indistinguishable by efficient statistical tests (see Hypothesis 2.1):

the distribution of x.sup.d (mod N) for random x.epsilon.[1,N.sup.2/d ].

the uniform distribution on [1,N].

This hypothesis is closely related to the security of the RSA-scheme. Under this hypothesis the transformation

stretches short random seeds x.epsilon.[1,N.sup.2/d ] into a pseudo-random numbers x.sup.d (mod N) in the interval [1,N]. We build various random number generators on this transformation. The sequential polynomial generator (SPG) generates from random seed x.epsilon.[1,N.sup.2/d ] a sequence of numbers x=x.sub.1,x.sub.2, . . . , x.sub.1, . . . .epsilon.[1,N.sup.2/d ]. The n(1-2/d) least significant bits of the binary representation of x.sub.i.sup.d (mod N) are the output of x.sub.i and the 2n/d most significant bits form the successor x.sub.i+1 of x.sub.i, where n is the number of bits in N.

It follows from a general argument of Goldreich, Goldwasser, Micali (1986) and the above hypothesis that all these generators are perfect, i.e. the distribution of output strings is indistinguishable, by efficient statistical tests, from the uniform distribution of binary strings of the same length. The sequential generator is nearly as efficient as the LCG. Using a modulus N, that is n bit long, it outputs n(1-2/d) pseudo-random bits per iteration step. The costs of an iteration step x.fwdarw.x.sup.d (mod N) with x.epsilon.[1,N.sup.2/d ] corresponds to the costs of a about one full multiplications modulo N. This is because the evaluation of x.sup.d (mod N) over numbers x.ltoreq.N.sup.2/d consists almost entirely of multiplications with small numbers that do not require modular reduction.

We extend the SPG to a parallel polynomial generator (PPG). The PPG generates from random seed x.epsilon.[1,N.sup.2/d ] a tree. The nodes of this iteration tree are pseudo-random numbers in [1,N.sup.2/d ] with outdegree at most d/2. To compute the successor nodes y(1), . . . , y(s) and the output string of node y we stretch y into a pseudo-random number y.sup.d (mod N) that is n bit long. Then the successors y(1), . . . , y(s) of y are obtained by partitioning the most significant bits of y.sup.d (mod N) into s.ltoreq.d/2 bit strings of length 2n/d . The output of node y consists of the remaining least significant bits of y.sup.d (mod N). Any collection of subtrees of the iteration tree can be independently processed in parallel once the corresponding roots are given. In this way m parallel processors can speed the generation of pseudo-random bits by a factor m. These parallel processors need not to communicate; they are given pseudo-independent input strings and their output strings are simply concatenated. The concatenated output of all nodes of the iteration tree is pseudo-random, i.e. the parallel generator is perfect. The PPG enables fast retrieval of substrings of the pseudo-random output. To access a node of the iteration tree we follow the path from the root to this node. After retrieving a bit the subsequent bits in the output can be generated at full speed. Iteration trees of depth at most 30 are sufficient for practical purposes; they generate pseudo-random strings of length 10.sup.20 (for outdegree 4) such that individual bits can be retrieved within a few seconds.

The Complexity Assumption for the Polynomial Random Generator

Let P(x) be a polynomial of degree d.gtoreq.2 with integer coefficients and let N be an integer that is n bits long, i.e. 2.sup.n-1 .ltoreq.N<2.sup.n. We denote l= 2n/d . Residue classes modulo N are identified with the corresponding integers in the interval [1,N].

The polynomial generator is based on the transformation

where x ranges over a sufficiently large subinterval [1,M] of [1,N]. We would like that the outputs of (1), for random x.epsilon.[1,M] and given N, M and P, be indistinguishable from random y.epsilon.[1,N]. The following conditions and restrictions are clearly necessary.

the modulus N must be difficult to factor since given the factorization of N we can easily invert (1).

M must be sufficiently large to make P(x)/N large for almost all x.epsilon.[1,M]. This is because we can easily invert (1) provided that P(x)/N is small.

P(x) must not be a square polynomial. If P(x)=Q(x).sup.2 for some polynomial Q then the Jacobi-symbol ##EQU1## is 1 for all x whereas prob ##EQU2## for random y.epsilon.[1,N]. Since the Jacobi-symbol can be evaluated efficiently we can distinguish P(x) mod N from random numbers y.epsilon.[1,N].

P(x) must not be a linear transform of a square polynomial. If P(x)=aQ(x).sup.2 +b we can, from P(x) mod N, recover Q(x).sup.2 mod N and check that ##EQU3##

We choose N,M,P(x) as to correspond to these conditions. Let N be a random number that is uniformly distributed over the set ##EQU4## of integers that are products of two distinct primes which each is n/2 bits long. We choose arbitrary M that are proportional to 2.sup.l, M=.theta.(2.sup.l); i.e. 1/c.ltoreq.2.sup.l /M.ltoreq.c for some absolute constant c>0. Then M is proportional to N.sup.2/d for all N.epsilon.S.sub.n. The choice for the polynomials P(x) seems to be subject to only a few restrictions. We are going to study a particular class of permutation polynomials where the hypothesis below can be justified by known theory. These are the RSA-polynomials P(x)=x.sup.d with d relatively prime to .phi.(N)=(p-1)(q-1).

