A Generic Model of the Pseudo-Random Generator Based on Permutations Suitable for Security Solutions in Computationally-Constrained Environments

Abstract

Symmetric cryptography methods have an important role in security solutions design in data protection. In that context, symmetric cryptography algorithms and pseudo-random generators connected with them have strong influence on designed security solutions. In the computationally constrained environment, security efficiency is also important. In this paper we proposed the design of a new efficient pseudo-random generator parameterized by two pseudo-random sequences. By the probabilistic, information-theoretic and number theory methods we analyze characteristics of the generator. Analysis produced several results. We derived sufficient conditions, regarding parameterizing sequences, so that the output sequence has uniform distribution. Sufficient conditions under which there is no correlation between parameterizing sequences and output sequence are also derived. Moreover, it is shown that mutual information between the output sequence and parameterizing sequences tends to zero when the generated output sequence length tends to infinity. Regarding periodicity, it is shown that, with appropriately selected parameterizing sequences, the period of the generated sequence is significantly longer than the periods of the parameterizing sequences. All this characteristics are desirable regarding security applications. The efficiency of the proposed construction can be achieved by selection parameterizing sequences from the set of efficient pseudo-random number generators, for example, multiple linear feedback shift registers.

1. Introduction

The expansion of communication and network technologies, as well as technological advances in the design and implementation of microprocessor devices, have led to the ability to informational connecting different devices and creation of intelligent systems capable of monitoring and managing complex processes. Communication devices utilize the Internet infrastructure and protocols to create a world of connected devices, like Wireless Sensor Networks (WSN) and Internet of Things (IoT). This technological advancement enables the progress of many technological and life processes bringing to us smart cities, autonomous vehicles, robotization and intelligent robot behavior [1,2,3,4]. In that context, information security has a very important role in compromising the integrity and privacy of data in such an integrated world can cause serious damage, even to the level of a general disaster [5,6,7,8,9]. Therefore, in addition to security mechanisms incorporated into Internet protocols, additional security mechanisms incorporated into devices and systems are used to prevent unintended behavior. Moreover, a huge number of that type of devices (sensors, cameras, surveillance systems) need to work in real time fashion so that the defined security mechanisms do not disrupt system behavior. They must be designed in such a way that it is easy to implement them both in hardware and software and their application should not disrupt system behavior i.e., they must be efficient [10,11].

There are various IoT applications, connected with different types of sensors, that have become an integral part of our lives, and most of them can be classified in common areas such as smart healthcare services, smart home, intelligent transportation, smart grid, etc. However, as a consequence of mass deployment, many IoT challenges have arisen, such as limited processing capability and memory resources, large amount of data to transmit, different operating characteristics of hardware, and heterogeneous data and networks types [12,13,14,15,16]. Moreover, personal privacy, data confidentiality and integrity are also a great challenge of IoT that must be overcome, particularly for devices with limited resources and heterogeneous technologies [13,14,17,18,19]. Cryptography can be used to protect confidentiality (or secrecy) of data and communication. It can also be used to ensure the integrity (or accuracy) of information as well as for authentication (and non-repudiation) services [20]. An important point in the IoT world is that most IoT solutions have a “closed design”, so it is often very difficult or even impossible to incorporate additional security mechanisms after the production process is completed. On the other hand, as a consequence of the limited software and hardware resources of IoT devices, the suite of cryptographic algorithms that can be implemented is narrowing, so the right measure must be found between the desired level of security and implementation capabilities, which makes the security issue even more challenging [13,16]. Different cryptographic algorithms that offer roughly the same level of security may require different power and resource consumption, so you need to choose the right one, subject to the limitations of some specific IoT application and deployed hardware [19]. Given that public-key crypto algorithms, compared to symmetric crypto algorithms, have far greater power and resource consumption due to their high processing time [21], it is a natural choice to use a symmetric algorithm in IoT security solution design. Detailed analysis and comparison of symmetric block-type algorithms such as AES, RC6, Twofish, SPECK128, LEA, and ChaCha20-Poly1305 algorithms in IoT devices are given in [16]. On the other hand, stream or sequential symmetric key ciphers are typically faster than block-type. Block ciphers, in general, require more memory resources to encrypt/decrypt larger chunks (block) of data, while sequential ciphers usually take only one or a few bits at a time, they have relatively low memory requirements and therefore are suitable to implement in limited scenarios. Stream cryptography algorithms, as a subgroup of symmetric cryptography algorithms, are among the most common cryptography data protection techniques. The idea comes from Shannon’s one-time pad system, where instead of a random sequence of encryption bits, a series of bits obtained from a pseudo-random generator is used [20]. The sequence generated by the pseudo-random generator is used for plain-text encryption and its properties determine the security of the protected data. Therefore, the basic cryptography goal in stream cryptography systems is to design pseudo-random bit/symbol generators with good cryptographic characteristics. Many ideas have been implemented in the last fifty years, with more or less success.

One of the most popular and widely used pseudo-random sequence generator is the RC4 generator defined in 1987 by Ron Rivest. The description of the algorithm was revealed by reverse engineering of the RSA INC software [22], and the correctness of the algorithm description obtained was confirmed by Rivest himself [23,24].

The RC4 algorithm owes its popularity to its simplicity and ease of implementation in both software and hardware. The high popularity and applicability has attracted the attention of the cryptanalytic community. The results of a deep and thorough analysis of this algorithm led to the detection of a number of weaknesses of the algorithm. A comprehensive review of the weaknesses identified is given in [25] where the empirically detected weaknesses are theoretically proved as well as the original results of the authors of the article. The compromitation of this algorithm was additionally contributed by the implementation methods in security protocols, so that its use in security protocols has not been recommended since 2015 [26].

On the other hand, the beauty and elegance of the idea itself suggest the possibility of its exploitation.

Our work is aimed to define low complexity and efficient generic model of the pseudo-random generator that does not suffer from the weaknesses immanent to the RC4 and which is suitable for the implementation of the security solution in the computational constrained microprocessor environments, e.g., WSN and IoT. This paper defines a pseudo-random generator that can, in some way, be considered as a generalization of ideas related to RC4 because it uses the time varying permutations, sequences for permutation changing and addressing output element from the current generator state. In order to prove plausible cryptographic properties of the proposed pseudo-random generator different mathematical techniques are used to analyze probability distribution of the output sequence, correlation properties, information leakage between the state of the generator and output sequence and periodicity.

The paper is organized in four parts. After the first part containing motivation for this work and introduction in the second part we introduce necessary notation, describe proposed pseudo-random generator and his relationship to RC4 in brief. The third part contains the analysis of the generator, some comments and remarks. The fourth part contains a summary of the paper’s results.

2. Notation and Generating Algorithm Description

Let $I_k=\left\{0,1,\dots ,k-1\right\}$. Then with ${\mathcal{P}}_k$ we will denote a set of all bijections from $I_k$ to $I_k$, and as usual, its elements will be named permutations. Set ${\mathcal{P}}_k$ is a totally ordered set by the, so called, lexicographic order and have exactly $k!$ elements, where ! denotes factorial operation. Elements of the set ${\mathcal{P}}_k$ we will denote by ${\Pi }_1,{\Pi }_2,\dots ,{\Pi }_{k!}$.

By $P\left\{X\right\}$ we will denote the probability of set X.

Let $S=\left\{f_0,f_1,\dots ,f_{m-1}\right\}\subseteq {\mathcal{P}}_k$ be a set of permutations on $I_k$ with the following properties:

• For any ${\Pi }_j\in {\mathcal{P}}_k,j=1,2,\dots ,k!,$ exists a number $l>0$ and set of integers $i_1,i_2,\dots ,i_l\in I_m$ such that ${\Pi }_j=f_{i_l}\circ f_{i_{l-1}}\circ \dots \circ f_{i_1}$, where ∘ is composition of functions.
• For all $p,q\in I_m$ if $p\ne q$ then $f_p\ne f_q$.
• ${\Pi }_1=I\in S$ where I is identical permutation.

