基于ADC采样的真随机数发生器的熵估计资源-CSDN文库

42 浏览量 2021-04-26 20:48:18 上传评论收藏 2.56MB PDF 举报

标题中提到的知识点是“基于ADC采样的真随机数发生器的熵估计”。ADC，即模拟到数字转换器，是一种常见的电子组件，用于将连续的模拟信号转换为离散的数字信号。在加密系统中，真随机数发生器（TRNGs）被广泛使用，因为它们生成的随机数的安全性是许多加密算法和协议的基础。在描述中提到了熵估计在TRNG结构安全性评估中的重要性。熵是衡量随机数发生器输出不可预测性的一个重要指标，它被用来评估随机数的随机性质量。熵估计基于随机模型来进行，目前这种方法是评估特定TRNG结构安全性的推荐方法。此外，随机数发生器的生成速度也是它们的一个重要属性。在本文中，作者提出了基于ADC采样的TRNG的熵估计方法，并扩展了现有的模型来完成这项工作。特别地，作者提出了一个等效模型来估计ADC采样得到的任何单个位的熵，并提出了一个多比特ADC输出的熵估计方法，该方法提供了熵的下限。标签中提到的“研究论文”表明这篇文章是发表在学术期刊上的研究成果。文章发表在《IEEE Transactions on Information Forensics and Security》杂志上，该期刊是IEEE（电气和电子工程师协会）出版的一份涵盖信息安全和取证领域的研究论文集。从部分内容中提取的关键知识点包括： 1. TRNGs：真随机数发生器是用于生成加密系统中所需随机数的设备。它们依赖于非确定性事件来产生随机数，不同于伪随机数发生器（PRNGs），后者基于确定性算法产生数列，但可以通过特定算法和种子值来预测。 2. 安全性基础：TRNGs的安全性是众多加密算法和协议的基础。如果TRNGs不能提供足够的随机性，那么依赖于这些随机数的安全系统就可能遭受攻击。 3. ADC采样：在TRNGs中使用ADC来采样噪声信号是一种实现高比特率的技术。这种方法可以利用模拟噪声信号的随机性，通过数字化过程转换成数字随机数。 4. 熵估计：在加密学中，熵估计是对TRNGs性能的定量分析，它能够提供一个衡量随机数发生器输出不可预测性的客观指标。基于随机模型的熵估计被认为是一种有效的方法来评估TRNG的安全性。 5. 多比特熵估计：作者提出的多比特ADC输出的熵估计方法旨在为TRNG提供一个更精确的熵下限估计。这对于评估TRNG的性能至关重要。 6. 统计测试套件：为了验证随机数序列是否符合真正的随机性标准，需要通过一系列的统计测试。文章提到了NIST SP 800-22、Diehard和TestU01（包括BigCrush测试）等测试套件，这些测试套件能够检验随机数序列的随机性质量。 7. 芯片实现：文章提到原型芯片是在SMIC65纳米工艺中制造的，这表明TRNGs可以在实际的硬件平台上实现，并具有一定的功耗（34mW）。通过简单的后处理，生成的随机比特序列能够达到132.3Mb/s的速度，并且通过了严格的统计测试套件。 8. 兼容性：研究中生成的随机比特序列符合AIS31标准，这意味着它们能够用于符合该标准的应用领域。 9. 技术术语：文中提到了一些技术术语，如NIST SP800-22、Diehard、TestU01以及BigCrush等，这些术语代表了在评估随机数生成器时应用的各类统计测试方法和标准。在知识层面，这篇文章涉及了密码学、信息安全、统计分析、模拟电子学以及集成电路设计等多个学科领域。它不仅在理论上扩展了TRNGs的熵估计方法，而且在实践上也实现了原型芯片的设计和制造，展示了在现代密码学硬件实现方面的最新进展。此外，该研究对随机数发生器在安全和效率上的要求提供了实践中的解决方案，即在保证足够随机性的同时，提高生成速度和通过统计测试的能力。

资源推荐

资源详情

资源评论

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 14, NO. 11, NOVEMBER 2019 2887

Entropy Estimation for ADC Sampling-Based

True Random Number Generators

Yuan Ma, Tiany u Ch en , Jingqiang Lin, Member, IEEE,JingYang , and Jiwu Jing, Member, IEEE