Rivest, Shamir and Adleman (1978) have invented the RSA-cryptoscheme that is based on the multiplicative group

of residue classes modulo N that are relatively prime to N. The integer N is product of two odd primes, N=p.q. The order of the group * .sub.N is .phi.(N)=(p-1)(q-1). The transformation

with gcd(.phi.(N),d)=1 is a permutation on the residue classes modulo N, i.e. it permutes the integers in the interval [1,N]. The inverse transformation is given by x.fwdarw.x.sup.e (mod N) where e=d.sup.-1 mod.phi.(N). The permutation (2) with gcd(.phi.(N),d)=1 and d.noteq.1 is an RSA-enciphering function. The enciphering key d does not reveal the inverse key e provided that .phi.(N) is unknown. Knowledge of .phi.(N) is equivalent to knowing the factorization N=p.q. The security of the RSA-scheme relies on the assumption that RSA-enciphering x.fwdarw.x.sup.d (mod N) is difficult to invert when d, N are given but .phi.(N) and e=d.sup.-1 mod.phi.(N) are unknown. All known methods for inverting RSA-enciphering require the factorization of N.

We are going to show that the following hypothesis is closely related to the security of the RSA-scheme. Our random number generators will rely on this hypothesis.

Hypothesis 2.1 Let d.gtoreq.3 be an odd integer and l= 2n/d . For random N.epsilon.S.sub.n such that gcd(d,.phi.(N))=1 and for all M=.theta.(2.sup.l) the following distributions on [1,N] are indistinguishable by polynomial time statistical tests:

the uniform distribution on [1,N],

x.sup.d (mod N) for random x.epsilon.[1,M].

We explain the hypothesis in more detail. The concept of a statistical test has been introduced by Yao (1982). A polynomial time statistical test is a sequence T=(T.sub.n).sub.n.epsilon. of probabilistic algorithms with a uniform polynomial time bound n.sup.o(1). According to Yao it is sufficient to consider statistical tests with 0,1-output. Let

be the probability that T.sub.n outputs 1. The probability space is that of all integers N.epsilon.S.sub.n with gcd(d,.phi.(N))=1, all numbers y.epsilon.[1,N] and all 0-1 sequences of internal coin tosses, with uniform distribution. Let ##EQU5## be the same probability with random numbers y.epsilon.[1,N] replaced by y=x.sup.d (mod N) for random x.epsilon.[1,M]. The hypothesis means that for every polynomial time statistical test T and all M.sub.n =.theta.(2.sup.l) ##EQU6## We say that the statistical test T .epsilon..sub.n -rejects RSA-ciphertexts x.sup.d (mod N) of random x.epsilon. ##EQU7## for infinitely many n. If (3) holds for all polynomial time statistical tests T we call RSA-ciphertexts x.sup.d (mod N) of random messages x.epsilon.[1,M.sub.n ] pseudo-random in [1,N]. In this case the distributions of x.sup.d (mod N) for random x.epsilon.[1,M.sub.n ] and the uniform distribution on [1,N] are called indistinguishable.

In general two sequences of distributions (D.sub.n).sub.n.epsilon. and (D.sub.n).sub.n.epsilon. are called indistinguishable if for every pol. time statistical test (T.sub.n).sub.n.epsilon. , that is given random inputs with respect to D.sub.n (D.sub.n, resp.) the probability ##EQU8## resp.) of output 1 satisfy lim ##EQU9## for all t.gtoreq.0. In case of indistinguishable distributions D.sub.n,D.sub.n and if D.sub.n is the uniform distribution on set C.sub.n then random elements with respect to D.sub.n are called pseudo-random in C.sub.n. In case of pseudo-random pairs (x,y) we call x and y pseudo-independent. A random number generator is called perfect if it transforms random seeds into pseudo-random strings.

It can easily be seen that the Hypothesis 2.1 can only fail if RSA-enciphering leaks partial information on RSA-messages.

Fact 2.2 Suppose Hypothesis 2.1 fails. Then given d and N we can distinguish between RSA-ciphertexts x.sup.d (mod N) of random messages x.epsilon.[1,N] and of random messages x.epsilon.[1,M.sub.n ] for some M.sub.n =.theta.(2.sup.l).

Proof The transformation x.fwdarw.x.sup.d (mod N) permutes the integers in the interval [1,N]. The RSA-enciphering x.sup.d (mod N) of random messages x.epsilon.[1,N] is uniformly distributed over [1,N]. If Hypothesis 2.1 fails the uniform distribution can be distinguished from RSA-ciphertexts x.sup.d (mod N) for random x.epsilon.[1,M.sub.n ]; i.e. RSA-ciphertexts x.sup.d (mod N) would leak information on whether the message x is contained in [1,M.sub.n ]. QED

We do not claim that the RSA-scheme breaks down if the hypothesis fails. This is because messages in the interval [1,2.sup.l ] are rather unlikely. Nevertheless the hypothesis is close to the security of the RSA-scheme. Using the following Theorem 2.3 we can relate the hypothesis to RSA-security (see Corollary 2.5).