Let ${\left\{A_n\right\}}_{n=1}^{\infty }$ and ${\left\{C_n\right\}}_{n=1}^{\infty }$ be a two sequences of independent identically distributed random variables with $P\left\{A_n=l\right\}=a_l,l=0,1,...,k-1$ and $P\left\{C_n=l\right\}=c_l,l=0,1,...,\left(m-1\right).$

Then we will define a pseudo-random sequence ${\left\{Z_n\right\}}_{n=1}^{\infty }$ with equations

$$\begin{array}{cc}{g}_0=p\hfill & p\in {\mathcal{P}}_k\hfill \\ g_{n+1}=f_{C_{n+1}}\circ g_n\hfill & n\ge 0\hfill \\ Z_{n+1}=g_{n+1}\left(A_{n+1}\right)\hfill & n\ge 0.\hfill \end{array}$$

(1)

From (1) generating algorithm for the sequence ${\left\{Z_n\right\}}_{n=1}^{\infty }$ is obvious. As a first step we will construct the sequence of permutations ${\left\{g_n\right\}}_{n=0}^{\infty }$, $g_n\in$ ${\mathcal{P}}_k$ using sequence ${\left\{C_n\right\}}_{n=1}^{\infty }$ and element $Z_n$ of the sequence ${\left\{Z_n\right\}}_{n=1}^{\infty }$ is computed as a value of the function $g_n$ at the point $A_n$. Graphical presentation of the sequence generating process is given on the Figure 1.

Defined generator algorithm apply time-varying permutations as well as the RC4 but in RC4 fixed set of permutations, set of transpositions, is used. Graphical presentation of the RC4 algorithm is given on the Figure 2. where the summatios and numbers with denote reduction modulo $256.$

In the defined generator case any set S which is generator of ${\mathcal{P}}_k$ can be used. Sequences that are used in RC4 applied transposition determination and address of permutation table position corresponds to sequences ${\left\{C_n\right\}}_{n=1}^{\infty }$ and ${\left\{A_n\right\}}_{n=1}^{\infty }$ in our algorithm respectively. While the mentioned sequences from RC4 are precisely defined, in our case sequences ${\left\{C_n\right\}}_{n=1}^{\infty }$ and ${\left\{A_n\right\}}_{n=1}^{\infty }$ are arbitrarily chosen and the generator is parameterized by those two sequences. Later in the paper we define sufficient conditions for sequences ${\left\{C_n\right\}}_{n=1}^{\infty }$ and ${\left\{A_n\right\}}_{n=1}^{\infty }$ to achieve good pseudo-random and security properties.

3. Analysis of the Generator

For every pseudo-random generator it is necessary to analyze its properties regarding the possibilities of output sequence prediction or reconstruction of the generator initial state. In that sense desirable properties are uniform distribution of the output sequence, nonexistence of the correlation between the output sequence and elements of the generator, nonexistence of the output sequence auto-correlation and long period of the output sequence. These features are especially important for generators used in security solutions and lack any of them usually have serious consequences on the security of the system. Different examples can be found in [20,27].

3.1. Distribution of the Generated Sequence

Intuitively one can expect that ${\left\{Z_n\right\}}_{n=1}^{\infty }$ has a uniform distribution but relatively weak constraints demanded for the sequences ${\left\{A_n\right\}}_{n=1}^{\infty }$ and ${\left\{C_n\right\}}_{n=1}^{\infty }$ require formal proof for the expectations. By the next theorem we will show that ${\left\{Z_n\right\}}_{n=1}^{\infty }$ has an asymptotically uniform distribution.

Theorem 1.

If

• ${\displaystyle \sum _{i=1}^k}{a}_i=1$and$a_i>0$for all$i\in I_k,$
• ${\displaystyle \sum _{i=0}^{m-1}}{c}_i=1$and$c_i>0$for all$i\in I_m,$

then pseudo-random sequence${\left\{Z_n\right\}}_{n=1}^{\infty }$has an asymptotically uniform distribution i.e.,

$$\left(\forall l\in I_k\right)\left(\underset{n\to \infty }{\lim }P\left\{Z_n=l\right\}=\frac{1}{k}\right)$$

for$l\in I_k$.

The proof of the Theorem 1 will be derived in two steps. First, using Markov chains theory, we will show that sequence ${\left\{g_n\right\}}_{n=0}^{\infty }$ has asymptotically uniform distribution and after that, in the second step, using that result we will show the statement of the theorem.

Proof. 

First we will analyze the sequence of functions ${\left\{g_n\right\}}_{n=0}^{\infty }$. It is obvious that $g_n\in$${\mathcal{P}}_k$, as a consequence of $\left({\mathcal{P}}_k,\circ \right)$ being group. Next we will show that

$$\left(\forall i\in \left\{1,2,\dots ,k!\right\}\right)\left(\underset{n\to \infty }{\lim }P\left\{g_n={\Pi }_i\right\}=\frac{1}{k!}\right)$$

(2)

To prove (2) we will observe the sequence ${\left\{g_n\right\}}_{n=0}^{\infty }$ as a stationary Markov chain over the set of states ${\mathcal{P}}_k$. Indeed, according to the definition of ${\left\{g_n\right\}}_{n=0}^{\infty }$, transition from the $g_n$ to $g_{n+1}$ doesn’t depend on the history of $g_n$, but only on the current state $g_n$ and the value of $C_n$.

Denote by $G_n={\left[P\left\{g_n={\Pi }_i\right\}\right]}_{1\times k!}$ a row matrix whose elements are the probabilities that after n steps the chain is in the state ${\Pi }_i$. Let $t_{ij}$ be the probability that the chain changes state from ${\Pi }_i$ to ${\Pi }_j$ in one step and $T={\left[t_{ij}\right]}_{k!\times k!}$ be one step transition matrix for the Markov chain. Denote by $T_n={\left[t_{ij}^n\right]}_{k!\times k!}$n-step probability transition matrix of that system starting at the state ${\Pi }_i$ changes to state ${\Pi }_j$ after exactly n steps. It is well known, (see [28,29]), that $T_n=T^n$ and that,

$$\begin{array}{ccc}\hfill G_n& =& G_0{T}_n\hfill \\ \hfill \underset{n\to \infty }{\lim }{G}_n& =& \underset{n\to \infty }{\lim }{G}_0{T}_n=G_0\underset{n\to \infty }{\lim }{T}_n\hfill \end{array}$$

(3)

When the limit values in (3) exists. To show that $\underset{n\to \infty }{\lim }{T}_n$ exists it is sufficient to show that such $n_0\in \mathbb{N}$ exists for which $t_{ij}^{n_0}>0$ for all $i,j\in \left\{1,2,...,k!\right\}$ (see [28,29]).

Let us define numbers $n_{ij}$ as

$$n_{ij}=\underset{r}{\min }\left\{r|\left(\exists \left(i_1,i_2,\dots ,i_r\right)\in I_m^r\right)\left(f_{i_r}\circ \dots \circ f_{i_2}\circ f_{i_1}={\Pi }_j\circ {\Pi }_i^{-1}\right)\right\}.$$

(4)

Due to the properties of the set S it is clear that $n_{ij}>0$. Let $n_0$ be $\underset{i,j\in \left\{1,2,\dots ,k!\right\}}{\max }{n}_{ij}$ and show that $t_{ij}^{n_0}$ is greater than zero. Because $\left({\mathcal{P}}_k,\circ \right)$ is group then the equation $x\circ {\Pi }_i={\Pi }_j$ has exactly one solution, ${\Pi }_j\circ {\Pi }_i^{-1}$, so we can write

$$\begin{array}{cc}\hfill t_{ij}^{n_0}& =\sum _{\left(i_1,\dots ,i_{n_0}\right)}P\left\{f_{i_{n_0}}\circ \dots \circ f_{i_2}\circ f_{i_1}\circ {\Pi }_i={\Pi }_j\right\}\hfill \\ \hfill & =\sum _{\left(i_1,\dots ,i_{n_0}\right)}P\left\{f_{i_{n_0}}\circ \dots \circ f_{i_2}\circ f_{i_1}={\Pi }_j\circ {\Pi }_i^{-1}\right\}\hfill \\ \hfill & =\sum _{\begin{array}{c}\left(i_1,\dots ,i_{n_0}\right)\\ f_{i_{n_0}}\circ \dots \circ f_{i_2}\circ f_{i_1}={\Pi }_i^{-1}\circ {\Pi }_j\end{array}}\prod _{l=1}^{n_0}P\left\{C_l=i_l\right\}\hfill \end{array}$$

