Digitized Chaos for Pseudo-Random Number Generation in Cryptography

Transcription

1 Digitized Chaos for Pseudo-Random Numer Generation in Cryptography Tommaso Addao, Ada Fort, Santina Rocchi, Valerio Vignoli Department of Information Engineering University of Siena, 53 Italy RESEARCH MANUSCRIPT PLEASE REFER TO THE PUBLISHED PAPER Introduction Random numers play a key-role in cryptography, since they are used, e.g., to define enciphering keys or passwords []. Nowadays, the generation of random numers is otained referring to two types of devices, that are often properly comined together: True Random Numer Generators TRNGs), and Pseudo Random Numer Generators PRNGs). The former are devices that eploit truly stochastic physical phenomena [2 6], such as the electronic noise or the chaotic dynamics of certain nonlinear systems: for these devices the output sequences have an intrinsic degree of unpredictaility, that is measured referring to the theoretical tools provided y Information Theory e.g., in terms of the Shannon entropy) [4, 7]. On the other hand, PRNGs are deterministic periodic finite state machines whose aim is to emulate, within the period, the random ehavior of a truly random source of numers. From a theoretical point of view, due to their deterministic nature, PRNGs are potentially predictale y oserving their generated sequences [, 8 ]. Nevertheless, in literature some families of PRNGs are classified to e secure, meaning that their algorithmic structure involves calculations that in average, referring to the prediction task, require an amount of computation time that is asymptotically unfeasile with the size of the prolem, when referring to oth the computational equipment at disposal and the known computing fastest algorithms [, ]. It is worth noting that a given generator, even if elonging to an asymptotically secure family of PRNGs, can generate short periodic and unsecure) sequences for several values of the initial seed 2. Therefore, apart from the cryptographic roustness of their algorithmic structure, a cryptographic PRNG must generate sequences that are Chaos-Based Cryptography: Theory, Algorithms and Applications, 2, L. Kocarev, and S. Lian Ed.), vol. 354, Springer, p E.g., the well known Blum, Blum, Shu generator k n+ = kn 2 mod N can generate short periodic sequences short compared to N).

2 Research manuscript. Please refer to the pulished paper 2 acceptale from a statistical point of view, i.e., that pass a certain numer of standard statistical tests [, 2]. In this work we propose to take certain chaotic systems as a reference for the design of PRNGs ased on nonlinear congruences. In detail, in Section 2 we report a rief comparison etween linear and nonlinear PRNGs. Since our aim is to derive nonlinear congruential generators from certain chaotic maps, in Section 3 we overview some theoretical fundamentals aout TRNGs ased on statistically stale miing dynamical systems, focusing on the family of the Rényi maps. In Section 4 we discuss the link that eists etween the dynamics of chaotic and pseudo-chaotic systems: to eplain how the two dynamics are related it is necessary to project some results achieved within the Ergodic Theory valid for chaotic systems) on the world of digital pseudo-chaos. To this aim, we have proposed a weaker and more general interpretation of the Shadowing Theory proposed y Coomes et al. [3], focusing on proaility measures, rather than on single chaotic trajectories. In Section 5 we study how to digitize the Rényi maps, discussing how to set a minimum period length of the digitized trajectories. In Section 6 we present two alternative methods for the design of PRNGs ased on nonlinear recurrences derived from the Renyi map, reporting the results of the NIST SP8.22 standard statistical test suite [2]. 2 Linear vs. nonlinear congruential generators Conventional cryptographic systems are ased on finite state machines, and the prolem of generating random numers can e analyzed referring to finite susets of integers. Accordingly, let Λ M = {,...,M} e the set of the first M + ) non-negative integers. We define the j-plet k,...,k j Λ M as the initial seed of the generator, and we define a congruential generator as an iterative method for generating the sequence {k i Λ M,i N}, where k n = Gk n,...,k n j ) mod M, n > j, ) for a certain function G : Λ j M N. The congruentialgeneratoris called linear if the function G is a linear comination of the previous j numers in the sequence with coefficients in Λ M ), otherwise it is said nonlinear. The simplest eample of a linear generator of the form ) is the Linear Congruential Generator LCG) k n = ak n +c mod M, whereas for the Linear Feedack Shift Register LFSR) with primitive polynomial 3 ++ we have M = 2, Λ 2 = {,} and Gk n,k n 2,k n 3 ) = k n + k n 3 []. Eamples of nonlinear congruential generators are the Nonlinear Feedack Shift Registers NLFSRs), the polynomial congruential generators in which Gk n ) = a p k p n +a p k p n +...+a, and the Inversive Congruential Generator with Gk n ) = akn +c [,4 7]. Alternatively, we will show that the function G can e otained y digitizing a chaotic map. Regardless of the linearity of G, a generator with finite memory like those of the form ) can e implemented in a finite state machine, eing the state of the machine at the time-step n the j-tuple σ n = k n,...,k n j ) Σ = Λ j n. Since the cardinality of Σ is finite and due to the deterministic nature of the machine evolution, for any initial seed σ Σ the sequence {σ i,i N} is eventually periodic with period µσ ), and it enters the loop after a transient of ησ )

