Random Walk in a N-cube Without Hamiltonian Cycle to Chaotic Pseudorandom Number Generation: Theoretical and Practical Considerations

TL;DR

This paper presents a novel chaotic pseudorandom number generator based on a walk in an N-cube missing a Hamiltonian cycle, with theoretical proofs and practical validation of its chaotic behavior and statistical quality.

Contribution

It introduces a new PRNG construction using N-cube walks without Hamiltonian cycles, providing theoretical analysis and practical implementation details.

Findings

Proven chaotic behavior of the PRNG.

Constructed Hamiltonian cycle removal method.

Successfully passes classical statistical tests.

Abstract

Designing a pseudorandom number generator (PRNG) is a difficult and complex task. Many recent works have considered chaotic functions as the basis of built PRNGs: the quality of the output would indeed be an obvious consequence of some chaos properties. However, there is no direct reasoning that goes from chaotic functions to uniform distribution of the output. Moreover, embedding such kind of functions into a PRNG does not necessarily allow to get a chaotic output, which could be required for simulating some chaotic behaviors. In a previous work, some of the authors have proposed the idea of walking into a $\mathsf{N}$-cube where a balanced Hamiltonian cycle has been removed as the basis of a chaotic PRNG. In this article, all the difficult issues observed in the previous work have been tackled. The chaotic behavior of the whole PRNG is proven. The construction of the balanced Hamiltonian cycle is theoretically and practically solved. An upper bound of the expected length of the walk to obtain a uniform distribution is calculated. Finally practical experiments show that the generators successfully pass the classical statistical tests.

Tables

Table 1. Table 1: Statistical evaluation of known PRNGs: number of succeeded tests

PRNG	LCG	MRG	AWC	SWB	SWC	GFSR	INV
NIST	11	14	15	15	14	14	14
DieHARD	16	16	15	16	18	16	16

Table 2. Table 2: Statistical effects of CIPRNG on the succeeded tests

PRNG	LCG	MRG	AWC	SWB	SWC	GFSR	INV
NIST	15	15	15	15	15	15	15
DieHARD	18	18	18	18	18	18	18

Table 3. Table 3: Functions with DSCC Matrix and smallest MT

Function $f$	$f\left(x\right)$, for $x$ in $(0,1,2,\dots ,2^n-1)$	$𝖭$	$b$
$ⓐ$	[13,10,9,14,3,11,1,12,15,4,7,5,2,6,0,8]	4	64
$ⓑ$	[29, 22, 25, 30, 19, 27, 24, 16, 21, 6, 5, 28, 23, 26, 1, 17,	5	78
	31, 12, 15, 8, 10, 14, 13, 9, 3, 2, 7, 20, 11, 18, 0, 4]
	[55, 60, 45, 44, 58, 62, 61, 48, 53, 50, 52, 36, 59, 34, 33, 49,
	15, 42, 47, 46, 35, 10, 57, 56, 7, 54, 39, 37, 51, 2, 1, 40, 63,
$ⓒ$	26, 25, 30, 19, 27, 17, 28, 31, 20, 23, 21, 18, 22, 16, 24, 13,	6	88
	12, 29, 8, 43, 14, 41, 0, 5, 38, 4, 6, 11, 3, 9, 32]
	[111, 124, 93, 120, 122, 114, 89, 121, 87, 126, 125, 84, 123, 82,
	112, 80, 79, 106, 105, 110, 75, 107, 73, 108, 119, 100, 117, 116,
	103, 102, 101, 97, 31, 86, 95, 94, 83, 26, 88, 24, 71, 118, 69,
	68, 115, 90, 113, 16, 15, 76, 109, 72, 74, 10, 9, 104, 7, 6, 65,
$ⓓ$	70, 99, 98, 64, 96, 127, 54, 53, 62, 51, 59, 56, 60, 39, 52, 37,	7	99
	36, 55, 58, 57, 49, 63, 44, 47, 40, 42, 46, 45, 41, 35, 34, 33,
	38, 43, 50, 32, 48, 29, 28, 61, 92, 91, 18, 17, 25, 19, 30, 85,
	22, 27, 2, 81, 0, 13, 78, 77, 14, 3, 11, 8, 12, 23, 4, 21, 20,
	67, 66, 5, 1]
	[223, 238, 249, 254, 243, 251, 233, 252, 183, 244, 229, 245, 227,
	246, 240, 176, 175, 174, 253, 204, 203, 170, 169, 248, 247, 226,
	228, 164, 163, 162, 161, 192, 215, 220, 205, 216, 155, 222, 221,
	208, 213, 150, 212, 214, 219, 211, 145, 209, 239, 202, 207, 140,
	195, 234, 193, 136, 231, 230, 199, 197, 131, 198, 225, 200, 63,
	188, 173, 184, 186, 250, 57, 168, 191, 178, 180, 52, 187, 242,
	241, 48, 143, 46, 237, 236, 235, 138, 185, 232, 135, 38, 181, 165,
	35, 166, 33, 224, 31, 30, 153, 158, 147, 218, 217, 156, 159, 148,
$ⓔ$	151, 149, 19, 210, 144, 152, 141, 206, 13, 12, 171, 10, 201, 128,	8	109
	133, 130, 132, 196, 3, 194, 137, 0, 255, 124, 109, 120, 122, 106,
	125, 104, 103, 114, 116, 118, 123, 98, 97, 113, 79, 126, 111, 110,
	99, 74, 121, 72, 71, 70, 117, 101, 115, 102, 65, 112, 127, 90, 89,
	94, 83, 91, 81, 92, 95, 84, 87, 85, 82, 86, 80, 88, 77, 76, 93,
	108, 107, 78, 105, 64, 69, 66, 68, 100, 75, 67, 73, 96, 55, 190,
	189, 62, 51, 59, 41, 60, 119, 182, 37, 53, 179, 54, 177, 32, 45,
	44, 61, 172, 11, 58, 9, 56, 167, 34, 36, 4, 43, 50, 49, 160, 23,
	28, 157, 24, 26, 154, 29, 16, 21, 18, 20, 22, 27, 146, 25, 17, 47,
	142, 15, 14, 139, 42, 1, 40, 39, 134, 7, 5, 2, 6, 129, 8]

Table 4. Table 4: NIST SP 800-22 test results ( ℙ T subscript ℙ 𝑇 \mathbb{P}_{T} )

Test	${\text{MT}}_4$	${\text{MT}}_5$	${\text{MT}}_6$	${\text{MT}}_7$	${\text{MT}}_8$
Frequency (Monobit)	0.924 (1.0)	0.678 (0.98)	0.102 (0.97)	0.213 (0.98)	0.719 (0.99)
Frequency within a Block	0.514 (1.0)	0.419 (0.98)	0.129 (0.98)	0.275 (0.99)	0.455 (0.99)
Cumulative Sums (Cusum) *	0.668 (1.0)	0.568 (0.99)	0.881 (0.98)	0.529 (0.98)	0.657 (0.995)
Runs	0.494 (0.99)	0.595 (0.97)	0.071 (0.97)	0.017 (1.0)	0.834 (1.0)
Longest Run of Ones in a Block	0.366 (0.99)	0.554 (1.0)	0.042 (0.99)	0.051 (0.99)	0.897 (0.97)
Binary Matrix Rank	0.275 (0.98)	0.494 (0.99)	0.719 (1.0)	0.334 (0.98)	0.637 (0.99)
Discrete Fourier Transform (Spectral)	0.122 (0.98)	0.108 (0.99)	0.108 (1.0)	0.514 (0.99)	0.534 (0.98)
Non-overlapping Template Matching*	0.483 (0.990)	0.507 (0.990)	0.520 (0.988)	0.494 (0.988)	0.515 (0.989)
Overlapping Template Matching	0.595 (0.99)	0.759 (1.0)	0.637 (1.0)	0.554 (0.99)	0.236 (1.0)
Maurer’s "Universal Statistical"	0.202 (0.99)	0.000 (0.99)	0.514 (0.98)	0.883 (0.97)	0.366 (0.99)
Approximate Entropy (m=10)	0.616 (0.99)	0.145 (0.99)	0.455 (0.99)	0.262 (0.97)	0.494 (1.0)
Random Excursions *	0.275 (1.0)	0.495 (0.975)	0.465 (0.979)	0.452 (0.991)	0.260 (0.989)
Random Excursions Variant *	0.382 (0.995)	0.400 (0.994)	0.417 (0.984)	0.456 (0.991)	0.389 (0.991)
Serial* (m=10)	0.629 (0.99)	0.963 (0.99)	0.366 (0.995)	0.537 (0.985)	0.253 (0.995)
Linear Complexity	0.494 (0.99)	0.514 (0.98)	0.145 (1.0)	0.657 (0.98)	0.145 (0.99)

Equations

$$F_f(x,i)=(x_1,\dots ,x_{i-1},f_i(x),x_{i+1},\dots ,x_{\mathsf{N}}).$$

$$x^{t+1}=F_f(x^t,s_t).$$

$${\mathcal{H}}_f(x,s)=(F_f(x,s_0),\sigma (s)).$$

$$\sigma ((u^k{)}_{k\in \mathbb{N}})=(u^{k+1}{)}_{k\in \mathbb{N}}.$$

$$\begin{array}[]{l}F_{f,p_{i}}(x,(u^{0},u^{1},\ldots,u^{p_{i}-1}))\mapsto\\ \qquad F_{f}(\ldots(F_{f}(F_{f}(x,u^{0}),u^{1}),\ldots),u^{p_{i}-1}).\end{array}$$

$$\begin{array}[]{cccc}\Sigma:&\mathds{S}_{\mathsf{N},\mathcal{P}}&\rightarrow&\mathds{S}_{\mathsf{N},\mathcal{P}}\\ &\left((u^{k})_{k\in\mathds{N}},(v^{k})_{k\in\mathds{N}}\right)&\mapsto&\begin{array}[]{l}\left(\sigma^{v^{0}}\left((u^{k})_{k\in\mathds{N}}\right),\right.\\ \qquad\left.\sigma\left((v^{k})_{k\in\mathds{N}}\right)\right).\end{array}\end{array}$$

$$\begin{array}[]{cccc}G_{f}:&\mathcal{X}_{\mathsf{N},\mathcal{P}}&\rightarrow&\mathcal{X}_{\mathsf{N},\mathcal{P}}\\ &(e,(u,v))&\mapsto&\left(F_{f,v^{0}}\left(e,(u^{0},\ldots,u^{v^{0}-1}\right),\Sigma(u,v)\right).\end{array}$$

$$d_{\text{mathds}{S}_{\mathsf{N},\mathcal{P}}}(s,\check{s})=0.01\text{leavevmode}0004000000000000000000\text{leavevmode}01\text{leavevmode}\mathrm{1005...}$$

$$d(x,\check{x})=d_{\text{mathds}{S}_{\mathsf{N},\mathcal{P}}}(s,\check{s})+d_{\text{mathds}{B}^{\mathsf{N}}}(e,\check{e}),$$

$$\begin{array}[]{l}d_{\mathds{S}_{\mathsf{N},\mathcal{P}}}(s,\check{s})=\\ \quad\sum_{k=0}^{\infty}\dfrac{1}{10^{(k+1)p+kn\max{(\mathcal{P})}}}\bigg{(}|v^{k}-\check{v}^{k}|\\ \quad\quad+\left|\sum_{l=0}^{v^{k}-1}\dfrac{u^{\sum_{m=0}^{k-1}v^{m}+l}}{10^{(l+1)n}}-\sum_{l=0}^{\check{v}^{k}-1}\dfrac{\check{u}^{\sum_{m=0}^{k-1}\check{v}^{m}+l}}{10^{(l+1)n}}\right|\bigg{)}\end{array}$$

