A Low Power Circuit Design for Chaos-Key Based Data Encryption

Dynamic and non-linear systems have been used to generate random bits in high-security applications for decades. In this perspective, due to their stochastic characteristic, chaotic systems have been emerging as the natural choice for the generation of random bits. This paper presents the design and the implementation of a chaos-based true random number generator and a chaos-key based data encryption scheme for secure communications. The mathematical expression of the dynamic system is presented and analyzed to evaluate the possibility of chaos occurrence. Then, the chaotic system is realized at the circuit level using 130 nm CMOS technology to generate random bit sequences, which are utilized in data encryption. Chaotic signal outputs of the chaos-based random number generator circuit are sampled at a maximum frequency of 50 MHz, enabling a high throughput of random bits. The core of the chaotic circuit consumes $630~\mu \text{W}$ in static mode and a maximum of $660~\mu \text{W}$ in running mode. The chaos-based one-time pad encryption scheme using the chaos-key generator shows the advantages of using this random number generator in secure communications. In this context, the data secrecy is compared to the advanced encryption standard AES128. Moreover, the design is simulated in different working conditions such as voltage supply and temperature variations, where it is shown that the random bit output benefits from a high entropy per bit and passes the standard statistical test suite (NIST) for cryptographic applications.


I. INTRODUCTION
Random number generators are critical components that are responsible of generating public keys, private keys, and other kinds of random numbers that are utilized in cryptographic applications and data security [1]- [5]. The explosive growth of Internet-of-Things (IoTs) devices places new challenges on random number generators including energy efficiency, hardware security, and flexibility. Nowadays, true random number generators, taking advantage of the nonlinear and dynamic characteristics of chaotic systems, are attracting substantial research interest [6]- [10]. A chaotic system, which is represented by a deterministic expression, is nonlinear and dynamic [6]. Therefore, it is not sensitive to the system's noise, such as voltage and temperature variations. Despite being deterministic, chaotic systems have been emerging as the natural choice for random bit generators in The associate editor coordinating the review of this manuscript and approving it for publication was Woorham Bae . high-security applications, due to their sensitivity to initial conditions and irregular motion in the phase space. Therefore, at a certain point of observation, the chaotic system behaves as a random-like process [10]. Chaotic systems used in generating random bits are categorized into discrete and continuous systems. The discrete chaotic maps, in which the next state is calculated depending on some previous states and is represented by a map x k+1 = M (x k ), include logistic maps, piece-wise affine Markov maps, Renyi maps. Whereas continuous chaotic systems, in which the next state is an integration of the previous states, are regulated by a set of differential equations X = F(X ). Some well-known continuous chaotic systems are Lorenz's equations, Chua's circuit, and Rossler's oscillators. Both discrete chaotic maps and continuous chaotic systems can be digitized to produce pseudo-random numbers. The ''pseudo'' term refers to random number generators which use deterministic algorithms where the data is represented by a digital word [11]- [13]. Whereas true random number generators are generated from physical entropy sources such as thermal noise, jitter noise, or analog implemented chaotic systems. Although chaotic systems have deterministic expressions, they are considered as true random number generators if the chaotic system is implemented in analog circuit design. Many chaos-based true random number generators have been designed in the state-of-the-art [14]- [19]. Due to quantization errors in the digital domain, the dynamic characteristics of chaotic pseudo-random number generators are limited. Therefore, we focus on the design of a true random number generator based on a chaotic system in the analog circuit. Many true chaos-based RNGs are induced from linear maps due to their simplified implementation. Among the numerous approaches used to implement linear chaotic maps, Markov chaotic maps are widely used in very-large-scale integration designs for their low implementation cost. Some transforms of Markov chaotic maps such as N-Bernoulli maps, tent maps, zigzag maps, and piecewise affine Markov maps (PWAM) have been utilized to generate random bit sequences [20]- [24]. However, in cryptographic applications, linear methods are not recommended for generating random keys. Ngoc et al. proposed an analog circuit to implement a nonlinear logistic map based on fuzzy modeling [25]. However, the accuracy of nonlinear modeling maps depends on experience and is limited by circuit parameters. Although many continuous chaotic systems have been developed and verified by mathematics, due to their high power consumption, low-frequency operation, and low capability of operating at low voltage levels, only a few of them were designed in a highly integrated circuit. Most of them use off-the-shelf electronic devices which are power-hungry circuits [26]- [28]. Chua's circuit is a well-known implementation of a continuous chaotic system in integrated circuits [29]- [31]. Moreover, implementations in integrated circuit using external components including inductors, and capacitors which occupy a large area have been conducted in [32], [33]. The research in [34] presented a fully CMOS circuit design for random bit generator using Jerk equations. The circuit was implemented in 180nm CMOS technology. However, the system analysis is not fully addressed and the large capacitors limit the internal oscillator frequency which reduces the random signal throughput. This work presents a low power circuit design for a chaotic system that fills the gap between theoretical analysis and implementation of chaotic systems for the generation of random bit sequences. A novel 3D continuous chaotic system is proposed with mathematical analysis. The chaotic circuit is implemented in 130nm CMOS technology with a supply voltage of 1.2V which significantly reduces the power consumption. Moreover, post-processing is implemented to eliminate the bias effect and provide ready-to-use random bits. Therefore, according to the evaluation methodology of random number generators proposed by the German Federal Office for Information Security (AIS-20/31), the proposed random bit generator falls into the PTG.3 class, which can be used in cryptography [35]. As an application, chaos-based one-time pad cryptography is developed using the proposed chaos-key generator. In one-time pad (OTP) cryptography, the security relies on the randomness of the keys [36], [37]. The OTP cryptosystem based on the XOR operation uses chaos-based random bit sequences as the OTP codebook. The contributions of this paper include: 1) The design of a novel 3D continuous chaotic system which is rich of dynamic characteristics. 2) The implementation of a chaos-based true random number generator in 130nm CMOS technology providing ready-to-use random bits.
3) The application of an one-time pad cryptography for image encryption/decryption based on the chaos-key generator. The rest of this paper is organized as follows. To assess the sytem's robustness, Section II presents the mathematical analysis of the chaotic system. Section III details the circuit design using 130 nm CMOS technology to be used in integrated devices. The randomness performance is evaluated in Section IV. The OTP image encryption based on chaos-key generation is presented in Section V. Finally, Section VI concludes the paper.