3 Research manuscript. Please refer to the pulished paper 3 a) ) k k k k 2 k k Figure : The distriution of vectors k 2,k,k ) for the linear congruential generator k n = 333k n +3 mod 2 2 suplot a)) and for the nonlinear congruential generator k n = k 3 n k 2 n +7 mod 2 2 suplot )). steps []. As a result, the same happens to the sequences of pseudo-random numers, eing the generated numer at the time-step n dependent of the state σ n. A generator that for any σ generates a sequence with period equal to the cardinality of Σ is called a maimum cycle generator. The prolem of relating the length of the cycles µ with the initial seed σ and the generator parameters e.g., for a linear generator the coefficients in the linear comination G), is an issue of high interest in cryptography. Indeed, it is desirale to know a priori that a given sequence of pseudo-random numers will not enter a too-short predictale cycle. For generators ased on linear recurrences the prolem has een studied in depth, and well known design criteria are at disposal to otain maimum cycle devices. On the other hand, for most families of nonlinear generators the prolem seems to e intractale, with few eceptions [, 8]. When dealing with cryptographic applications, linear methods for generating pseudo-random sequences like LFSRs, LCGs or their proper cominations) are highly not recommended, since efficient algorithms are at disposal to predict the sequence on the asis of a relatively short sequence oservation [8, 9]. This cryptographic weakness is reflected y the fact that methods ased on linear recurrences may generate numers lying on regular lattices [9]. In detail, d+)-tuples of generated numers k n,k n i,...,k n id ) in the sequence form vectors that elong to a lattice structure in N d+, as shown in the suplot a) of Fig.. In the suplot ) of the same figure it is shown that this does not happen for nonlinear generators, for which the distriutions of generated points can reveal irregular structures that it must e underlined in most cases are far from eing uniformly distriuted. Concluding this rief comparison overview, linear recurrences allow for the definition of maimum cycle generators, with regular distriutions of generated numers even too regular for some applications [5, 9]), involving very efficient hardware or software implementations, and they are highly not recommended in cryptography []. These drawacks can e overcome y nonlinear

4 Research manuscript. Please refer to the pulished paper 4 generators, ut in this case only for few eceptions maimum cycles generators could e designed [5, 8], their hardware or software implementations are less efficient and the distriutions of generated numers can e particularly not uniform. Nevertheless, as shown in this work, solutions derived from chaotic systems can help in defining nonlinear cryptographic PRNGs with oth efficient implementation and good statistical properties. 3 Statistically stale miing systems Since our aim is to derive nonlinear congruential generators from certain chaotic maps, in this Section we overview some fundamentals that will e used afterwards. The theory presented hereafter has een simplified to match the aim of this work, adopting the following notation and terminology. With reference to the Leesgue integration theory, the notation L p I) denotes the set of functions f : I R such that I f) p d <, with < p N, whereas L I) is the set of almost everywhere ounded measurale functions. We recall that L p I) and L I) can e made Banach spaces with reference to the norms f p = I f) p d) p and f = inf{m R + such that { I : f) > M} has zero measure}, respectively. We define Π as the set of all finite partitions of intervals of [,), i.e., if Q Π then Q = {I i,i =,...,q,with q > }, with I i I j = for i j and q i= I i = [,). Among the elements of Π we highlight the partition P n = {I,...,I 2n } made of the 2 n equal and disjoint intervals that divide [, ). We define the special set of proaility density functions pdfs) of ounded variations [2] as D BV = {f L [,)) : f =,f,f is of ounded variation}. 2) The set D BV is a wide set containing all those pdfs of practical interest and physical meaning. The chaotic systems taken into account in this work are those ruled y the maps defined as in the following Definition The map S : [,) [,) is piecewise affine epanding PWAE) if and only if it is ontoand there eists a partition Q Π, withq = {I,...,I q }, such that S Ii is a linear function of the form S Ii ) = γ i +β i, with γ,β i R and γ i > i =,...,q ). 3. Statistical staility and correlation decay We say that a pdf φ L is invariant for the map S if for any suset A [,) it results φ )d = φ )d, A S A) which implies PS) A) = P A). By assuming [,) as a random variale with pdf φ, let us focus on the sequence {S p ),p N}. Even if S is deterministic p = S p ) is a stochastic variale and we denote with φ p its associated pdf. In this paper we refer to the following

5 Research manuscript. Please refer to the pulished paper 5 Definition 2 A PWAE map S is said to e statistically stale if φ D Π there eists an unique invariant pdf φ L [,)) such that lim φ p φ p =. 3) According to the aove definition, for a statistically stale PWAE map as far as p the pdf of the random variale S p ) approaches an invariant stationary) pdf φ that only depends on the map S, regardless of the distriution of the initial condition. The evolution of densities {φ p,p N} can e analyzed y means of the Froenious-Perron operator Θ S : D Π D Π φ p+ = Θ S φ p ) = y=s ) ds φ p y). 4) dy y) An efficient numerical method for analyzing the convergence rate of the sequence of pdfs can e found in [2,22]. As shown in the net sections, in practical cases that are of interest for random numer generation the transient 3) vanishes in few steps. A consequence of statistical staility is the decay of the autocorrelation function associated to the stochastic process {S p ),p N} [23]. Once assuming the process stailized on its invariant density φ the autocorrelation function r is given y r m) = E{S m )} = S m )φ )d. 5) 3.2 True random numer generation with Rényi maps Let us consider a special case of PWAE maps, i.e., the family of Rényi transformations S β ) = β mod, β >,β R, 6) where we assume the modulus operator etended to the real numers, i.e., β mod = β β. Inthe following,wedenotewith = β theintegerpart of β, whereas we denote with γ = β mod its fractional part. If the parameter β assumes integer values N i.e., γ = ) the Rényi map has the uniform pdf as its unique stationary pdf [2]. In such case the Froenious-Perron operator can e eplicitly written as φ p+ = Θ S φ p ) = ) +i φ p, 7) and it can e easily used for evaluating the limit 3) starting from an aritrary pdf φ. Moreover, since S m ) = m mod, the autocorrelation function 5) results equal to i= r p) = E{ i S p i)} = = p i= i+) 3 2 2p p i= ii+)2 2 2p i+ p p i)d = i p i3 i2 + 32p 2 2p ) = 3p + 2 p. 8)