(5)

Now, to prove $t_{ij}^{n_0}>0$ it is sufficient to show that at least one summand in (5) is greater then zero, see [28,29]. Because $n_{ij}>0$ we can find a set of indices $\left\{i_1,i_2,\dots ,i_{n_{ij}}\right\},n_{ij}\le n_0$ such that $f_{i_{n_{ij}}}\circ \dots \circ f_{i_2}\circ f_{i_1}={\Pi }_i^{-1}\circ {\Pi }_j$. Because the index of identical permutation is 1, then the summand which corresponds to the set of indices $\left\{i_1,i_2,\dots ,i_{n_{ij}},\underset{n_0-n_{ij}}{\underbrace{1,1,\dots ,1}}\right\}$ is evidently greater then zero and we showed that $\underset{n\to \infty }{\lim }{T}_n$ exists. Because convergence is component wise, $\underset{n\to \infty }{\lim }{t}_{ij}^n=t_j^{*}$ exists. Limit value $\underset{n\to \infty }{\lim }{T}_n$ can be determined as a solution of the system of a equations known as Champman-Kolmogorov equations.

$$\begin{array}{c}{\displaystyle \sum _{j=1}^{k!}}{t}_j^{*}{t}_{jl}=t_l^{*}\hfill \\ {\displaystyle \sum _{j=1}^{k!}}{t}_j^{*}=1\hfill \end{array}$$

(6)

It is easy to check, by substitution, that the $t_1^{*}=$$t_2^{*}=\dots =$$t_{k!}^{*}=\frac{1}{k!}$ is unique solution of the system (6).

From now on the proof is straightforward. Let $l\in I_k$ be arbitrary, then

$$\begin{array}{cc}\hfill P\left\{Z_n=l\right\}& =P\left\{g_n\left(A_n\right)=l\right\}\hfill \\ \hfill & =\sum _{i=1}^{k!}P\left\{g_n\left(A_n\right)=l|g_n={\Pi }_i\right\}P\left\{g_n={\Pi }_i\right\}\hfill \\ \hfill & =\sum _{i=1}^{k!}P\left\{{\Pi }_i\left(A_n\right)=l|g_n={\Pi }_i\right\}P\left\{g_n={\Pi }_i\right\}\hfill \\ \hfill & =\sum _{i=1}^{k!}\sum _{j=0}^{k-1}P\left\{{\Pi }_i\left(j\right)=l|A_n=j\right\}P\left\{A_n=j\right\}P\left\{g_n={\Pi }_i\right\}.\hfill \end{array}$$

(7)

Because $\left\{{\Pi }_i\left(j\right)=l|\right\}$ and $\left\{A_n=j\right\}$ are independent random variables it follows from (7) that

$$\begin{array}{cc}\hfill P\left\{Z_n=l\right\}& =\sum _{i=1}^{k!}\sum _{j=0}^{k-1}P\left\{{\Pi }_i\left(j\right)=l|A_n=j\right\}P\left\{A_n=j\right\}P\left\{g_n={\Pi }_i\right\}\hfill \\ \hfill & =\sum _{i=1}^{k!}\sum _{j=0}^{k-1}P\left\{{\Pi }_i\left(j\right)=l\right\}P\left\{A_n=j\right\}P\left\{g_n={\Pi }_i\right\}\hfill \\ \hfill & =\sum _{j=0}^{k-1}P\left\{A_n=j\right\}\sum _{i=1}^{k!}P\left\{g_n={\Pi }_i\right\}P\left\{{\Pi }_i\left(j\right)=l\right\}\hfill \end{array}$$

(8)

Finding limit of the both sides of the (8) it follows

$$\begin{array}{cc}\hfill \underset{n\to \infty }{\lim }P\left\{Z_n=l\right\}& =\underset{n\to \infty }{\lim }\sum _{j=0}^{k-1}P\left\{A_n=j\right\}\sum _{i=1}^{k!}P\left\{g_n={\Pi }_i\right\}P\left\{{\Pi }_i\left(j\right)=l\right\}\hfill \\ \hfill & =\sum _{j=0}^{k-1}P\left\{A_n=j\right\}\sum _{i=1}^{k!}P\left\{{\Pi }_i\left(j\right)=l\right\}\underset{n\to \infty }{\lim }P\left\{g_n={\Pi }_i\right\}\hfill \end{array}$$

(9)

because $P\left\{A_n=j\right\},P\left\{{\Pi }_i\left(j\right)=l\right\}$ do not depend on $n.$ Using that $\underset{n\to \infty }{\lim }$P$\left\{g_n={\Pi }_i\right\}$=$\frac{1}{k!}$ from (9) it follows that

$$\begin{array}{cc}\hfill \underset{n\to \infty }{\lim }P\left\{Z_n=l\right\}& =\sum _{j=0}^{k-1}P\left\{A_n=j\right\}\sum _{i=1}^{k!}P\left\{{\Pi }_i\left(j\right)=l\right\}\underset{n\to \infty }{\lim }P\left\{g_n={\Pi }_i\right\}\hfill \\ \hfill & =\frac{1}{k!}\sum _{j=0}^{k-1}P\left\{A_n=j\right\}\sum _{i=1}^{k!}P\left\{{\Pi }_i\left(j\right)=l\right\}\hfill \\ \hfill & =\frac{1}{k!}\sum _{j=0}^{k-1}P\left\{A_n=j\right\}\left(k-1\right)!\hfill \\ \hfill & =\frac{\left(k-1\right)!}{k!}\sum _{j=0}^{k-1}P\left\{A_n=j\right\}\hfill \\ \hfill & =\frac{1}{k}\hfill \end{array}$$

which proves the theorem. □

Remark 1.

Asymptotically uniform distribution of the sequence $Z_n,n=1,2,...\dots ,$ as we have shown, is a consequence of the asymptotically uniform distribution of ${\left\{g_n\right\}}_{n=0}^{\infty }.$ If $G_0={\left[\frac{1}{k!},\frac{1}{k!},\dots ,{\frac{1}{k!}}_i\right]}_{1\times k!}$ it is easy to verify that ${\left\{g_n\right\}}_{n=0}^{\infty }$ has a uniform distribution and as a consequence $Z_n,n=1,2,\dots$ has a uniform distribution too.

Theorem 2.

If the random variables $A_n,n=1,2,...\dots$ are uniformly distributed then for all $z\in I_k$

$$P\left\{Z_n=z\right\}=\frac{1}{k}$$

Proof. 

By the generator definition we have

$$\begin{array}{cc}\hfill P\left\{Z_n=z\right\}& =\sum _{i=1}^{k!}\sum _{j=0}^{k-1}P\left\{Z_n=z|g_n={\Pi }_i\wedge A_n=j\right\}·P\left\{g_n={\Pi }_i\wedge A_n=j\right\}\hfill \\ \hfill & =\sum _{i=1}^{k!}\sum _{j=0}^{k-1}P\left\{{\Pi }_i\left(j\right)=z\right\}·P\left\{g_n={\Pi }_i\right\}·P\left\{A_n=j\right\}\hfill \end{array}$$

(10)

because $A_n$ is uniformly distributed from (10) it follows that

$$\begin{array}{cc}\hfill P\left\{Z_n=z\right\}& =\sum _{i=1}^{k!}\sum _{j=0}^{k-1}P\left\{{\Pi }_i\left(j\right)=z\right\}·P\left\{g_n={\Pi }_i\right\}·\frac{1}{k}\hfill \\ \hfill & =\frac{1}{k}\sum _{i=1}^{k!}\sum _{j=0}^{k-1}P\left\{{\Pi }_i\left(j\right)=z\right\}·P\left\{g_n={\Pi }_i\right\}\hfill \\ \hfill & =\frac{1}{k}\sum _{i=1}^{k!}P\left\{g_n={\Pi }_i\right\}\sum _{j=0}^{k-1}P\left\{{\Pi }_i\left(j\right)=z\right\}\hfill \\ \hfill & =\frac{1}{k}\hfill \end{array}$$

because ${\displaystyle \sum _{i=1}^{k!}}P\left\{g_n={\Pi }_i\right\}=1$ and ${\displaystyle \sum _{j=0}^{k-1}}P\left\{{\Pi }_i\left(j\right)=z\right\}=1$ and theorem is proved.□

By these theorems we showed that generator has at least asymptotically uniform distribution of the values in the generator output sequence. This is important security feature because it indicates impossibility of the prediction of the generator output sequence based on the probability distribution of the output sequence values.