Abstract—True random number generators (TRNGs) are

widely used in cryptographic systems, and their security is the

base of many cryptographic algorithms and protocols. At present,

entropy estimation based on a stochastic model is a well-

recommended approach to evaluate the security of a speciﬁc

TRNG structure. Besides, the generation speed is also an impor-

tant property for TRNGs. For this purpose, an analog-to-digital

converter (ADC) can be employed to sample the noisy signal to

achieve high bit rate. However, no research focuses on the entropy

estimation on the basis of the stochastic model toward ADC

sampling. In this paper, we propose an entropy estimation for

the ADC sampling-based TRNG through extending an existing

model. In particular, we present an equivalent model to estimate

the entropy of any single bit in the converted sample obtained

by the ADC sampling. Furthermore, we propose a method of the

entropy estimation for the multi-bit ADC output, which provides

the lower bound of the entropy. By conducting simulations

and hardware experiments on this type of TRNG, we conﬁrm

the correctness of the proposed entropy estimation theory. The

prototype chip is fabricated in the SMIC 65-nm process, and the

consumed power is 34 mW. The random bit sequences compatible

with the AIS 31 standard are generated at a speed of 132.3 Mb/s.

The sequences are able to pass the rigorous statistical test suites,

including NIST SP 800-22, Diehard, and TestU01 (containing the

Big Crush test), after simple post-processing at a bit rate of

around 33 Mb/s.

Index Terms—True random number generator, analog-to-

digital converter sampling, multi-bit entropy estimation, sufﬁcient

entropy, chip implementation.

I. INTRODUCTION

ANDOM number generator (RNG) represents a basic

cryptographic primitive, and its output named random

number is widely employed in cryptographic systems. The

security of RNGs is the foundation of many cryptographic

algorithms and protocols. Generally speaking, RNGs are clas-

siﬁed into two types: nondeterministic (true-) random number

generators (TRNGs) and deterministic (pseudo-) random num-

ber generators (PRNGs). PRNGs utilize stretching functions

Manuscript received October 7, 2018; revised February 16, 2019 and

March 18, 2019; accepted March 21, 2019. Date of publication April 1,

2019; date of current version June 27, 2019. This work was supported in

part by the National Key Research and Development Program of China under

Grant 2016YFB0800102, in part by the National Natural Science Foundation

of China under Grant 61872357, Grant 61802396, Grant 61602476, and

Grant 61772518, and in part by the National Cryptography Development

Fund of China under Grant MMJJ20170205 and Grant MMJJ20180113. The

associate editor coordinating the review of this manuscript and approving

it for publication was Dr. Eduard A. Jorswieck. (Corresponding author:

Tianyu Chen.)

The authors are with the Data Assurance and Communication Security

Research Center, Chinese Academy of Sciences, Beijing 100093, China,

and also with the State Key Laboratory of Information Security, Institute

of Information Engineering, Beijing 100093, China (e-mail: yma@is.ac.cn;

tychen@is.ac.cn; linjq@is.ac.cn; yangjing@is.ac.cn; jing@is.ac.cn).

Digital Object Identiﬁer 10.1109/TIFS.2019.2908798

to extend a seed (produced by TRNGs) into an arbitrarily

long sequence, and TRNGs collect randomness from physical

phenomena, such as temperature, noise or radioactive decay,

to generate an unpredictable sequence. Thus, the security of

TRNGs is crucial.

Entropy is used to serve as the measure of the unpre-

dictability, and is applicable to the quantiﬁcation of the true

randomness. The standards ISO 18031 [1] and AIS 31 [2]

recommend to use entropy estimation based on stochastic

models to evaluate the quality of TRNGs. A deal of work

provided various models and entropy calculation approaches

for different kinds of TRNGs. Killmann and Schindler [3]

proposed a general model for calculating the entropy of

common TRNG designs with concise structures. For a par-

ticular design, the model of an elementary oscillator-based

TRNG (EO-TRNG) was investigated through the evolution of

phase [4], [5] and time [6]–[9]. The models for other kinds

of TRNGs were presented in [10]–[12]. The sufﬁciency of

the entropy provided by TRNGs is crucial for the security

of cryptographic systems that use random numbers.

In addition to the security (i.e., sufﬁciency of contained

entropy), the generation speed (i.e., bit rate) of random num-

bers is another important factor in TRNG design. Although

EO-TRNGs have been well studied in respect of entropy

estimation, the available jitter amount and the utilization rate

of jitter are very low, which yields a low speed as the

price of achieving high security. Hence, recent solutions pre-

sented in literature focused either on improving the oscillator

structure [11], [13], [14] or on increasing the probability of

collecting jitter [10], [15].