6 Research manuscript. Please refer to the pulished paper 6 According to the previous result, as far as m the autocorrelation approaches.25, i.e., the sequence of numers { km,k N} ecomes a sequence of uncorrelated random variales uniformly distriuted in [, ). The hyperolic curve r m) 4 = 2 m 9) represents the correlation decay associated to the chaotic sequence, assuming the chaotic state pdf stailized on its invariant uniform pdf Ideal Random Numer Generators If the Rényi map S is stailized on its invariant uniform pdf, it is possile [2,24] to generate a sequence {ψ i,i N} of i.i.d. uniform random integers ψ i {,..., } y partitioning the domain with the intervals [ i J i =, i+ ), i =,...,, ) and coding the sequence {S i ),i N} with the rule ψ i = m S i ) J m. ) The partition made of the intervals ) is called the natural generating symolic partition. The aove technique defines the way to generate a symolic sequence from any chaotic trajectory, otaining an information source of i.i.d. uniformly distriuted random integers, i.e., the aove technique defines an ideal TRNG. We recall that for an ideal TRNG having as alphaet the first M nonnegative integers it must result: and in general, for k, E{ψ} = M i= E{ψ m...ψ mk } = i M = M, 2) 2 M )k 2 k. 3) It is interesting noting that if we apply the generation rule ) referring to a symolic partition made of M intervals that are different from those of the form ), in general we otain a Markovian information source that generates sequences iased and affected y memory [4,2,24]. In other words, we otain a not ideal TRNG not satisfying 2) and 3), and we stress that in general the otained Markovian source can have infinite memory [23, 25]. Nevertheless, since the uniform pdf is the invariant pdf for the Rényi map S, the iasing etween numers can e eliminated using a symolic partition made of intervals with equal length, otaining 2) to e satisfied. Nevertheless, as shown in the following eample, this trick may not help in eliminating the correlation etween the generated numers.

7 Research manuscript. Please refer to the pulished paper f) 2.5 f) f2).2 f3) f6) f p - u p Figure 2: The pdfs associated to the random variales y = S p 3 ), for p =,,2,3,6. After 6 iterations the distance φ 5 u is lower than 3 : the convergencerate is eponential, as confirmed in the log-scale plot of φ p u. The pdfs were calculated eploiting a modified version of the accurate approach descried in [2, 22] Eample Let us consider the Rényi chaotic map S 3 ) = 3 mod. 4) If the state is not uniformly distriuted, a vanishing transient occurs for the state pdf to reach the stationary invariant pdf. More in detail, regardless of the pdf φ D Π associated to, the greater is p and the more the random variale y = S p 3 ) is uniformly-distriuted, as stated in 3). In other words, ε > there eists p such that φ p u < ε, 5) where u : [,) {} is the uniform pdf. The numer of iterations p necessary to satisfy the aove inequality in general depends on φ and ε, ut in cases of practical interest, since the convergence rate is eponential, few iterations suffice to otain a reasonaly accurate approimation of the uniform pdf u [3, 2]. Indeed, 8 iterations of the map S 3 suffices to satisfy the inequality 5) with values of ε in the order of 4, even when φ is quite different from the uniform pdf see, e.g., Fig. 2). As far as the map S 3 is used to define a TRNG, the statistical characteristics of the otained information source depends on the chosen symolic partition.

8 Research manuscript. Please refer to the pulished paper 8 CHAOTIC DYNAMICS SYMBOLIC DYNAMICS S 3 ) /3 2/3 2/3 /3 a) / a) ) 2 /3 /3 /3 /3 /3 ) /3 /3 2 /3 Figure 3: The Rényi map S 3 ) = 3 mod and the Markov chains modeling the symolic dynamics otained y partitioning the domain with the partition P = {[, 2), [ 2,)} case a) and the natural generating symolic partition {[, 3), [ 3, 2 3), [ 2 3,)} case ). The state transition proailities of the Markov chains are reported eside the arrows. To make clear this idea, in Fig. 3, we represented the two Markov chains that model the symolic dynamics otained y partitioning the domain[, ) with the partition P = {[ [, 2), 2,)} case a) and the natural generating symolic partition {[ [, 3), 3, [ 3) 2, 2 3,)} case ). In the case a) the otained TRNG is not ideal. Indeed, y denoting with I the interval [ 2,) we have E{ψ m...ψ mk } = ψ m {,}... ψ mk {,} = Pψ m =,...,ψ mk = ) = P = k i= S m i 3 I ) ψ m...ψ mk Pψ m...ψ mk ) = u)d = λ k i= k i= S mi 3 I ) ) S mi 3 I ) ) =, 6) where λ represents the Leesgue measure. When k = in 6), we otain the mean value E{ψ} = 2, 7) that satisfies 2) for M = 2. When k = 2 in 6), y denoting with m = m 2 m, we otain the autocorrelation function R m) = E{ψ i ψ i+m } = m, 8)

9 Research manuscript. Please refer to the pulished paper r m) m Figure4: Theautocorrelationdecay9) forthe sequence{s p 3 ),p N}, plotted in logarithmic scale. that only asymptotically satisfies 3) for M = 2, if m, i.e., if the generated symols ecomes progressively uncorrelated. In general, the same can e shown for any order k 2. On the other hand, when the Rényi map S 3 is partitioned with its natural generating symolic partition, adopting the same theoretical approach it can e easily shown that the otained TRNG is ideal: the three integers that may e generated are i.i.d. and their generation proailities are equal to /3, with a k-th order joint proaility Pψ,ψ 2,...,ψ k ) = k i= 3 = 3, satisfying oth m 2) and 3) for any order k. It is worth noting that the result 8) is in accordance with the correlation decay property 9) etween and S3 m ). Indeed, it is epected that if and S3 m ) are not correlated, also the two numers generated with the rule ) are not correlated. The autocorrelation function depicted in Fig. 4 shows that a few under-sampling steps suffice to have a negligile residual correlation etween and S3 m ) Preliminary conclusions The aove discussion lead to two different strategies for generating random numers with the chaotic Rényi maps: A) To divide the domain [, ) with the natural generating symolic partition associated to the map S, in order to otain an ideal TRNG issuing random integers; B) To divide the domain [,) with an aritrary partition P n of 2 n intervals, in order to otain a not-ideal TRNG issuing 2 n random integers. In such case the symols are uniformly distriuted, ut they are affected y a correlation of any order that has a vanishing decay. Accordingly, an ideal TRNGissuing2 n randomintegerscane approimatedwith anyaccuracy y under-sampling the sequence {S i ),i N} y a factor p, that is referring to the sequence {S ip ),i N}.

