Analysis and Guidelines for Different Designs of Pseudo Random Number Generators

The design of an efficient Pseudo Random Number Generator (PRNG) with good randomness properties is an important research topic because it is a core component in many applications. Based on an extensive study of most PRNGs in the past few decades, this paper categorizes six distinct design scenarios under two primary groups: non-chaotic and chaotic generators. The non-chaotic group comprises Linear Feedback Shift Registers (LFSR) with S-Boxes, primitive roots, and elliptic curves, whereas the chaotic group encompasses discrete, continuous, and fractional-order chaotic generators. This paper delves into the related scientific summaries, equations, flowcharts, and designs with necessary recommendations for each PRNG scenario. Even though the focus is on the basic design characteristics that provide simple, functional and secure PRNGs, it is possible to enhance those designs for additional features and improved efficiency. Simulation outcomes and system key configurations, which produce long random sequences, are also presented and evaluated using leading criteria. The evaluation criteria include the National Institute of Standards and Technology (NIST) SP-800-22 test suite, TestU01 randomness tests, histogram, entropy, autocorrelation, and cross-correlation. Furthermore, key space, key sensitivity, and bit rate indicate that all designed examples meet international standards with high quality. The presented PRNGs are compared and integrated into an image encryption system. Although each PRNG design scenario can have a different key space, simple designs with fixed-length system keys are chosen for the sake of proper comparisons. Statistical and security assessments of the encryption system demonstrate that the PRNGs are cryptographically secure.

SECTION I. Introduction

Random number generators fall into two main categories, True Random Number Generators (TRNGs) and Pseudo Random Number Generators (PRNGs). TRNGs derive randomness from physical processes, such as electronic noise and radioactive decay, or sources in the real world such as atmospheric noise. TRNGs are completely random because they inherit the unpredictability from physical phenomena, but they can be slower and more expensive to implement than PRNGs [1]. On the other hand, a PRNG is an algorithm that uses mathematical formulas to generate a sequence of bits/numbers whose properties approximate the properties of sequences of random bits/numbers. PRNGs use a seed value to initialize the mathematical formulas and generate sequences of numbers that appear random. Although PRNGs are deterministic, they simulate randomness through the use of complex algorithms that can produce long sequences of numbers.

As shown in Fig. 1, PRNGs are widely utilized in many applications such as game development, cryptography, computer simulations and modeling, statistical analysis, internet, artificial intelligence, machine learning, and graphics. For example, randomness is a core element in games of chance such as casino games, where it ensures that game outcomes are unpredictable and fair [1].

FIGURE 1.

Applications of PRNGs in different fields.

Random numbers are also used in key generation, which is a critical and essential element of any cryptographic application. For instance, a hash function is designed by utilizing a 2D chaotic map and using the generated random sequences as keys to the hash function for authentication purpose [2]. Furthermore, computer simulations, such as Monte Carlo techniques, rely mostly on repeated random sampling to generate numerical results [3]. In statistics, generating random samples is essential in creating different statistical distributions that can be used to analyze different problems. Random numbers can also be used in generating initial passwords for websites, and random walks on complex networks improve the process of selecting network weights for optimal performance [4]. In computer graphics, crowd simulation is based on random distribution to maintain realistic scenes [5].

Common randomness evaluation criteria, which are applied in the literature for assessing the quality of a PRNG, are given in Table 1. Each of those tests is designed to measure different aspects of randomness in the generated bitstream. Evaluation criteria that are used in assessing the quality of encrypted images are also given in Table 1. The table briefly describes each test and provides any mathematical equations used in calculating it [6], [7], [8]. A PRNG can exist as a software or hardware module depending on the used source of randomness and the required application. In the hardware case, the bit rate is generally much higher than the software counterpart. In either case, the design of a PRNG can be categorized into two main categories as shown in Fig. 2, namely non-chaos-based and chaos-based. In the non-chaos-based category, different randomness sources can be used such as Liner Feedback Shift Register (LFSR), elliptic curves, fractals, and much more.

TABLE 1 Evaluation Criteria Used in Assessing Random Bitstreams and Encrypted Images

FIGURE 2.

PRNGs design categories.

In the chaos-based category, discrete maps, continuous systems, and fractional-order systems are used. Discrete maps are a common choice for researchers as they are simple and efficient. For example, the logistic map has been enhanced, as proposed in [9] and [10], and combined with other maps like the Tent map [11], Sine map [12], and Chebyshev map to achieve better randomness quality and to increase the key space as reported in [13]. On the other hand, continuous systems generally offer larger key space as compared to discrete maps because of the larger number of control parameters as in [14]. In addition, each system state can produce several random numbers simultaneously [15], [16].

Those advantages over discrete maps can, however, affect the performance and system complexity. Finally, some designs combine non-chaotic generators with chaotic generators to balance the performance, complexity, and key space [17], [18]. In hardware scenarios, a common modern approach for PRNG is through the realization of the numerical solution used in solving the chaotic system. For example, combining both analog and digital design for chaotic generator [19] and PRNG based on discrete chaos [20]. Table 2 summarizes recently proposed PRNG designs with respect to their category, source of randomness, key space and bit rate, if provided. The table also shows whether key sensitivity tests, different randomness evaluation criteria, and image encryption applications are considered or not.

TABLE 2 Recently Proposed PRNG Designs and Their Used Evaluation Criteria

The objective of this paper is to investigate six different scenarios for designing PRNGs by providing basic definitions, simple flowcharts, design procedures, and some recommendations based on literature survey. The analysis includes the most common evaluation criteria that exist in recent literature such as NIST SP-800-22, TestU01 randomness tests, histogram, entropy, autocorrelation, and cross-correlation. In addition, key space, key sensitivity, key expansion, and algorithm complexity are studied for further assessment of the six PRNGs. Finally, the six PRNGs are utilized in an image encryption application to validate their use in cryptographic applications.