II. PROPOSED 3D CONTINUOUS CHAOTIC SYSTEM
This section presents the 3D continuous chaotic system in mathematical expressions. The system dynamics and chaotic complexity are analyzed using Lyapunov spectrums, bifurcation diagrams, wavelet analysis, and stability evaluation.

A. CONTINUOUS CHAOTIC SYSTEM
The proposed 3D dynamic system is expressed in the canonical form X = F(X ), The following subsections present the mathematical analysis in terms of chaotic and dynamic characteristics by evaluating the Lyapunov exponents and Kaplan-York dimension. Moreover, the stability analysis of equilibrium points is also an important aspect that we address in this section.

B. MATHEMATICAL ANALYSIS
In this part, we present the dynamic characteristics of the dynamic system mentioned above. Based on mathematical analysis, we can evaluate if a dynamic system has a chaotic characteristic and how strong it is. The dynamic system was simulated in MATLAB using the 4 th -order Runge-Kutta integration algorithm with a step size of 10 −4 . The Lyapunov exponents of a differential system are defined as: For a = 0.3, b 1 = 0.1, b 2 = 80, and b 3 = 0.7, the Lyapunov exponents of the differential system are: L 1 = 0.0841, VOLUME 8, 2020   The presence of a positive Lyapunov exponent verifies the unstable characteristic of a dynamic system. Therefore, the dynamic system possibly exhibits chaotic characteristic and thus can be used to generate random bits. The divergence of (1) is evaluated based on the following conditions: A negative L indicates that the differential chaotic system does not converge. Moreover, the Lyapunov dimension proposed by Kaplan and Yorke [38], which represents the chaotic complexity, is defined as: Table 1 compares the Lyapunov exponents of the proposed 3D chaotic system to previous studies. As evidenced in the table, the proposed 3D chaotic system has the highest Lyapunov dimension which indicates highly dynamic complexity.
We evaluate the robustness of the system parameters by observing the bifurcation diagrams and the Lyapunov spectrums according to the primary parameters b 1 and b 3 as shown in Fig. 1 and Fig. 2, respectively. As evidenced in these figures, the chaotic characteristics of the chaotic system are preserved over a wide range of values for b 1 , and b 3 . The largest Lyapunov exponent remains positive and stable. The bifurcation diagrams also indicate that the proposed chaotic system is sustained in chaos state. In other words, the parameter set a = 0.3, b 1 = 0.1, and b 3 = 0.7 ensures that the dynamic characteristics of the system are preserved, even in the presence of circuit parameter variations.
Wavelet analysis has been proved to be a valuable tool in the study of chaotic systems. Therefore, to study the non-periodicity of the proposed 3D chaotic system, the scale index is calculated based on the inner scalogram of the continuous chaotic signals [42]. The scale indexes are compared to Lyapunov spectrums and bifurcation diagrams as seen in Fig. 1 and Fig. 2. The scale index is such that 0 ≤ i scale ≤ 1 and it can be used to measure the degree of non-periodicity of the chaotic signal. By definition, the scale index is close to zero for periodic signals and close to one for highly non-periodic signals. According to the spreading values of the scale indexes, the non-periodic behavior of the chaotic system is visualized within a wide range of parameters b 1 and b 3 .