10 Research manuscript. Please refer to the pulished paper ~ T) ~ ~ T) ) Figure 5: The effect of the finite-precision computation of a generic function T. Furthermore, we stress that if can e divided y q, then /q unions of q partitioning intervals can e used to otain an ideal TRNG that can generate random integers in the set {,...,/q}. For eample, any Rényi map S with even can e used to define an ideal TRNG with alphaet {,}, referring to the partition P. The processis similar to generatingeven orodd numersthrowing a fair si-sided die. 4 Pseudo-Chaotic Systems In this work we propose to eploit the ergodic dynamics of PWAE chaotic maps for the design of nonlinear PRNGs with good statistical properties and that involve low-compleity implementations. To this aim, we start analyzing the links that eist etween chaos and pseudo-chaos. Pseudo-chaos is otained when a chaotic dynamical system is simulated using finite precision arithmetic algorithms [26 28]. In detail, referring to a generic chaotic map T : [,) [,),thepseudo-chaoticapproimationoft isotainedintwosteps. Inthefirst step any point [,) is represented y a finite-precision point elonging to a finite set Λ [,), called the discrete domain. Accordingly we have the definition of the finite-precision point : [,) Λ, as a function of. In the second step the function T is approimated y a finite-precision approimating function T : Λ Λ such that T) T ) = ξ) <, 9) where the function ξ quantifies the quality of the approimation. Summarizing, the overall pseudo-chaotic approimation is defined y the composition T : [,) Λ. If the function ξ assumes reasonalysmall values for all, it is often said that T shadows T. Trying to relate the properties of the two systems T and T can e a difficult task, depending on their nonlinear functional forms. For eample, adopting a dynamical evolution point of view, Coomes et al. in [3] proved some major results valid for hyperolic diffeomorphisms, that represent a fundamental reference within the Shadowing Theory for chaotic systems. We adopt a different point of view, since we are interested in relating the proaility measures associated to T and T. In detail, for a given suset I [,), we are interested in

11 Research manuscript. Please refer to the pulished paper the quantity EI,ξ) = PT) I) P T ) I), 2) wheretheseti isunderstoodtoeasu-intervalof[,). SinceT ismeasurale, the previous quantity can e also written as EI,ξ) = P T I)) P T I Λ)). 2) Due to the calculating approimation, in general it can happen that T I Λ) T I) Λ), 22) i.e., there are points mapped in I y the function T that do not elong to T I). Aout this issue, we have the following Proposition Proved in [29]) Let I [,) e an interval with endpoints a <, and let us assume that T I) it results T) T ) < α = sup ξ). 23) T I) Accordingly, y denoting with φ the pdf of T), if a 2α then it results α a+α ) φ)d P T ) I +α a α φ)d. 24) It is worth noting that the aove Proposition has a general validity, and that if the condition 23) holds in the whole interval [,), then the result 24) holds for any interval I [,) with length greater than 2α. This is the case provided y the Shadowing Theory, that is valid for certain continuous maps [3]; in this work we allow the chaotic map to e not continuous, as discussed in the following. 4. Almost-uniform measure-preserving chaotic transformations Under the hypotheses of Proposition, in this susection we refine the theoretical result 24) assuming the random variale T) almost uniformly-distriuted, i.e., we assume φ u ε, where u : [, ) {} is the uniform pdf over [, ). Accordingly, for any interval I [,) with endpoints a < it results a) ε) φ)d a)+ε). 25) I If we now assume the interval I to have Leesgue measure 2, i.e., a = k using 25) the inequality 24) can e rewritten as ) ) ) 2 k 2α ε) P T ) I 2 k +2α +ε), 2 k,

12 Research manuscript. Please refer to the pulished paper 2 which implies ε 2 k 2α ε) P T ) I ) 2 k ε 2 k +2α+ε). Focusing on the worst case, we finally have ) T ) P I 2 k ε +2α+ε), 26) 2k which leads to the relative error ) P T ) I 2 k 4.2 Random perturations ε+2 k+ α+ε). 27) 2 k Westressthattheaoveresultsholdevenassumingthefunction T toestochastic, i.e., pertured y a small additive random noise. In such case the quantity T) T ) is a randomvariale, and the Proposition and 26)hold provided to define α as the supremum of ξ)+ν, eing ν the stochastic fluctuation. As it will e made clearer in the following, we will consider pseudo-random perturations of the pseudo-chaotic map T, to make the resulting nonlinear generator immune from short periodic cycles. 5 Nonlinear recurrences derived from the Rényi map There is an infinite numer of different ways to define the digitized version of a chaotic system. In this section we propose a method for digitizing the Rényi maps, in order to otain PRNGs ased on nonlinear recurrences. Assuming n N, with n >, we define the discrete domain as the following set of dyadic rationals { q Λ 2 n = 2 n Q : q < 2n}. Given the Rényi map S ) = mod, for any aritrary small positive γ we define the digitized map S β : Λ 2 n Λ 2 n as S β q 2 n ) = 2 n +γ)q mod 2n ) = 2 n q + γq mod 2n ) 28) The link etween and is defined assuming the truncation strategy to approimate, i.e., if [,) it results = q) 2 n = 2n 2 n. 29) Accordingly, any point can e written as = +ξ) = q) 2 n +ξ), where ξ) [,2 n ). Summarizing, S and S arelinked y the definition rulesshown in Fig. 6. We spend few words on the role of the aove introduced parameters γ and n. First of all, we stress that the digital architecture implementing