The remainder of this paper is organized as follows. Section II describes the six different PRNGs, which are based on chaotic and non-chaotic generators. Section III provides different security analyses for the six generators and compares them from the security and efficiency points of view. Section IV introduces and analyzes an image encryption application that utilizes the six PRNGs. Finally, the conclusions are given in Section V.

SECTION II. Six Different PRNG Designs

The two design categories of PRNGs, non-chaos-based and chaos-based, are studied and discussed in this section. In the first design category, PRNGs based on LFSR and S-Box (LS), Primitive Roots (PR), and Elliptic Curve (EC) are considered. In the second category, PRNGs based on Discrete Chaos (DC), Continuous Chaos (CC), and Fractional Chaos (FC) are considered. The design objective is to provide simple and functional PRNGs that enable valid comparisons. Although those designs pass the required statistical and sensitivity tests, they can be enhanced for improved statistical results and performance. The main flowcharts for the six PRNGs are shown in Fig. 3, which will be explained and discussed in the following subsections.

FIGURE 3.

Flowcharts for the six PRNGs: (a) LS, (b) PR, (c) EC, (d) DC, (e) CC, and (f) FC.

A. PRNG Based on LFSR and S-Box (LS)

An N-bit LFSR is a sequence of N shift registers connected in series with a feedback function. This function determines the period of the LFSR, where the outputs from some selected registers are XORed to define the feedback polynomial. When the polynomial is primitive, the period of the LFSR achieves its maximum value $2^{N}-1$ . It is important to seed the LFSR with a non-zero value for proper operation [36]. For example, the feedback polynomial $x^{32}+x^{7}+x^{6}+x^{2}+1$ is a primitive polynomial for the 32-bit LFSR shown in Fig. 4(a). Table 3 shows some examples of primitive polynomials that achieve maximum period.

TABLE 3 Examples of Primitive Polynomials for a 32-bit LFSR

FIGURE 4.

(a) A 32-bit LFSR with feedback polynomial $x^{32}+x^{7}+x^{6}+x^{2}+1$ , (b) proposed PRNG, and (c) random behavior of the PRNG output.

Figure 4(b) shows a proposed new design of a PRNG, which uses three 32-bit LFSRs and 4 S-Boxes. The feedback polynomials for the three LFSRs are chosen as the first three polynomials in Table 3. The flowchart of the PRNG is shown in Fig. 3(a), where four 8-bit values $S_{1},S_{2}$ , $S_{3}$ , and $S_{4}$ are first used to dynamically generate four S-Boxes according to the Generate_SBox function described in [37]. The three LFSRs are initialized with three different 32-bit seeds, and three values ${Rd}_{1},{Rd}_{2}$ , and ${Rd}_{3}$ are initialized to zeros. Then, the three LFSRs are simultaneously clocked using the Next_Clock function to produce three new 32-bit values. The three new values of A, B, and C are XORed to generate one 32-bit value, D. Afterwards, each consecutive 8-bit numbers ($D_{1},D_{2}$ , $D_{3}$ , and $D_{4}$ ) are confused using the four S-Boxes to produce $V_{1},V_{2}$ , $V_{3}$ , and $V_{4}$ . Then, each of $V_{1},V_{2}$ , and $V_{3}$ are XORed with $V_{4}$ and ${Rd}_{3}$ , ${Rd}_{1}$ , and ${Rd}_{2}$ , respectively to produce three random 8-bit values $R_{1},R_{2}$ , and $R_{3}$ . Finally, ${Rd}_{1},{Rd}_{2}$ , and ${Rd}_{3}$ are set to $R_{1},R_{2}$ , and $R_{3}$ , respectively, and the resulting 24-bit random value is the concatenation of those three 8-bit values. The process continues by clocking the PRNG to produce new values.

The Generate_SBox algorithm used to generate the $8\times 8$ S-Box is based on an 8-bit LFSR with a feedback polynomial $x^{8}+x^{6}+x^{5}+x^{4}+1$ . This algorithm is capable of generating 255 different S-Boxes depending on the initial seed of the 8-bit LFSR. The $8\times 8$ S-Box is implemented as a $16\times 16$ matrix, where each element of the matrix contains one of the different states that the LFSR can take and the last element in the matrix is set to zero. The operation of the S-Box is simple, where the 4 least and most significant bits of the input value are used to select the row and column of the $16\times 16$ matrix, respectively, and the output of the S-Box is the element at this location.

While there are so many PRNG designs based on LFSR, the design shown in Fig. 4(b) represents one simple design. For instance, a PRNG has recently been designed through carefully selecting two LFSRs and XOR gates to improve the length of the generated bit sequences by a factor of 200X as compared to the single LFSR-based design [38]. Moreover, area efficient stochastic number generators are designed through sharing the output of the LFSR with two comparators to achieve a minimal area hardware overhead [39]. A staggered LFSR is also proposed, where a subordinate LFSR determines the number of feedback polynomial applications for the main LFSR to enhance the randomness of the generated bit sequence [40].

During the design process of the LS PRNG, the key sensitivity tests are performed by modifying one bit in one of the seed values used in generating the S-Boxes. If the delay element is not available, only one S-Box is changed and the results of the correlation tests are not good. By adding the delay element, the change is propagated from one iteration to the next iteration resulting in a completely different bitstream.

Because LFSRs are predictable and cannot be used alone in generating secure PRNGs, combining more than one LFSR is necessary for adding security to the produced bitstream. Furthermore, utilizing S-Boxes helps in making the bitstream random and enables passing the NIST SP-800-22 and TestU01 randomness tests. Finally, enhancing the key sensitivity is achieved by adding a delay element. Figure 4(c) shows the output values $R_{1},R_{2}$ , and $R_{3}$ for the first 20 iterations, and they are independent.

Therefore, the main design guidelines are summarized as follows:

• Combining two or more LFSRs enhances security and increases the key space.

• Incorporating a non-linear element, such as S-Box, adds and extra level of security.

• Adding a delay element enhances the key sensitivity.