The basic structure of EO-TRNG contains an entropy source

and a sampling unit. In the TRNG, an unstable oscillator gen-

erates a fast sampled signal with jitter, and another oscillator

generates a sampling clock signal with or without jitter. The

randomness comes from jitter in the fast signal that is caused

by noises. For the sake of security, the sampling interval (the

period of the sampling signal) needs to meet the requirement

that, the standard variance of the accumulated jitter within the

interval should be larger than half or even one period of the

sampled signal [4], [8]. So the essential problem is the low

sensitivity of the sampling method to jitter in the EO-TRNGs.

The rough sampling circuit (such as D ﬂip-ﬂop) cannot track

the phase evolution until the accumulated randomness causes

a transition of the voltage.

For this reason, analog-to-digital converter (ADC), a com-

mon device in signal processing circuits, can be employed

to sample the noisy signal for improving the speed. Either

timing jitter or phase noise causes the variation of the voltage

See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

2888 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 14, NO. 11, NOVEMBER 2019

in oscillating signals, and ADC is designed to capture voltage

values in high precision. Besides, as the sampling rate can

be very high (from dozens to hundreds of million samples

per second) in current ADC technologies, the bit rate of ADC

sampling based TRNG can be up to dozens of Mbps, i.e., the

speed is 3∼4 orders of magnitude faster than that of an

EO-TRNG.

ADCs were used in chaos-based and quantum-based

TRNGs. In general, ADCs are employed to construct a chaotic

circuit for random number generation, such as [16], or to

sample chaotic signals to generate random sequence, such

as [17], [18]. For those chaos-based TRNGs, the theoretical

entropy sufﬁciency cannot be guaranteed due to the lack of

stochastic models. The maximum sampling frequency and the

available output bits are determined through multiple attempts

of posteriori statistical test on sampling sequences. In addition,

in quantum-based TRNGs [19], [20], the digitization functions

for analog quantum noisy signals (e.g., Gaussian distributed

noises) are implemented by ADCs. For Gaussian noise signals,

the sampling model is easy to establish, as the sampling

process is independent. However, for oscillating signals with

phase noise, it is hard to ﬁgure out the ADC sampling

model and the entropy, as adjacent samples are correlated.

In fact, ADC outputs have been used as random numbers

in some chips, but the utilized entropy is the noise inside

ADC, rather than the sampled signal. For example, in the TI

CC2530 SoC (System-on-Chip), the least-signiﬁcant output

bit caused by ADC internal noise is employed as the true

random number and PRNG seed of the chip [21]. As far as

we know, no literature has addressed on the stochastic models

of the behavior that ADCs sample oscillating signals, and in

this case more output bits can be used as random numbers.

Compared with noisy signals, the oscillating signals with

phase noise are much easier to generate and more often used

in circuits or chips, such as Application Speciﬁc Integrated

Circuits (ASICs).

In this paper, for the ﬁrst time, we propose a generic entropy

estimation method for the TRNGs where oscillating signals are

sampled by ADCs to calculate the entropy of multi-bit ADC

output, and design simulation and hardware experiments to

verify the theoretical results. From entropy estimation theory,

one can compute the entropy from given parameters, or deter-

mine the required sampling frequency of the ADC for a given

entropy threshold, which can be used as the guidance for exist-

ing TRNGs based on ADC sampling. By our proposed method,

one can utilize more output bits of ADC to signiﬁcantly

improve the utilization efﬁciency of entropy and the generation

speed of random numbers, while maintaining the sufﬁciency of

entropy.

In summary, we make the following contributions.

1) We ﬁrst provide an equivalent model to reveal the

relationship of the entropy contained in each single bit

of the ADC output under the linear relationship between

the voltage of ADC input and the phase, which is a

breakthrough point of our work.

2) We propose an entropy estimation for the multi-bit ADC

output, and apply it to different waveforms of sampled

oscillating signals to assess the sufﬁciency of entropy.

The correctness of the estimation method is veriﬁed by

simulated TRNGs.

3) We implement an ADC sampling based TRNG design

in SMIC 65 nm process for further veriﬁcation of the

entropy estimation method. The prototype chip can gen-

erate the random bit sequences with sufﬁcient entropy

compatible with AIS 31 at a speed of 132.3 Mbps, and

the sequences after XOR post-processing are able to pass

the NIST, Diehard, and TestU01 statistical test suites at

a bit rate of around 33 Mbps.

The organization of this paper is described as follows.

In Section II, we summarize the stochastic model for the

EO-TRNG based on phase evolution, and introduce the fun-

damental principles of ADCs. The equivalent model with

the proof is presented in Section III. The entropy estimation

of multi-bit ADC output is proposed in Section IV. The

simulation and hardware experiments are shown in Section V.