$$y$$

$$\{(e,((u^0,\dots ,u^{v^{k_1-1}},U^0,U^1,\dots ),(v^0,\dots ,v^{k_1},V^0,V^1,\dots ))\mid$$

$$\forall i,j\in \text{mathds}N,U^i\in [[1,\mathsf{N}]],V^j\in \mathcal{P}\}\subset \mathcal{B}(x,\epsilon ),$$

$$s_{i_1},u_0,s_{i_2},u_1,s_{i_3},u_2,\dots ,s_{i_l-1},u_{l-2},s_{i_l},v$$

$$\left\{\begin{array}[]{lcl}c_{\mathsf{N}}+d_{\mathsf{N}}&=&\mathsf{N}\\ c_{\mathsf{N}}a_{\mathsf{N}}+d_{\mathsf{N}}(a_{\mathsf{N}}+2)&=&2^{\mathsf{N}}\end{array}\right.\Leftrightarrow\left\{\begin{array}[]{lcl}d_{\mathsf{N}}&=&\dfrac{2^{\mathsf{N}}-\mathsf{N}.a_{\mathsf{N}}}{2}\\ c_{\mathsf{N}}&=&\mathsf{N}-d_{\mathsf{N}}\end{array}\right.$$

$$\left\{\begin{array}[]{lcl}3.zi_{\mathsf{N}}+ti_{\mathsf{N}}+2.bi_{\mathsf{N}}+\textit{TC}_{\mathsf{N}-2}(i)&=&\textit{TC}_{\mathsf{N}}(i)\\ zi_{\mathsf{N}}+ti_{\mathsf{N}}+bi_{\mathsf{N}}&=&\textit{TC}_{\mathsf{N}-2}(i)\end{array}\right.\qquad\Leftrightarrow$$

$$\left\{\begin{array}[]{lcl}zi_{\mathsf{N}}&=&\dfrac{\textit{TC}_{\mathsf{N}}(i)-2.\textit{TC}_{\mathsf{N}-2}(i)-bi_{\mathsf{N}}}{2}\\ ti_{\mathsf{N}}&=&\textit{TC}_{\mathsf{N}-2}(i)-zi_{\mathsf{N}}-bi_{\mathsf{N}}\end{array}\right.$$

$$\left\{\begin{array}[]{lcl}zi_{\mathsf{N}}&=&\dfrac{\textit{TC}_{\mathsf{N}}(i)-2.\textit{TC}_{\mathsf{N}-2}(i)}{2}\\ ti_{\mathsf{N}}&=&\textit{TC}_{\mathsf{N}-2}(i)-zi_{\mathsf{N}}\end{array}\right.$$

$${\text{TC}}_3$$

$${\text{TC}}_5$$

$${\text{TC}}_7$$

$${\text{TC}}_4$$

$${\text{TC}}_6$$

$$\textit{TC}_{\mathsf{N}}(i)=\left\{\begin{array}[]{l}a_{\mathsf{N}}\textrm{ if }1\leq i\leq c_{\mathsf{N}}\\ a_{\mathsf{N}}+2\textrm{ if }c_{\mathsf{N}}+1\leq i\leq c_{\mathsf{N}}+d_{\mathsf{N}}\end{array}\right.$$

$$\begin{array}[]{rcl}\textit{TC}_{\mathsf{N}}(i)-2.\textit{TC}_{\mathsf{N}-2}(i)&\geq&a_{\mathsf{N}}-2(a_{\mathsf{N}-2}+2)\\ &\geq&\frac{2^{\mathsf{N}}-r_{\mathsf{N}}}{\mathsf{N}}-2\left(\frac{2^{\mathsf{N-2}}-r_{\mathsf{N-2}}}{\mathsf{N-2}}+2\right)\\ &\geq&\frac{2^{\mathsf{N}}-2N}{\mathsf{N}}-2\left(\frac{2^{\mathsf{N-2}}}{\mathsf{N-2}}+2\right)\\ &\geq&\frac{(\mathsf{N}-2).2^{\mathsf{N}}-2N.2^{\mathsf{N-2}}-6N(N-2)}{\mathsf{N.(N-2)}}\\ \end{array}$$

$$p(e)\left\{\begin{array}[]{ll}=\frac{2}{3}\textrm{ if $e=(v,v)$ with $v\in\mathds{B}^{3}$,}\\ =\frac{1}{6}\textrm{ otherwise.}\end{array}\right.$$

$$P=\dfrac{1}{6}\left(\begin{array}[]{llllllll}4&1&1&0&0&0&0&0\\ 1&4&0&0&0&1&0&0\\ 0&0&4&1&0&0&1&0\\ 0&1&1&4&0&0&0&0\\ 1&0&0&0&4&0&1&0\\ 0&0&0&0&1&4&0&1\\ 0&0&0&0&1&0&4&1\\ 0&0&0&1&0&1&0&4\end{array}\right).$$

$$\Vert \pi -\mu {\Vert }_{\mathrm{TV}}=\underset{A\subset \text{mathds}{B}^{\mathsf{N}}}{\max }|\pi (A)-\mu (A)|.$$

$$\Vert \pi -\mu {\Vert }_{\mathrm{TV}}=\frac{1}{2}\sum _{X\in \text{mathds}{B}^{\mathsf{N}}}|\pi (X)-\mu (X)|.$$

$$\Vert \pi -\mu {\Vert }_{\mathrm{TV}}\le \Vert \pi -\nu {\Vert }_{\mathrm{TV}}+\Vert \nu -\mu {\Vert }_{\mathrm{TV}}$$

$$d(t)=\underset{X\in \text{mathds}{B}^{\mathsf{N}}}{\max }\Vert P^t(X,\cdot )-\pi {\Vert }_{\mathrm{TV}}.$$

$$t_{\mathrm{mix}}(\epsilon )=\min \{t\mid d(t)\le \epsilon \}.$$

Full text

In a previous work, some of the authors have proposed the idea of walking into a $\mathsf{N}$-cube where a balanced Hamiltonian cycle has been removed as the basis of a chaotic PRNG. In this article, all the difficult issues observed in the previous work have been tackled. The chaotic behavior of the whole PRNG is proven. The construction of the balanced Hamiltonian cycle is theoretically and practically solved. An upper bound of the expected length of the walk to obtain a uniform distribution is calculated. Finally practical experiments show that the generators successfully pass the classical statistical tests.

1 Introduction

The exploitation of chaotic systems to generate pseudorandom sequences is a very topical issue [18, 17, 7]. Such systems are fundamentally chosen because of their unpredictable character and their sensitiveness to initial conditions. In most cases, these generators simply consist in iterating a chaotic function like the logistic map [18, 17] or the Arnold’s one [7]…Optimal parameters of such functions remain to be found so that attractors are avoided,e.g.. By following this procedure, generated numbers will hopefully follow a uniform distribution. In order to check the quality of the produced outputs, PRNGs (Pseudo-Random Number Generators) are usually tested with statistical batteries like the so-called DieHARD [13], NIST [4], or TestU01 [11] ones.

In its general understanding, the notion of chaos is often reduced to the strong sensitiveness to the initial conditions (the well known “butterfly effect”): a continuous function $k$ defined on a metrical space is said to be strongly sensitive to the initial conditions if for each point $x$ and each positive value $\epsilon$, it is possible to find another point $y$ as close as possible to $x$, and an integer $t$ such that the distance between the $t$-th iterates of $x$ and $y$, denoted by $k^{t}(x)$ and $k^{t}(y)$, is larger than $\epsilon$. However, in his definition of chaos, Devaney [9] imposes to the chaotic function two other properties called transitivity and regularity. The functions mentioned above have been studied according to these properties, and they have been proven as chaotic on $\mathbb{R}$. But nothing guarantees that such properties are preserved when iterating the functions on floating point numbers, which is the domain of interpretation of real numbers $\mathbb{R}$ on machines.

To avoid this lack of chaos, we have previously presented some PRNGs that iterate continuous functions $G_{f}$ on a discrete domain $\{1,\ldots,n\}^{\mathbb{N}}\times\{0,1\}^{n}$, where $f$ is a Boolean function (i.e., $f:\{0,1\}^{\mathsf{N}}\rightarrow\{0,1\}^{\mathsf{N}}$). These generators are $\textit{CIPRNG}_{f}^{1}(u)$ [10, 1], $\textit{CIPRNG}_{f}^{2}(u,v)$ [20], and $\chi_{\textit{14Secrypt}}$ [8] where CI stands for Chaotic Iterations. We have firstly proven in [1] that, to establish the chaotic nature of $\textit{CIPRNG}_{f}^{1}$ algorithm, it is necessary and sufficient that the asynchronous iterations are strongly connected. We then have proven that it is necessary and sufficient that the Markov matrix associated to this graph is doubly stochastic, in order to have a uniform distribution of the outputs. We have finally established sufficient conditions to guarantee the first property of connectivity. Among the generated functions, we thus have considered for further investigations only the ones that satisfy the second property as well.

However, it cannot be directly deduced that $\chi_{\textit{14Secrypt}}$ is chaotic since we do not output all the successive values of iterating $G_{f}$. This algorithm only displays a subsequence $x^{b.n}$ of a whole chaotic sequence $x^{n}$ and it is indeed incorrect to say that the chaos property is preserved for any subsequence of a chaotic sequence. This article presents conditions to preserve this property.

Finding a Boolean function which provides a strongly connected iteration graph having a doubly stochastic Markov matrix is however not an easy task. We have firstly proposed in [1] a generate-and-test based approach that solved this issue. However, this one was not efficient enough. Thus, a second scheme has been further presented in [8] by remarking that a $\mathsf{N}$-cube where an Hamiltonian cycle (or equivalently a Gray code) has been removed is strongly connected and has a doubly stochastic Markov matrix.

However, the removed Hamiltonian cycle has a great influence in the quality of the output. For instance, if this one is not balanced (i.e., the number of changes in different bits are completely different), some bits would be hard to switch. This article shows an effective algorithm that efficiently implements the previous scheme and thus provides functions issued from removing, in the $\mathsf{N}$-cube, a balanced Hamiltonian cycle.

The length $b$ of the walk to reach a distribution close to the uniform one would be dramatically long. This article theoretically and practically studies the length $b$ until the corresponding Markov chain is close to the uniform distribution. Finally, the ability of the approach to face classical tests suite is evaluated.

This article, which is an extension of [8], is organized as follows. The next section is devoted to preliminaries, basic notations, and terminologies regarding Boolean map iterations. Then, in Section 3, Devaney’s definition of chaos is recalled while the proof of chaos of our most general PRNGs is provided. This is the first major contribution. Section 4 recalls a general scheme to obtain functions with an expected behavior. Main theorems are recalled to make the article self-sufficient. The next section (Sect. 5) presents an algorithm that implements this scheme and proves that it always produces a solution. This is the second major contribution. Then, Section 6 defines the theoretical framework to study the mixing-time, i.e., the sufficient amont of time until reaching an uniform distribution. It proves that this one is in the worst case quadratic in the number of elements. Experiments show that the bound is in practice significantly lower. This is the third major contribution. Section 7 gives practical results on evaluating the PRNG against the NIST suite. This research work ends with a conclusion section, where the contribution is summarized and intended future work is outlined.

2 Preliminaries

In what follows, we consider the Boolean algebra on the set $\mathds{B}=\{0,1\}$ with the classical operators of conjunction ’.’, of disjunction ’+’, of negation ’$\overline{\leavevmode\nobreak\ }$’, and of disjunctive union $\oplus$.