Theorem 2.3 Alexi, Chor, Goldreich, Schnorr (1985)

Let d,N be integers such that gcd(d,.phi.(N))=1. Every probabilistic algorithm AL, which given the RSA-enciphering x.sup.d (mod N) of a message x, has an .epsilon..sub.N -advantage in guessing the least significant bit of the message x can be transformed (uniformly in N) into a probabilistic algorithm AL for deciphering arbitrary RSA-ciphertexts. The deciphering algorithm AL, when given for input x.sup.d (mod N), d and N, terminates after at most ##EQU10## elementary steps and outputs x with probability at least 1/2.

We count for elementary steps the .sub.N operations (addition, multiplication, division), RSA-encryptions and calls for algorithm AL at unit cost. We say that algorithm AL has an .epsilon..sub.N -advantage in guessing the least significant bit of x if ##EQU11## The probability space is the set of all x.epsilon.[1,N] and all 0-1 sequences of internal coin tosses, with uniform probability.

By Theorem 2.3 the security of the RSA-scheme with parameters N, d implies that the following two distributions cannot be distinguished given only N and d:

the uniform distribution on [1,N],

x.sup.d (mod N) for random, even x.epsilon.[1,N].

Everyone who is able to distinguish these distributions can decode arbitrary RSA-ciphertexts x.sup.d (mod N) given only N and d. We will present in Corollary 2.4 a more formal version of this statement.

We say that a probabilistic algorithm AL .epsilon..sub.N -rejects the distribution D on [1,N] if ##EQU12## where ##EQU13## (resp.) is the probability that AL on input y.epsilon.[1,N] outputs 1. The probability space is the set of all y.epsilon.[1,N], distributed according to D (with uniform distribution, resp.) and of all 0-1 sequences of internal coin tosses of algorithm AL. Using this notion we can reformulate Theorem 2.3 as follows.

Corollary 2.4 Let d, N be integers such that gcd(d,.phi.(N))=1. Every probabilistic algorithm AL, that .epsilon..sub.N -rejects RSA-ciphertexts x.sup.d (mod N) of even random messages x can be transformed (uniformly in N) into a probabilistic algorithm for decoding arbitrary RSA-ciphertexts. This deciphering algorithm terminates after at most ##EQU14## elementary steps (i.e. .sub.N operations, RSA encryptions and calls for AL).

We next show that Corollary 2.4 remains valid if we replace RSA-ciphertexts of random even messages x, by RSA-ciphertexts of random messages x.epsilon.[1,N/2].

Corollary 2.5 Let d, N be odd integers such that gcd(d,.phi.(N))=1. Every probabilistic algorithm AL, that .epsilon..sub.N -rejects RSA-ciphertexts x.sup.d (mod N) of random messages x.epsilon.[1,N/2] can be transformed (uniformly in N) into a probabilistic algorithm for decoding arbitrary RSA-ciphertexts. This deciphering algorithm terminates after at most ##EQU15## elementary steps.

Proof For odd N and all x.epsilon.[1,N] we have

We see from this equivalence that the following distributions are identical for odd N:

.x.sup.d (mod N) for random x.epsilon.[1,N/2],

.2.sup.-d y.sup.d (mod N) for random even y.epsilon.[1,N].

Moreover we can transform in polynomial time y.sup.d (mod N) into 2.sup.-d y.sup.d (mod N). Thus an .epsilon..sub.N -rejection of RSA-encipherings x.sup.d (mod N) of random messages x.epsilon.[1,N/2] can be transformed (uniformly in N) into an .epsilon..sub.N -rejection of RSA-ciphertexts y.sup.d (mod N) of random even y.epsilon.[1,N]. Corollary 2.5 follows from Corollary 2.4 by this transformation.

Under the assumption that the RSA-scheme is safe Corollary 2.5 proves a slight modification of our hypothesis. The interval [1,2.sup.l ] of Hypothesis 2.1 is replaced by the interval [1,N/2] in this modification. This poses the question whether the length of the interval is crucial for the hypothesis to be valid. We next show that Hypothesis 2.1, with the interval [1,2.sup.l ] replaced by the interval ##EQU16## is valid if the RSA-scheme is safe.

Theorem 2.6 Let d, N be odd integers such that gcd(d,.phi.(N))=1. Every probabilistic algorithm AL, that .epsilon..sub.N -rejects RSA-ciphertexts x.sup.d (mod N) of random messages x.epsilon.[1, N2.sup.-k ] can be transformed (uniformly in N) into a probabilistic algorithm for decoding arbitrary RSA-ciphertexts. This deciphering algorithm terminates after at most ##EQU17## elementary steps.

Proof Under the assumption that the RSA-scheme is safe, Alexi et alii (1985) have shown that the log n least significant bits of RSA-messages x are pseudo-random when given x.sup.d (mod N), d and N. Their proof transforms every algorithm that .epsilon..sub.N -rejects RSA-encipherings x.sup.d (mod N) of random messages x satisfying x=0(mod 2.sup.k), (uniformly in N) into a probabilistic algorithm for deciphering arbitrary RSA-ciphertexts. This RSA-deciphering procedure terminates after at most ##EQU18## elementary steps (i.e. .sub.N -operations, RSA-encipherings and calls for algorithm AL).

