Pseudo-random Number Generators and Stream Ciphers Computers, being deterministic, cannot, on the basis of pure computation, produce a random sequence of bits or numbers (whatever random is) Sometimes we are interested in generating a sequence (e.g. for testing) that has some properties of a random sequence (e.g. certain statistical properties such as unbiased distributions of values, lack of correlation, etc.) A PRNG that is "cryptographically secure" i.e. one for which the next output cannot be (practically) predicted on the basis of an observed sequence, can be used for cryptography as a pseudo-one-time pad. The key is some "seed" used to initialize the generator. All practical PRNGs have an associated "period" - they eventually repeat themselves. * This is a consequence of the PRNG being a finite state machine * The period can be very long (and must be for cryptographic applications, otherwise a brute-force attack is practical) * Fortunately, finite state machines can have periods on the order of 2^n where n is the number of bits of state, so producing PRNGs with long periods is not a problem. Examples: Congruential generators s(i+1) = (a * s(i) + b) % m * For example, let a = 7, b = 3, m = 11, Start with 4: 4, 31 = 9, 66 = 0, 3 = 3, 24 = 2, 17 = 6, 45 = 1, 10 = 10, 73 = 7, 52 = 8, 59 = 4, ... (period = 11) Start with 5: 5, 38 = 5, ... period = 1. * Obviously, the maximum period of such a generator cannot exceed m * In fact, for prime p, the period of a congruential generator is the order of a mod p (the smallest value l such that a^l = 1 mod p) for all seeds except for a single "bad value" given by s_bad = -(a-1)^(-1) * b mod p * The greatest periods are thus obtained when a is a primitive root of p, and the period is p-1. * This is easy to see in the case of b = 0, since we just have s_i = s_0 * a^i. * The case for b != 0 can be analyzed using linear algebra and an eigenvector decomposition. * Not cryptographically secure. Linear, and in fact polynomial congruential generators have all been broken. Truncated linear congruential generators (take low-order bits as output) have also been broken (but not truncated quadratic generators as we will see) * Some combinations of a, b and m give good statistical properties (e.g. m = 2^31 - 1 = 214783647, a = 7^5 = 16807.) Linear Feedback Shift Registers We've seen these before. Basically we have an n-place register (often of bits, but can be generalized to integers mod m) At each clock cycle, the register is shifted, the low-order slot is output, and the high end slot is set to a weighted sum mod m of the slot values before the shift. For the common case of m=2 (bits) this is the XOR or parity of a subset of the slots or "taps" (the ones with non-zero weight) * Clearly, the maximum period for such a shift register is m^n -1 (that is the number of possible states minus the all 0 state that clearly generates an endless string of 0) * In fact this bound is achieveable, and is achieved if m is a prime p, and the polynomial determined by the weights is what is called "primitive" over the field Z/p which basically means it doesn't factor and has certain other properties somewhat analogous to a primitive root only in a polynomial field rather than an integral one. * Finding such primitive polynomials is generally done using a guess and check procedure. * Some examples for m = 2, where we specify the location of the "taps" (2,1) (3,1) (4,1) (5,2) (13,4,3,1) (9689, 84) These are what are called "sparse" polynomials "Dense" ones would probably be better cryptographically * LFSRs are not valuable cryptographically by themselves The firse n output bits are the seed, and the tap sequence can be efficiently determined from 2n output bits if unknown. * They are used in cryptography by non-linearly combining the outputs of one or more. * Key is often just the initial state of the registers. * e.g. XOR the outputs of several relatively prime registers, and clock them based on another non-linear function of the state * Lots of such schemes have, in fact been broken. * Supposedly still the workhorse of military encryption (and some cell phone schemes) because they are very easy to implement in hardware Blum-Blum-Shub Generator 1. Select large, secret primes, p, q congruent to 3 mod 4. 2. Compute product n = p*q 3. Select a seed s0 = some random r^2 mod n. This is the key. (for direct application, the intial squaring is not necessary) 4. From then on, compute s_i+1 = s_i ^ 2 % n 5. Compute a random bit b_i = s_i % 2. * Cryptographically secure if factoring is hard * Actually up to log_2 k bits can be taken at each step where k is the length of s_i. ----------------------------------------------------------------------------- Some More Abstract Algebra Recall the definitions for a group (set of elements with asociative operation, identity, and inverse) A slightly more complex object is a "ring" Which is a set of elements with two operations ("addition" and "multiplication") where "addition" forms an abelian group on the set. In addition 1. multiplication is associative 2. multiplication is left and right distributive over addition. There may be a multiplicative identity (1) - a ring with identity. Multiplication may be commutative - a cummutative ring. Examples