B. PRNG Based on Primitive Roots (PR)

In number theory, g is said to be a primitive root for p if every integer that is non-zero $mod~p$ is congruent to a power of $g ~mod~p$ [41]. For example, if $g=3$ and $p=7$ , it can be easily shown that every power of $3 ~mod~7$ is unique, hence 3 is a primitive root for 7. On the other hand, if $g=2$ , then it is clear that $2^{1}~mod ~7= 2$ and $2^{4}~mod ~7=2$ , therefore 2 is not a primitive root for 7. Another useful property is that knowing one primitive root for p can help in finding all remaining primitive roots of p. If p is selected to be a prime, then there is $\Phi (p-1)$ primitive roots. The Euler function $\Phi (n)$ equals the number of integers j with $1\le j\le n$ such that $gcd\left ({{ j, n }}\right)=1$ , where $gcd$ is the greatest common divisor [41]. Hence, there is a large number of primitive roots that can be found for a large prime p.

Recently, a PRNG has been designed based on a prime number and its primitive roots [42]. A modified version of this PRNG is proposed in this section to increase the number of bits per iteration from 8 bits to 24 bits. Figure 3(b) shows the flowchart of the modified PRNG, which utilizes a prime number (p) and m of its primitive roots ($r_{1},r_{2}, \ldots.,r_{m}$ ). The number of selected primitive roots, m, should be a multiple of 3 so that the number of iterations required to scan all roots in groups of three is $L=m/3$ . The process starts by initializing the power counter i and the three values ${Rd}_{1},{Rd}_{2}$ , and ${Rd}_{3}$ to zeros. Then, i is incremented by 1, the primitive roots counter (k) is set to zero, and the condition $k\lt L$ is evaluated. If the condition is true, three new 8-bit values $R_{1},R_{2}$ , and $R_{3}$ are calculated from three consecutive roots $r_{3k+1}$ , $r_{3k+2}$ , and $r_{3k+3}$ , respectively.

Each root is raised to the $i^{th}$ power, the result is reduced $mod~p$ , the result is further reduced by $mod~2^{8}$ , and the three produced values are XORed with ${Rd}_{3},{Rd}_{1}$ , and ${Rd}_{2}$ , respectively. Finally, ${Rd}_{1},{Rd}_{2}$ , and ${Rd}_{3}$ are set to $R_{1}, R_{2}$ , and $R_{3}$ , respectively, and the resulting 24-bit random value is the concatenation of those three 8-bit values. The process continues by incrementing k by 1, then testing the condition $k\lt L$ , and so on. If the condition $k\lt L$ is false, k is reset to zero and i is incremented by 1. It should be noted that a delay is introduced in the XOR operation to pass the key sensitivity tests, similar to what is performed in the LS PRNG.

Figure 5(a) shows the generated values of $R_{1},R_{2}$ , and $R_{3}$ for the first 20 iterations and they are random. The main motivation behind this design is to exploit the special property of uniqueness found in primitive roots when raised to different powers and then reduced modp. Figure 5(b) demonstrates the uniqueness property using the prime number $p=23$ and three of its primitive roots (7, 10, and 20).

FIGURE 5.

(a) Values of $R_{1},R_{2}$ , and $R_{3}$ for the first 20 iterations, and (b) powers of primitive roots are unique $mod~p$ (7, 10, and 20 are primitive roots for the prime number 23).

Hence, the main design guidelines are summarized as follows:

• The special property of uniqueness found in primitive roots can be exploited.

• Adding a delay element enhances the key sensitivity.

C. PRNG Based on Elliptic Curve (EC)

An elliptic curve equation takes the form $y^{2}=x^{3}+Ax+B$ , where A and B are constants, $4A^{3}+27B^{2}\ne ~0$ . In cryptography, elliptic curves are usually defined over a field p, where p is a large prime number, forming an additive abelian group. The point at infinity $\mathcal {O}$ is defined to be the identity element of the group and the group operations are point addition and multiplication [43]. Figure 6(a) shows the geometric interpretation for point addition as described by ${P_{3}=P}_{1}+P_{2}=(x_{3},y_{3})$ as follows: $$\begin{align*} & P_{3} = \\ & \begin{cases} \displaystyle \left ({{m_{1}^{2}-x_{1}-x_{2}, m_{1}\left ({{x_{1}-x_{3}}}\right)-y_{1}}}\right), & x_{1} \neq x_{2} \\ \displaystyle \left ({{m_{2}^{2}-2 x_{1}, m_{2}\left ({{x_{1}-x_{3}}}\right)-y_{1}}}\right), & P_{1}=P_{2}, y_{1} \neq 0 \\ \displaystyle \mathcal {O}, & x_{1}=x_{2}, y_{1} \neq y_{2} \\ \displaystyle \mathcal {O}, & P_{1}=P_{2}, y_{1}=0 \\ \displaystyle P_{1}, & P_{2}=\mathcal {O} \\ \displaystyle P_{2}, & P_{1}=\mathcal {O} \end{cases} \tag {1}\end{align*}$$ where $P_{1}=\left ({{ x_{1},y_{1} }}\right)$ , $P_{2}=(x_{2},y_{2})$ , $m_{1}=\frac {y_{2}-y_{1}}{x_{2}-x_{1}}$ , and ${m}_{2}=\frac {3x_{1}^{2}+A}{2y_{1}}$ . In general, a generator point G is defined to generate all the point on the curve. If the points of the elliptic curve form more than one group, each group should have its generator point. Figure 6(b) shows an example of a generator point $G=P_{1}=(4, 4)$ , highlighted in yellow, for the elliptic curve $y^{2}=x^{3}+2x+2~mod~19$ . All of the curve points can be calculated from $P_{1}$ . For example, the point $P_{2}=2P_{1}=(18, 13)$ is highlighted in yellow, and in general $P_{n}=nP_{1}$ .

FIGURE 6.

(a) Elliptic curve example and the first two cases for point addition, and (b) elliptic curve points example.