13 Research manuscript. Please refer to the pulished paper 3 Figure 6: The definition rules for the pseudo-chaotic Rényi map. 28) is a n-it state machine, and for this reason we call the parameter n the digital resolution of the pseudo-chaotic system [28, 3]. Furthermore, it can e noticed that due to the modular calculations in 28) for any integer the pseudo-chaotic version of S ) = mod agrees with the pseudo-chaotic version of S +2 n) = +2 n ) mod for a same value of γ in 28)). Moreover, it must e highlighted that if γ < 2 n then for any q < 2n the quantity γq is equal to zero: in such case the epression 28) defines a linear congruential generator. Accordingly, in order to make 28) a nonlinear congruential generator it must e 2 n γ. 3) As it will e shown in the net Section, adopting the point of view discussed in Section 4 the greater are n and /γ and the etter the dynamics of S is shadowed y S. 5. Properties of the Digitized Rényi Maps In this Section we theoretically discuss some of the relationships that eist etween the Rényi chaotic maps and their pseudo-chaotic versions 28). We face this prolem in two steps. First, we discuss the link etween the Rényi map S β = +γ) mod and the Rényi map S ) = mod, and then we analyze how 28) approimates S ). Accordingly, let us egin to analyze the link etween S β and S. Referring to the Figs.7 and 8, it can e noticed that the higher asolute error S β ) S ) is made around the discontinuity points of the maps, i.e., within the union of intervals [ i M = β, i ). 3) The length of the i-th of these intervals is i, where = β β easily verified that the asolute error in [,)/M is not greater than i=, and it can e ) β. Despite the effects of the discontinuities, for small values of γ the dynamics of S β ) and S ) within a limited time period follow trajectories that are close to each other for most values of, in the sense specified y the following Theorem Let us consider the interval K = [, δ ),

14 Research manuscript. Please refer to the pulished paper 4 D 2D 3D S 3. ) Additional slope Figure 7: The Rényi map S 3. solid line) and the Rényi map S 3 dashed line). D 2D 3D.9.8 S 3. ) - S 3 ) Figure 8: The asolute error S 3. ) S 3 ) etween the two Rényi maps S 3. and S 3.

15 Research manuscript. Please refer to the pulished paper 5 where δ = ) p+ β and p N. For any S p K ) it results S p β ) Sp ) ) p+ β. 32) For proving the theorem, we first need the Lemma Let us consider two points, 2 elonging to the same interval I = [ i, i+ β ), with i. Accordingly the two points do not elong to M and the two maps S and S β have constant slope in I. It results S β ) S 2 ) 2 + ). 33) β Proof. We have S β ) S 2 ) = S β ) S )+S ) S 2 ) S β ) S ) + S ) S 2 ). The first term is not greater ) than the maimum asolute error S β ) S ) in [,)/M, that is β. On the other hand, since S is linear over I, we have S ) S 2 ) = 2, and the lemma is proved. We can now prove the Theorem. Proof of Theorem. Let us assume that the two points S j β ) and Sj ) for j =,,...,p elong to same intervals I j = [ ij, ij+ β ), with i j. From the previous Lemma we have S j+ β ) S j+ ) S j + β ) Sj ) ), β and proceeding y induction it is easy to prove that for j > S j β ) Sj ) ) j r = ) j+ β β. 34) r= The aove inequality agrees with 32) y setting j = p, and the proof is completed if we show that if S p K ) then the two points S j β ) and Sj ) for j =,,...,p elong to same intervals I j = [ ij, ij+ β ), with i j. Accordingly, we define the set P = { i, < i } and we note that for j = the previous condition is satisfied if the distance of from the greater nearest point in P is not smaller than β ): this is a sufficient condition for not to elong to the set M defined in 3). For the second step, since we know from 34) that S β ) S ) < β ), a sufficient condition to have oth of the points S β ),S ) in a same interval I is to have S ) not closer than β ) + β ) to the greater nearest point in P. Generalizing, for j =,...,p oth of the points S j β ),Sj ) lye in a same interval I j if S j ) is not closer than ) j r = ) j+ β β r=

16 Research manuscript. Please refer to the pulished paper g = g =. f *) f*) g =.5 f *) f*) g = g =..2.8 f*).8 f *) g = Figure 9: The estimation of the invariant pdf for the Rényi maps S 3+γ, for several values of γ. From the Ergodic Theory of dynamical systems it results φ lim β β u =, where u is the uniform pdf in [,) [2,2]. to the greater nearest point in P. Let us now focus on the set K : we will show that for m =,...,p the set S m K ) contains only points that satisfy the previous sufficient conditions. In detail, we note that the set S K ) is made of intervals of the form [ i, i + δ ) for i <, that is, each point in S K ) is not closer than δ to the greater nearest point in P. Following the same reasoning, it is easy to check that each point in S m K ) is not closer than δ to the greater nearest m point in P. Accordingly, in order to satisfy the previously discussed sufficient conditions, it suffices that δ p j ) j+ β, 35) that is satisfied for j =,...,p if concluding the proof. δ = β )p+, 36) The previous result indicates that for any p N if γ the trajectory of {S j β )} converges to the trajectory {Sj )} uniformly over {,...,p}. Moreover, we stress that the invariant measure induced y the uniform pdf of the