C. STABILITY OF EQUILIBIUM POINTS
The stability evaluation of the equilibrium is an important step in practical designs supporting the choice of system parameters. The Jacobian matrix of the chaotic system is calculated to evaluate the stability of equilibrium points. where ). The eigenvalues of the Jacobian matrix satisfy the condition: The chaotic system has equilibrium at E = [x 1 , 0, 0], in which x 1 satisfies: For a small perturbation from the fixed points the characteristic polynomial equation is derived as in equation (6). According to the Routh-Hurwitz criterion, the real parts of the roots of (6) are negative if and only if A < 0, and a(a + A) + A > 0. The system at the equilibrium set E must be unstable, thereby the chaotic phenomenon is enabled. The parameters must satisfy one of the following conditions: From (7), we determined that the equilibrium of the system is at E = [0.03167, 0, 0]. Therefore, the first condition in (8) is satisfied. In other words, we prove that the proposed chaotic system has an unstable and saddle focus equilibrium which enables chaotic characteristics. Overall, the above presented chaotic system has non-periodicity in which the data space is limited in the range [−0.5 − 0.5] as shown in Fig. 3. This enables the deployment of the proposed chaotic system using CMOS devices with a supply voltage of 1.2V. In this context, the common voltage is set to 0.6V.

III. CIRCUIT IMPLEMENTATION
In this section, we present the chaotic circuit design for the above differential chaos and the post-processing circuit using a 130 nm CMOS technology.