For odd N and all x.epsilon.[1,N] we obviously have

Therefore the following two distributions are identical for odd N:

x.sup.d (mod N) for random x.epsilon.[1,N2.sup.-k ],

2.sup.-kd y.sup.d (mod N) for random y.epsilon.[1,N 2.sup.-k ] satisfying y=0(mod 2.sup.k).

Moreover we can transform in polynomial time y.sup.d (mod N) into 2.sup.-kd y.sup.d (mod N). Thus an .epsilon..sub.N -rejection of RSA-ciphertexts x.sup.d (mod N) of random messages x.epsilon.[1,N 2.sup.-k ] can be transformed (uniformly in N) into an .epsilon..sub.N -rejection of RSA-ciphertexts y.sup.d (mod N) of random messages y satisfying y=0(mod 2.sup.k). Corollary 2.6 follows from this transformation and the above mentioned proof of Alexi et alii (1985).

Notice that the time bound for the RSA-deciphering algorithm of Corollary 2.6 is polynomially related to the time bound of algorithm AL provided that k.ltoreq.log n. Hence if Hypothesis 2.1 fails, with the interval [1,2.sup.l ] replaced by the interval [1, N2.sup.- log n ], then RSA-ciphertexts can be deciphered in polynomial time. Also if Hypothesis 2.1 fails, with the interval [1,2.sup.l ] replaced by the interval ##EQU19## then RSA-ciphertexts can be deciphered in time ##EQU20## However the fastest known algorithm for RSA-deciphering, via factoring N, requires about ##EQU21## steps, where 0.693.apprxeq.log2. Thus if Hypothesis 2.1 fails for the interval ##EQU22## then we can speed up the presently known attacks to the RSA-scheme.

It remains the question whether the computational properties of the distribution x.sup.d (mod N) change when x ranges over very small integers x. In fact Hypothesis 2.1 does not hold for the interval [1,N.sup.1/d ] since we have x.sup.d <N for all x.epsilon.[1,N.sup.1/d ] and therefore RSA-ciphertexts x.sup.d (mod N) can easily be deciphered for x.epsilon.[1,N.sup.1/d ]. On the other hand the d-powers x.sup.d are of order N.sup.2 for almost all numbers x.epsilon.[1,2.sup.l ]. We conjecture that this is sufficient to make the task of deciphering x.sup.d (mod N) hard. This is justified because inverting the squaring

is known to be as hard as factoring N, and the squares x.sup.2 are of order N.sup.2, too.

We are going to study the question whether Hypothesis 2.1 should be extended to polynomials P(x) that are more general than RSA-polynomials P(x)=x.sup.d with gcd(d,.phi.(N))=1. There is an obvious extension of Hypothesis 2.1 to arbitrary exponents d.gtoreq.2. It seems that the condition gcd(d,.phi.(N))=1 is not necessary for odd d. But we must modify the hypothesis for even d since the Jacobi-symbol gives efficient information on the quadratic residuosity. We formulate the extended hypothesis so that it can be applied in the proof of Theorem 3.1 to establish perfect RNG's. For reasons of efficiency we are particularly interested in even exponents d and in exponents that are powers of 2.

Extension to even d of Hypothesis 2.1: For random N.epsilon.S.sub.n, all M=.theta.(2.sup.l), random x.epsilon.[1,M] and y:=x.sup.d (mod N), z:= y/2.sup.n-l the following holds.

(1) y and z.sup.d (mod N) are pseudo-random quadratic residues,

(2) the number y(mod 2.sup.n-l) is pseudo-random in [1,2.sup.n-l ],

(3) z.sup.d (mod N) and y(mod 2.sup.n-l) are pseudo-independent.

The extended hypothesis can be justified by the work of Alexi et alii (1984) for the case that N is a Blum-integer, i.e. N is product of two primes p and q such that p=3(mod 4) and q=3(mod 4). Roughly speaking, it does not matter that y=x.sup.d (mod N) ranges over quadratic residues. None of the disjoint parts z and y(mod 2.sup.n-l) of y contains efficient information on the quadratic residuosity of x.sup.d (mod N). The dependence of z and y(mod 2.sup.n-l), by the quadratic residuosity of y, is hidden by the transformation z.fwdarw.z.sup.d (mod N).

Next we consider arbitrary polynomials P(x) of degree d. We are going to show that some elementary methods for distinguishing random numbers y.epsilon.[1,N] and P(x) mod N for random x.epsilon.[1,N.sup.2/d ] do not work. Theorem 2.7 is a first step in this direction. This problem clearly deserves further study.

In general we can invert the transformation

only if the factorization N=pq is given. Then, using Berlekamps algorithm for polynomial factorization we invert (1) modulo p and modulo q and apply the Chinese remainder construction. This can be done in probabilistic time (nd).sup.o(1). Without knowing the factorization of M we do not know how to invert (1). We can however invert factors P(x) of x.sup..phi.(N) provided that we know the cofactor x.sup..phi.(N) /P(x) but then we can factor N.