17 Research manuscript. Please refer to the pulished paper 7 Rényi map S agrees with the Leesgue measure of intervals, and in such case the Leesgue measure of S p K ) is equal to δ. Accordingly, for γ δ goes to zero and the property 32) holds almost everywhere in [,). This fact is somehow reflected y the shape of the invariant pdf associated to S β. In detail, the Ergodic Theory [7,2] provides the tools for showing that lim φ β u =, 37) β i.e., the invariant pdf associated to S β converges in L [,)) to the invariant pdf of S, that is the uniform pdf. As it can e seen in Fig. 9, the presence of the additional slope highlighted in Fig. 7 causes an accumulation of the pdf around the point, and the effect vanishes as soon as γ goes to zero. A rigorous theoretical approach to analyze this topic and to demonstrate the aove limit is reviewed and discussed in [2, 2]. As a second step of our analysis, we investigate the link etween S β and S. The procedure is similar to that one previously discussed, with the difference that we have to take into account, defining the map S β, the effects of the truncations. In detail, we have the following Theorem 2 Let us consider the interval with K 2 = [δ 2, δ 2 ), δ 2 = 2βp+ β )2 n + + ) p+ β, 38) and p,n N. For any S p K 2 ) it results S p ) S p β ) < β p+ β )2 n + ) p+ β. 39) Proof. See the Appendi. The previous theorem represent the main result of this work, since it eplicitly relates the dynamics of the pseudo-chaotic map S β with the dynamics of the original chaotic Rényi map S. Interestingly, we highlight two aspect. First, y increasing n the effect of the digitization vanishes eponentially. Moreover, we recall from the discussion at the eginning of this Section that to have a nonlinear congruential generator the parameter γ = β must e not smaller than 2 n. Accordingly, the larger is n and the more the parameter β can e set close to. The larger is n, the more β can e set close to and the more the interval K 2 covers the entire domain. Accordingly, y playing with n and β one can design a pseudo-chaotic map whose dynamics is aritrarily close the the original chaotic Rényi map S, otaining nonlinear recurrences. 5.. Eample Let us consider the Rényi map S 3, and let us define its digitization y means of the 32 it pseudo-chaotic map m ) S 3+γ 2 32 = 3+γ)m mod , 4)

18 Research manuscript. Please refer to the pulished paper 8 where γ = and β = 3.738A.Adopting the inary fied point representation, β can e written as.. 4) As discussed in the net Section, the inary representation of β plays a key-role to determine the computation compleity involved y the PRNG ased on the pseudo-chaotic Rényi maps. From Theorem 2 we have that S p 3 ) S p 3+γ ) 3+γ) p+ 3+γ) γ 2.328, if p =, , if p = 2, , if p = 7... ) 3 p+ 3 2 TheaoveinequalitiesholdforanypointsuchthatS p ) K 2 [.75,.9925), that is calculated for p = 7. As a result, if we set T = S3 7 and α = , referring to the partition P 3, from 27) we otain that for any interval I j of the partition that also elongs to K 2 ) P T ) Ij ) ε ε). 43) If we assume ε in the order of 3 i.e., according to a worst case indicated y the numerical analysis, see Fig. 2), the aove inequality yields that the proaility for the state to elong to any interval I j K 2 of the partition P 3 after 7 iterations of the digitized Rényi map differs from /8 y a relative error that is smaller than 2%, even if, in the worst case, the distriution of the initial state was very different from the uniform distriution. If the initial state is etter uniformly distriuted, the numer of iterations decreases and the ounds decrease eponentially. Theorem 2 does not tell us what may happen outside the interval K 2, at the orders of the phase space [,): if / T p K 2 ) the shadowing error made y the digitized map T after p iterations can e much greater than the upper ound 24), due to the effects of the map discontinuities. Actually, in practical cases this fact has negligile consequences on the short-term statistical ehavior of the digitized map, since its dynamics is typically oserved adopting a coarse-grained resolution, greater than α e.g., in this eample we adopted an oservation interval with length /8, eing α in the order of 3 ). Nevertheless, we stress that our point of view is statistical: we are not interested in following trajectories eactly; rather, we are interested in emulating the long-term statistical ehavior of the original system. To this aim, we must introduce the pseudo-random perturation of the digitized state trajectories, in order to emulate the trajectory instaility of chaotic systems and to avoid the digitized system entering periodic stale orits.

19 Research manuscript. Please refer to the pulished paper Pseudo-random perturation of digitized chaotic systems: setting the period length It is well known that periodic trajectories are dense in chaotic attractors [3]. However, they are instale and the proaility for a chaotic motion to enter a periodic orit is zero. That is not what happens in a digitized system, for which all the trajectories are eventually periodic. In this work we propose to emulate the instaility of chaotic trajectories y pseudo-randomly perturing the digitized state. To this aim, we remark that if the perturation magnitude remains particularly small the shadowing property previously discussed still holds, as highlighted in Section 4.2. Referring to the approach of Lasota in [25] the presence of noise in a chaotic system can e modeled as it follows. At each time step the chaotic sample p+ deviates from its ideal value due to a statistically independent noise ν p added to the sample p, i.e., p+ = T p +ν p ). 44) As a result, in a chaotic system the presence of noise can cause the trajectories to diverge, e.g., ringing the pertured state p +ν p outside the asin of attraction of the chaotic attractor: this is not the case for a chaotic map like the Rényi map, defined as in 6). In general, the resulting process descries a discrete-time random walk in the phase space [,), that may not admit a stale stationary proaility density function [25]. If the noisy samples {ν p } are i.i.d. random variales statistically independent from the { m } samples, it results that φ p+ = Θ T φ p f ν ), 45) where f ν is the pdf associated to the noisy samples, whereas the operator Θ T is the etension of the Froenius Perron operator Θ T defined in 4) to the whole set of densities of ounded variations in L [,)). It is worth noting that p only depends on the noisysamples ν p,ν p 2,... and if φ = Θ T φ f ν ) then the pdf φ is stationary and invariant for the stochastic dynamical system 44). The characterization of the evolution of densities induced y 45) for systems like 44) is still an open theoretical prolem, and depending on the considered case even the eistence of an invariant density can e an undetermined issue [25, 32]. Nowadays, the consequence of the stochastic perturations on the dynamics is typically studied resorting to computer simulations, and this is eactly what we do y digitizing the Rényi map and y adding a small perturation noise to the digitized state. Since our aim is to reproduce the instaility of chaotic trajectory, we set the noise magnitude as small as possile, i.e., equal to the digitized resolution /2 n. Accordingly, as discussed in the following Section, we pertur the less significant it LSB) of the digitized state y performing the or operation with the output it of a LFSR. Simulation results show that the chief statistical ehavior of the original Rényi map are preserved See, e.g., Fig. ). Even considering the pseudo-random perturation, the resulting overall computing method is deterministic and the digitized dynamics is still eventually periodic with a period length that can e set greater than a minimum, according to the following Proposition 2 Let us consider the inary periodic sequences yp), zp) and