A. CHAOTIC CIRCUIT DESIGN
The main components of continuous chaotic systems are integrators. In this section, we present the Gm-C integrator circuit design and the non-linear function based on operation amplifier. The chaotic system is formaluated using Kirchhoff's law, and the results reveal the following system of Ordinary Differential Equations (ODEs): where C x , C y , C z are integrating capacitors with C x = C y , and f (v x ) is the nonlinear tanh(.) function. The circuit realization in (9) is normalized by the time constant τ = C x g m , then it is undimensioned by an arbitrary voltage V r as: The integrator is implemented using an inverted-based Gm-C integrator as depicted in Fig. 4. The relationship between the output current i o and the input voltage v i follows: The transconductance gain g m is comprised of a pair of nMOS and pMOS devices. The total transconductance gain is calculated as: The nonlinear function i out = f (v x ) is a hyperbolic tangent function. The circuit implementation of the non-linear function f (v x ) using a differential amplifier is shown in Fig. 5. The saturated drain current I sat of a mosfet device is exponential to the gate and source voltages as: Assuming that a differential input pair is saturated, the voltage-to-current transfer characteristic i out = i D1 − VOLUME 8, 2020 , is proportional to the difference between two drain currents as follow: The current bias I SS was designed to be resilient against process-voltage-temperature (PVT) variations based on the research in [43]. Here we match the parameters in the first equation and the circuit parameters as: The whole circuit design of the chaotic system is elaborated in Fig. 6. The integrating capacitors set to C x = 1.2pF, C y = 1.2pF, and C z = 4pF. The transconductance g m in (12) is 240 µS, and the current source for tanh(.)I SS = 80µA. The circuit design of continuous chaotic systems has a great impact on the intrinsic oscillator frequency. Low-frequency chaotic oscillators limit the final random bit throughput. In our chaotic circuit design, the optimization and tradeoff between circuit parameters including transconductance and capacitors are carefully taken into account. The intrinsic oscillator frequency is f = g m 2πC = 31.8 MHz, which is indeed a very high frequency with respect to other discrete or integrated solutions.
Continuous chaotic systems implemented using off-the-shelf devices are power-hungry circuits that, due to the large values of passive components, limit the oscillator frequency in the ''KHz'' range. In [44], the authors used inductor L = 10mH and capacitor C = 10nF in the chaotic circuit, where the maximum oscillator frequency is 830 kHz and the sampling frequency is 19 MHz. In the full CMOS   implementation of a continuous chaotic system presented in [18], the chaotic signal is post-processed at a frequency of 50 MHz, but the oscillator frequency is undeclared and is expected to be much lower than in this work due to the large capacitors used (between 10nF and 20 nF, instead of 1.2pF).
Trajectories of the chaotic outputs of the chaotic system are shown in Fig. 7 with control voltage V T = 0.7. The attractor of the chaotic system is observed and compatible with the simulation results. The layout diagram of the chaotic circuit is shown in Fig. 9. Continuous chaotic systems have high dynamic characteristics (compared to chaotic maps and chaotic iterations) due to higher dimensional signals and multiple parameters. However, they are also associated to more complicated circuit designs, especially when the existing physical noises can degrade the dynamic characteristics if the chaotic system is too sensitive to its parameters. Our continuous chaotic system is shown to be robust since the dynamic characteristics are preserved with existence of circuit noise and device mismatch. The comparator includes a preamplifier (PREAMP) and a latch circuit (LATCH). The main function of the preamplifier is to provide sufficient gain to overcome the offset of the subsequent comparator without introducing significant offset of its own. The comparator is designed to work at a frequency of 50MHz; the aperture time is 10 ns with a 50%-duty cycle clock. Random offsets due to transistor mismatches, which may be introduced to the second-stage of the comparator (LATCH circuit), will be eliminated by the following postprocessing. Therefore, the comparator circuit does not require a highly critical design. Transistor sizes are chosen properly to reduce mismatch and satisfy the gain requirement. The PREAMP circuit, shown in Fig. 10, uses an output reset   switch (M 5 ), to prevent regeneration during the comparing phase. When the clock signal CLK is at a low level, the dioded-connected PMOS transistors M 3 and M 4 generate the output. The offset of PREAMP is amplified with a high gain. Meanwhile, when CLK is at a high level, the output of PREAMP is fed into an edge-triggered latch (LATCH) that also amplifies its inputs.

2) SHIFT-XOR BASED POST-PROCESSING CIRCUIT
The circuit design is based on shift and exclusive-OR operations, in which the eliminated bits are re-used by the feedback. Therefore, the bit-rate between input and output is preserved. This post-processing is composed of four shift registers [45], [46]. The working principle is to evaluate the incoming bits from comparators and reuse these bits by XORing them with the same bit-stream after a few step shifting. In this context, we use 8-bit length registers. The circuit design for a one-bit shift register uses a positive-edge trigger dynamic flip-flop while 8-bit shift registers are composed of eight one-bit shifters. The circuit design is shown in Fig. 11.