of rings Integers with addition and multiplication (commutative, with identity) Evens with addition and multiplication (no identity) nxn matrixes with matrix addition and multiplication (not commutative) Integers mod m for any m. Polynomials with coefficients in Z mod m A commutative ring with identity that also has a multiplicative inverse for all elements except 0 is called a "field" Examples of fields Rationals Reals Complex numbers Real invertable matrices + 0. Integers modulo a prime The integers are not a field (no inverse) The integers mod m for m not prime are not a field (no inverse). Note that the non-zero elements of a field form a group under multiplication (the so-called multiplicative group of the field) So we have examples of finite fields with prime order based on Z/p. Are there finite fields of non-prime order? It turns out the answer is yes, for orders of the form p^n for p prime, but we have to do a bit of work to construct them. These are the so-called Galois fields G_(p^n) In cryptography the field G_(2^n) come up frequently. The Galois fields are constructed from polynomial rings mod p. To do the construction, we note that there is an analog of the integer division algorithm for polynomials - we can divide a higher order polynomial by a lower one, and come up with a unique quotient and remainder under the condition that the order of the remainder is less than the divisor. (x^4 + 1) / (x^2 + x) = (x^2 -x + 1) * (x^2 + x) + (-x + 1) Thus we can define congruency modulo a polynomial In the above, (x^4 + 1) == (-x + 1) mod (x^2 + x) Note that integer coefficients may become rationals in this process, and generally we need coefficients over some field. Alternatively, we can do these computations in the field Z/p rather than the rationals The modulo reduction is done after the polynomial reduction and may result in some additional congruence relations as coefficients become congruent to each other in Z/p. The elements of the Galois fields are congruence classes of polynomials mod some irreducible polynomials q(x) over Z/p. An irreducible polynomial is somewhat analogous to a prime number in that it cannot be factored into smaller pieces. Addition is polynomial addition Multiplication is polynomial multiplication modulo the irreducible polynomial q(x) Example. The Galois field G_(2^2) = G_4 is derived from some irreducible 2nd degree polynomial in Z/2. Note that for Z/2, there are exactly 2^n polynomials of degree n. Of the ones with non-zero second order, only x^2 + x + 1 is irreducible. The possible residues are 0, 1, x and x + 1. (all possible 1st order polynomials in Z/2) Following are tables for addition and multiplication Note how binary notation can be used to concisely represent the residues. Addition + | 0 1 x x+1 | 00 01 10 11 (binary notation) -------------------------- 0 00 | 0 1 x x+1 1 01 | 1 0 x+1 x x 10 | x x+1 0 1 x+1 11 | x+1 x 1 0 Multiplication * | 0 1 x x+1 (polynomial) | 00 01 10 11 (binary notation) -------------------------- 0 00 | 0 0 0 0 1 01 | 0 1 x x+1 x 10 | 0 x x+1 1 x+1 11 | 0 x+1 1 x We can define G_(2^3) = G_8 similarly, using as elements the 2^3 possible 2nd order polynomial residues in Z/2, and reduction modulo an irreducible 3rd order polynomial to define multiplication. (e.g. x^3 + x + 1). If we take the polynomial residue x, and compute its powers modulo x^3 + x + 1, we get x^0 = 1 x^1 = x x^2 = x^2 x^3 = x+1 x^4 = x^2+x x^5 = x^2+x+1 x^6 = x^2+1 x^7 = 1 In fact x is a generator for the (cyclic) multiplicative group of G_8. For this case, in fact, all the non-constant residues are generators for the group (because its order, 7 is prime). For G_(2^4) = G_16, there are non-constant elements that are not generators. It turns out that it does not matter which irreducible nth order polynomial we choos to define the group. We get the same group (up to an isomorphism) regardless. Thus it makes sense to talk about G_(2^4) without reference to a particular polynomial It turns out, that for every element g of the Galois group G_(p^n), there is a minimum order, irriducible polynomial q_g such that q_g(g) = 0. This polynomial has degree at most n. When the element corresponding to such a minimal polynomial is also a generator for the group, then we say that the polynomial q is "primitive" for the field X/p. Note the analogy to primitive roots of primes. In both cases, they are derived from multiplicative generators for the field. So finally, we get an inkling of why primitive polynomials are involved in maximal period LFSR. The transformation of a bit vector can be represented by a matrix whose characteristic equation is a polynomial with coefficients equal to the tap weights. The roots are the eigenvalues, and we are interested in when a power of an eigenvalue is 1. This turns out to be the order of the element of the Galois group whose minimal polynomial is the characteristic equation that produces the eigenvalues. (And to actually prove this is a whole lot more math). Garret gives one approach, except his definition of a primitive polynomial has a VERY serious typo. The N in the def on page 343 should actually be p^n - 1 where n is the degree of the polynomial, and p is the prime defining the field Z/p in which the polynomial is primitive.