We discuss the application notes in Section VI and conclude

the paper in Section VII.

II. P

RELIMINARIES

In this section, we summarize the stochastic models of

oscillator-based TRNGs, and analyze the solution to deal

with the inﬂuence of the correlation among raw data on

entropy estimations. We further describe the EO-TRNGs

model (in [4]) based on the phase evolution with electronic

noise, which is the base of our work. In addition, the founda-

tional concepts of ADCs are introduced.

A. Oscillator-Based TRNGs Stochastic Model

The oscillator-based TRNG design has been widely

employed because of its nice properties of elegant and scalable

structure, and its stochastic models have been well studied

in recent years. To model oscillator-based TRNGs and esti-

mate the entropy, Killmann and Schindler [3] established a

common stochastic model based on time evolution approach,

and presented a tight lower bound of the bit-rate entropy.

For the EO-TRNG design, using the similar method in [3],

Ma et al. [8] provided a calculation approach to quantify the

precise entropy. Baudet et al. [4] presented a phase evolution

approach for modeling and provided a concise analytical

formula to calculate the entropy (including the n-bit entropy

and the lower bound). Besides, Amaki et al. [6] proposed a

model via using Markov state transition matrix to calculate

the probabilities of certain state vectors.

The correlation of raw data causes great difﬁculty for

entropy estimation, as the complexity of traversing the state

space of n successive samples makes the entropy calculation

infeasible. In general, two approaches are presented to address

this problem. One is removing the correlation intrinsically

in the TRNG design. For example, Bucci and Luzzi [22]

proposed a stateless (memoryless) TRNG architecture, where

two adjacent samples are independent while being generated.

The other approach is avoiding processing the correlation

of raw data when the entropy is calculated. For example,

Killmann and Schindler [3] provided a lower bound of entropy

(i.e., conditional entropy on previous phase) instead of n-bit

MA et al.: ENTROPY ESTIMATION FOR ADC SAMPLING-BASED TRNGs 2889

or bit-rate entropy with heavy complexity. Baudet et al. [4]

and our work also adopted the latter approach to avoid the

inﬂuence of the correlation on entropy estimation.

B. Stochastic Model Based on Phase Evolution

We summarize the entropy estimation approach presented

in [4] for the EO-TRNG. The stochastic model utilizes a

Wiener process (ϕ(t))

t∈R

(i.e., one-dimensional Brownian

motion) to describe the evolution of the phase with drift μ>0

and volatility σ

> 0. Speciﬁcally, for an initial time t

and

phase ϕ(t

), the phase ϕ(t) follows a Gaussian distribution

N with mean ϕ(t

) + μt and variance σ

t at any time t,

where t = t − t

is the sampling interval.

In the sampling process, when the sampling point lies in

the high voltage level of the sampled signal, a random bit ‘1’

is outputted; otherwise, ‘0’ is outputted. From the aspect of

phase, the random variable B(t) of sampling bit at time t is

expressed as follows with 1-periodic phase ϕ(t) mod 1. It is

called conventional sampling process in this paper.

B(t) =

⎧

⎪

⎨

⎪

⎩

1,ϕ(t) mod 1 ∈]

, 1[;

0,ϕ(t) mod 1 ∈]0,

[;

0or1,ϕ(t) mod 1 ∈{0,

The quality of sampling bit depends on two independent

parameters: the sampling interval t and the volatility σ

> 0.

Obviously, the increase of either of the two parameters makes

the improvement of the entropy of generated bits. Baudet

et al. [4] deﬁned quality factor Q = σ

t representing the

accumulation of the phase jitter during the time interval t.

Then, the expression of the joint entropy for the n-bit output

b is deduced in [4]:



b∈{0,1}

− p(b) log



p(b)



= n −

32(n − 1)

ln(2)

cos

(2πν)e

−4π

+ O(e

−6π

), (1)

where ν = μt represents the frequency ratio of the sampled

signal to the sampling one.

Nevertheless, the authors emphasized that the bit-rate

entropy cannot be calculated directly from Formula (1),

because calculated H

is not uniform in n. Following the

similar idea in [3], Baudet et al. also provided a lower bound

of the entropy:



B(t)|ϕ(0)







B(t)|ϕ(0) = x



=−



[ p

1,x

(t) log



1,x

(t)





1 − p

1,x

(t)



log



1 − p

1,x

(t)



]dx

= 1 −

ln(2)

−4π

+ O(e

−6π

), (2)

where p

1,x

(t) = p



B(t) = 1|ϕ(0) = x



The derivation for p

1,x

(t) is introduced as follows. For the

sampling bit B(t) = 1(orB(t) = 0), a probability function

(x) (or g

(x)) is deﬁned with a given value x of the phase

at time t:



ϕ(t) = x



⎧

⎪

⎨

⎪

⎩

1, x mod 1 ∈]

, 1[;

0, x mod 1 ∈]0,

[;

, x mod 1 ∈{0,

The Fourier coefﬁcient of g

(x) (or g

(x)) is expressed as γ

(or γ

), i.e., γ

(h) =



(x)e

−2πihx

dx,wherei is imaginary

unit and h ∈ Z.