Can we invert (1) for small integers x? If .vertline.P(x).vertline./N is small we can guess z=P(x) and factorize P(x)-z. Theorem 2.7 below shows that .vertline.P(x).vertline./N is large for almost all x.epsilon.[1,N.sup.2/d ] provided that P(x) has degree.ltoreq.N.sup.1/2d. This degree bound is necessary since there exist polynomials of degree N.sup.2/d that vanish on the intervall [1,N.sup.2/d ].

Theorem 2.7 Let A,B,d be integers such that M.gtoreq.(BN).sup.1/d 16Ad, and let P(x).epsilon. [x] have degree d. Then we have prob[.vertline.P(x).vertline..ltoreq.BN].ltoreq.1/A for random x.epsilon.[1,M].

Proof Let x.sub.1, . . . , x.sub.k be the distinct real numbers in [0,N] satisfying P(x.sub.i).sup.2 =B.sup.2 N.sup.2 for i=1, . . . , k. We have k.ltoreq.2d since P(x).sup.2 has degree 2d. We partition the real interval [0,M] into 4Ad intervals of length M/(4Ad). A fundamental theorem in approximation theory (see e.g. Stiefel (1969), p. 236) implies that ##EQU23## for each of these intervals I. Hence ##EQU24## This shows that every interval I, that contains an integer x satisfying .vertline.P(x).vertline..ltoreq.BN, must also contain some point x.sub.i, 1.ltoreq.i.ltoreq.k.ltoreq.2d. The intervals I that contain some point x.sub.i can have at most ##EQU25## integer points. This accounts for at most a fraction of ##EQU26## of the points in [1, M].

The Sequential and the Parallel Polynomial Generator

In this section we build several RNG's on polynomials P(x) of degree d.gtoreq.2 that have the following generator property. The generator property formulates Hypothesis 2.1 for arbitrary polynomials P(x).

Definition The polynomial P(x) has the generator property if for random N.epsilon.S.sub.n, all M proportional to N.sup.2/d and random x.epsilon.[1,M] the number P(x) mod N is pseudo-random in [1,N].

The generator property means that P stretches random seeds x.epsilon.[1,N.sup.2/d ] into pseudo-random numbers P(x) mod N in the interval [1,N]. By Hypothesis 2.1 RSA-polynomials P(x)=x.sup.d with gcd(d,.phi.(N))=1 and d.gtoreq.3 have the generator property.

The sequential polynomial generator (SPG) generates a sequence of numbers x=x.sub.1, x.sub.2, . . . , x.sub.i, . . . , in [1,N.sup.2/d ] that are represented by bit strings of length l:= 2n/d . The output at x.sub.i, Out(x.sub.i).epsilon.{0,1}.sup.n-l, is the bit string consisting of the n-l least significant bits of the binary representation of P(x.sub.i) mod N. The successor x.sub.i+1 of x.sub.i is the number corresponding to the other bits of P(x.sub.i) mod N,

The sequential polynomial generator as illustrated in FIG. 6.

Let the k-output of the SPG ##EQU27## be the concatenated output of the first k steps.

Notice that the most significant bits of P(x.sub.i) mod N are biased depending on the most significant bits of N. Even though the most significant bits of P(x.sub.i) mod N are not pseudo-random we can form from these bits the successor x.sub.i+1 of x.sub.i. This is because the generator property and Hypothesis 2.1 imply that P(x.sub.i) mod N is pseudo-random for random numbers x.sub.i .epsilon.[1,M] for all M proportional to 2.sup.l. We could fix M to 2.sup.l if the SPG would not use at all the l most significant bits of P(x.sub.i) mod N, and would form Out(x.sub.i) and x.sub.i+1 from the n-l least significant bits.

Theorem 3.1 Suppose that P has the generator property. Then for random N.epsilon.S.sub.n, random x.epsilon.[1,N.sup.2/d ] and polynomially bounded k (i.e. k=k(n)=n.sup.O(1)) the k-output SPG.sub.k,p (x,N) of the sequential polynomial generator is pseudo-random.

Proof For random N.epsilon.S.sub.n and random x.sub.1 .epsilon.[1,N.sup.2/d ] the number P(x.sub.1) mod N.epsilon.[1,N] is pseudo-random. It follows that the bit string Out(x.sub.1).epsilon.{0,1}.sup.n-l is pseudo-random and that the number x.sub.2 .epsilon.[1,2.sup.l ] is pseudo-random. We also see that the pair (Out(x.sub.1), x.sub.2) is pseudo-random. It follows from the generator property and since x.sub.2 is pseudo-random that

is pseudo-random, too. To prove this claim we replace in a statistical test T=(T.sub.n).sub.n.epsilon. for z:=(Out(x.sub.1) Out(x.sub.2), x.sub.3) either (Out(x.sub.2), x.sub.3) or Out (x.sub.1) by independent random objects generated through internal coin tosses. This transforms T into statistical test for P(x.sub.2) mod N (P(x.sub.1)mod N, resp.). If z is .epsilon..sub.n -rejected then either P(x.sub.2) mod N or P(x.sub.1) mod N is (.epsilon..sub.n /2)-rejected. In either case this yields a statistical test that (.epsilon..sub.n /2)-rejects P(x.sub.1) mod N.