Let us first introduce basic notations. Let $\mathsf{N}$ be a positive integer. The set $\{1,2,\ldots,\mathsf{N}\}$ of integers belonging between $1$ and $\mathsf{N}$ is further denoted as $\llbracket 1,\mathsf{N}\rrbracket$. A Boolean map $f$ is a function from $\mathds{B}^{\mathsf{N}}$ to itself such that $x=(x_{1},\dots,x_{\mathsf{N}})$ maps to $f(x)=(f_{1}(x),\dots,f_{\mathsf{N}}(x))$. In what follows, for any finite set $X$, $|X|$ denotes its cardinality and $\lfloor y\rfloor$ is the largest integer lower than $y$.

Functions are iterated as follows. At the $t^{th}$ iteration, only the $s_{t}-$th component is said to be “iterated”, where $s=\left(s_{t}\right)_{t\in\mathds{N}}$ is a sequence of indices taken in $\llbracket 1;{\mathsf{N}}\rrbracket$ called “strategy”. Formally, let $F_{f}:\mathds{B}^{{\mathsf{N}}}\times\llbracket 1;{\mathsf{N}}\rrbracket$ to $\mathds{B}^{\mathsf{N}}$ be defined by

[TABLE]

Then, let $x^{0}\in\mathds{B}^{\mathsf{N}}$ be an initial configuration and $s\in\llbracket 1;{\mathsf{N}}\rrbracket^{\mathbb{N}}$ be a strategy, the dynamics are described by the recurrence

[TABLE]

Let be given a Boolean map $f$. Its associated iteration graph $\Gamma(f)$ is the directed graph such that the set of vertices is $\mathds{B}^{\mathsf{N}}$, and for all $x\in\mathds{B}^{\mathsf{N}}$ and $i\in\llbracket 1;{\mathsf{N}}\rrbracket$, the graph $\Gamma(f)$ contains an arc from $x$ to $F_{f}(x,i)$. Each arc $(x,F_{f}(x,i))$ is labelled with $i$.

Running Example. Let us consider for instance ${\mathsf{N}}=3$. Let $f^{*}:\mathds{B}^{3}\rightarrow\mathds{B}^{3}$ be defined by $f^{*}(x_{1},x_{2},x_{3})=(x_{2}\oplus x_{3},\overline{x_{1}}\overline{x_{3}}+x_{1}\overline{x_{2}},\overline{x_{1}}\overline{x_{3}}+x_{1}x_{2})$. The iteration graph $\Gamma(f^{*})$ of this function is given in Figure 1.

Let us finally recall the pseudorandom number generator $\chi_{\textit{14Secrypt}}$ [8] formalized in Algorithm 1. It is based on random walks in $\Gamma(f)$. More precisely, let be given a Boolean map $f:\mathds{B}^{\mathsf{N}}\rightarrow\mathds{B}^{\mathsf{N}}$, an input PRNG Random, an integer $b$ that corresponds to a number of iterations, and an initial configuration $x^{0}$. Starting from $x^{0}$, the algorithm repeats $b$ times a random choice of which edge to follow and traverses this edge. The final configuration is thus outputted.

Based on this setup, we can study the chaos properties of these functions. This is the aim of the next section.

3 Proof of Chaos

3.1 Motivations

Let us us first recall the chaos theoretical context presented in [1]. In this article, the space of interest is $\mathds{B}^{{\mathsf{N}}}\times\llbracket 1;{\mathsf{N}}\rrbracket^{\mathbb{N}}$ and the iteration function $\mathcal{H}_{f}$ is the map from $\mathds{B}^{{\mathsf{N}}}\times\llbracket 1;{\mathsf{N}}\rrbracket^{\mathbb{N}}$ to itself defined by

[TABLE]

In this definition, $\sigma:\llbracket 1;{\mathsf{N}}\rrbracket^{\mathbb{N}}\longrightarrow\llbracket 1;{\mathsf{N}}\rrbracket^{\mathbb{N}}$ is a shift operation on sequences (i.e., a function that removes the first element of the sequence) formally defined with

[TABLE]

We have proven [1, Theorem 1] that $\mathcal{H}_{f}$ is chaotic in $\mathds{B}^{{\mathsf{N}}}\times\llbracket 1;{\mathsf{N}}\rrbracket^{\mathbb{N}}$ if and only if $\Gamma(f)$ is strongly connected. However, the corollary which would say that $\chi_{\textit{14Secrypt}}$ is chaotic cannot be directly deduced since we do not output all the successive values of iterating $F_{f}$. Only a few of them are concerned and any subsequence of a chaotic sequence is not necessarily a chaotic sequence as well. This necessitates a rigorous proof, which is the aim of this section. Let us firstly recall the theoretical framework in which this research takes place.

3.2 Devaney’s Chaotic Dynamical Systems

Consider a topological space $(\mathcal{X},\tau)$ and a continuous function $f:\mathcal{X}\rightarrow\mathcal{X}$ [9].

Definition 1

The function $f$ is said to be topologically transitive if, for any pair of open sets $U,V\subset\mathcal{X}$, there exists $k>0$ such that $f^{k}(U)\cap V\neq\varnothing$. □

Definition 2

An element $x$ is a periodic point for $f$ of period $n\in\mathds{N}^{*}$ if $f^{n}(x)=x$.□

Definition 3

$f$ is said to be regular on $(\mathcal{X},\tau)$ if the set of periodic points for $f$ is dense in $\mathcal{X}$: for any point $x$ in $\mathcal{X}$, any neighborhood of $x$ contains at least one periodic point (without necessarily the same period). □

Definition 4** (Devaney’s formulation of chaos [9])**

The function $f$ is said to be chaotic on $(\mathcal{X},\tau)$ if $f$ is regular and topologically transitive. □

The chaos property is strongly linked to the notion of “sensitivity”, defined on a metric space $(\mathcal{X},d)$ by:

Definition 5

The function $f$ has sensitive dependence on initial conditions if there exists $\delta>0$ such that, for any $x\in\mathcal{X}$ and any neighborhood $V$ of $x$, there exist $y\in V$ and $n>0$ such that $d\left(f^{n}(x),f^{n}(y)\right)>\delta$.

The constant $\delta$ is called the constant of sensitivity of $f$. □

Indeed, Banks et al. have proven in [3] that when $f$ is chaotic and $(\mathcal{X},d)$ is a metric space, then $f$ has the property of sensitive dependence on initial conditions (this property was formerly an element of the definition of chaos).

3.3 A Metric Space for PRNG Iterations

Let us first introduce $\mathcal{P}\subset\mathds{N}$ a finite nonempty set having the cardinality $\mathsf{p}\in\mathds{N}^{\ast}$. Intuitively, this is the set of authorized numbers of iterations. Denote by $p_{1},p_{2},\ldots,p_{\mathsf{p}}$ the ordered elements of $\mathcal{P}$: $\mathcal{P}=\{p_{1},p_{2},\ldots,p_{\mathsf{p}}\}$ and $p_{1}<p_{2}<\ldots<p_{\mathsf{p}}$.

In our Algorithm 1, $\mathsf{p}$ is 1 and $p_{1}$ is $b$. But this algorithm can be seen as $b$ functional compositions of $F_{f}$. Obviously, it can be generalized with $p_{i}$, $p_{i}\in\mathcal{P}$, functional compositions of $F_{f}$. Thus, for any $p_{i}\in\mathcal{P}$ we introduce the function $F_{f,p_{i}}:\mathds{B}^{\mathsf{N}}\times\llbracket 1,\mathsf{N}\rrbracket^{p_{i}}\rightarrow\mathds{B}^{\mathsf{N}}$ defined by

[TABLE]

The considered space is $\mathcal{X}_{\mathsf{N},\mathcal{P}}=\mathds{B}^{\mathsf{N}}\times\mathds{S}_{\mathsf{N},\mathcal{P}}$, where $\mathds{S}_{\mathsf{N},\mathcal{P}}=\llbracket 1,\mathsf{N}\rrbracket^{\mathbb{N}}\times\mathcal{P}^{\mathbb{N}}$. Each element in this space is a pair where the first element is $\mathsf{N}$-uple in $\mathds{B}^{\mathsf{N}}$, as in the previous space. The second element is a pair $((u^{k})_{k\in\mathbb{N}},(v^{k})_{k\in\mathbb{N}})$ of infinite sequences. The sequence $(v^{k})_{k\in\mathbb{N}}$ defines how many iterations are executed at time $k$ before the next output, while $(u^{k})_{k\in\mathbb{N}}$ details which elements are modified.

Let us introduce the shift function $\Sigma$ for any element of $\mathds{S}_{\mathsf{N},\mathcal{P}}$.

[TABLE]

In other words, $\Sigma$ receives two sequences $u$ and $v$, and it operates $v^{0}$ shifts on the first sequence and a single shift on the second one. Let us consider

[TABLE]

Then the outputs $(y^{0},y^{1},\ldots)$ produced by the $\textit{CIPRNG}_{f}^{2}(u,v)$ generator [21] are by definition the first components of the iterations $X^{0}=(x^{0},(u,v))$ and $\forall n\in\mathds{N},X^{n+1}=G_{f}(X^{n})$ on $\mathcal{X}_{\mathsf{N},\mathcal{P}}$. The new obtained generator can be shown as either a post-treatment over generators $u$ and $v$, or a discrete dynamical system on a set constituted by binary vectors and couple of integer sequences.

3.4 A metric on $\mathcal{X}_{\mathsf{N},\mathcal{P}}$

We define a distance $d$ on $\mathcal{X}_{\mathsf{N},\mathcal{P}}$ as follows. Consider $x=(e,s)$ and $\check{x}=(\check{e},\check{s})$ in $\mathcal{X}_{\mathsf{N},\mathcal{P}}=\mathds{B}^{\mathsf{N}}\times\mathds{S}_{\mathsf{N},\mathcal{P}}$, where $s=(u,v)$ and $\check{s}=(\check{u},\check{v})$ are in $\mathds{S}_{\mathsf{N},\mathcal{P}}=\mathcal{S}_{\llbracket 1,\mathsf{N}\rrbracket}\times\mathcal{S}_{\mathcal{P}}$.

• •

$e$ and $\check{e}$ are integers belonging in $\llbracket 0,2^{\mathsf{N}-1}\rrbracket$. The Hamming distance on their binary decomposition, that is, the number of dissimilar binary digits, constitutes the integral part of $d(X,\check{X})$.

• •

The fractional part is constituted by the differences between $v^{0}$ and $\check{v}^{0}$, followed by the differences between finite sequences $u^{0},u^{1},\ldots,u^{v^{0}-1}$ and $\check{u}^{0},\check{u}^{1},\ldots,\check{u}^{\check{v}^{0}-1}$, followed by differences between $v^{1}$ and $\check{v}^{1}$, followed by the differences between $u^{v^{0}},u^{v^{0}+1},\ldots,u^{v^{1}-1}$ and $\check{u}^{\check{v}^{0}},\check{u}^{\check{v}^{0}+1},\ldots,\check{u}^{\check{v}^{1}-1}$, etc. More precisely, let $p=\lfloor\log_{10}{(\max{\mathcal{P}})}\rfloor+1$ and $n=\lfloor\log_{10}{(\mathsf{N})}\rfloor+1$.

• –

The $p$ first digits of $d(x,\check{x})$ are $|v^{0}-\check{v}^{0}|$ written in decimal numeration (and with $p$ digits: zeros are added on the left if needed).