20 Research manuscript. Please refer to the pulished paper r m) Short Periodic Trajectory Pertured Trajectory -5 Theoretical m Figure : The effect on the correlation decay of the LSB perturation. The two trajectories were otained using the digitized map 4), starting from the same initial condition. The autocorrelation functions were estimated on samples. wp) = yp) zp), for p N, and let P y,p z,p w e their respective periods. If P z > is prime, then P w = kp z, with m. Proof. Since P z >, it is immediate to verify that P w >. If P w < P y P z an integer q eists such that P y P z = qp w + P y P z mod P w, with P y P z mod P w < P w. On the other hand, wp) = yp) zp) = yp+p y P z ) zp + P y P z ) = wp + P y P z ) = wp + qp w + P y P z ) = wp + P y P z mod P w ). Since P w is the smallest integer such that wp) = wp + P w ), it must e P y P z mod P w =. Accordingly it results P y P z = hp w, that is P w = PyPz h. If P z is prime, h divides P y and P w = mp z. Referring to the aove notation, we can set wp) as the LSB of p, yp) as the less significant it of S p )) and zp) as the output it of an LFSR. According to the aove proposition, if the LFSR has prime period P z, then the pertured trajectories of have period that is not smaller than P z. By recalling that a LFSR of order k has period P z = 2 k, we remark that P z is a Mersenne prime if we set k = 3 or k = 6, otaining P z equal to and = 2.3 8, respectively. These choices assure that the period of the generated digitized sequences can e made long enough for our cryptographic purposes, regardless of the initial condition of the nonlinear recurrence 28). 5.3 On the hardware/software implementation of the digitized Rényi map We spend few comments aout the hardware/software implementation of the digitized Rényi map, noting that the only operations involved in the calculation are 2 n -modular additions to calculate the multiplication), with a truncation of the result to the n most significant its. The numer of additions is equal to the numer of in the inary representation of β, and the addition operations can

21 Research manuscript. Please refer to the pulished paper 2 e easily performed referring to efficient solutions like carry-save adders [3]. In the eample previously discussed, ten 2 n -modular additions suffices. 6 PRNGs derived from the Rényi map: design and testing When dealing with PRNGs and statistical tests, one point must e clear: for any given PRNGs it is always possile to define a never-passing test. This is ecause of the deterministic and periodic nature of PRNGs, that always introduces some undesired defects in the statistical characteristics of the generated sequences. Nevertheless, the results discussed in this paper indicate that for any given finite-time statistical test there is an infinite numer of PRNGs ased on the pseudo-chaotic Rényi map 28) that pass that test. This is ecause of the two following remarks:. with any Rényi chaotic map S with integer ) it is always possile to otain an ideal TRNG, y adopting a proper symolic coding of its dynamics [2]; 2. y playing with the parameters n and γ one can use a map S β to approimate the chaotic Rényi map S according to any aritrary accuracy over finite time-windows. The aove point 2. can e faced adopting the two different strategies identified in the preliminary conclusions A) and B), discussed in Section 3.2, taking in mind that the required accuracy of the approimation depends on the target application e.g., it depends on the statistical tests taken into account). Before introducing two specific eamples related to these two mentioned approaches, it is worth discussing how to perform the domain partitioning. 6. Domain partitioning in digitized chaotic systems The simplest approimated way to generate numers referring to the rule ) is to compare the digitized state with the endpoints of a symolic partition: in general, up to M comparisons are required for a partition made of M intervals. This operation introduces the prolem of comparing dyadic rationals, since even the partition endpoints must e represented according to a digitization strategy. For eample, the endpoints /3 and /6 of the natural generating symolic partition of the map S 3 can not e represented adopting a conventional inary fied point representation of numers, and the same happens for the endpoints associated to other maps S with 2 m. On the other hand, it is very easy to apply the generation rule ) when the partition is of the form P k, i.e., a partition made of 2 k equal intervals. In such case, no comparison is necessary since the most k significant its of the state indicate the numer of the elonging interval in the partition, i.e., the generated numer of the PRNG. Adopting the same reasoning discussed in the preliminary conclusions of the Section 3.2, the partition P k can e used without introducing correlation etween symols if is of the form q2 k, with q N +.