By induction on k the same argument proves that

is pseudo-random for every fixed k. The pseudo-randomness also holds if k=k(n) depends on n if k is polynomially bounded in n, i.e. k=n.sup.o(1). Using the above argument we can transform a test that .epsilon..sub.n -rejects (SPG.sub.k,P (x.sub.1,N), x.sub.k+1) into a test that (.epsilon..sub.n /k)-rejects P(x.sub.1) mod N.

It is important that the above proof also applies to polynomials P(x)=x.sup.d with even d. Instead of using the generator property of P we can use the extension to even d of Hypothesis 2.1. Speaking informally, it does not hurt that x.sup.d (mod N) ranges over quadratic residues since the output merely contains the least significant bits of x.sup.d (mod N) and these bits give no efficient information on the quadratic residuosity of x.sup.d (mod N). Thus we can use for random bit generation the polynomial P(x)=x.sup.16 which yields particular efficient generators.

PRACTICAL POLYNOMIAL GENERATORS

For practical applications let N be a fixed product of two random primes p and q which each is 256 bits long. N.sup.2/d must be so large that it is infeasible to enumerate a non-negligible part of [1,N.sup.2/d ]. We recommend that d.ltoreq.16 so that N.sup.2/d .gtoreq.2.sup.64.

Let N be n=512 bits long and let gcd(15,.phi.(N))=1. We choose d=15, P(x)=x.sup.15. Let Out(x.sub.i) consist of the 440 least significant bits of P(x.sub.i) mod N and let x.sub.i+1 be the number corresponding to the 68 most significant bits of P(x.sub.i) mod N. We compute x.sup.15 (mod N) by computing x.sup.2, x.sup.4, x.sup.8, x.sup.7 =x.sup.4 . x.sup.2 . x and x.sup.15 =x.sup.8 . x.sup.7 (mod N). Only the last multiplication requires modular reduction. The other multiplications are with small numbers. The costs of one iteration step correspond to one full modular multiplication. Thus this SPG iteratively outputs 440 pseudo-random bits at the cost of one full modular multiplication with a modulus that is 512 bits long.

Another suitable polynomial is P(x)=x.sup.16 even though this polynomial does not have the generator property. The computation of x.sup.16 (mod N) is particularly easy; we compute x.sup.2, x.sup.4, x.sup.8 and x.sup.16 =x.sup.8 . x.sup.8 (mod N). The SPG with P(x)=x.sup.16 iteratively outputs 448 bits at the cost of one full modular multiplication with a modulus N that is 512 bits long.

Next we are going to extend the SPG to a generator which we can speed by parallelization. The parallel polynomial generator (PPG) generates from random seed x.epsilon.[1,N.sup.2/d ] a tree with root x and outdegree at most d/2. The nodes of this iteration tree are pseudo-random numbers in [1,N.sup.2/d ] that are represented by bit strings of length l.

The successors y(1), . . . , y(s) of a node y with degree s and the output string Out(y) at y are defined as follows. Let b.sub.1, . . . , b.sub.n be the bits of the binary representation of P(y) mod N, with b.sub.1 being the most significant bit, i.e. ##EQU28## We partition the sl most significant bits into s block with l bits in each block. The corresponding numbers ##EQU29## are the successors of node y in the iteration tree. The output Out(y) at node y consists of the remaining low order bits of P(y) mod N,

For convenience we denote the nodes on level k of the iteration tree as x(j.sub.1, . . . , j.sub.k); x(j.sub.1, . . . , j.sub.k-1) is the direct predecessor of x(j.sub.1, . . . , j.sub.k) and j.sub.k ranges from 1 to s.sub.k-1 ="outdegree of x(j.sub.1, . . . , j.sub.k-1)". For simplicity we let the outdegree of node x(j.sub.1, . . . , j.sub.k) be a function depending on k only; we assume that s.sub.k .gtoreq.1.

The parallel polynomial generator can be figured by the infinite tree of FIG. 7.

We define the k-output PPG.sub.k,P (x,N) of the PPG with seed x as the concatenation of all bit strings Out(x(j.sub.1, . . . , j.sub.i)) on levels i with 0.ltoreq.i.ltoreq.k, with respect to any efficient enumeration order, as e.g. preorder traversal, postorder traversal, inorder traversal or enumeration by levels.

In the particular case that all outdegrees are one, i.e. s.sub.0 =s.sub.1 =. . . =s.sub.k =1, the parallel and the sequential polynomial generator coincide. The argument of Goldreich, Goldwasser and Micali (1986) extends Theorem 3.1 from the SPG to arbitrary PPG's, provided that we process at most polynomially many nodes in the iteration tree. This yields the following theorem.

Theorem 3.2 Suppose that P has the generator property. Then for random N.epsilon.S.sub.n, random x.epsilon.[1,2.sup.l ] the k-output PPG.sub.k,P (x,N) of the parallel polynomial generator is pseudo-random provided that the length of PPG.sub.k,P (x,N) is polynomially bounded.