Although ECs are commonly used in cryptography, they are also utilized in PRNGs. Several EC-based PRNGs are introduced where the points of the EC are the source of random bits. Two design categories are generally used, namely iterative designs such as [44] and [45] and non-iterative designs such as [46] and [47]. Since EC points can be subjected to cryptanalysis as pointed out in [48], it is not recommended to use all the bits from each coordinate. Moreover, higher bits are not chaotic enough and using them reduces the entropy in the bitstream.

Recently, a PRNG design based on elliptic curves has been proposed [22], where the process of generating random numbers is shown in Fig. 3(c). After reading the parameter K and the curve generator point G, the process starts by calculating the base point $P_{0}=kG$ and initializing the points counter $n= 0$ . Then, a new point $P_{n+1}$ is produced by adding the base point $P_{0}$ to the previous point $P_{n}$ . Afterwards, the x-coordinate and y-coordinate of the point $P_{n+1}=(x,y)$ are reduced $mod~2^{96}$ , and a mixing process is performed using the Mix function defined in [22] to shuffle the bits of x and y forming a sequence of 192 random bits. In this Mix function, the final bit sequence is formed by joining each consecutive 24 bits from x and y until all of the 96 bits from each of x and y are used. The process continues by incrementing n by 1 and calculating a new point on the curve.

Curve-192 is selected from the NIST list of recommended secure curves [49], where its prime modulus p is 192 bits and the base point G has 189 bits and 187 bits in the x and y coordinates, respectively. In this design approach, it is important not to extract too many bits from the elliptic curve points because the lower significant bits are more chaotic than the higher significant bits. For instance, different values of the extracted number of bits were investigated during the design process of the EC PRNG. When more than 96 bits were extracted from any point coordinate to increase the bit rate, the produced bitstream did not pass the NIST test.

It is also recommended to use a large prime number p and to carefully select the elliptic curve parameters such that the generator point of the curve forms a large group containing most of the curve points. For example, the curve $y^{2}=x^{3}-5x+3~mod~{149}$ forms 11 subgroups. The point $(1, 44)$ generates the largest subgroup with a total of 150 points, and the point $(2, 1)$ generates a subgroup of only 75 points. Hence, this curve is not secure because the number of points in the largest subgroup is very small.

Therefore, the main design guidelines are summarized as follows:

• A large prime number p should be chosen.

• Elliptic curve parameters should be carefully selected.

• It is not recommended to extract too many bits from the elliptic curve points.

D. PRNG Based on Discrete Chaos (DC)

Discrete maps are extensively utilized in PRNGs because of their simplicity and ease of implementation. Recently, several designs based on hyperchaotic systems are proposed such as the 3D discrete hyperchaotic system [50], a combination of the 2D Logistic map and Duffing map [51], and the 2D sine-cosine-logistic coupling [52]. In addition to those different design options, a simple and secure design is proposed using a modified logistic map.

The logistic map is well-known and studied in chaos theory, where it exhibits chaotic behavior for certain parameter values. This property makes it a candidate for use in cryptography as a source of randomness, and many research work has modified the logistic map to enhance its chaotic behavior and to introduce more controlling parameters [53], [54]. The positive logistic map is defined as: $$\begin{equation*} x_{n+1}=\lambda x_{n}\left ({{ a-bx_{n} }}\right), \tag {2}\end{equation*}$$ where $\lambda$ is the map parameter, a and b are the newly added parameters [54].

The process of generating random bytes, as shown in Fig. 3(d), starts by reading the map parameters and initial value, $\lambda$ , a, b and $x_{0}$ . After calculating $x_{n+1}$ from the map, it is scaled by ${10}^{12}$ to ensure randomness, the result is converted into an integer using the floor operation $\left \lfloor {{\cdot }}\right \rfloor$ , and reduced $mod~2^{24}$ to generate a 24-bit random value, R. Finally, three new random 8-bit values $R_{1},R_{2}$ , and $R_{3}$ are calculated where $R_{1}$ is the least significant 8 bits, $R_{2}$ is the middle significant 8 bits, and $R_{3}$ is the most significant 8 bits. The process continues by incrementing n by 1, and a new point is calculated from the map.

To elaborate the benefits of adding more control parameters, consider the original logistic map with one parameter ($\lambda$ ) and one initial condition ($x_{0}$ ). Assuming 32 bits for each parameter, the driving key length equals 64 bits. This length is insecure and can be attacked using brute-force attacks. On the other hand, the positive logistic map has three controlling parameters ($\lambda$ , a, b) and one initial condition ($x_{0}$ ). Assuming 32 bits for each parameter, the driving key length is 128 bits that can resist brute-force attacks. Therefore, the new controlling parameters enhance the security of the driving key for the logistic map.

The dynamics of the positive logistic map are explored in Fig. 7, where the map parameters are selected as $\lambda = 8/3$ , $a=1.5$ , $b=1.875$ , and $x_{0}=0.5$ . The cobweb diagram of Fig. 7(a) demonstrates the chaotic behavior of the map, whereas Fig. 7(b) shows the values of the map in the first 25 iterations. Because the maximum Lyapunov exponent of Fig. 7(c) has positive values, the positive logistic map with the two newly added parameters can exhibit chaotic behavior. Regarding the choice of the map parameters, if the parameters are selected as $\lambda = 3$ , $a=1$ , $b=1$ , and $x_{0}=0.5$ , the map will not exhibit chaotic behavior and it will oscillate between two points. Hence, the attractor can not be utilized in random number generation.

FIGURE 7.

(a) Cobweb diagram, (b) the first 25 iterations, and (c) maximum Lyapunov exponent of the positive logistic map.

Therefore, the main design guidelines are summarized as follows:

• Adding extra controlling parameters to the map enhances the key space.

• The choice of the map parameter values must ensure the chaotic behavior of the map.

E. PRNG Based on Continuous Chaos (CC)

In general, continuous systems have more parameters and system states than discrete maps. Those system states can serve as independent sources of randomness. Hence, many research efforts are based on continuous systems such as [55] and [56]. As an example for the different design options available in this category, the Lorenz system is utilized in PRNG using a simple and secure design.