• –

The next $n\times\max{(\mathcal{P})}$ digits aim at measuring how much $u^{0},u^{1},\ldots,u^{v^{0}-1}$ differ from $\check{u}^{0},\check{u}^{1},\ldots,\check{u}^{\check{v}^{0}-1}$. The $n$ first digits are $|u^{0}-\check{u}^{0}|$. They are followed by $|u^{1}-\check{u}^{1}|$ written with $n$ digits, etc.

If $v^{0}=\check{v}^{0}$, then the process is continued until $|u^{v^{0}-1}-\check{u}^{\check{v}^{0}-1}|$ and the fractional part of $d(X,\check{X})$ is completed by 0’s until reaching $p+n\times\max{(\mathcal{P})}$ digits.

• *

If $v^{0}<\check{v}^{0}$, then the $\max{(\mathcal{P})}$ blocs of $n$ digits are $|u^{0}-\check{u}^{0}|$, …, $|u^{v^{0}-1}-\check{u}^{v^{0}-1}|$, $\check{u}^{v^{0}}$ (on $n$ digits), …, $\check{u}^{\check{v}^{0}-1}$ (on $n$ digits), followed by 0’s if required.

• *

The case $v^{0}>\check{v}^{0}$ is dealt similarly.

• –

The next $p$ digits are $|v^{1}-\check{v}^{1}|$, etc.

This distance has been defined to capture all aspects of divergences between two sequences generated by the $\textit{CIPRNG}_{f}^{2}$ method, when setting respectively $(u,v)$ and $(\check{u},\check{v})$ as inputted couples of generators. The integral part measures the bitwise Hamming distance between the two $\mathsf{N}$-length binary vectors chosen as seeds. The fractional part must decrease when the number of identical iterations applied by the $\textit{CIPRNG}_{f}^{2}$ discrete dynamical system on these seeds, in both cases (that is, when inputting either $(u,v)$ or $(\check{u},\check{v})$), increases. More precisely, the fractional part will alternately measure the following elements:

• •

Do we iterate the same number of times between the next two outputs, when considering either $(u,v)$ or $(\check{u},\check{v})$?

• •

Then, do we iterate the same components between the next two outputs of $\textit{CIPRNG}_{f}^{2}$ ?

• •

etc.

Finally, zeros are put to be able to recover what occurred at a given iteration. Such aims are illustrated in the two following examples. Running Example. Consider for instance that $\mathsf{N}=13$, $\mathcal{P}=\{1,2,11\}$ (so $\mathsf{p}=3$, $p=\lfloor\log_{10}{(\max{\mathcal{P}})}\rfloor+1=2$, while $n=2$), and that s=\left\{\begin{array}[]{l}u=\underline{6,}\leavevmode\nobreak\ \underline{11,5},...\\ v=1,2,...\end{array}\right. while \check{s}=\left\{\begin{array}[]{l}\check{u}=\underline{6,4}\leavevmode\nobreak\ \underline{1},...\\ \check{v}=2,1,...\end{array}\right..

So

[TABLE]

Indeed, the $p=2$ first digits are 01, as $|v^{0}-\check{v}^{0}|=1$, and we use $p$ digits to code this difference ($\mathcal{P}$ being $\{1,2,11\}$, this difference can be equal to 10). We then take the $v^{0}=1$ first terms of $u$, each term being coded in $n=2$ digits, that is, 06. As we can iterate at most $\max{(\mathcal{P})}$ times, we must complete this value by some 0’s in such a way that the obtained result has $n\times\max{(\mathcal{P})}=22$ digits, that is: 0600000000000000000000. Similarly, the first $\check{v}^{0}=2$ terms in $\check{u}$ are represented by 0604000000000000000000, and the value of their digit per digit absolute difference is equal to 0004000000000000000000. These digits are concatenated to 01, and we start again with the remainder of the sequences.

Running Example. Consider now that $\mathsf{N}=9$ ($n=1$), $\mathcal{P}=\{2,7\}$ ($\mathsf{p}=2,p=1$), and that

s=\left\{\begin{array}[]{l}u=\underline{6,7,}\leavevmode\nobreak\ \underline{4,2,}...\\ v=2,2,...\end{array}\right.

while \check{s}=\left\{\begin{array}[]{l}\check{u}=\underline{4,9,6,3,6,6,7,}\leavevmode\nobreak\ \underline{9,8},...\\ \check{v}=7,2,...\end{array}\right.

So: $d_{\mathds{S}_{\mathsf{N},\mathcal{P}}}(s,\check{s})=0.5\leavevmode\nobreak\ 2263667\leavevmode\nobreak\ 1\leavevmode\nobreak\ 5600000...$.

$d$ can be more rigorously written as follows:

[TABLE]

where:

• •

$d_{\mathds{B}^{\mathsf{N}}}$ is the Hamming distance,

• •

$\forall s=(u,v),\check{s}=(\check{u},\check{v})\in\mathcal{S}_{\mathsf{N},\mathcal{P}}$,

[TABLE]

Let us show that,

Proposition 1

$d$* is a distance on $\mathcal{X}_{\mathsf{N},\mathcal{P}}$. *

Proof

$d_{\mathds{B}^{\mathsf{N}}}$ is the Hamming distance. We will prove that $d_{\mathds{S}_{\mathsf{N},\mathcal{P}}}$ is a distance too, thus $d$ will also be a distance, being the sum of two distances.

• •

Obviously, $d_{\mathds{S}_{\mathsf{N},\mathcal{P}}}(s,\check{s})\geqslant 0$, and if $s=\check{s}$, then $d_{\mathds{S}_{\mathsf{N},\mathcal{P}}}(s,\check{s})=0$. Conversely, if $d_{\mathds{S}_{\mathsf{N},\mathcal{P}}}(s,\check{s})=0$, then $\forall k\in\mathds{N},v^{k}=\check{v}^{k}$ due to the definition of $d$. Then, as digits between positions $p+1$ and $p+n$ are null and correspond to $|u^{0}-\check{u}^{0}|$, we can conclude that $u^{0}=\check{u}^{0}$. An extension of this result to the whole first $n\times\max{(\mathcal{P})}$ blocs leads to $u^{i}=\check{u}^{i}$, $\forall i\leqslant v^{0}=\check{v}^{0}$, and by checking all the $n\times\max{(\mathcal{P})}$ blocs, $u=\check{u}$.

• •

$d_{\mathds{S}_{\mathsf{N},\mathcal{P}}}$ is clearly symmetric ($d_{\mathds{S}_{\mathsf{N},\mathcal{P}}}(s,\check{s})=d_{\mathds{S}_{\mathsf{N},\mathcal{P}}}(\check{s},s)$).

• •

The triangle inequality is obtained because the absolute value satisfies it as well.

■

Before being able to study the topological behavior of the general chaotic iterations, we must first establish that:

Proposition 2

*For all $f:\mathds{B}^{\mathsf{N}}\longrightarrow\mathds{B}^{\mathsf{N}}$, the function $G_{f}$ is continuous on $\left(\mathcal{X},d\right)$. *

Proof

We will show this result by using the sequential continuity. Consider a sequence $x^{n}=(e^{n},(u^{n},v^{n}))\in\mathcal{X}_{\mathsf{N},\mathcal{P}}^{\mathds{N}}$ such that $d(x^{n},x)\longrightarrow 0$, for some $x=(e,(u,v))\in\mathcal{X}_{\mathsf{N},\mathcal{P}}$. We will show that $d\left(G_{f}(x^{n}),G_{f}(x)\right)\longrightarrow 0$. Remark that $u$ and $v$ are sequences of sequences.

As $d(x^{n},x)\longrightarrow 0$, there exists $n_{0}\in\mathds{N}$ such that $d(x^{n},x)<10^{-(p+n\max{(\mathcal{P})})}$ (its $p+n\max{(\mathcal{P})}$ first digits are null). In particular, $\forall n\geqslant n_{0},e^{n}=e$, as the Hamming distance between the integral parts of $x$ and $\check{x}$ is 0. Similarly, due to the nullity of the $p+n\max{(\mathcal{P})}$ first digits of $d(x^{n},x)$, we can conclude that $\forall n\geqslant n_{0}$, $(v^{n})^{0}=v^{0}$, and that $\forall n\geqslant n_{0}$, $(u^{n})^{0}=u^{0}$, $(u^{n})^{1}=u^{1}$, …, $(u^{n})^{v^{0}-1}=u^{v^{0}-1}$. This implies that:

• •

$G_{f}(x^{n})_{1}=G_{f}(x)_{1}$: they have the same Boolean vector as first coordinate.

• •

$d_{\mathds{S}_{\mathsf{N},\mathcal{P}}}(\Sigma(u^{n},v^{n});\Sigma(u,v))=10^{p+n\max{(\mathcal{P})}}d_{\mathds{S}_{\mathsf{N},\mathcal{P}}}((u^{n},v^{n});(u,v))$. As the right part of the equality tends to 0, we can deduce that it is also the case for the left part of the equality, and so $G_{f}(x^{n})_{2}$ is convergent to $G_{f}(x)_{2}$.

■

3.5 $\Gamma_{\mathcal{P}}(f)$ as an extension of $\Gamma(f)$

Let $\mathcal{P}=\{p_{1},p_{2},\ldots,p_{\mathsf{p}}\}$. We define the directed graph $\Gamma_{\mathcal{P}}(f)$ as follows.

• •

Its vertices are the $2^{\mathsf{N}}$ elements of $\mathds{B}^{\mathsf{N}}$.

• •

Each vertex has $\displaystyle{\sum_{i=1}^{\mathsf{p}}\mathsf{N}^{p_{i}}}$ arrows, namely all the $p_{1},p_{2},\ldots,p_{\mathsf{p}}$ tuples having their elements in $\llbracket 1,\mathsf{N}\rrbracket$.

• •

There is an arc labeled $u_{0},\ldots,u_{p_{i}-1}$, $i\in\llbracket 1,\mathsf{p}\rrbracket$ between vertices $x$ and $y$ if and only if $y=F_{f,p_{i}}(x,(u_{0},\ldots,u_{p_{i}-1}))$.

It is not hard to see that the graph $\Gamma_{\{1\}}(f)$ is $\Gamma(f)$ formerly introduced in [1] for the $\textit{CIPRNG}_{f}^{1}(u)$ generator, which is indeed $\textit{CIPRNG}_{f}^{2}(u,(1)_{n\in\mathds{N}})$.

Running Example. Consider for instance $\mathsf{N}=2$, Let $f_{0}:\mathds{B}^{2}\longrightarrow\mathds{B}^{2}$ be the negation function, i.e., $f_{0}(x_{1},x_{2})=(\overline{x_{1}},\overline{x_{2}})$, and consider $\mathcal{P}=\{2,3\}$. The graphs of iterations are given in Figure 2. Figure 2(a) shows what happens when each iteration result is displayed . On the contrary, Figure 2(b) illustrates what happens when 2 or 3 modifications are systematically applied before results are generated. Notice that here, the orientations of arcs are not necessary since the function $f_{0}$ is equal to its inverse $f_{0}^{-1}$.

3.6 Proofs of chaos

We will show that,

Proposition 3

$\Gamma_{\mathcal{P}}(f)$* is strongly connected if and only if $G_{f}$ is topologically transitive on $(\mathcal{X}_{\mathsf{N},\mathcal{P}},d)$. *

Proof

Suppose that $\Gamma_{\mathcal{P}}(f)$ is strongly connected. Let $x=(e,(u,v)),\check{x}=(\check{e},(\check{u},\check{v}))\in\mathcal{X}_{\mathsf{N},\mathcal{P}}$ and $\varepsilon>0$. We will find a point $y$ in the open ball $\mathcal{B}(x,\varepsilon)$ and $n_{0}\in\mathds{N}$ such that $G_{f}^{n_{0}}(y)=\check{x}$: this strong transitivity will imply the transitivity property. We can suppose that $\varepsilon<1$ without loss of generality.