Correlation Properties

Theorem 3.

If the random variables $A_n,n=1,2,...\dots$ are uniformly distributed then for all $a,b\in I_k,$

• $P\left\{Z_{n+l}=b\wedge Z_n=a\right\}=\frac{1}{k^2}$
• $P\left\{Z_{n+l}=b|Z_n=a\right\}=\frac{1}{k}$

Proof. 

• By the generator definition we have

  $$\begin{array}{cc}\hfill & P\left\{Z_{n+l}=b\wedge Z_n=a\right\}=P\left\{g_{n+k}\left(A_{n+k}\right)=b\wedge g_n\left(A_n\right)=a\right\}=\hfill \\ \hfill & =\sum _{i=1}^{k!}\sum _{j=1}^{k!}P\left\{g_{n+k}\left(A_{n+k}\right)=b\wedge g_n\left(A_n\right)=a|g_{n+k}={\Pi }_i\wedge g_n={\Pi }_j\right\}\hfill \\ \hfill & ·P\left\{g_{n+k}={\Pi }_i\wedge g_n={\Pi }_j\right\}\hfill \\ \hfill & =\sum _{i=1}^{k!}\sum _{j=1}^{k!}P\left\{{\Pi }_i\left(A_{n+k}\right)=b\wedge {\Pi }_j\left(A_n\right)=a\right\}·P\left\{g_{n+k}={\Pi }_i\wedge g_n={\Pi }_j\right\}\hfill \\ \hfill & =\sum _{i=1}^{k!}\sum _{j=1}^{k!}P\left\{{\Pi }_i\left(A_{n+k}\right)=b\wedge {\Pi }_j\left(A_n\right)=a\right\}·P\left\{g_{n+k}={\Pi }_i|g_n={\Pi }_j\right\}\hfill \\ \hfill & ·P\left\{g_n={\Pi }_j\right\}.\hfill \end{array}$$

  (11)

  Now, using notation from the Theorem 1 $P\left\{g_{n+k}={\Pi }_i|g_n={\Pi }_j\right\}$ is equal to $t_{i,j}^k$ and putting it in (11) it follows that

  $$\begin{array}{cc}\hfill & P\left\{Z_{n+l}=b\wedge Z_n=a\right\}=\hfill \\ \hfill & =\sum _{i=1}^{k!}\sum _{j=1}^{k!}P\left\{{\Pi }_i\left(A_{n+k}\right)=b\wedge {\Pi }_j\left(A_n\right)=a\right\}·P\left\{g_{n+k}={\Pi }_i|g_n={\Pi }_j\right\}\hfill \\ \hfill & ·P\left\{g_n={\Pi }_j\right\}\hfill \\ \hfill & =\sum _{i=1}^{k!}\sum _{j=1}^{k!}P\left\{{\Pi }_i\left(A_{n+k}\right)=b\wedge {\Pi }_j\left(A_n\right)=a\right\}·t_{i,j}^k·P\left\{g_n={\Pi }_j\right\}.\hfill \end{array}$$

  (12)

  Because ${\Pi }_i,{\Pi }_j$ are permutations $P\left\{{\Pi }_i\left(A_{n+k}\right)=b\wedge {\Pi }_j\left(A_n\right)=a\right\}$ is equal to $P\left\{A_{n+k}={\Pi }_i^{-1}\left(b\right)\wedge A_n={\Pi }_j^{-1}\left(a\right)\right\}$ and using that $A_{n+k},A_n$ are independent random variables from (12) it follows that

  $$\begin{array}{cc}\hfill & P\left\{Z_{n+l}=b\wedge Z_n=a\right\}=\hfill \\ \hfill & =\sum _{i=1}^{k!}\sum _{j=1}^{k!}P\left\{{\Pi }_i\left(A_{n+k}\right)=b\wedge {\Pi }_j\left(A_n\right)=a\right\}·t_{i,j}^k·P\left\{g_n={\Pi }_j\right\}\hfill \\ \hfill & =\sum _{i=1}^{k!}\sum _{j=1}^{k!}P\left\{A_{n+k}={\Pi }_i^{-1}\left(b\right)\wedge A_n={\Pi }_j^{-1}\left(a\right)\right\}·t_{i,j}^k·P\left\{g_n={\Pi }_j\right\}\hfill \\ \hfill & =\sum _{i=1}^{k!}\sum _{j=1}^{k!}P\left\{A_{n+k}={\Pi }_i^{-1}\left(b\right)\right\}·P\left\{A_n={\Pi }_j^{-1}\left(a\right)\right\}·t_{i,j}^k·P\left\{g_n={\Pi }_j\right\}\hfill \end{array}$$

  (13)

  Now, using that $A_{n+k}$ and $A_n$ are uniformly distributed independent random variables it follows from (13) that

  $$\begin{array}{cc}\hfill P& \left\{Z_{n+l}=b\wedge Z_n=a\right\}=\hfill \\ \hfill & =\sum _{i=1}^{k!}\sum _{j=1}^{k!}P\left\{A_{n+k}={\Pi }_i^{-1}\left(b\right)\right\}·P\left\{A_n={\Pi }_j^{-1}\left(a\right)\right\}·t_{i,j}^k·P\left\{g_n={\Pi }_j\right\}\hfill \\ \hfill & =\sum _{i=1}^{k!}\sum _{j=1}^{k!}\frac{1}{k}·\frac{1}{k}·t_{i,j}^k·P\left\{g_n={\Pi }_j\right\}\hfill \\ \hfill & =\frac{1}{k^2}\sum _{i=1}^{k!}P\left\{g_n={\Pi }_i\right\}\sum _{j=1}^{k!}{t}_{i,j}^k\hfill \\ \hfill & =\frac{1}{k^2}\hfill \end{array}$$

  (14)

  because ${\displaystyle \sum _{j=1}^{k!}}{t}_{i,j}^k=1$ and ${\displaystyle \sum _{i=1}^{k!}}P\left\{g_n={\Pi }_i\right\}=1,$ and statement is proved.
• Using statement of the Theorem 2 that $P\left\{Z_n=a\right\}=\frac{1}{k}$ by the definition of conditional probability it follows that

  $$P\left\{Z_{n+l}=b|Z_n=a\right\}=\frac{P\left\{Z_{n+k}=b\wedge Z_n=a\right\}}{P\left\{Z_n=a\right\}}=\frac{\frac{1}{k^2}}{\frac{1}{k}}=\frac{1}{k}$$

  which proves the statement. □

3.2. Information Leakage

Information leakage means existence of the correlation between generator output sequence and elements of its inner state. Such type correlation may be base for the process of reconstruction of the some generator state during his generation history. Knowledge of the one state during the generator work and knowledge of the generator algorithm allows prediction of the future elements of the output sequence which is undesirable in security applications. In this part, correlation with the state element sequences ${\left\{A_n\right\}}_{n=1}^{\infty }$ and ${\left\{C_n\right\}}_{n=1}^{\infty }$ with ${\left\{Z_n\right\}}_{n=1}^{\infty }$ is considered.

Theorem 4.

Under the conditions of the Theorem 1 we have

• $\underset{n\to \infty }{\lim }P\left(Z_n=z|C_n=c\right)=\frac{1}{k}$
• $\underset{n\to \infty }{\lim }I\left(Z_n,C_n\right)=0$

where$z\in I_k$and$c\in I_m$

Proof. 