The Lorenz system is a system of ordinary differential equations, which possesses chaos at certain system parameters. While being chaotic, the system state never repeats, and the dynamics of the system is sensitive to any change in the initial condition.

The Lorenz system is given by: $$\begin{align*} \frac {dx}{dt}& =\sigma \left ({{ x-y }}\right), \tag {3a}\\ \frac {dy}{dt}& =x\left ({{ \rho -z }}\right)-y, \tag {3b}\\ \frac {dz}{dt}& =xy-\beta z, \tag {3c}\end{align*}$$ where $\sigma, \rho$ , and $\beta$ are the system parameters. This system can be solved using many numerical methods, where the Euler approximation method is used in this work. The Lorenz system is utilized in designing a PRNG as shown in Fig. 3(e). The process of generating random bytes starts by reading the system parameter $\beta$ and the initial conditions $x_{0}$ , $y_{0}$ , and $z_{0}$ . The remaining system parameters $\sigma$ and $\rho$ are initialized to 10 and 28, respectively, the iteration step $h= 0.01$ , and the points counter $n=0$ . Then, the system is iterated to generate a new state $x_{n+1}$ , $y_{n+1}$ , and $z_{n+1}$ . Three new 8-bit values $R_{1},R_{2}$ , and $R_{3}$ are calculated from $x_{n+1}$ , $y_{n+1}$ , and $z_{n+1}$ , respectively, such that each state is scaled by a factor of ${10}^{12}$ and the result is converted to an integer followed by reduction $mod~2^{8}$ . The process continues by incrementing n by 1, and a new state is calculated from the system.

While Fig. 8(a) shows the generated random values for the first 20 iterations, Figs. 8(b) and 8(c) explore the dynamics of the Lorenz system where the system parameters are selected as $\sigma = 10$ , $\rho = 28$ , $\beta = 8/3$ , $x_{0}=0.1$ , $y_{0}=1$ , and $z_{0}=10$ . In Fig. 8(b), the Lorenz attractor in the X-Z plane shows that the system state does not repeat, whereas Fig. 8(c) shows the maximum Lyapunov exponent with positive values ensuring the chaotic behavior of the system. The Lorenz system contains many controlling parameters that help in expanding the key space driving the system. It is important to select the system parameters such that the system is chaotic. For example, if the parameters are selected as $\sigma = 10$ , $\rho = 13$ , $\beta = 8/3$ , the system becomes stable and converges to a fixed point. Hence, the attractor cannot be used in random number generation. Finally, to increase the bit rate, the 3 states are used to extract 24 bits per iteration; 8 bits from each state. Selecting only one state would reduce the bit rate by a factor of one third.

FIGURE 8.

(a) Values of $R_{1},R_{2}$ , and $R_{3}$ for the first 20 iterations, (b) strange attractor X-Z plane, and (c) maximum Lyapunov exponent of the Lorenz system.

Therefore, the main design guidelines are summarized as follows:

• Many system parameters should be selected to increase the key space.

• The choice of the system parameter values must ensure chaotic behavior.

• All system states should be utilized in the generation process to increase the bit rate.

F. PRNG Based on Fractional Chaos (FC)

As an extension to continuous systems, fractional-order systems add more system parameters by introducing the fractional-order powers. However, these extra options can have a negative effect on the system complexity and performance. Similar to continuous systems, one of the different design options available in this design category is proposed.

The fractional-order Lorenz system is introduced by applying fractional-order derivatives for the three differential equations given by: $$\begin{align*} \frac {d^{\alpha }x}{{dt}^{\alpha }}& = -10\left ({{ y-x }}\right), \tag {4a}\\ \frac {d^{\beta }y}{{dt}^{\beta }} & = -xz+\left ({{ 24-4~c }}\right)x+cy, \tag {4b}\\ \frac {d^{\gamma }z}{{dt}^{\gamma }}& =xy-\frac {8}{3}z, \tag {4c}\end{align*}$$ where c is a parameter and $\alpha, \beta$ , and $\gamma$ are positive real values that represent fractional orders. The fractional-order derivatives $\alpha, \beta$ , and $\gamma$ increase the system controlling parameters. This system can be solved using the Adams-Bashforth-Moulton predictor-corrector scheme [57]. The range of those added parameters that make the system exhibit chaos is studied in [58].

Recently, the fractional-order Lorenz system has been utilized in PRNG [27]. The process of generating random bytes is shown in Fig. 3(f), and it is similar to the corresponding process of the integer-order Lorenz system where the system parameter $\alpha$ and the initial conditions $x_{0}$ , $y_{0}$ , and $z_{0}$ are calculated from the system ke. Then, the remaining system parameters $\beta$ and $\gamma$ are both initialized to 1, $c= 4$ , the iteration step $h= 0.005$ , and the points counter $n=0$ . The system is solved to generate a new state $x_{n+1}$ , $y_{n+1}$ , and $z_{n+1}$ . Three new 8-bit values $R_{1},R_{2}$ , and $R_{3}$ are calculated from $x_{n+1}$ , $y_{n+1}$ , and $z_{n+1}$ , respectively, such that each state is scaled by a factor of ${10}^{12}$ and the result is converted to an integer followed by reduction $mod~2^{8}$ . The process continues by incrementing n by 1, and a new state is calculated from the system. While Fig. 9(a) shows the generated random values for the first 20 iterations, Figs. 9(b) and 9(c) explore the strange attractor in the X-Z plane for $\alpha = 0.8$ and $\alpha = 0.95$ , respectively. The system parameters are selected as $\beta = 1$ , $\gamma = 1$ , $C=4$ , $x_{0}=-8.3458$ , $y_{0}=-10.6753$ , and $z_{0}=12.3088$ .

FIGURE 9.

(a) Values of $R_{1},R_{2}$ , and $R_{3}$ for the first 20 iterations, and strange attractor in the X-Z plane for (b) $\alpha = 0.8$ , and (c) $\alpha = 0.95$ in the fractional-order Lorenz system.