Let us denote by $(E,(U,V))$ the elements of $y$. As $y$ must be in $\mathcal{B}(x,\varepsilon)$ and $\varepsilon<1$, $E$ must be equal to $e$. Let $k=\lfloor\log_{10}(\varepsilon)\rfloor+1$. $d_{\mathds{S}_{\mathsf{N},\mathcal{P}}}((u,v),(U,V))$ must be lower than $\varepsilon$, so the $k$ first digits of the fractional part of $d_{\mathds{S}_{\mathsf{N},\mathcal{P}}}((u,v),(U,V))$ are null. Let $k_{1}$ be the smallest integer such that, if $V^{0}=v^{0}$, …, $V^{k_{1}}=v^{k_{1}}$, $U^{0}=u^{0}$, …, $U^{\sum_{l=0}^{k_{1}}V^{l}-1}=u^{\sum_{l=0}^{k_{1}}v^{l}-1}$. Then $d_{\mathds{S}_{\mathsf{N},\mathcal{P}}}((u,v),(U,V))<\varepsilon$. In other words, any $y$ of the form $(e,((u^{0},...,u^{\sum_{l=0}^{k_{1}}v^{l}-1}),(v^{0},...,v^{k_{1}}))$ is in $\mathcal{B}(x,\varepsilon)$.

Let $y^{0}$ such a point and $z=G_{f}^{k_{1}}(y^{0})=(e^{\prime},(u^{\prime},v^{\prime}))$. $\Gamma_{\mathcal{P}}(f)$ being strongly connected, there is a path between $e^{\prime}$ and $\check{e}$. Denote by $a_{0},\ldots,a_{k_{2}}$ the edges visited by this path. We denote by $V^{k_{1}}=|a_{0}|$ (number of terms in the finite sequence $a_{1}$), $V^{k_{1}+1}=|a_{1}|$, …, $V^{k_{1}+k_{2}}=|a_{k_{2}}|$, and by $U^{k_{1}}=a_{0}^{0}$, $U^{k_{1}+1}=a_{0}^{1}$, …, $U^{k_{1}+V_{k_{1}}-1}=a_{0}^{V_{k_{1}}-1}$, $U^{k_{1}+V_{k_{1}}}=a_{1}^{0}$, $U^{k_{1}+V_{k_{1}}+1}=a_{1}^{1}$,…

Let

[TABLE]

So $y\in\mathcal{B}(x,\varepsilon)$ and $G_{f}^{k_{1}+k_{2}}(y)=\check{x}$.

Conversely, if $\Gamma_{\mathcal{P}}(f)$ is not strongly connected, then there are 2 vertices $e_{1}$ and $e_{2}$ such that there is no path between $e_{1}$ and $e_{2}$. Thus, it is impossible to find $(u,v)\in\mathds{S}_{\mathsf{N},\mathcal{P}}$ and $n\in\mathds{N}$ such that $G_{f}^{n}(e,(u,v))_{1}=e_{2}$. The open ball $\mathcal{B}(e_{2},1/2)$ cannot be reached from any neighborhood of $e_{1}$, and thus $G_{f}$ is not transitive. ■

We now show that,

Proposition 4

*If $\Gamma_{\mathcal{P}}(f)$ is strongly connected, then $G_{f}$ is regular on $(\mathcal{X}_{\mathsf{N},\mathcal{P}},d)$. *

Proof

Let $x=(e,(u,v))\in\mathcal{X}_{\mathsf{N},\mathcal{P}}$ and $\varepsilon>0$. As in the proofs of Prop. 3, let $k_{1}\in\mathds{N}$ such that

[TABLE]

[TABLE]

and $y=G_{f}^{k_{1}}(e,(u,v))$. $\Gamma_{\mathcal{P}}(f)$ being strongly connected, there is at least a path from the Boolean state $y_{1}$ of $y$ to $e$. Denote by $a_{0},\ldots,a_{k_{2}}$ the edges of such a path. Then the point:$(e,((u^{0},\dots,u^{v^{k_{1}-1}},a_{0}^{0},\dots,a_{0}^{|a_{0}|},a_{1}^{0},\dots,a_{1}^{|a_{1}|},\dots,a_{k_{2}}^{0},\dots,$ \,a_{k_{2}}^{|a_{k_{2}}|},u^{0},\dots,u^{v^{k_{1}-1}},a_{0}^{0},\dots,a_{k_{2}}^{|a_{k_{2}}|}\dots),$$(v^{0},\dots,v^{k_{1}},|a_{0}|,\dots,|a_{k_{2}}|,v^{0},\dots,v^{k_{1}},|a_{0}|,\dots,|a_{k_{2}}|,\dots)) is a periodic point in the neighborhood $\mathcal{B}(x,\varepsilon)$ of $x$. ■

$G_{f}$ being topologically transitive and regular, we can thus conclude that

Theorem 1

*Function $G_{f}$ is chaotic on $(\mathcal{X}_{\mathsf{N},\mathcal{P}},d)$ if and only if its iteration graph $\Gamma_{\mathcal{P}}(f)$ is strongly connected. *

Corollary 1

*The pseudorandom number generator $\chi_{\textit{14Secrypt}}$ is not chaotic on $(\mathcal{X}_{\mathsf{N},\{b\}},d)$ for the negation function. *

Proof

In this context, $\mathcal{P}$ is the singleton $\{b\}$. If $b$ is even, no vertex $e$ of $\Gamma_{\{b\}}(f_{0})$ can reach its neighborhood and thus $\Gamma_{\{b\}}(f_{0})$ is not strongly connected. If $b$ is odd, no vertex $e$ of $\Gamma_{\{b\}}(f_{0})$ can reach itself and thus $\Gamma_{\{b\}}(f_{0})$ is not strongly connected. ■

3.7 Comparison with other well-known generators

The objective of this section is to evaluate the statistical performance of the proposed CIPRNG method, by comparing the effects of its application on well-known but defective generators. We considered during the experiments the following PRNGs: linear congruential generator (LCG), multiple recursive generators (MRG) add-with-carry (AWC), subtract-with-borrow (SWB), shift-with-carry (SWC) Generalized Feedback Shift Register (GFSR), and nonlinear inversive generator. A general overview and a reminder of these generators can be found, for instance, in the documentation of the TestU01 statistical battery of tests [11]. For each studied generator, we have compared their scores according to both NIST [4] and DieHARD [13] statistical batteries of tests, by launching them alone or inside the $\textit{CIPRNG}_{f}^{2}(v,v)$ dynamical system, where $v$ is the considered PRNG set with most usual parameters, and $f$ is the vectorial negation.

Obtained results are reproduced in Tables 1 and 2. As can be seen, all these generators considered alone failed to pass either the 15 NIST tests or the 18 DieHARD ones, while both batteries of tests are always passed when applying the $\textit{CIPRNG}_{f}^{2}$ post-treatment. Other results in the same direction, which can be found in [2], illustrate the fact that operating a provable chaotic post-treatment on defective generators tends to improve their statistical profile.

Such post-treatment depending on the properties of the inputted function $f$, we need to recall a general scheme to produce functions and an iteration number $b$ such that $\Gamma_{\{b\}}$ is strongly connected.

4 Functions with Strongly Connected $\Gamma_{\{b\}}(f)$

First of all, let $f:\mathds{B}^{{\mathsf{N}}}\rightarrow\mathds{B}^{{\mathsf{N}}}$. It has been shown [1, Theorem 4] that if its iteration graph $\Gamma(f)$ is strongly connected, then the output of $\chi_{\textit{14Secrypt}}$ follows a law that tends to the uniform distribution if and only if its Markov matrix is a doubly stochastic one. In [8, Section 4], we have presented a general scheme which generates function with strongly connected iteration graph $\Gamma(f)$ and with doubly stochastic Markov probability matrix.

Basically, let us consider the ${\mathsf{N}}$-cube. Let us next remove one Hamiltonian cycle in this one. When an edge $(x,y)$ is removed, an edge $(x,x)$ is added.

Running Example. For instance, the iteration graph $\Gamma(f^{*})$ (given in Figure 1) is the $3$-cube in which the Hamiltonian cycle $000,100,101,001,011,111,$ $110,010,000$ has been removed.

We have first proven the following result, which states that the ${\mathsf{N}}$-cube without one Hamiltonian cycle has the awaited property with regard to the connectivity.

Theorem 2

*The iteration graph $\Gamma(f)$ issued from the ${\mathsf{N}}$-cube where an Hamiltonian cycle is removed, is strongly connected. *

Moreover, when all the transitions have the same probability ($\frac{1}{n}$), we have proven the following results:

Theorem 3

*The Markov Matrix $M$ resulting from the ${\mathsf{N}}$-cube in which an Hamiltonian cycle is removed, is doubly stochastic. *

Let us consider now a ${\mathsf{N}}$-cube where an Hamiltonian cycle is removed. Let $f$ be the corresponding function. The question which remains to be solved is: can we always find $b$ such that $\Gamma_{\{b\}}(f)$ is strongly connected?

The answer is indeed positive. Furthermore, we have the following results which are stronger than previous ones.

Theorem 4

*There exists $b\in\mathbb{N}$ such that $\Gamma_{\{b\}}(f)$ is complete. *

Proof

There is an arc $(x,y)$ in the graph $\Gamma_{\{b\}}(f)$ if and only if $M^{b}_{xy}$ is positive where $M$ is the Markov matrix of $\Gamma(f)$. It has been shown in [1, Lemma 3] that $M$ is regular. Thus, there exists $b$ such that there is an arc between any $x$ and $y$. ■

This section ends with the idea of removing a Hamiltonian cycle in the $\mathsf{N}$-cube. In such a context, the Hamiltonian cycle is equivalent to a Gray code. Many approaches have been proposed as a way to build such codes, for instance the Reflected Binary Code. In this one and for a $\mathsf{N}$-length cycle, one of the bits is exactly switched $2^{\mathsf{N}-1}$ times whereas the other bits are modified at most $\left\lfloor\dfrac{2^{\mathsf{N-1}}}{\mathsf{N}-1}\right\rfloor$ times. It is clear that the function that is built from such a code would not provide a uniform output.

The next section presents how to build balanced Hamiltonian cycles in the $\mathsf{N}$-cube with the objective to embed them into the pseudorandom number generator.

5 Balanced Hamiltonian Cycle

Many approaches have been developed to solve the problem of building a Gray code in a $\mathsf{N}$-cube [16, 5, 19, 6], according to properties the produced code has to verify. For instance, [5, 19] focus on balanced Gray codes. In the transition sequence of these codes, the number of transitions of each element must differ at most by 2. This uniformity is a global property on the cycle, i.e., a property that is established while traversing the whole cycle. On the other hand, when the objective is to follow a subpart of the Gray code and to switch each element approximately the same amount of times, local properties are wished. For instance, the locally balanced property is studied in [6] and an algorithm that establishes locally balanced Gray codes is given.