Idea of proof

There is a straightforward way to extend the proof of Theorem 3.1. Suppose that the k-output PPG.sub.k,P (x,N) collects the outputs of k nodes. Then every statistical test that .epsilon..sub.n -rejects PPG.sub.k,P (x,N) for random x.epsilon.[1,N.sup.2/d ] and random N.epsilon.S.sub.n can be transformed into a statistical test that (.epsilon..sub.n /k)-rejects P(x) mod N.

For the output of the PPG we can use any efficient enumeration for the nodes of the iteration tree. To support parallel evaluation we can adjust the shape of the iteration tree and the enumeration order to the number of available parallel processors. In Example 3 we form, for 8 parallel processors, an iteration tree consisting of 8 rays attached to the root; the nodes are enumerated by levels and within levels from left to right. For m parallel processors we can use any iteration tree consisting of m isomorphic subtrees attached to the root; we can enumerate, in any order, the m-tuples of corresponding nodes in these subtrees. The enumeration within the subtrees can be chosen to support fast retrieval; for this we can enumerate the nodes e.g. in preorder traversal or in inorder traversal. It is an obvious but important observation that m processors can speed the pseudo-random bit generation of the PPG by a factor m. Once we are given m nodes on the same level of the iteration tree we can process the subtrees below these nodes independently by m parallel processors. These processors do not need to communicate.

Corollary 3.3 Using m processors in parallel we can speed the pseudo-random bit generation of the parallel polynomial generator by a factor m.

PRACTICAL PARALLEL POLYNOMIAL GENERATORS

Let N be product of two random primes so that N is 512 bits long. Let P(x)=x.sup.16.

We construct from random x.epsilon.[1,2.sup.64 ] a tree with 8 nodes per level. (FIG. 8)

1. Stretch a random seed x.epsilon.[1,2.sup.64 ] into x.sup.16 (mod N).

2. Partition the binary representation of x.sup.16 (mod N) into 8 bit strings x(1), . . . , x(8) of length 64. Put k=1 and let PPG.sub.1,P (x,N) the empty string.

3. For j=1, . . . , 8 let x(j 1.sup.k).epsilon.I.sub.64 consist of the 64 most significant bits of the binary representation of x(j 1.sup.k-1).sup.16 mod N, and let Out(x(j 1.sup.k)).epsilon.I.sub.448 consist of the remaining 448 least significant bits.

4. ##EQU30##

Using 8 parallel processors this PPG iteratively generates 8 . 448=3584 pseudo-random bits in the time for one full modular multiplication with a modulus N that is 512 bits long. With current processors for smart cards such a full modular multiplication can be done in less than 0.2 sec. Thus 8 parallel processors can generate about 18000 pseudo-random bits per sec.

We construct from random x.epsilon.[1,2.sup.64 ] a complete tree of outdegree 4.

1. Choose a random seed x.epsilon.[1,2.sup.64 ] for root of the tree.

2. For every node y.epsilon.[1,2.sup.64 ] of the tree compute the successors y(1), . . . , y(4) and the output Out(y) of y.sup.16 (mod N) by partitioning the binary representation B of y.sup.16 (mod N) as

and compute for i=1, . . . , 4

The main interest in such a PPG comes from fast retrieval methods.

Fast retrieval for the PPG: If the PPG has a complete iteration tree one can efficiently retrieve substrings of the output. Consider example 4 with a complete iteration tree of outdegree 4. Level k of the tree has 4.sup.k nodes and the first k levels have about 4.sup.k . 5/4 nodes in total. Suppose the nodes of the tree are enumerated in preorder traversal. Each node yields 256 output bits. To retrieve node y we follow the path from the root to y. This requires processing and storage of at most k nodes and can be done at the costs of about k full modular multiplications. Once we have retrieved node y and stored the path from the root to node y, the bit string that follows Out(y) in the output can be generated by standard methods at the speed of 256 bits per modular multiplication. For most practical applications the depth k will be at most 30 which permits to generate a pseudo-random string that is 3.7 . 10.sup.20 bits long. We see that retrieval of substrings is very efficient, it merely requires a preprocessing stage of a few seconds to retrieve the initial segment of the substring.

Theorem 3.4 Every node y of depth k in the iteration tree of the PPG can be accessed and processed at the costs of O(k) modular multiplications.

Parallelization and fast retrieval for arbitrary perfect RNG's

It is an important observation that the above methods of parallelization and of efficient retrieval apply to every perfect RNG (G.sub.n).sub.n.epsilon. . The parallel version of the generator associates an iteration tree to a random seed. For example let G.sub.n :I.sub.n .fwdarw.I.sub.3n stretch a random strings in I.sub.n into pseudo-random strings in I.sub.3n. We construct from random seed x .epsilon.I.sub.n a binary iteration tree with nodes in I.sub.n. Let x be the root of the tree. Construct the two successors y(1), y(2) and the output Out(y) of node y by partitioning G.sub.n (y).epsilon.I.sub.3n into three substrings of length n,

Let PG.sub.k,G (x) be the concatenated output of all nodes with depth at most k (compare with the definition of PPG.sub.k,P (x,N)).