The fractional-order Lorenz system adds three extra controlling parameters over the integer-order Lorenz system, which helps in expanding the key space driving the system. Those extra parameters come at the cost of reduced performance because the system state at iteration N is obtained by solving the system for the previous (N – 1) states. Hence, it is recommended to calculate a small number of states and then restart the system from the last reached state.

The effect of using different values of N on the system performance is investigated. The system is tested for different values of N, after which the system is restarted using the last state. The results show that doubling the value of N reduces the bit rate by a factor of 0.5. Accordingly, restarting the system after a selected number of iterations improves the performance and increases the bit rate.

Similar to the integer-order Lorenz system, it is important to select the system parameters such that the system is chaotic. For example, by selecting the system parameters as $\alpha = 0.7$ , $\beta = 1$ , $\gamma = 1$ , $C=4$ , the system becomes stable and converge to a stable point. Finally, all system states should be used to increase the bit rate as previously explained for the CC PRNG.

Therefore, the main design guidelines are summarized as follows:

• Many system parameters should be selected to increase the key space.

• The choice of the system parameter values must ensure chaotic behavior.

• The three states should be utilized in the generation process to increase the bit rate.

• Restart the system after a limited number of iterations (e.g., 100 iterations) to enhance the performance.

SECTION III. PRNG Results and Discussion

Four test groups, namely statistical tests, correlation tests, key sensitivity, and algorithm complexity, are applied to each PRNG and the results are explained and discussed. In addition, the potential for expanding the key for each PRNG design is investigated. The six PRNGs are then compared based on the security tests, algorithm performance, and key expansion. As shown in Table 4, the system key consists of the system parameters and initial conditions. For a fair comparison, a system key of length 128 bits is utilized in all PRNGs. Since PR is the only system that has dependent parameters (i.e., a prime number and some of its primitive roots), its key is carefully constructed to satisfy this relation. Afterwards, all other systems can safely operate using the same key whose value is “9086A797951D9751A32BB8E9CE8ED264” in hexadecimal.

TABLE 4 System Keys for the Six PRNGs; Each With 128 Bits in Length

Although the scope of this research is focused on basic PRNG design characteristics, each design category can be further modified by changing the system key to fulfill any required changes in the system design. It is also worth mentioning that due to the emergence of low resource devices, NIST started a contest to select a new standard for lightweight cryptography in constrained environments [59]. The contest ended with the selection of the Ascon family.

Table 4 shows the equivalent system parameters and initial conditions for the non-chaos-based PRNGs as extracted from the key. As for the chaos-based PRNGs, the parameters and initial conditions extracted from the key are modified by applying: $$\begin{align*} S& =S_{fix}+S_{key}\times {10}^{-12}, \tag {5a}\\ X& =X_{key}\times {10}^{-10}, \tag {5b}\end{align*}$$ where S is any system parameter, $S_{fix}$ is the fixed part of the system parameter, $S_{key}$ is the decimal value of the corresponding parameter as obtained from the key, X is any initial condition, and $X_{key}$ is the decimal value of the corresponding initial condition as obtained from the key. The scaling factors ${10}^{-12}$ and ${10}^{-10}$ are used to ensure that the value of $S_{key}$ does not affect the first two digits of the fixed part and to limit the initial values to less than 1, respectively. The fixed values of the parameters are selected as {$\lambda _{fix}$ , $a_{fix}$ , $b_{fix}$ , $\beta {}_{fix}$ , $\alpha {}_{fix}$ } = {2.6, 1.45, 1.85, 2.66, 0.9}. Hence, the resulting parameters and initial conditions for the chaos-based PRNGs are shown in Table 4.

All algorithms are implemented using C# under.net framework 4.7 and the experiments are conducted on a Dell laptop with processor Intel Core i7-1065G7 CPU @1.30GHz, running Windows 10 with 16 GB of RAM. The PRNGs are configured to generate 3,145,728 bytes which are equivalent to a colored image of size $1024\times 1024$ .

A. Statistical Tests

The statistical evaluation examines the bitstreams generated from the six PRNGs using different tests including NIST SP-800-22 test suite [5], TestU01 randomness tests [6], histogram, and entropy. For any PRNG that is intended to be used in cryptographic applications, the NIST statistical test suite is an important tool for determining whether a bitstream is cryptographically secure or not. The NIST test suite provides a significance level $\alpha$ for each test, and if P-value $\ge \alpha$ then the sequence passes this test. For cryptography applications $\alpha$ is set to 0.01, which means that 1% of the sequences are expected to be non-random. In addition, the distribution of the P-values is considered to be uniformly distributed when $PV\ge 0.0001$ , and nonuniform otherwise. The bitstream is considered to be random if the P-values distribution is uniform and PP passes the required value. Table 5 shows the NIST results of the six PRNGs, where they all succeeded in passing the NIST tests. Therefore, the presented PRNGs are considered cryptographically secure. However, the results in Table 5 and Table 6 can be improved by optimizing the design process for each PRNG category.

TABLE 5 NIST Results for the Six PRNGs

TABLE 6 TestU01 Results for the Six PRNGs

Furthermore, TestU01 is widely used in literature because of its built-in test batteries that cover many aspects of randomness tests. Three test batteries are selected for testing the randomness of the generated bitstreams, namely Rabbit, Alphabit, and Block Alphabit. Table 6 shows the results of the six PRNGs for the selected batteries, and they all succeeded in passing all of the 157 tests.

A histogram shows the distribution of the generated bytes from the PRNG, where a good PRNG should produce a uniform histogram with equally distributed numbers. On the other hand, a poor PRNG shows a nonuniform histogram indicating biases in the generated numbers. As shown in Fig. 10, all of the six PRNGs show uniform distributions for the output values. Moreover, the generated bytes from each PRNG are converted into an image as shown in Fig. 10. Visual inspection of the images reveals the randomness of the generated bytes, which is consistent with the results of previous tests. Finally, a good PRNG should have an entropy value that approaches its maximum value of 8. This indicates that the produced numbers cannot be predicted from previously generated ones. The entropy values for LS, PR, EC, DC, CC, and FC are 7.99994, 7.99994, 7.99994, 7.99995, 7.99995, and 7.99994, respectively. Since these values approach the maximum value, the generated bitstreams are not predictable.