The current context is to provide a function $f:\mathds{B}^{\mathsf{N}}\rightarrow\mathds{B}^{\mathsf{N}}$ by removing an Hamiltonian cycle in the $\mathsf{N}$-cube. Such a function is going to be iterated $b$ times to produce a pseudorandom number, i.e., a vertex in the $\mathsf{N}$-cube. Obviously, the number of iterations $b$ has to be sufficiently large to provide a uniform output distribution. To reduce the number of iterations, it can be claimed that the provided Gray code should ideally possess both balanced and locally balanced properties. However, both algorithms are incompatible with the second one: balanced Gray codes that are generated by state of the art works [19, 5] are not locally balanced. Conversely, locally balanced Gray codes yielded by Igor Bykov approach [6] are not globally balanced. This section thus shows how the non deterministic approach presented in [19] has been automatized to provide balanced Hamiltonian paths such that, for each subpart, the number of switches of each element is as uniform as possible.

5.1 Analysis of the Robinson-Cohn extension algorithm

As far as we know three works, namely [16], [5], and [19] have addressed the problem of providing an approach to produce balanced gray code. The authors of [16] introduced an inductive approach aiming at producing balanced Gray codes, assuming the user gives a special subsequence of the transition sequence at each induction step. This work has been strengthened in [5] where the authors have explicitly shown how to build such a subsequence. Finally the authors of [19] have presented the Robinson-Cohn extension algorithm. Their rigorous presentation of this algorithm has mainly allowed them to prove two properties. The former states that if $\mathsf{N}$ is a 2-power, a balanced Gray code is always totally balanced. The latter states that for every $\mathsf{N}$ there exists a Gray code such that all transition count numbers are 2-powers whose exponents are either equal or differ from each other by 1. However, the authors do not prove that the approach allows to build (totally balanced) Gray codes. What follows shows that this fact is established and first recalls the approach.

Let be given a $\mathsf{N}-2$-bit Gray code whose transition sequence is $S_{\mathsf{N}-2}$. What follows is the Robinson-Cohn extension method [19] which produces a $\mathsf{N}$-bits Gray code.

Let $l$ be an even positive integer. Find $u_{1},u_{2},\dots,u_{l-2},v$ (maybe empty) subsequences of $S_{\mathsf{N}-2}$ such that $S_{\mathsf{N}-2}$ is the concatenation of

[TABLE]

where $i_{1}=1$, $i_{2}=2$, and $u_{0}=\emptyset$ (the empty sequence). 2. 2.

Replace in $S_{\mathsf{N}-2}$ the sequences $u_{0},u_{1},u_{2},\ldots,u_{l-2}$ by $\mathsf{N}-1,u^{\prime}(u_{1},\mathsf{N}-1,\mathsf{N}),u^{\prime}(u_{2},\mathsf{N},\mathsf{N}-1),u^{\prime}(u_{3},\mathsf{N}-1,\mathsf{N}),\dots,u^{\prime}(u_{l-2},\mathsf{N},\mathsf{N}-1)$ respectively, where $u^{\prime}(u,x,y)$ is the sequence $u,x,u^{R},y,u$ such that $u^{R}$ is $u$ in reversed order. The obtained sequence is further denoted as $U$. 3. 3.

Construct the sequences $V=v^{R},\mathsf{N},v$, $W=\mathsf{N}-1,S_{\mathsf{N}-2},\mathsf{N}$, and let $W^{\prime}$ be $W$ where the first two elements have been exchanged. 4. 4.

The transition sequence $S_{\mathsf{N}}$ is thus the concatenation $U^{R},V,W^{\prime}$.

It has been proven in [19] that $S_{\mathsf{N}}$ is the transition sequence of a cyclic $\mathsf{N}$-bits Gray code if $S_{\mathsf{N}-2}$ is. However, step (1) is not a constructive step that precises how to select the subsequences which ensure that yielded Gray code is balanced. Following sections show how to choose the sequence $l$ to have the balance property.

5.2 Balanced Codes

Let us first recall how to formalize the balance property of a Gray code. Let $L=w_{1},w_{2},\dots,w_{2^{\mathsf{N}}}$ be the sequence of a $\mathsf{N}$-bits cyclic Gray code. The transition sequence $S=s_{1},s_{2},\dots,s_{2^{n}}$, $s_{i}$, $1\leq i\leq 2^{\mathsf{N}}$, indicates which bit position changes between codewords at index $i$ and $i+1$ modulo $2^{\mathsf{N}}$. The transition count function $\textit{TC}_{\mathsf{N}}:\{1,\dots,\mathsf{N}\}\rightarrow\{0,\ldots,2^{\mathsf{N}}\}$ gives the number of times $i$ occurs in $S$, i.e., the number of times the bit $i$ has been switched in $L$.

The Gray code is totally balanced if $\textit{TC}_{\mathsf{N}}$ is constant (and equal to $\frac{2^{\mathsf{N}}}{\mathsf{N}}$). It is balanced if for any two bit indices $i$ and $j$, $|\textit{TC}_{\mathsf{N}}(i)-\textit{TC}_{\mathsf{N}}(j)|\leq 2$.

Running Example. Let $L^{*}=000,100,101,001,011,111,$ $110,010$ be the Gray code that corresponds to the Hamiltonian cycle that has been removed in $f^{*}$. Its transition sequence is $S=3,1,3,2,3,1,3,2$ and its transition count function is $\textit{TC}_{3}(1)=\textit{TC}_{3}(2)=2$ and $\textit{TC}_{3}(3)=4$. Such a Gray code is balanced.

Let $L^{4}$ $=0000,0010,0110,1110,1111,0111,0011,0001,0101,0100,1100,1101,1001,1011,1010,1000$ be a cyclic Gray code. Since $S=2,3,4,1,4,$ $3,2,3,1,4,1,3,2,1,2,4$, $\textit{TC}_{4}$ is equal to 4 everywhere, this code is thus totally balanced.

On the contrary, for the standard $4$-bits Gray code $L^{\textit{st}}=0000,0001,0011,0010,0110,0111,0101,0100,$

$1100,1101,1111,1110,1010,1011,1001,1000$, we have $\textit{TC}_{4}(1)=8$ $\textit{TC}_{4}(2)=4$ $\textit{TC}_{4}(3)=\textit{TC}_{4}(4)=2$ and the code is neither balanced nor totally balanced.

Theorem 5

*Let $\mathsf{N}$ in $\mathbb{N}^{*}$, and $a_{\mathsf{N}}$ be defined by $a_{\mathsf{N}}=2\left\lfloor\dfrac{2^{\mathsf{N}}}{2\mathsf{N}}\right\rfloor$. There exists then a sequence $l$ in step (1) of the Robinson-Cohn extension algorithm such that all the transition counts $\textit{TC}_{\mathsf{N}}(i)$ are $a_{\mathsf{N}}$ or $a_{\mathsf{N}}+2$ for any $i$, $1\leq i\leq\mathsf{N}$. *

The proof is done by induction on $\mathsf{N}$. Let us immediately verify that it is established for both odd and even smallest values, i.e., $3$ and $4$. For the initial case where $\mathsf{N}=3$, i.e., $\mathsf{N-2}=1$ we successively have: $S_{1}=1,1$, $l=2$, $u_{0}=\emptyset$, and $v=\emptyset$. Thus again the algorithm successively produces $U=1,2,1$, $V=3$, $W=2,1,1,3$, and $W^{\prime}=1,2,1,3$. Finally, $S_{3}$ is $1,2,1,3,1,2,1,3$ which obviously verifies the theorem. For the initial case where $\mathsf{N}=4$, i.e., $\mathsf{N-2}=2$ we successively have: $S_{1}=1,2,1,2$, $l=4$, $u_{0},u_{1},u_{2}=\emptyset,\emptyset,\emptyset$, and $v=\emptyset$. Thus again the algorithm successively produces $U=1,3,2,3,4,1,4,3,2$, $V=4$, $W=3,1,2,1,2,4$, and $W^{\prime}=1,3,2,1,2,4$. Finally, $S_{4}$ is $2,3,4,1,4,3,2,3,1,4,1,3,2,1,2,4$ such that $\textit{TC}_{4}(i)=4$ and the theorem is established for odd and even initial values.

For the inductive case, let us first define some variables. Let $c_{\mathsf{N}}$ (resp. $d_{\mathsf{N}}$) be the number of elements whose transition count is exactly $a_{\mathsf{N}}$ (resp $a_{\mathsf{N}}+2$). Both of these variables are defined by the system

[TABLE]

Since $a_{\mathsf{N}}$ is even, $d_{\mathsf{N}}$ is an integer. Let us first prove that both $c_{\mathsf{N}}$ and $d_{\mathsf{N}}$ are positive integers. Let $q_{\mathsf{N}}$ and $r_{\mathsf{N}}$, respectively, be the quotient and the remainder in the Euclidean division of $2^{\mathsf{N}}$ by $2\mathsf{N}$, i.e., $2^{\mathsf{N}}=q_{\mathsf{N}}.2\mathsf{N}+r_{\mathsf{N}}$, with $0\leq r_{\mathsf{N}}<2\mathsf{N}$. First of all, the integer $r$ is even since $r_{\mathsf{N}}=2^{\mathsf{N}}-q_{\mathsf{N}}.2\mathsf{N}=2(2^{\mathsf{N}-1}-q_{\mathsf{N}}.\mathsf{N})$. Next, $a_{\mathsf{N}}$ is $\frac{2^{\mathsf{N}}-r_{\mathsf{N}}}{\mathsf{N}}$. Consequently $d_{\mathsf{N}}$ is $r_{\mathsf{N}}/2$ and is thus a positive integer s.t. $0\leq d_{\mathsf{N}}<\mathsf{N}$. The proof for $c_{\mathsf{N}}$ is obvious.

For any $i$, $1\leq i\leq\mathsf{N}$, let $zi_{\mathsf{N}}$ (resp. $ti_{\mathsf{N}}$ and $bi_{\mathsf{N}}$) be the occurrence number of element $i$ in the sequence $u_{0},\dots,u_{l-2}$ (resp. in the sequences $s_{i_{1}},\dots,s_{i_{l}}$ and $v$) in step (1) of the algorithm.

Due to the definition of $u^{\prime}$ in step (2), $3.zi_{\mathsf{N}}+ti_{\mathsf{N}}$ is the number of element $i$ in the sequence $U$. It is clear that the number of element $i$ in the sequence $V$ is $2bi_{\mathsf{N}}$ due to step (3). We thus have the following system:

[TABLE]

[TABLE]

In this set of 2 equations with 3 unknown variables, let $b_{i}$ be set with 0. In this case, since $\textit{TC}_{\mathsf{N}}$ is even (equal to $a_{\mathsf{N}}$ or to $a_{\mathsf{N}}+2$), the variable $zi_{\mathsf{N}}$ is thus an integer. Let us now prove that the resulting system has always positive integer solutions $z_{i}$, $t_{i}$, $0\leq z_{i},t_{i}\leq\textit{TC}_{\mathsf{N}-2}(i)$ and s.t. their sum is equal to $\textit{TC}_{\mathsf{N}-2}(i)$. This latter constraint is obviously established if the system has a solution. We thus have the following system.

[TABLE]

The definition of $\textit{TC}_{\mathsf{N}}(i)$ depends on the value of $\mathsf{N}$. When $3\leq N\leq 7$, values are defined as follows:

[TABLE]

It is not difficult to check that all these instanciations verify the aforementioned constraints.

When $N\geq 8$, $\textit{TC}_{\mathsf{N}}(i)$ is defined as follows:

[TABLE]

We thus have

[TABLE]

A simple variation study of the function $t:\mathbb{R}\rightarrow\mathbb{R}$ such that $x\mapsto t(x)=(x-2).2^{x}-2x.2^{x-2}-6x(x-2)$ shows that its derivative is strictly positive if $x\geq 6$ and $t(8)=224$. The integer $\textit{TC}_{\mathsf{N}}(i)-2.\textit{TC}_{\mathsf{N}-2}(i)$ is thus positive for any $\mathsf{N}\geq 8$ and the proof is established.