• By the definition

  $$\begin{array}{cc}\hfill P& \left(Z_n=z|C_n=c\right)=\hfill \\ \hfill & =\frac{P\left(Z_n=z\wedge C_n=c\right)}{P\left(C_n=c\right)}=\frac{P\left(g_n\left(A_n\right)=z\wedge C_n=c\right)}{P\left(C_n=c\right)}\hfill \\ \hfill & =\frac{P\left(\left({\displaystyle \bigcup _{i=1}^{k!}}{g}_n={\Pi }_i\wedge {\Pi }_i\left(A_n\right)=z\right)\wedge C_n=c\right)}{P\left(C_n=c\right)}\hfill \\ \hfill & =\frac{P\left(\left({\displaystyle \bigcup _{i=1}^{k!}}{f}_{C_n}\circ g_{n-1}={\Pi }_i\wedge {\Pi }_i\left(A_n\right)=z\right)\wedge C_n=c\right)}{P\left(C_n=c\right)}\hfill \\ \hfill & =\frac{P\left({\displaystyle \bigcup _{i=1}^{k!}}\left(\left(f_{C_n}\circ g_{n-1}={\Pi }_i\wedge {\Pi }_i\left(A_n\right)=z\right)\wedge C_n=c\right)\right)}{P\left(C_n=c\right)}.\hfill \end{array}$$

  (15)

  Because $\left\{f_{C_n}\circ g_{n-1}={\Pi }_i\right\}$ and $\left\{f_{C_n}\circ g_{n-1}={\Pi }_j\right\}$ are disjoint events for $i,j\in I_k$ and $i\ne j$, from (15) it follows that

  $$\begin{array}{cc}\hfill P& \left(Z_n=z|C_n=c\right)=\frac{P\left({\displaystyle \bigcup _{i=1}^{k!}}\left(\left(f_{C_n}\circ g_{n-1}={\Pi }_i\wedge {\Pi }_i\left(A_n\right)=z\right)\wedge C_n=c\right)\right)}{P\left(C_n=c\right)}\hfill \\ \hfill & =\frac{{\displaystyle \sum _{i=1}^{k!}}P\left(\left(\left(f_{C_n}\circ g_{n-1}={\Pi }_i\wedge {\Pi }_i\left(A_n\right)=z\right)\wedge C_n=c\right)\right)}{P\left(C_n=c\right)}\hfill \end{array}$$

  (16)

  Now, using Bayes theorem from (16) it follows that

  $$\begin{array}{cc}\hfill P& \left(Z_n=z|C_n=c\right)=\frac{{\displaystyle \sum _{i=1}^{k!}}P\left(\left(\left(f_{C_n}\circ g_{n-1}={\Pi }_i\wedge {\Pi }_i\left(A_n\right)=z\right)\wedge C_n=c\right)\right)}{P\left(C_n=c\right)}\hfill \\ \hfill & =\frac{{\displaystyle \sum _{i=1}^{k!}}{\displaystyle \sum _{j=0}^{k-1}}P\left(\left(\left(f_{C_n}\circ g_{n-1}={\Pi }_i\wedge {\Pi }_i\left(A_n\right)=z\right)\wedge C_n=c\right)|\left(A_n=j\right)\right)·P\left(A_n=j\right)}{P\left(C_n=c\right)}\hfill \\ \hfill & =\frac{{\displaystyle \sum _{i=1}^{k!}}{\displaystyle \sum _{j=0}^{k-1}}P\left(\left(\left(f_{C_n}\circ g_{n-1}={\Pi }_i\wedge {\Pi }_i\left(j\right)=z\right)\wedge C_n=c\right)\right)·P\left(A_n=j\right)}{P\left(C_n=c\right)}\hfill \\ \hfill & =\frac{{\displaystyle \sum _{i=1}^{k!}\sum _{j=0}^{k-1}}P\left(\left(g_{n-1}=f_{C_n}^{-1}\circ {\Pi }_i\wedge C_n=c\right)\wedge {\Pi }_i\left(j\right)=z\right)·P\left(A_n=j\right)}{P\left(C_n=c\right)}.\hfill \end{array}$$

  (17)

  Now, because events $\left\{g_{n-1}=f_{C_n}^{-1}\circ {\Pi }_i\wedge C_n=c\right\}$ and $\left\{{\Pi }_i\left(j\right)=z\right\}$ are independent from (17) it follows that

  $$\begin{array}{cc}\hfill P& \left(Z_n=z|C_n=c\right)=\hfill \\ \hfill & =\frac{{\displaystyle \sum _{i=1}^{k!}}{\displaystyle \sum _{j=0}^{k-1}}P\left(\left(g_{n-1}=f_{C_n}^{-1}\circ {\Pi }_i\wedge C_n=c\right)\wedge {\Pi }_i\left(j\right)=z\right)·P\left(A_n=j\right)}{P\left(C_n=c\right)}\hfill \\ \hfill & =\frac{{\displaystyle \sum _{i=1}^{k!}}{\displaystyle \sum _{j=0}^{k-1}}P\left(g_{n-1}=f_{C_n}^{-1}\circ {\Pi }_i\wedge C_n=c\right)·P\left({\Pi }_i\left(j\right)=z\right)·P\left(A_n=j\right)}{P\left(C_n=c\right)}\hfill \end{array}$$

  (18)

  Grou** summands which depends on j from (18) it follows that

  $$\begin{array}{cc}\hfill P& \left(Z_n=z|C_n=c\right)=\hfill \\ \hfill & =\frac{{\displaystyle \sum _{i=1}^{k!}}{\displaystyle \sum _{j=0}^{k-1}}P\left(g_{n-1}=f_{C_n}^{-1}\circ {\Pi }_i\wedge C_n=c\right)·P\left({\Pi }_i\left(j\right)=z\right)·P\left(A_n=j\right)}{P\left(C_n=c\right)}\hfill \\ \hfill & =\sum _{i=1}^{k!}\frac{P\left(g_{n-1}=f_{C_n}^{-1}\circ {\Pi }_i\wedge C_n=c\right){\displaystyle \sum _{j=0}^{k-1}}P\left(A_n=j\right)·P\left({\Pi }_i\left(j\right)=z\right)}{P\left(C_n=c\right)}\hfill \\ \hfill & =\sum _{i=1}^{k!}\frac{P\left(g_{n-1}=f_{C_n}^{-1}\circ {\Pi }_i\wedge C_n=c\right)}{P\left(C_n=c\right)}{\displaystyle \sum _{j=0}^{k-1}}P\left(A_n=j\right)·P\left({\Pi }_i\left(j\right)=z\right)\hfill \\ \hfill & =\sum _{i=1}^{k!}P\left(g_{n-1}=f_{C_n}^{-1}\circ {\Pi }_i|C_n=c\right){\displaystyle \sum _{j=0}^{k-1}}P\left(A_n=j\right)·P\left({\Pi }_i\left(j\right)=z\right)\hfill \\ \hfill & =\sum _{i=1}^{k!}P\left(g_{n-1}=f_c^{-1}\circ {\Pi }_i\right){\displaystyle \sum _{j=0}^{k-1}}P\left(A_n=j\right)·P\left({\Pi }_i\left(j\right)=z\right)\hfill \end{array}$$

  (19)

  Taking the limit from the both sides in (19) it follows

  $$\begin{array}{cc}\hfill \underset{n\to \infty }{lim}& P\left(Z_n=z|C_n=c\right)=\hfill \\ \hfill & =\underset{n\to \infty }{lim}\sum _{j=0}^{k-1}P\left(A_n=j\right)\sum _{i=1}^{k!}P\left(g_{n-1}=f_c^{-1}\circ {\Pi }_i\right)·P\left({\Pi }_i\left(j\right)=z\right)\hfill \\ \hfill & =\sum _{j=0}^{k-1}P\left(A_n=j\right)\sum _{i=1}^{k!}P\left({\Pi }_i\left(j\right)=z\right)·\underset{n\to \infty }{lim}P\left(g_{n-1}=f_c^{-1}\circ {\Pi }_i\right)=\hfill \\ \hfill & =\sum _{j=0}^{k-1}P\left(A_n=j\right)\sum _{i=1}^{k!}P\left({\Pi }_i\left(j\right)=z\right)·\frac{1}{k!}\hfill \\ \hfill & =\frac{1}{k!}\sum _{j=0}^{k-1}P\left(A_n=j\right)\sum _{i=1}^{k!}P\left({\Pi }_i\left(j\right)=z\right)\hfill \\ \hfill & =\frac{1}{k!}\sum _{j=0}^{k-1}P\left(A_n=j\right)·\left(k-1\right)!=\hfill \\ \hfill & =\frac{\left(k-1\right)!}{k!}\sum _{j=0}^{k-1}P\left(A_n=j\right)=\frac{1}{k}\hfill \end{array}$$

  which proves the statement.
• By the definition of mutual information we have that

  $$I\left(Z_n,C_n\right)=H\left(Z_n\right)-H\left(Z_n|C_n\right)$$

  (20)