22 Research manuscript. Please refer to the pulished paper PRNGs design approach A) According to the approach A) discussed in Section 3.2, we divide the domain [, ) adopting a refinement of the natural generating symolic partition associated to the map S, in order to approimate an ideal TRNG issuing random integers. Since we refer to partitions of the form P k, we have to digitize maps S with = m 2 k, for any m N,m >. As an eample, in Tale we reported the NIST SP8.22 test [2] results for a PRNG ased on T = S β, with n = 64 its and β = 4.838A = 4). At each time step the 2 most significant its of were output P k = P 2 ). The minimum pass rate for each statistical test with the eception of the Random Ecursion Variant test is approimately.965 for a sample size of inary sequences 2 million its each). The minimum pass rate for the Random Ecursion Variant test is approimately for a sample size = 7 inary sequences 2 million its each) PRNGs design approach B) According to the approach ) discussed in Section 3.2, we divide the domain [,) with an aritrary partition P n of 2 n intervals, in order to approimate a not-ideal TRNG. In such case the 2 n random integers are uniformly distriuted, ut they are affected y a correlation that has a vanishing decay. Accordingly, an ideal TRNG issuing 2 n random integers can e approimated with any accuracy y under-sampling the sequence {S i ),i N} y a factor p, that is referring to the sequence {S ip ),i N}. As an eample, we report the NIST SP8.22test results for a PRNG ased on T = S β 8, with n = 32 its and β = 7.AA = 7,p = 8). Referring to the map T, at each time step the 8 most significant its of were output P k = P 8 ). The tests were performed on a sample size of inary sequences 2 million its each), as in the previous eample Comments on the test results We stress that the aove presented good results are typical, even if changing the parameter γ to a different small value, provided to satisfy 3). We have tried at random dozens of PRNGs with n = 32,64 and = 3,4,5,6,7,8, with different values of γ, otaining similar results. If = 4 or 8) we output the 2 or 3) most significant its of at each time step. For the other values, we set an under-sampling rate equal to p = 8, whereas outputting the most significant yte 8 its). As a general trend, it seems that for the kind of generators proposed in this paper the most sensitive test is the Non Overlapping Template. The focus of this test, according to the default parameters, is the numer of occurrences of 48 different non-periodic patterns of 9-its. In some cases it happened that the passing rate for some patterns dropped to 96.% when analyzing sequences of 2 million its each the theoretical requested minimum passing rate is 96.5%). Nevertheless, apart from this minor and occasional statistical imperfection, in all of the evaluated PRNGs none of the tests in the NIST SP8.22 standard were adly failed the worst PRNG found had a 94.% passing rate in one test).

23 Research manuscript. Please refer to the pulished paper RESULTS FOR THE UNIFORMITY OF P-VALUES AND THE PROPORTION OF PASSING SEQUENCES generator is <N64K2P_4.838A_2M_Seq.dat> C C2 C3 C4 C5 C6 C7 C8 C9 C P-VALUE PROPORTION STATISTICAL TEST Frequency BlockFrequency CumulativeSums CumulativeSums Runs LongestRun Rank FFT mean: NonOverlTemplate *) standard deviation: OverlappingTemplate Universal ApproimateEntropy mean: RandomEcursions *) standard deviation: mean: RandomEcVariant *) standard deviation: Serial Serial LinearCompleity *) Test with multiple results: mean value and standard deviation were reported Tale : NIST8.22 test results for the PRNG ased on T = S β, with n = 64 its and β = 4.838A. At each time step the 2 most significant its of were output. 7 Conclusions In this work we have proposed the design of PRNGs ased on nonlinear recurrences derived from the Rényi chaotic map. Starting from a weaker interpretation of the Shadowing Theory proposed y Coomes et al. we have theoretically framed the relationship that eists etween the Rényi chaotic maps and their digitized versions. Eploiting the ergodic properties of the original systems we have proposed a method for the design of nonlinear recurrences whose statistical ehavior can e analyzed in terms of chaotic dynamics approimation. In order to overcome the prolem of the shortness in the period length of the digitized trajectories, we have proposed to pertur the pseudo-chaotic dynamics in such a way to emulate the orit instaility peculiar to chaotic systems. Statistical tests confirm the validity of the approach, that is general and define an infinite family of PRNGs that can e used to approimate the statistical ehavior of an ideal TRNG with an aritrary accuracy. Appendi Proof of Theorem 2 We first need the following Lemma 2 Let q 2 Λ n n and z > q 2. If the restriction of the Rényi map S n β to the interval J = [ q 2,z ) is continuous, for any J and for any m N, with n

24 Research manuscript. Please refer to the pulished paper RESULTS FOR THE UNIFORMITY OF P-VALUES AND THE PROPORTION OF PASSING SEQUENCES generator is <N32K8P8_7.AA_2M_Seq.dat> C C2 C3 C4 C5 C6 C7 C8 C9 C P-VALUE PROPORTION STATISTICAL TEST Frequency BlockFrequency CumulativeSums CumulativeSums Runs LongestRun Rank FFT mean: NonOverlTemplate *) standard deviation: OverlappingTemplate Universal ApproimateEntropy mean: RandomEcursions *) standard deviation: mean: RandomEcVariant *) standard deviation: Serial Serial LinearCompleity *) Test with multiple results: mean value and standard deviation were reported Tale 2: NIST8.22 test results for the PRNG ased on T = S β 8, with n = 32 itsandβ = 7.AA. Everyeightiterationsof S β 8 the8mostsignificant its of were output. q m 2 n z, it results S β ) S m ) m + < β 2 n 2 n 2 n. Proof. We note that if S β is continuous over J, then it has a constant slope: for any, 2 J we have S β 2 ) S β ) = β 2. Moreover, we note that for any m 2 Λ n n it results S m ) β 2 m ) Sβ n 2 < n 2, indeed n S β m 2 n ) = βm mod 2n βm mod 2n m ) 2 n 2 n = S β 2 n < < βm mod 2n + 2 n = S m ) β 2 n + 2 n. Accordingly, S β ) S m ) Sβ m ) m β = 2 n ) S β 2 n +S β ) 2 S m ) n β 2 n m ) + Sβ m ) S β ) S β 2 n 2 n S m ) m + β < β 2 n 2 n 2 n, 46) concluding the proof. We can now prove the main Theorem. Proof of Theorem 2. We will prove the theorem focusing on the inequality S p ) S p S β ) p + S ) Sp β ) p β ) S p, β ) 47)