FIGURE 10.

Histogram and output bitstream represented as an image: (a) LS, (b) PR, (c) EC, (d) DC, (e) CC, and (f) FC.

B. Correlation Tests

The correlation of the generated bitstreams is examined in two different scenarios. In the first scenario, the autocorrelation coefficient is calculated between the original bitstream and 1000 shifted versions from itself. In the second scenario, each PRNG is derived by five keys that are different from the original key. Then, the cross-correlation coefficients between the original bitstream and the other five bitstreams are calculated. Autocorrelation indicates whether or not the bitstream exhibits dependency, periodicity, or repeated patterns. A good PRNG should produce a bitstream that is not dependent, periodic, or repeated. A value close to 1 or -1 represents poor bitstreams, whereas a value close to 0 represents a good bitstream.

As shown in Fig. 11, the autocorrelation values for different shift values are very close to zero as required. In addition, a cross-correlation coefficient value close to 0 indicates non-associated bitstreams whereas a value close to 1 or -1 indicates highly associated bitstreams.

FIGURE 11.

Autocorrelation coefficient values for different shift values in the six PRNGs: (a) LS, (b) PR, (c) EC, (d) DC, (e) CC, and (f) FC.

Figure 12 shows five different keys as well as the cross-correlation coefficient values between the resulting bitstreams and the original bitstream. The close to zero values imply that the generated bitstreams have high dependency on the system key, and a completely different bitstream is generated for a different system key.

FIGURE 12.

(a) Five different system keys, and (b) the resulting cross-correlation coefficient values for the six PRNGs.

C. Key Sensitivity

Key sensitivity is examined by changing the Least Significant Bit (LSB) of each parameter and initial condition. Then, the generated bitstreams are compared with the original bitstream generated using the original key. Table 7 summarizes the different sensitivity test cases for each system, and the resulting correlation coefficient values. The close to zero values demonstrate that even the slightest change in the system key changes the output bitstream significantly.

TABLE 7 Sensitivity Test Cases

D. Algorithm Complexity

The algorithm complexity for the six PRNGs is studied using the big O notation. For the first five algorithms (LS, PR, EC, DC, and CC), only one loop exists as shown in Figs. 3(a)-(e). Hence, the complexity of the algorithm is $\text {O}(N)$ , where N is the number of iterations. On the other hand, the FC algorithm performs two nested loops as required by the numerical method of Fig. 3(f). One inner loop is used to calculate a predicted value, and the other outer loop is required to calculate the final value for the system state variables. Hence, the FC algorithm complexity is $\text {O}(N^{2})$ .

Although the first five algorithms (LS, PR, EC, DC, and CC) have similar complexity, the performance for each is different since they apply different mathematical operations with different computation times. Hence, the bit rate is calculated for all PRNGs to investigate the differences between the different methods. Table 8 shows the average bit rate for the six PRNGs, where the DC algorithm performs much better than the other algorithms. The reason behind this stems from the simple equation of the positive logistic map, which requires few mathematical operations per iteration.

TABLE 8 Comparison Between the Six PRNGs

For the LS algorithm, most of the operations are XOR, bit-shift, and bit-AND which are fairly fast operations in C#. Therefore, the bit rate is very good and outperforms reported bit rates in the literature such as [17] and [18]. Similarly for the CC algorithm, the reported bit rate is very good because few mathematical operations are required per iteration.

In case of the PR algorithm, although there are few operations per iteration, the power operation takes more time especially as the power starts to grow. Hence, the reported bit rate is fairly good but less than other PRNGs. For the FC algorithm, the reported bit rate is much lower than other PRNGs because of two factors. The first factor is the complexity of the algorithm, and the second factor is the large number of mathematical operations required per iteration. In case of the EC algorithm, although there is only one addition operation per iteration, the use of big integers to support very large numbers used by the elliptic curve adds extra processing time for performing simple addition and multiplication operations. Therefore, the reported bit rate is the minimum among the presented PRNGs.

E. Key Expansion

The potential of increasing the length of the system key is investigated with respect to different factors such as the number of parameters, parameter size, and the effect of those changes on the validity of the system. For the LS system, it is possible to increase the number of parameters as needed by adding more LFSRs and/or S-Boxes. In such cases, a new PRNG design is required to utilize the extra bits available from the new parameters. The new design should also be evaluated using the aforementioned tests before using it in any cryptographic application. Therefore, the LS system key cannot be expanded for the current design.

In the case of PR, all system key parameters can be expanded as long as a prime number and some of its primitive roots are selected. Because the size of a primitive root can be at most the size of the prime number, the maximum length of the system key equals $n(m+1)$ , where n is the number of bits for the selected prime number and m is the number of primitive roots. Hence, the PR system key can be expanded using the same design.

For an elliptic curve defined over a field $F_{p}$ where p is a large prime number, the order of the curve (i.e., the number of points on the curve) is bounded by $\left ({{ p+1+2\sqrt {p} }}\right)$ as given by Hasse theorem [43]. The order of a point P on the curve is the smallest positive integer z such that $zP = \mathcal {O}$ , where $\mathcal {O}$ is the point at infinity. Since the order of any point P can not exceed the order of the curve, the order of P is bounded by $\left ({{ p+1+2\sqrt {p} }}\right)$ . For EC, the structure of the algorithm does not depend on the value of k, but k is used in calculating the base point $P_{0}=kG$ and the only restriction applied on k is not to make $P_{0}= \mathcal {O}$ . Hence, k must be less than the order of the generator point G. Therefore, the system key length can reach up to n bits where $n=\log _{2}{(p+1+2\sqrt {p})\approx }\log _{2}{(p)}$ .