  We will start with computing $H\left(Z_n\right).$

  $$H\left(Z_n\right)=\sum _{i=0}^{k-1}P\left(Z_n=i\right){log}_2\frac{1}{P\left(Z_n=i\right)}$$

  (21)

  Taking the limit from the both sides in (21) and using Theorem 1 we have

  $$\underset{n\to \infty }{lim}H\left(Z_n\right)={log}_{2}k.$$

  (22)

  In the same way it follows that

  $$\begin{array}{cc}\hfill H\left(Z_n|C_n\right)& =\sum _{i=0}^{m-1}P\left(C_n=i\right)·H\left(Z_n|C_n=i\right)=\hfill \\ \hfill & =\sum _{i=0}^{m-1}P\left(C_n=i\right)·\sum _{j=0}^{k-1}P\left(Z_n=j|C_n=c_i\right){log}_2\frac{1}{P\left(Z_n=j|C_n=i\right)}\hfill \end{array}$$

  (23)

  Taking the limit from both sides in (23) and using part 1 of the Theorem 4 we obtain

  $$\begin{array}{cc}\hfill & \underset{n\to \infty }{lim}H\left(Z_n|C_n\right)=\hfill \\ \hfill & =\sum _{i=0}^{m-1}P\left(C_n=i\right)·\sum _{j=0}^{k-1}\underset{n\to \infty }{lim}P\left(Z_n=j|C_n=i\right)·\underset{n\to \infty }{lim}{log}_2\frac{1}{P\left(Z_n=j|C_n=i\right)}\hfill \\ \hfill & =\sum _{i=0}^{m-1}P\left(C_n=i\right)·\sum _{j=0}^{k-1}\frac{1}{k}{log}_{2}k={log}_{2}k·\sum _{i=0}^{m-1}P\left(C_n=i\right)={log}_{2}k.\hfill \end{array}$$

  (24)

  Using (22) and( 24) in ( 20) it follows that

  $$\underset{n\to \infty }{lim}I\left(Z_n,C_n\right)=\underset{n\to \infty }{lim}H\left(Z_n\right)-\underset{n\to \infty }{lim}H\left(Z_n|C_n\right)={log}_{2}k-{log}_{2}k=0$$

  (25)

  which proves the statement. □

Theorem 5.

Under the conditions of the Theorem 1 we have

• $\underset{n\to \infty }{\lim }P\left(Z_n=z|A_n=a\right)=\frac{1}{k}$
• $\underset{n\to \infty }{\lim }I\left(Z_n,A_n\right)=0$

where $z,a\in I_k.$

Proof. 

• By the definition of conditional probability it follows that

  $$\begin{array}{cc}\hfill P& \left(Z_n=z|A_n=a\right)=\hfill \\ \hfill & =\frac{P\left(Z_n=z\wedge A_n=a\right)}{P\left(A_n=a\right)}=\frac{P\left(g_n\left(A_n\right)=z\wedge A_n=a\right)}{P\left(A_n=a\right)}\hfill \\ \hfill & =\frac{P\left(\left({\displaystyle \bigcup _{i=1}^{k!}}{g}_n={\Pi }_i\wedge {\Pi }_i\left(A_n\right)=z\right)\wedge A_n=a\right)}{P\left(A_n=a\right)}\hfill \\ \hfill & =\frac{P\left(\left({\displaystyle \bigcup _{i=1}^{k!}}{g}_n={\Pi }_i\wedge {\Pi }_i\left(A_n\right)=z\right)\wedge A_n=a\right)}{P\left(A_n=a\right)}\hfill \\ \hfill & =\frac{P\left({\displaystyle \bigcup _{i=1}^{k!}}\left(\left(\left(g_n={\Pi }_i\wedge {\Pi }_i\left(A_n\right)=z\right)\wedge A_n=a\right)\right)\right)}{P\left(A_n=a\right)}.\hfill \end{array}$$

  (26)

  Because $\left(\left(\left(g_n={\Pi }_i\wedge {\Pi }_i\left(A_n\right)=z\right)\wedge A_n=a\right)\right)$ and $\left(\left(\left(g_n={\Pi }_j\wedge {\Pi }_j\left(A_n\right)=z\right)\wedge A_n=a\right)\right)$ are disjoint events when $i\ne j$ from (26) it follows that

  $$\begin{array}{cc}\hfill P& \left(Z_n=z|A_n=a\right)=\hfill \\ \hfill & =\frac{P\left({\displaystyle \bigcup _{i=1}^{k!}}\left(\left(\left(g_n={\Pi }_i\wedge {\Pi }_i\left(A_n\right)=z\right)\wedge A_n=a\right)\right)\right)}{P\left(A_n=a\right)}\hfill \\ \hfill & =\frac{{\displaystyle \sum _{i=1}^{k!}}P\left(\left(g_n={\Pi }_i\wedge \left({\Pi }_i\left(A_n\right)=z\wedge A_n=a\right)\right)\right)}{P\left(A_n=a\right)}.\hfill \end{array}$$

  (27)

  Using that $P\left(A\wedge B\right)=P\left(A|B\right)·P\left(B\right)$ from (27) it follows that

  $$\begin{array}{cc}\hfill P& \left(Z_n=z|A_n=a\right)=\hfill \\ \hfill & =\frac{{\displaystyle \sum _{i=1}^{k!}}P\left(\left(g_n={\Pi }_i\wedge \left({\Pi }_i\left(A_n\right)=z\wedge A_n=a\right)\right)\right)}{P\left(A_n=a\right)}\hfill \\ \hfill & =\frac{{\displaystyle \sum _{i=1}^{k!}}P\left(g_n={\Pi }_i|\left({\Pi }_i\left(A_n\right)=z\wedge A_n=a\right)\right)·P\left({\Pi }_i\left(a\right)=z\wedge A_n=a\right)}{P\left(A_n=a\right)}\hfill \\ \hfill & =\sum _{i=1}^{k!}P\left(g_n={\Pi }_i|\left({\Pi }_i\left(A_n\right)=z\wedge A_n=a\right)\right)·\frac{P\left({\Pi }_i\left(a\right)=z\wedge A_n=a\right)}{P\left(A_n=a\right)}\hfill \\ \hfill & =\sum _{i=1}^{k!}P\left(g_n={\Pi }_i|\left({\Pi }_i\left(A_n\right)=z\wedge A_n=a\right)\right)·P\left({\Pi }_i\left(A_n\right)=z|A_n=a\right).\hfill \end{array}$$

  (28)

  Because $\left\{g_n={\Pi }_i\right\}$ and $\left\{{\Pi }_i\left(A_n\right)=z\wedge A_n=a\right\}$ are independent random variables from (28) it follows that

  $$\begin{array}{cc}\hfill P& \left(Z_n=z|A_n=a\right)=\hfill \\ \hfill & =\frac{{\displaystyle \sum _{i=1}^{k!}}P\left(\left(g_n={\Pi }_i\wedge \left({\Pi }_i\left(A_n\right)=z\wedge A_n=a\right)\right)\right)}{P\left(A_n=a\right)}\hfill \\ \hfill & =\frac{{\displaystyle \sum _{i=1}^{k!}}P\left(g_n={\Pi }_i|\left({\Pi }_i\left(A_n\right)=z\wedge A_n=a\right)\right)·P\left({\Pi }_i\left(a\right)=z\wedge A_n=a\right)}{P\left(A_n=a\right)}=\hfill \\ \hfill & =\sum _{i=1}^{k!}P\left(g_n={\Pi }_i|\left({\Pi }_i\left(A_n\right)=z\wedge A_n=a\right)\right)·P\left({\Pi }_i\left(A_n\right)=z|A_n=a\right)\hfill \\ \hfill & =\sum _{i=1}^{k!}P\left(g_n={\Pi }_i\right)·P\left({\Pi }_i\left(a\right)=z\right)\hfill \end{array}$$

  (29)