IV. RANDOMNESS EVALUATION
The following section presents the system's performance in terms of power consumption and randomness evaluation including signal entropy, signal correlation, and random-test suite. The chaotic circuit consumes 630µW in static mode and a maximum of 660µW in running mode. The comparator consumes 120µW at a 50MHz sampling frequency. Therefore, the low-power circuit design achieves an energy efficiency of 15.6 pJ/b for random binary outputs. The proposed system's performance is compared to other previous designs in Table 2. The comparison indicates that our proposed design benefits from a low power consumption with high throughput compared to other chaos-based RNGs using different continuous chaotic systems or discrete time chaotic maps in [25], [34]. Although the design in [47] consumes less power, the data rate is limited at ''KHz''. Besides, we compare our work with previous generators using physical noises [17], [48]. The work in [17], which uses metastability and jitter noise to generate random bits, has the highest throughput. However, it consumes much more power than our design. Thus, the proposed system design is more suitable for applications that require a relatively high throughput (Mbps) and low power.
To evaluate the randomness, Shannon's entropy of the output bitstream is calculated as follows: where p i is the probability of a given symbol and N is the number of symbols. The ideal entropy of a binary bitstream is unity. The entropy test for 600 sets of 60Kb length binary sequences is illustrated in Fig. 12. It is observed that the entropy of all the sets is near unity, and 98% of the samples have an entropy higher than 0.9998, which indicates a highly random performance. Moreover, the design was evaluated in different working conditions such as power supply and temparature variations. As illustrated in Fig. 13, the average random bit entropy does not show significant changes with power variation at different corners in Monte Carlo simulations.
The correlation, which measures the similarity between two time-serial sequences, is another important standard function to evaluate the randomness. The correlation is calculated as: where c y 1 y 2 denotes the cross-covariance of the time series y 1,t and y 2,t , which is calculated as:  where s y 1 and s y 2 are standard deviations of the series c y 1 y 1 (0) and c y 2 y 2 (0), respectively, and k is the number of lags (time delays). Likewise, the auto-correlation measures the similarity between the time series and its k-lags delay. Fig. 14 shows the auto-correlation and cross-correlation measurements of the proposed output bitstreams. The average similarity is of 0.13% which demonstrates the uncorrelated relationship between two different time series and the non-periodic random outputs. Moreover, the ready-to-use random bits after the data post-processing must satisfy the randomness criteria, measured by statistical tests, to determine that the proposed chaotic system can be used as a random source. The highly-acceptable statistical test suite NIST sp800-22, with numerical tests developed by the National Institute of Standards and Technology, is utilized to evaluate the randomness of binary sequences. This statistical test works under a tentative assumption of randomness (H 0 ). The output of each test (the P-value) is computed by comparing features of the stream to those of an effectively random stream. Tests are designed in a way that, if H 0 is true, the P-value is a uniformly distributed random variable in the interval [0, 1]; conversely, if H 0 is false, P-values collapse to zero. When a single sequence is available, the test interpretation is achieved by comparing the achieved P-value with a small but non-zero threshold value (a typical considered value is 0.01). The sequence is considered random if the P-value is larger than the threshold value, and non-random when smaller. When multiple sequences are available from the same generator, it is also possible to compute all the associated P-values and check the uniformity (χ 2 ) of their distribution which is known as the second-level test [49].  Eighty streams of 1-Mb length are directly used for the sub-tests in NIST including overlapping test, Maurer's universal statistical test, linear complexity test, serial test, run excursion test, and random excursion variant test which require at least 1-Mb length data. The other tests including the mono-bit test, frequency test within a block, run test, the longest run of one in a block, binary matrix rank test, approximate entropy test, and cumulative sums test use 500 streams of 160-Kbit length. The results of the NIST test are presented in Table 3. All the tests are passed with a reasonable proportion. The minimum pass rate for the first ten tests is 488 for a sample size of 500 bitstreams. The minimum pass rate for the last five tests is 76/80. Moreover, the random bit streams passed the second-level tests of randomness.

V. CHAOS-BASED ONE-TIME PAD CRYPTOSYSTEM
In this section, we present an OTP image encryption application using chaos-key generation. Security and encryption performance analysis are performed to demonstrate the advantages of using chaos-key in data encryption. Standard images are utilized to test the image encryption. Fig. 15 shows the OTP image encryption, in which a chaos-key generator is used as an OTP codebook. The chaos-key generator block is implemented using 130nm CMOS technology to provide an analog chaotic signal [V x , V y , V z ]. Then, the post-processing circuit, which is also implemented using 130nm CMOS technology, is used to generate ready-to-use random bits. These random bits are collected and used for the OTP image encryption and decryption in MATLAB. The plaintext then applies an XOR operation with the chaos-based generated random bits. The OTP encryption algorithm is the simplest and least expensive in terms of device resource (uses an XOR operations between the plain image pixel values and generated random bits) [50]. This application is presented as a proof of concept that the ready-to-use random bits generated from the proposed chaos-based generator can be used directly for secure communications. In this context, the OTP cryptography can use a very-long generated chaos-based random key, which is securely sent to the receiver, for multiple messages until the length of key is reached. The initial conditions and control voltage used to generate chaotic signals define the key space. Different initial conditions and control voltages generate different codebooks for the encryption process. In this context, we assume that the key is securely sent to the receiver over a secure channel which with no transmission errors.