For the DC system, it is assumed that each of the key parameters is 32 bits in length. Because this length can be extended to 64 bits, the system key can be doubled to reach $4\times 64=256$ bits. In such a case, the PRNG must be revalidated to pass all the previous tests. As for the CC, the two system parameters $\sigma$ and $\rho$ can be used in the key and all parameters can be extended to 64 bits. Hence, the system key can reach up to $6\times 64=384$ bits. Similar to DC, a revalidation of the system is required. Similarly, the FC system has two system parameters $\beta$ and $\gamma$ that can be used in the key and all parameters can be expanded to 64 bits. Hence, the system key can reach $6\times 64=384$ bits. The system must also be revalidated to pass all the required tests.

F. Comparing the Six PRNGs

The six PRNGs are compared based on security tests, algorithm performance, and key expansion. Table 8 summarizes the PRNG results and it is clear that each of the currently proposed designs has its advantages and disadvantages, where a tradeoff between performance and security exists. For instance, DC has the highest bit rate but its key is limited to 256 bits. Hence, it might not be suitable for applications that require high security. On the other hand, EC has the least bit rate but its system key can be expanded to the size of the selected prime number. Hence, EC is more suitable than DC from the security point of view. It should be mentioned that for a fair comparison between the six designs, the key length is fixed to 128 bits. If the key length is not fixed, proper comparisons would not be possible and the analysis outcomes of Table 8 would be changed.

SECTION IV. Image Encryption Application

Recently, a lot of research work focused on image encryption because of its increasing importance in the digital world. Table 9 summarizes some of the recent state of the art techniques and compares them with respect to different aspects such as key space, correlation coefficients, entropy, and differential attack measures.

TABLE 9 Recent Encryption Systems Results for Different Grayscale Images

Therefore, the six PRNGs are examined in a simple image encryption system as an example of a cryptographic application. Although each PRNG category can have a different key space, a simple system design with a fixed-length system key having a space of 2¹²⁸ is chosen for the sake of fair comparisons. The block diagrams for the encryption and decryption systems are given in Fig. 13, where two mandatory processes, namely substitution and permutation, are required as recommended by Shannon [60]. While image pixel values are changed in the substitution process, image pixel positions are changed in the permutation process. The substitution process consists of a simple XOR operation between the image pixel, the pseudo random key, and the last encrypted pixel. The permutation process is performed using the well-known Arnold cat map [61], which is given as: $$\begin{align*} \binom {x_{new}}{y_{new}} =\left ({{\begin{array}{cccccccccccccccccccc} 1 & \quad a \\ b & \quad 1+ab \\ \end{array}}}\right) \binom {x}{y} mod ~M, \tag {6}\end{align*}$$ where x and y are the original pixel locations, $x_{new}$ and $y_{new}$ are the new pixel locations, M is the image size, and $a, b~\in \{1, 2, \ldots, M-1\}$ . In general, deducing the Arnold cat map parameters from the input image adds a level of security and enhances the differential attack measures. Therefore, the values of a and b are calculated as follows: $$\begin{align*} S& =sum\left ({{ image~pixels }}\right), \tag {7a}\\ a& =mod\left ({{ S+a_{key},M-1 }}\right), \tag {7b}\\ b& =mod\left ({{ S+b_{key},M-1 }}\right)+1, \tag {7c}\end{align*}$$ where $a_{key},b_{key}$ are the first two consecutive 8-bit values from the system key.

FIGURE 13.

Block diagram for (a) the encryption system and (b) the decryption system.

Two standard images from the USC-SIPI database [68] are used in analyzing the encryption system; “Mandrill” and “Airplane” with sizes of $\mathrm {512\times 512}$ . The analysis results for the six PRNGs are shown in Table 10, where visual inspection of the encrypted images suggests the success of the system in hiding the image information.

TABLE 10 Encryption Results for the Six PRNGs

Images are known for the high correlation among their adjacent pixels in the horizontal, vertical, and diagonal directions. As shown in Table 10, the correlation coefficient values achieved by the encryption system are very small in all directions as required for good encryption.

In addition, the MSE values demonstrate the large difference between the encrypted and source images. At the same time, the entropy values are near 8 suggesting that the encrypted image acts similar to a random source.

Differential attacks are very common in image encryption, where an attacker tries to study the relationship between the input image and the output encrypted image by changing only one pixel value in the input image. In the case of a good encryption method, the expected values for NPCR and UACI metrics are around 99.61% and 33.46%, respectively [7]. In the proposed system design, the presence of the delay block enhances the differential attack results because the effect of changing one pixel is propagated to all of the image pixels. The differential attack measures are calculated by taking the average results of ten iterations where in each iteration one random pixel value is changed. The results in Table 10 confirm that the differential attack measures for the six PRNGs are in the good expected ranges.

SECTION V. Conclusion

Since PRNGs are a core component in many applications, this paper analyzed six design scenarios under two primary categories: non-chaotic and chaotic generators. While designing cryptographically secure PRNGs, it is recommended to follow some design guidelines to ensure that the key space is large enough to resist brute-force attacks, and that the key is sensitive to a one-bit change. Because the scope of this work is focused on basic PRNG design characteristics, a system key of length 128 bits is utilized in all PRNGs for the sake of proper comparisons. Although those designs pass the required statistical and sensitivity tests, they can be enhanced for improved statistical results and performance and the system key can be changed accordingly.

In case of the LS system, combining more than one LFSR increases the key space and enhances the security, the use of S-Boxes adds an extra level of security, and the delay element enhances the key sensitivity. In case of the PR system, the special property of uniqueness found in primitive roots enhances the security, and adding the delay element enhances the key sensitivity. For the EC system, selecting a secure elliptic curve with a large prime is mandatory, and extracting too many bits from the elliptic curve points is not recommended. For the DC system, adding extra controlling parameters enhances the key space, and carefully selecting the map parameters ensures chaotic behavior. In case of the CC system, using as many system parameters as possible increases the key space, and carefully selecting the system parameters ensures the chaotic behavior. The FC system is similar to the CC system, and to overcome the performance issue it is recommended to restart the system state after a small number of iterations. Finally, each of these design categories can be further enhanced to achieve different security levels with different key spaces.