Theorem 3.5 Let (G.sub.n).sub.n.epsilon. be any perfect RNG. Then for random seed x.epsilon.I.sub.n the concatenated output PG.sub.k,G (x) of all nodes with depth.ltoreq.k is pseudo-random provided that its length is polynomially bounded in n.

We illuminate our method of parallelization in applying it to some less efficient versions of the RSA/Rabin generator. Let N be a product of two random primes such that N is 512 bits long and gcd(3,.phi.(N))=1.

From random seed x.epsilon.[1,N] we generate the sequence of numbers x.sub.1, x.sub.2, . . . , x.sub.i, . . . .epsilon.[1,N] as

Under the assumption that the RSA-enciphering x.fwdarw.x.sup.3 (mod N) is safe for the particular N, Alexi et alii (1984) have shown that about the 16 least significant bits of x.sub.i are pseudo-independent from x.sub.i+1. This suggest the following output of x.sub.i

Thus for random x.sub.1 .epsilon.[1,N] and under the assumption that RSA-enciphering is safe we obtain pseudo-random bit strings ##EQU31## Out(x.sub.i) of length 1600. We apply a binary tree construction to the function

that stretches the binary representation of x.sub.1 .epsilon.[1,N] into ##EQU32## Out(x.sub.i). The binary tree has nodes in I.sub.512. The successors y(1), y(2) and the output of node y are obtained by partitioning G(y) into two successor strings of length 512 and an output string Out.sub.G (y) .epsilon.I.sub.576. Processing a node of the binary iteration tree costs 200 modular multiplication.

We can accelerate this generator under the reasonable assumption that the 448 least significant bits of random x.epsilon.[1,N] and the number x.sup.3 (mod N) are pseudo-independent. We set

and it follows that ##EQU33## Out(x.sub.i).epsilon.I.sub.1344 is pseudo-random for random x.sub.1 .epsilon.[1,N]. We apply the binary tree construction to the function

that stretches the binary representation of x.sub.1 .epsilon.[1,N] into ##EQU34## Out(x.sub.i). The successors y(1), y(2).epsilon.I.sub.512 and the output Out.sub.G (y).epsilon.I.sub.320 of node y are obtained by partitioning G(y).epsilon.I.sub.1344 into two strings in I.sub.512 and Out.sub.G (y).epsilon.I.sub.320. Processing a node of the binary tree costs 6 modular multiplications.

We can further speed up this generator under the assumption that the 448 least significant bits of random x.epsilon.[1,N] are pseudo-independent of x.sup.2 (mod N). (It follows from Alexi et alii (1984) that the 16 least significant bits of random x.epsilon.[1,N] are pseudo-independent of x.sup.2 (mod N) if factoring the particular N is hard. Under this assumption we can replace the iteration ##EQU35## by ##EQU36## As in Example 5 we associate with a random x.epsilon.[1,N] a binary iteration tree with nodes in I.sub.512. Processing a node of this tree costs about 4 modular multiplications and yields 320 pseudo-random bits for output.

It is interesting to compare the efficiency of these parallel RNG's with the parallel RNG's based on Hypothesis 2.1. For the latter RNG's in examples 1-4 the cost per node of the iteration tree is about 1 mulitplication modulo N. This shows that the new perfect RNG's are more suitable for our method of parallelization and fast retrieval.

Alexi, W., Chor, B., Goldreich, O., and Schnorr, C. P.: RSA and Rabin Functions: certain parts are as hard as the whole. Proceeding of the 25th Symposium on Foundations of Computer Science, 1984, pp. 449-457; also; Siam Journal on Comput., (1988).

Blum, L., Blum, M. and Shub, M.: A simple unpredictable pseudo-random number generator. Siam J. on computing (1986), pp. 364-383.

Blum, M. and Micali, S.: How to generate cryptographically strong sequences of pseudo-random bits. Proceedings of the 25th IEEE Symposium on Foundations of Computer Science, IEEE, New York (1982); also Siam J. Comput. 13 (1984), pp. 850-864.

Goldreich, O., Goldwasser, S., Micali, S.: How to Construct Random Functions. Proceedings of the 25th IEEE Symposium on Foundations of Computer Science, IEEE, New York, (1984); also Journal ACM 33,4 (1986), pp. 792-807.

Knuth, D. E.: The Art of Computer Programming. Vol. 2, second edition. Addison Wesley (1981).

Luby, M. and Rackoff, Ch.: Pseudo-random permutation generators and cryptographic composition. Proceedings of the 18th ACM Symposium on the Theory of Computing, ACM, New York (1985) pp. 356-363.

Stern, J.: Secret linear congruential generators are not cryptographically secure. Proceedings of the 28th IEEE-Symposium on Foundations of Computer Science (1987) pp. 421-426.

Stiefel, E.: Einfuhrung in die numerische Mathematik. Teubner, Stuttgart (1969).

Yao, A. C.: Theory and applications of trapdoor functions. Proceedings of the 25th IEEE Symposium on Foundations of Computer Science, IEEE, New York (1982), pp. 80-91.

While this invention has been particularly shown and described with references to preferred embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.