From g

(x) + g

(x) = 1, it follows γ

(0) = γ

(0) =

and

(h) =−γ

(h) for h = 0. Therefore, the exact expression of

1,x

(t) is

1,x

(t) =



h∈Z

(−h)e

−2πih(μt+x)

−2π

. (3)

It is noted that, the introduction of g

(·) and g

(·) provides

a universality of the above entropy computation method. One

can apply this method to the entropy estimation of other digi-

tization processes by rewriting the functions, and substituting

them into the computation process to get a lower bound of the

entropy.

C. Foundational Concepts of ADC

ADC is applied to convert an analog signal into a digital

signal/code at the sampling point. Several considerable factors

of ADC are listed as follows.

• Sampling rate: the number of converting samples per sec-

ond.

• Resolution. An ADC with a resolution M in bits means

the number of discrete values that the ADC can produce

over the range of analog values, which is usually a power

of two, namely 2

. The discrete values can represent the

range from 0 to 2

− 1 (i.e., unsigned integer) or from

−2

M−1

to 2

M−1

− 1 (i.e., signed integer). In this paper,

we use the former representation. The voltage resolution

of an ADC is given by V

FSR

,whereV

FSR

is the full

scale voltage range. V

FSR

is given by V

FSR

= V

Ref_Hi

−

Ref_Low

,whereV

Ref_Hi

and V

Ref_Low

are the upper and

lower voltages, respectively. The quantization principle of

an ADC is generally described as follows. An M-bit ADC

converts a sampled voltage V

real

(∈[V

Ref_Low

, V

Ref_Hi

])

to an appropriate numerical representation that is (2

−

1) · (V

real

− V

Ref_Low

)/V

FSR

in M-bit binary form.

• Effective number of bits (ENOB): a certain number of bits,

in the digitized sample, actually converted by an ADC

when the ADC samples an analog signal. The ENOB

is limited by the signal-to-noise ratio (SNR). The rest

bits (except for the bits corresponding to ENOB) in the

samples are produced by the inherent noise in ADCs.

An ideal ADC has a property that the ENOB is equal to

its resolution. In this paper, we ﬁrst assume that the ADC

is ideal in the model establishment. Note that, the real

resolution of a practical ADC can be treated as the integer

part of ENOB. Therefore, this assumption does not affect

the availability of the proposed stochastic model.

剩余13页未读，继续阅读

评论收藏

内容反馈

weixin_38695293

粉丝: 6
资源: 956

基于ADC采样的真随机数发生器的熵估计

ADC产生随机数

随机数rand

基于振荡器的真随机数发生器的熵

基于stm32f4定时器触发双ADC多通道规则同步采样

基于SDK ADC-DMA多通道采样-LPC51U68

基于STM32的内部ADC对音频信号进行采样

生成真随机数

基于GaAs_Al0.45Ga0.55As超晶格芯片自发混沌振荡的8 Gb_s物理真随机数实现.pdf

基于FPGA的CCD视频波形发生器.pdf

基于STM32的简单数字存储示波器（DSO）

多通道高速物理随机数的产生源自相互耦合的半导体激光器的两个混沌信号

Hardware Random Number Generator-开源

一种基于DSP和采样ADC的数字锁定放大器

基于STM32的ADC采样及各式滤波实现（HAL库）

基于ADC输出转换采样来生成 FFT图的详细分析

基于UCOS和STM32的ADC采样_stm32ucosII_

【官方英文版文档高质量翻译】STM32L476数据手册【翻译】【中文版】.pdf

STM32F4数据手册

HC32F196_F190系列数据手册Rev1.01

STM32F207中文资料

译文_C12345_STM32F407VGT6_2014-07-24.docx

STM32F2系列技术培训-全集.pdf

STM32 F4系列凭借高性能征战高端微控制器市场.pdf

RJM8L151xxx系列_数据手册_V2.00.pdf

RJM8L151xxx系列_数据手册_V1.91

stm32F429中文数据手册

CC1310芯片用户手册

最新资源