For each element $i$, we are then left to choose $zi_{\mathsf{N}}$ positions among $\textit{TC}_{\mathsf{N}}(i)$, which leads to ${\textit{TC}_{\mathsf{N}}(i)\choose zi_{\mathsf{N}}}$ possibilities. Notice that all such choices lead to an Hamiltonian path.

6 Mixing Time

This section considers functions $f:\mathds{B}^{\mathsf{N}}\rightarrow\mathds{B}^{\mathsf{N}}$ issued from an hypercube where an Hamiltonian path has been removed as described in the previous section. Notice that the iteration graph is always a subgraph of ${\mathsf{N}}$-cube augmented with all the self-loop, i.e., all the edges $(v,v)$ for any $v\in\mathds{B}^{\mathsf{N}}$. Next, if we add probabilities on the transition graph, iterations can be interpreted as Markov chains.

Running Example. Let us consider for instance the graph $\Gamma(f)$ defined in Figure 1 and the probability function $p$ defined on the set of edges as follows:

[TABLE]

The matrix $P$ of the Markov chain associated to the function $f^{*}$ and to its probability function $p$ is

[TABLE]

A specific random walk in this modified hypercube is first introduced (see Section 6.1). We further study this random walk in a theoretical way to provide an upper bound of fair sequences (see Section 6.2). We finally complete this study with experimental results that reduce this bound (Sec. 6.3). For a general reference on Markov chains, see [12], and particularly Chapter 5 on stopping times.

6.1 Formalizing the Random Walk

First of all, let $\pi$, $\mu$ be two distributions on $\mathds{B}^{\mathsf{N}}$. The total variation distance between $\pi$ and $\mu$ is denoted $\lVert\pi-\mu\rVert_{\rm TV}$ and is defined by

[TABLE]

It is known that

[TABLE]

Moreover, if $\nu$ is a distribution on $\mathds{B}^{\mathsf{N}}$, one has

[TABLE]

Let $P$ be the matrix of a Markov chain on $\mathds{B}^{\mathsf{N}}$. For any $X\in\mathds{B}^{\mathsf{N}}$, let $P(X,\cdot)$ be the distribution induced by the ${\rm bin}(X)$-th row of $P$, where ${\rm bin}(X)$ is the integer whose binary encoding is $X$. If the Markov chain induced by $P$ has a stationary distribution $\pi$, then we define

[TABLE]

and

[TABLE]

Intuitively speaking, $t_{\rm mix}(\varepsilon)$ is the time/steps required to be sure to be $\varepsilon$-close to the stationary distribution, wherever the chain starts.

One can prove that

[TABLE]

Let $(X_{t})_{t\in\mathbb{N}}$ be a sequence of $\mathds{B}^{\mathsf{N}}$ valued random variables. A $\mathbb{N}$-valued random variable $\tau$ is a stopping time for the sequence $(X_{i})$ if for each $t$ there exists $B_{t}\subseteq(\mathds{B}^{\mathsf{N}})^{t+1}$ such that $\{\tau=t\}=\{(X_{0},X_{1},\ldots,X_{t})\in B_{t}\}$. In other words, the event $\{\tau=t\}$ only depends on the values of $(X_{0},X_{1},\ldots,X_{t})$, not on $X_{k}$ with $k>t$.

Let $(X_{t})_{t\in\mathbb{N}}$ be a Markov chain and $f(X_{t-1},Z_{t})$ a random mapping representation of the Markov chain. A randomized stopping time for the Markov chain is a stopping time for $(Z_{t})_{t\in\mathbb{N}}$. If the Markov chain is irreducible and has $\pi$ as stationary distribution, then a stationary time $\tau$ is a randomized stopping time (possibly depending on the starting position $X$), such that the distribution of $X_{\tau}$ is $\pi$:

[TABLE]

6.2 Upper bound of Stopping Time

A stopping time $\tau$ is a strong stationary time if $X_{\tau}$ is independent of $\tau$. The following result will be useful [12, Proposition 6.10],

Theorem 6

*If $\tau$ is a strong stationary time, then $d(t)\leq\max_{X\in\mathds{B}^{\mathsf{N}}}\mathbb{P}_{X}(\tau>t)$. *

Let $E=\{(X,Y)\mid X\in\mathds{B}^{\mathsf{N}},Y\in\mathds{B}^{\mathsf{N}},\ X=Y\text{ or }X\oplus Y\in 0^{*}10^{*}\}$. In other words, $E$ is the set of all the edges in the classical ${\mathsf{N}}$-cube. Let $h$ be a function from $\mathds{B}^{\mathsf{N}}$ into $\llbracket 1,{\mathsf{N}}\rrbracket$. Intuitively speaking $h$ aims at memorizing for each node $X\in\mathds{B}^{\mathsf{N}}$ whose edge is removed in the Hamiltonian cycle, i.e., which bit in $\llbracket 1,{\mathsf{N}}\rrbracket$ cannot be switched.

We denote by $E_{h}$ the set $E\setminus\{(X,Y)\mid X\oplus Y=0^{{\mathsf{N}}-h(X)}10^{h(X)-1}\}$. This is the set of the modified hypercube, i.e., the ${\mathsf{N}}$-cube where the Hamiltonian cycle $h$ has been removed.

We define the Markov matrix $P_{h}$ for each line $X$ and each column $Y$ as follows:

[TABLE]

We denote by $\overline{h}:\mathds{B}^{\mathsf{N}}\rightarrow\mathds{B}^{\mathsf{N}}$ the function such that for any $X\in\mathds{B}^{\mathsf{N}}$, $(X,\overline{h}(X))\in E$ and $X\oplus\overline{h}(X)=0^{{\mathsf{N}}-h(X)}10^{h(X)-1}$. The function $\overline{h}$ is said to be square-free if for every $X\in\mathds{B}^{\mathsf{N}}$, $\overline{h}(\overline{h}(X))\neq X$.

Lemma 1

*If $\overline{h}$ is bijective and square-free, then $h(\overline{h}^{-1}(X))\neq h(X)$. *

Proof

Let $\overline{h}$ be bijective. Let $k\in\llbracket 1,{\mathsf{N}}\rrbracket$ s.t. $h(\overline{h}^{-1}(X))=k$. Then $(\overline{h}^{-1}(X),X)$ belongs to $E$ and $\overline{h}^{-1}(X)\oplus X=0^{{\mathsf{N}}-k}10^{k-1}$. Let us suppose $h(X)=h(\overline{h}^{-1}(X))$. In such a case, $h(X)=k$. By definition of $\overline{h}$, $(X,\overline{h}(X))\in E$ and $X\oplus\overline{h}(X)=0^{{\mathsf{N}}-h(X)}10^{h(X)-1}=0^{{\mathsf{N}}-k}10^{k-1}$. Thus $\overline{h}(X)=\overline{h}^{-1}(X)$, which leads to $\overline{h}(\overline{h}(X))=X$. This contradicts the square-freeness of $\overline{h}$. ■

Let $Z$ be a random variable that is uniformly distributed over $\llbracket 1,{\mathsf{N}}\rrbracket\times\mathds{B}$. For $X\in\mathds{B}^{\mathsf{N}}$, we define, with $Z=(i,b)$,

[TABLE]

The Markov chain is thus defined as

[TABLE]

An integer $\ell\in\llbracket 1,{\mathsf{N}}\rrbracket$ is said fair at time $t$ if there exists $0\leq j<t$ such that $Z_{j+1}=(\ell,\cdot)$ and $h(X_{j})\neq\ell$. In other words, there exists a date $j$ before $t$ where the first element of the random variable $Z$ is exactly $l$ (i.e., $l$ is the strategy at date $j$) and where the configuration $X_{j}$ allows to cross the edge $l$.

Let $\tau_{\rm stop}$ be the first time all the elements of $\llbracket 1,{\mathsf{N}}\rrbracket$ are fair. The integer $\tau_{\rm stop}$ is a randomized stopping time for the Markov chain $(X_{t})$.

Lemma 2

*The integer $\tau_{\rm stop}$ is a strong stationary time. *

Proof

Let $\tau_{\ell}$ be the first time that $\ell$ is fair. The random variable $Z_{\tau_{\ell}}$ is of the form $(\ell,b)$ such that $b=1$ with probability $\frac{1}{2}$ and $b=0$ with probability $\frac{1}{2}$. Since $h(X_{\tau_{\ell}-1})\neq\ell$ the value of the $\ell$-th bit of $X_{\tau_{\ell}}$ is [math] or $1$ with the same probability ($\frac{1}{2}$). This probability is independent of the value of the other bits.

Moving next in the chain, at each step, the $l$-th bit is switched from [math] to $1$ or from $1$ to [math] each time with the same probability. Therefore, for $t\geq\tau_{\ell}$, the $\ell$-th bit of $X_{t}$ is [math] or $1$ with the same probability, and independently of the value of the other bits, proving the lemma.■

Theorem 7

*If $\overline{h}$ is bijective and square-free, then $E[\tau_{\rm stop}]\leq 8{\mathsf{N}}^{2}+4{\mathsf{N}}\ln({\mathsf{N}}+1)$. *

For each $X\in\mathds{B}^{\mathsf{N}}$ and $\ell\in\llbracket 1,{\mathsf{N}}\rrbracket$, let $S_{X,\ell}$ be the random variable that counts the number of steps from $X$ until we reach a configuration where $\ell$ is fair. More formally

[TABLE]

Lemma 3

*Let $\overline{h}$ is a square-free bijective function. Then for all $X$ and all $\ell$, the inequality $E[S_{X,\ell}]\leq 8{\mathsf{N}}^{2}$ is established. *

Proof

For every $X$, every $\ell$, one has $\mathbb{P}(S_{X,\ell}\leq 2)\geq\frac{1}{4{\mathsf{N}}^{2}}$. Let $X_{0}=X$. Indeed,

• •

if $h(X)\neq\ell$, then $\mathbb{P}(S_{X,\ell}=1)=\frac{1}{2{\mathsf{N}}}\geq\frac{1}{4{\mathsf{N}}^{2}}$.

• •

otherwise, $h(X)=\ell$, then $\mathbb{P}(S_{X,\ell}=1)=0$. But in this case, intuitively, it is possible to move from $X$ to $\overline{h}^{-1}(X)$ (with probability $\frac{1}{2N}$). And in $\overline{h}^{-1}(X)$ the $l$-th bit can be switched. More formally, since $\overline{h}$ is square-free, $\overline{h}(X)=\overline{h}(\overline{h}(\overline{h}^{-1}(X)))\neq\overline{h}^{-1}(X)$. It follows that $(X,\overline{h}^{-1}(X))\in E_{h}$. We thus have $P(X_{1}=\overline{h}^{-1}(X))=\frac{1}{2{\mathsf{N}}}$. Now, by Lemma 1, $h(\overline{h}^{-1}(X))\neq h(X)$. Therefore $\mathbb{P}(S_{x,\ell}=2\mid X_{1}=\overline{h}^{-1}(X))=\frac{1}{2{\mathsf{N}}}$, proving that $\mathbb{P}(S_{x,\ell}\leq 2)\geq\frac{1}{4{\mathsf{N}}^{2}}$.