  Taking the limits from the both sides in (29) it follows

  $$\begin{array}{cc}\hfill \underset{n\to \infty }{lim}& P\left(Z_n=z|A_n=a\right)=\hfill \\ \hfill & =\underset{n\to \infty }{lim}{\displaystyle \sum _{i=1}^{k!}}P\left(g_n={\Pi }_i\right)·P\left({\Pi }_i\left(a\right)=z\right)\hfill \\ \hfill & =\sum _{i=1}^{k!}\underset{n\to \infty }{lim}P\left(g_n={\Pi }_i\right)·P\left({\Pi }_i\left(a\right)=z\right)\hfill \\ \hfill & =\sum _{i=1}^{k!}\frac{1}{k!}·P\left({\Pi }_i\left(a\right)=z\right)\hfill \\ \hfill & =\frac{1}{k!}\sum _{i=1}^{k!}P\left({\Pi }_i\left(a\right)=z\right)\hfill \\ \hfill & =\frac{1}{k!}·\left(k-1\right)!=\frac{1}{k}\hfill \end{array}$$
• In the same way as in the Theorem 4 it follows that

  $$\underset{n\to \infty }{lim}H\left(Z_n\right)={log}_{2}k$$

  By the definition of conditional entropy it follows that

  $$\begin{array}{cc}\hfill H\left(Z_n|A_n\right)& =\sum _{i=0}^{k-1}P\left(A_n=i\right)·H\left(Z_n|A_n=i\right)\hfill \\ \hfill & =\sum _{i=0}^{k-1}P\left(A_n=i\right)·\sum _{j=0}^{k-1}P\left(Z_n=j|A_n=i\right){log}_2\frac{1}{P\left(Z_n=j|A_n=i\right)}\hfill \end{array}$$

  (30)

  Taking the limit of both sides in (30) and statement of the part 1 we obtain

  $$\begin{array}{cc}\hfill & \underset{n\to \infty }{lim}H\left(Z_n|A_n\right)=\hfill \\ \hfill & =\sum _{i=0}^{k-1}P\left(A_n=i\right)·\sum _{j=0}^{k-1}\underset{n\to \infty }{lim}P\left(Z_n=j|A_n=i\right)·\underset{n\to \infty }{lim}{log}_2\frac{1}{P\left(Z_n=j|A_n=i\right)}\hfill \\ \hfill & =\sum _{i=0}^{k-1}P\left(A_n=i\right)·\sum _{j=0}^{k-1}\frac{1}{k}{log}_{2}k={log}_{2}k·\sum _{i=0}^{k-1}P\left(A_n=i\right)={log}_{2}k\hfill \end{array}$$

  (31)

  And finally, using the (22) and (31) in the definition for the $I\left(Z_n,A_n\right)$, it follows that

  $$\underset{n\to \infty }{lim}I\left(Z_n,A_n\right)=\underset{n\to \infty }{lim}H\left(Z_n\right)-\underset{n\to \infty }{lim}H\left(Z_n|A_n\right)={log}_{2}k-{log}_{2}k=0$$

  which proves the statement. □

3.3. Periodicity

Every pseudo-random generator can be viewed as a finite automaton with output over the finite set of states and symbols. Because the automaton transition function is deterministic it follows that the output sequence must be periodic. So, ${\left\{A_n\right\}}_{n=1}^{\infty },$ and ${\left\{C_n\right\}}_{n=1}^{\infty }$ are periodic and denote their periods by A and B respectively. It is easy to verify that ${\left\{g_n\right\}}_{n=0}^{\infty },$ and ${\left\{Z_n\right\}}_{n=1}^{\infty }$ are periodic too and denote their periods $G,Z$ respectively. In this part relations between $A,C,G$ and Z are considered and some sufficient conditions under $A,C,GM$ are defined which improves the value of Z. For that we need a few Lemmas.

To find out period of ${\left\{Z_n\right\}}_{n=1}^{\infty }$ we will first determine the period of the ${\left\{g_n\right\}}_{n=0}^{\infty }$.

Lemma 1.

Denote by $l\in \left\{1,2,...,k!\right\}$ the order of the permutation $\prod _{i=1}^C{f}_{C_i}$. Then the period of ${\left\{g_n\right\}}_{n=0}^{\infty }$ is $lC$.

Proof. 

First we have to prove that $lC$ is a period, but it is straightforward.

$$g_{k+\lambda lC}=f_{C_1}\circ f_{C_2}\circ \dots \circ f_{C_{\lambda lC}}\circ f_{C_{1+\lambda lC}}\circ \dots \circ f_{C_{k+\lambda lC}}$$

and because C is period of the ${\left\{C_n\right\}}_{n=1}^{\infty }$ we have

$$\begin{array}{cc}\hfill & f_{C_1}\circ f_{C_2}\circ \dots \circ f_{C_{\lambda lC}}\circ f_{C_{1+\lambda lC}}\circ \dots \circ f_{C_{k+\lambda lC}}=\hfill \\ \hfill & ={\left(f_{C_1}\circ f_{C_2}\circ \dots \circ f_{C_C}\right)}^{\lambda l}\circ f_{C_1}\circ \dots \circ f_{C_k}\hfill \\ \hfill & =f_{C_1}\circ \dots \circ f_{C_k}\hfill \\ \hfill & =g_k\hfill \end{array}$$

Next step is to prove that $lC$ is the fundamental period i.e., that every other period is divisible by $lC$.

Suppose contrary, that $lC$ isn’t the fundamental period i.e., that the fundamental period is $d,d\mid lC$ and $d<lC$. From $g_{k+\lambda d}=g_k$ we have

$$\prod _{i=k+1}^{k+\lambda d}{f}_{C_i}=I,k\in \mathbb{N},k\ge 1$$

(32)

where I is the identical permutation. Multiplying (32) with $f_{C_k}$ from the left we have

$$\prod _{i=k}^{k+\lambda d-1}{f}_{C_i}\circ f_{C_{k+\lambda d}}=f_{C_k}$$

and applying (32) we have

$$f_{C_{k+\lambda d}}=f_{C_k},k\ge 1.$$

From this we have

$$C_{k+\lambda d}=C_{k,}k\ge 1$$

which means that d is a period of ${\left\{C_n\right\}}_{n=1}^{\infty }$ and that $C|d$ i.e., $d=rC,r<l$. Now, look at $g_{1+\lambda d}$

$$\begin{array}{cc}\hfill g_{1+\lambda d}& =\prod _{i=1}^{1+\lambda d}{f}_{C_i}=\prod _{i=1}^{\lambda rC}{f}_{C_i}\circ f_{C_{1+\lambda rC}}=\hfill \\ \hfill & ={\left(\prod _{i=1}^C{f}_{C_i}\right)}^{\lambda r}\circ f_{C_1}=f_{C_1}=g_1\hfill \end{array}$$

and we conclude that

$${\left(\prod _{i=1}^C{f}_{C_i}\right)}^{\lambda r}=I$$

for every $\lambda \ge 1$. Finally we have

$${\left(\prod _{i=1}^C{f}_{C_i}\right)}^r=I$$

and conclude that $l|r$ which is in contradiction with $r<l$ so we proved that $lC$ is the fundamental period of ${\left\{g_n\right\}}_{n=0}^{\infty }$. □

Lemma 2.

Let G be the fundamental period of ${\left\{g_n\right\}}_{n=0}^{\infty }$. If $\left(G,A\right)=1$ and $\left\{A_1,A_2,\dots ,A_n,\dots \right\}=I_k$ then period of ${\left\{Z_n\right\}}_{n=1}^{\infty }$ is $GA.$

Proof. 

By straightforward computation we can easily check that $GA$ is a period of the ${\left\{Z_n\right\}}_{n=1}^{\infty }$. We need only to prove that $GA$ is fundamental period of ${\left\{Z_n\right\}}_{n=1}^{\infty }$.

Suppose that the fundamental period isn’t $GA$ but it is d. Then $d\mid GA$ and because $\left(G,A\right)=1$ we have $d=d_1{d}_2,\left(d_1,d_2\right)=1$ and $d_1|G,d_2|A$.