A. STATISTICAL ANALYSIS 1) HISTOGRAM ANALYSIS
The Advanced Encryption Standard (AES) and chaos-key based OTP cryptography were implemented using MATLAB on an 8th-generation Intel core i7 and 8G RAM computer. Fig. 16 provides comparison between AES and the proposed algorithm using chaos-key generation for image encryption. As described in these figures, the encrypted images using the AES algorithm and the proposed encryption scheme have a flat histogram. The chaos-key based algorithm finished within 13s. The encryption time excludes the key generation. For AES encryption, the keys are static and stored in the memory. The proposed chaos-key generation has a throughput of 50Mbps, therefore, it takes approximately 0.042s to generate 262144 8-bit chaotic numbers for the sample color image size of [W × H ] = 512 × 512, which is insignificant compared to the encryption time.

2) IMAGE ENTROPY, UACI AND NPCR EVALUATION
Entropy is a statistical measure of randomness that can be used to characterize the texture of an image. In image encryption, the image entropy is used to evaluate the randomness of encrypted image pixel values. The entropy test results, shown in Table 4, indicate that the encrypted images have good randomness pixel values. To test the influence of an one-pixel change on the whole image encrypted using the proposed chaos-based algorithm, two common measures are used: Number of Pixels Change Rate (NPCR) and Unified Average Changing Intensity (UACI). Let the grey-scale value of the pixel at grid (i, j) be denoted as C 1 (i, j) in the plain image and C 2 (i, j) in the encrypted image, the NPCP is defined as follows: The UACI, which measures the average intensity of differences between the plain image and the encrypted image, is defined as follows.

3) CORRELATION TEST
The correlation tests of two horizontally adjacent pixels, two vertically adjacent pixels, and two diagonally adjacent pixels in the plain image and encrypted image using the chaos-key generator are presented in Fig.17. According to the correlation coefficients listed in Table. 5, it can be inferred that the adjacent pixels in the encrypted image are uncorrelated.

B. KEY SPACE
Data security should have a big enough keyspace to withstand brute-force attacks. In chaos-key generation, the size of the chaotic system and its parameters define the keyspace. In this application, each parameter has 2 32 different values. The 3D continuous chaotic system has a key length of 2 96 because it has a different value set (V x0 , V y0 , V z0 ) for initialization. Moreover, the system parameter V T is also controlled by a 32-bit key length. In total, the chaotic system has a keyspace of 2 128 .

C. KEY SENSITIVITY
The different generated chaos-keys with different sets of input (V x0 , V y0 , V z0 , V T ) are evaluated. The chaos-key k 1 is generated by the input set (0.615, 0.6, 0.6, 0.7) and the chaos-key k 2 is generated by the input set (0.61500001, 0.6, 0.6, 0.7). Chaos-key k 1 is used to encrypt the original image. Fig. 18 shows the image decryption with correct chaos-key k 1 and image decryption using wrong chaos-key k 2 . A tiny change in the input set caused a huge difference in the decryption results. Therefore, the proposed scheme with chaos-key generation has a high sensitivity to secret keys in the encryption and decryption process.

VI. CONCLUSION
We have presented a novel continuous chaotic system implementation in highly integrated analog circuit design and its engineering application to image encryption. The chaotic dynamics were analyzed and studied. The circuit realization in 130 nm CMOS technology enables our design to be used in constrained devices. The generated random numbers passed all the statistical tests of the NIST testsuite at a throughput of 50Mbps. Moreover, an image encryption scheme using the chaos-key generator was presented. The encryption and decryption performances of the chaos-key based image encryption scheme were compared to the standard AES128 algorithm in terms of data secrecy and accomplishing time. In the future, the chaotic system implementation could be integrated into a microprocessor as a standalone cryptographic processor. Moreover, power and speed optimization will be attempted to increase system performance.  where she is currently a Lecturer and a Researcher with the School of Electronics and Telecommunications. She is author or coauthor of about ten journals and more than 30 international conference papers. Her research focuses on power management for biomedical applications, wearable devices, and LED drivers. Actually, her group has 20 bachelor's degree students, three master's degree students working closely with Professors from KAIST, South Korea, UC San Diego, USA, and Telecom-ParisTech, France, for collaborative projects.