Therefore, $\mathbb{P}(S_{X,\ell}\geq 3)\leq 1-\frac{1}{4{\mathsf{N}}^{2}}$. By induction, one has, for every $i$, $\mathbb{P}(S_{X,\ell}\geq 2i)\leq\left(1-\frac{1}{4{\mathsf{N}}^{2}}\right)^{i}$. Moreover, since $S_{X,\ell}$ is positive, it is known [15, lemma 2.9], that

[TABLE]

Since $\mathbb{P}(S_{X,\ell}\geq i)\geq\mathbb{P}(S_{X,\ell}\geq i+1)$, one has

[TABLE]

Consequently,

[TABLE]

which concludes the proof. ■

Let $\tau_{\rm stop}^{\prime}$ be the time used to get all the bits but one fair.

Lemma 4

*One has $E[\tau_{\rm stop}^{\prime}]\leq 4{\mathsf{N}}\ln({\mathsf{N}}+1).$ *

Proof

This is a classical Coupon Collector’s like problem. Let $W_{i}$ be the random variable counting the number of moves done in the Markov chain while we had exactly $i-1$ fair bits. One has $\tau_{\rm stop}^{\prime}=\sum_{i=1}^{{\mathsf{N}}-1}W_{i}$. But when we are at position $X$ with $i-1$ fair bits, the probability of obtaining a new fair bit is either $1-\frac{i-1}{{\mathsf{N}}}$ if $h(X)$ is fair, or $1-\frac{i-2}{{\mathsf{N}}}$ if $h(X)$ is not fair.

Therefore, $\mathbb{P}(W_{i}=k)\leq\left(\frac{i-1}{{\mathsf{N}}}\right)^{k-1}\frac{{\mathsf{N}}-i+2}{{\mathsf{N}}}.$ Consequently, we have $\mathbb{P}(W_{i}\geq k)\leq\left(\frac{i-1}{{\mathsf{N}}}\right)^{k-1}\frac{{\mathsf{N}}-i+2}{{\mathsf{N}}-i+1}.$ It follows that $E[W_{i}]=\sum_{k=1}^{+\infty}\mathbb{P}(W_{i}\geq k)\leq{\mathsf{N}}\frac{{\mathsf{N}}-i+2}{({\mathsf{N}}-i+1)^{2}}\leq\frac{4{\mathsf{N}}}{{\mathsf{N}}-i+2}$.

It follows that $E[W_{i}]\leq\frac{4{\mathsf{N}}}{{\mathsf{N}}-i+2}$. Therefore

[TABLE]

But $\sum_{i=1}^{{\mathsf{N}}+1}\frac{1}{i}\leq 1+\ln({\mathsf{N}}+1)$. It follows that $1+\frac{1}{2}+\sum_{i=3}^{{\mathsf{N}}+1}\frac{1}{i}\leq 1+\ln({\mathsf{N}}+1).$ Consequently, $E[\tau_{\rm stop}^{\prime}]\leq 4{\mathsf{N}}(-\frac{1}{2}+\ln({\mathsf{N}}+1))\leq 4{\mathsf{N}}\ln({\mathsf{N}}+1)$. ■

One can now prove Theorem 7.

Proof

Since $\tau_{\rm stop}^{\prime}$ is the time used to obtain $\mathsf{N}-1$ fair bits. Assume that the last unfair bit is $\ell$. One has $\tau_{\rm stop}=\tau_{\rm stop}^{\prime}+S_{X_{\tau},\ell}$, and therefore $E[\tau_{\rm stop}]=E[\tau_{\rm stop}^{\prime}]+E[S_{X_{\tau},\ell}]$. Therefore, Theorem 7 is a direct application of Lemma 3 and 4. ■

Now using Markov Inequality, one has $\mathbb{P}_{X}(\tau>t)\leq\frac{E[\tau]}{t}$. With $t_{n}=32N^{2}+16N\ln(N+1)$, one obtains: $\mathbb{P}_{X}(\tau>t_{n})\leq\frac{1}{4}$. Therefore, using the definition of $t_{\rm mix}$ and Theorem 6, it follows that $t_{\rm mix}\leq 32N^{2}+16N\ln(N+1)=O(N^{2})$.

Notice that the calculus of the stationary time upper bound is obtained under the following constraint: for each vertex in the $\mathsf{N}$-cube there are one ongoing arc and one outgoing arc that are removed. The calculus doesn’t consider (balanced) Hamiltonian cycles, which are more regular and more binding than this constraint. Moreover, the bound is obtained using the coarse Markov Inequality. For the classical (lazy) random walk the $\mathsf{N}$-cube, without removing any Hamiltonian cycle, the mixing time is in $\Theta(N\ln N)$. We conjecture that in our context, the mixing time is also in $\Theta(N\ln N)$.

In this latter context, we claim that the upper bound for the stopping time should be reduced. This fact is studied in the next section.

6.3 Practical Evaluation of Stopping Times

Let be given a function $f:\mathds{B}^{\mathsf{N}}\rightarrow\mathds{B}^{\mathsf{N}}$ and an initial seed $x^{0}$. The pseudo code given in Algorithm 2 returns the smallest number of iterations such that all elements $\ell\in\llbracket 1,{\mathsf{N}}\rrbracket$ are fair. It allows to deduce an approximation of $E[\tau_{\rm stop}]$ by calling this code many times with many instances of function and many seeds.

Practically speaking, for each number $\mathsf{N}$, $3\leq\mathsf{N}\leq 16$, 10 functions have been generated according to the method presented in Section 5. For each of them, the calculus of the approximation of $E[\tau_{\rm stop}]$ is executed 10000 times with a random seed. Figure 3 summarizes these results. A circle represents the approximation of $E[\tau_{\rm stop}]$ for a given $\mathsf{N}$. The line is the graph of the function $x\mapsto 2x\ln(2x+8)$. It can firstly be observed that the approximation is largely smaller than the upper bound given in Theorem 7. It can be further deduced that the conjecture of the previous section is realistic according to the graph of $x\mapsto 2x\ln(2x+8)$.

7 Experiments

Let us finally present the pseudorandom number generator $\chi_{\textit{16HamG}}$, which is based on random walks in $\Gamma_{\{b\}}(f)$. More precisely, let be given a Boolean map $f:\mathds{B}^{\mathsf{N}}\rightarrow\mathds{B}^{\mathsf{N}}$, a PRNG Random, an integer $b$ that corresponds to an iteration number (i.e., the length of the walk), and an initial configuration $x^{0}$. Starting from $x^{0}$, the algorithm repeats $b$ times a random choice of which edge to follow, and crosses this edge provided it is allowed to do so, i.e., when $\textit{Random}(1)$ is not null. The final configuration is thus outputted. This PRNG is formalized in Algorithm 3.

This PRNG is slightly different from $\chi_{\textit{14Secrypt}}$ recalled in Algorithm 1. As this latter, the length of the random walk of our algorithm is always constant (and is equal to $b$). However, in the current version, we add the constraint that the probability to execute the function $F_{f}$ is equal to 0.5 since the output of Random(1) is uniform in $\{0,1\}$. This constraint is added to match the theoretical framework of Sect. 6.

Notice that the chaos property of $G_{f}$ given in Sect.3 only requires the graph $\Gamma_{\{b\}}(f)$ to be strongly connected. Since the $\chi_{\textit{16HamG}}$ algorithm only adds probability constraints on existing edges, it preserves this property.

For each number $\mathsf{N}=4,5,6,7,8$ of bits, we have generated the functions according to the method given in Sect. 4 and 5. For each $\mathsf{N}$, we have then restricted this evaluation to the function whose Markov Matrix (issued from Eq. (6)) has the smallest practical mixing time. Such functions are given in Table 3. In this table, let us consider, for instance, the function $ⓐ$ from $\mathds{B}^{4}$ to $\mathds{B}^{4}$ defined by the following images : $[13,10,9,14,3,11,1,12,15,4,7,5,2,6,0,8]$. In other words, the image of $3\leavevmode\nobreak\ (0011)$ by $ⓐ$ is $14\leavevmode\nobreak\ (1110)$: it is obtained as the binary value of the fourth element in the second list (namely 14).

In this table the column that is labeled with $b$ gives the practical mixing time where the deviation to the standard distribution is inferior than $10^{-6}$.

Let us first discuss about results against the NIST test suite. In our experiments, 100 sequences (s = 100) of 1,000,000 bits are generated and tested. If the value $\mathbb{P}_{T}$ of any test is smaller than 0.0001, the sequences are considered to be not good enough and the generator is unsuitable.

Table 4 shows $\mathbb{P}_{T}$ of sequences based on $\chi_{\textit{16HamG}}$ using different functions, namely $ⓐ$,…, $ⓔ$. In this algorithm implementation, the embedded PRNG Random is the default Python PRNG, i.e., the Mersenne Twister algorithm [14]. Implementations for $\mathsf{N}=4,\dots,8$ of this algorithm is evaluated through the NIST test suite and results are given in columns $\textit{MT}_{4}$, …, $\textit{MT}_{8}$. If there are at least two statistical values in a test, this test is marked with an asterisk and the average value is computed to characterize the statistics.

We first can see in Table 4 that all the rates are greater than 97/100, i.e., all the generators achieve to pass the NIST battery of tests. It can be noticed that adding chaos properties for Mersenne Twister algorithm does not reduce its security against this statistical tests.

8 Conclusion

This work has assumed a Boolean map $f$ which is embedded into a discrete-time dynamical system $G_{f}$. This one is supposed to be iterated a fixed number $p_{1}$ or $p_{2}$,…, or $p_{\mathds{p}}$ times before its output is considered. This work has first shown that iterations of $G_{f}$ are chaotic if and only if its iteration graph $\Gamma_{\mathcal{P}}(f)$ is strongly connected where $\mathcal{P}$ is $\{p_{1},\ldots,p_{\mathds{p}}\}$. It can be deduced that in such a situation a PRNG, which iterates $G_{f}$, satisfies the property of chaos and can be used in simulating chaos phenomena.

We then have shown that a previously presented approach can be directly applied here to generate function $f$ with strongly connected $\Gamma_{\mathcal{P}}(f)$. The iterated map inside the generator is built by first removing from a $\mathsf{N}$-cube a balanced Hamiltonian cycle and next by adding a self loop to each vertex. The PRNG can thus be seen as a random walk of length in $\mathcal{P}$ into this new $\mathsf{N}$-cube. We have presented an efficient method to compute such a balanced Hamiltonian cycle. This method is an algebraic solution of an undeterministic approach [19] and has a low complexity. To the best of the authors knowledge, this is the first time a full automatic method to provide chaotic PRNGs is given. Practically speaking, this approach preserves the security properties of the embedded PRNG, even if it remains quite cost expensive.

We furthermore have presented an upper bound on the number of iterations that is sufficient to obtain an uniform distribution of the output. Such an upper bound is quadratic on the number of bits to output. Experiments have however shown that such a bound is in $\mathsf{N}.\log(\mathsf{N})$ in practice. Finally, experiments through the NIST battery have shown that the statistical properties are almost established for $\mathsf{N}=4,5,6,7,8$ and should be observed for any positive integer $\mathsf{N}$.

In future work, we intend to understand the link between statistical tests and the properties of chaos for the associated iterations. By doing so, relations between desired statistically unbiased behaviors and topological properties will be understood, leading to better choices in iteration functions. Conditions allowing the reduction of the stopping-time will be investigated too, while other modifications of the hypercube will be regarded in order to enlarge the set of known chaotic and random iterations.

Acknowledgements

This work is partially funded by the Labex ACTION program (contract ANR-11-LABX-01-01). Computations presented in this article were realised on the supercomputing facilities provided by the Mésocentre de calcul de Franche-Comté.