Further,

$$g_{k+\lambda d}\left(A_{k+\lambda d}\right)=g_k\left(A_k\right)$$

(33)

for every $\lambda \ge 1,\lambda \in \mathbb{N}$. We can set $\lambda ={\lambda }_1·\frac{G}{d_1},{\lambda }_1\ge 1$ in the equation above which transform it to

$$g_{k+{\lambda }_{1}G{d}_2}\left(A_{k+{\lambda }_{1}G{d}_2}\right)=g_k\left(A_k\right)$$

and having in mind that G is a period of ${\left\{g_n\right\}}_{n=0}^{\infty }$ we obtain

$$g_k\left(A_{k+{\lambda }_{1}G{d}_2}\right)=g_k\left(A_k\right).$$

From the fact that $g_k$ is bijection it follows that

$$A_{k+{\lambda }_{1}G{d}_2}=A_k$$

which means that $G{d}_2$ is a period of ${\left\{A_n\right\}}_{n=1}^{\infty }$ and consequently that $A|G{d}_2$. Using that $\left(G,A\right)=1$ we have that $A|d_2$ and with $d_2|A$ we conclude that $A=d_2$. According to former observations we have that d must be of the form $d_{1}A$ and rewriting of (33) yields

$$g_{k+\lambda d_{1}A}\left(A_{k+\lambda d_{1}A}\right)=g_k\left(A_k\right).$$

This equation we can simplify to

$$g_{k+\lambda d_{1}A}\left(A_k\right)=g_k\left(A_k\right)$$

because A is a period of ${\left\{A_n\right\}}_{n=1}^{\infty }.$ Now we put our attention to $g_{k+nG+\lambda d_{1}A}\left(A_{k+nG+\lambda d_{1}A}\right)$.

$$\begin{array}{cc}\hfill g_{k+\lambda d_{1}A}\left(A_{k+nG}\right)& =g_{k+nG+\lambda d_{1}A}\left(A_{k+nG+\lambda d_{1}A}\right)=\hfill \\ \hfill & =g_{k+nG}\left(A_{k+nG}\right)=\hfill \\ \hfill & =g_k\left(A_{k+nG}\right)\hfill \end{array}$$

so we have that functions $g_{k+\lambda d_{1}A},g_k$ are equal on the set $\left\{A_{k+nG}|n\in \mathbb{N}\right\}$. Set $\left\{x|k+nG{\equiv }_{A}x,n\in \mathbb{N}\right\}$ is equal $I_A,$ because $\left(G,A\right)=1,$ and from the periodicity of ${\left\{A_n\right\}}_{n=1}^{\infty }$ follows $\left\{A_{k+nG}|n\in \mathbb{N}\right\}=I_k$. Functions $g_{k+\lambda d_{1}A},g_k$ are equal on their domain so we have that

$$g_{k+\lambda d_{1}A}=g_k,\lambda \ge 1,\lambda \in \mathbb{N}$$

which means that $d_{1}A$ is a period of the ${\left\{g_n\right\}}_{n=0}^{\infty }$. In the same way as above we have that $d_1=G$ and we have that the fundamental period of the ${\left\{Z_n\right\}}_{n=1}^{\infty }$ is $GA$. □

Following Corollary is a trivial consequence of the Lemma 2.

Corollary 1.

If $\left(G,A\right)=1$ then the period of the ${\left\{Z_n\right\}}_{n=1}^{\infty }$ is greater or equal to A.

This corollary shows that with suitably chosen pseudo-random sequence ${\left\{A_n\right\}}_{n=1}^{\infty }$ output sequence will have the period greater or equal to period of the ${\left\{A_n\right\}}_{n=1}^{\infty }.$

The next theorem, the main result of this paragraph, is a straightforward application of the former Lemmas.

Theorem 6.

Let $l\in \left\{1,2,...,k!\right\}$ denote the order of the permutation $\prod _{i=1}^C{f}_{C_i}$. Then if $\left(lC,A\right)=1$ and $\left\{A_1,A_2,\dots ,A_n,\dots \right\}=I_k,$ the period of ${\left\{Z_n\right\}}_{n=1}^{\infty }$ is $lCA.$

A statement of this theorem is a stronger variant of the Corollary 1 and it shows that with appropriately selected pseudo-random sequences ${\left\{A_n\right\}}_{n=1}^{\infty }$ and ${\left\{B_n\right\}}_{n=1}^{\infty }$ period of the generator output sequence is significantly longer then period sequences ${\left\{A_n\right\}}_{n=1}^{\infty }$ and ${\left\{B_n\right\}}_{n=1}^{\infty }$.

4. Conclusions

Confidentiality of different sensor networks is a very serious requirement since such networks cannot fully achieve their purpose without having the necessary security. Namely, for various IoT applications, which typically have limited processing capabilities, restricted memory capacity and power constraints, one of the key challenges is to design an efficient and reliable cryptographic generator that meets the desired security requirements. In this paper, we defined a pseudo-random generator that can, in some way, be considered as a generalization of ideas related to RC4 because it uses time varying permutations and sequences for permutation changing and addressing output element from the current permutation are considered in a general fashion. In the paper, we analyze properties of the purposed generator. The proposed pseudo-random generator can be implemented efficiently in software and hardware, for example by using output of the multiple linear shift registers as input sequences ${\left\{A_n\right\}}_{n=1}^{\infty },$ and ${\left\{C_n\right\}}_{n=1}^{\infty }$ of the generator. The security characteristics considered in the paper potentiate application of the generator in the computational constrained environments security solutions.

In the first part of the proposed generator properties analysis, the generator output sequence probability distribution is considered. Theorem 1 establishes sufficient conditions for the generator output sequence have an asymptotically uniform probability distribution. Moreover, sufficient conditions are established for the distribution of the output sequence to have the exact uniform distribution, Remark 1 and Theorem 2. The generator output sequence uniform distribution indicates resistance of the generator to attacks based on output sequence elements prediction.

The second part of the generator analysis deala with the correlation properties of the generator output sequence in which it was shown, by Theorem 3, that the output sequence elements are asymptotically independent and accordingly no immanent remote correlations are detected, unlike to the RC4 generator (see [25]). This property indicates resistance to autocorrelation type atacks.

The third part of the analysis relates to the possibility of information leaking about the internal state of the generator, sequence ${\left\{A_n\right\}}_{n=1}^{\infty }$ and ${\left\{C_n\right\}}_{n=1}^{\infty }$, through the output sequence ${\left\{Z_n\right\}}_{n=1}^{\infty }$. Theorems 4 and 5 show that the amount of information that flows through an output sequence tends to zero when the length of the sequence tends to infinity. In practical terms, this means that, by rejecting the initial segment of a generated sequence of a given length, the amount of information about the state of the generator flowing into the output sequence is arbitrarily small.

In the last part of the generator analysis, the period length of the output sequence is analyzed. It has been shown that if sequences ${\left\{A_n\right\}}_{n=1}^{\infty }$ and ${\left\{C_n\right\}}_{n=1}^{\infty }$ are chosen in a suitable manner and their periods satisfy the conditions of Theorem 6, the output sequence has a significantly longer period than the sequences ${\left\{A_n\right\}}_{n=1}^{\infty }$ and ${\left\{C_n\right\}}_{n=1}^{\infty }$.

According to the performed analysis results proposed generator has provably good security characteristics.

Complexity and implementation considerations about this proposal are determined by the generation and complexity of the sequences ${\left\{C_n\right\}}_{n=1}^{\infty }$ and ${\left\{A_n\right\}}_{n=1}^{\infty }.$ Relatively weak constraints demanded for the probability distribution for the sequences ${\left\{C_n\right\}}_{n=1}^{\infty }$ and ${\left\{A_n\right\}}_{n=1}^{\infty }$ in the Theorem 1 allow implementation of the efficiently generated sequences, for example sequences generated by the multiple linear feedback shift registers.

The method described in this paper makes it possible to obtain a pseudo-random sequence with asymptotically uniform distribution and longer period using two pseudo-random sequences with irregular (non-uniform) probability distributions. Required initial conditions for two pseudo-random sequences are not serious limitations for this method because they describe natural requirements for the pseudo-random sequences, i.e., that values of their elements exhaust the set on which they are defined. An interesting question arising in this context is the speed of convergence in the Theorem 1, i.e., the number of steps after which we can use the sequence ${\left\{Z_n\right\}}_{n=1}^{\infty }$ as uniformly distributed. It is not possible to answer this question generally because the matrix T is defined by the chosen set S and probability distribution of the random variable C. Consequently, for each set S and random variable C it has to be analyzed separately. In practice, this does not make any restrictions on the application of the proposed generator because in every concrete case it is possible to compute number of transition steps to achieve representation of the limit values by the desired accuracy.