1. TET 8/14/2002 CHES2002, Rev 0.1 MOTOROLA and the Stylized M Logo are registered in the US Patent & Trademark Office. All other product or service names are the property of their respective owners. © Motorola, Inc. 2002. A Hardware Random Number Generator Thomas Tkacik, Motorola

2. Desired Properties of Random Numbers ● Unpredictable ● Lack of bias ● Bit Independence ● Nonrepeatable ● Long cycle length

3. RNG Block Diagram 43 bit LFSR 37 bit CASR Oscillator 1 Oscillator 2 32 bit select

4. Linear Feedback Shift Register ● 43 bit LFSR ● Characteristic polynomial X 43 + X 41 + X 20 + X + 1 ● Maximal length Cycle length = 2 43 - 1 ● There is a slight bias Bias ~ 2 -43 43 bit LFSR 37 bit CASR Oscillator 1 Oscillator 2 32 bit select

5. Cellular Automata Shift Register ● 37 bit CASR ● CA90a i (t+1) = a i-1 (t) ^ a i+1 (t) ● CA150a i (t+1) = a i-1 (t) ^ a i (t) ^ a i+1 (t) ● CA150 is at bit 28, CA90 used elsewhere ● Maximal length Cycle length = 2 37 - 1 ● There is a slight bias Bias ~ 2 -37 43 bit LFSR 37 bit CASR Oscillator 1 Oscillator 2 32 bit select

6. LFSR and CASR Combination ● Combination is formed by permuting and XORing 32 bits of LFSR and CASR ● The combination has a cycle length of Cycle length = 2 80 - 2 43 - 2 37 + 1 ● The bias is reduced to Bias ~ 2 -80 43 bit LFSR 37 bit CASR Oscillator 1 Oscillator 2 32 bit select

7. State-Time Diagram for LFSR, CASR and Combined Generator Time LFSR CASR Combination 43 bit LFSR 37 bit CASR Oscillator 1 32 bit select

8. DIEHARD Results for LFSR, CASR and Combined Generator 43 bit LFSR 37 bit CASR Osc 1 Osc 2

9. Summary ● A Hardware Random Number Generator composed of simple components 43 bit LFSR 37 bit CASR Oscillator's frequency's vary with voltage and temperature State registers are not reset at power-up ● Written as RTL The oscillators have instantiated inverters ● The oscillator clocks can be turned off for low power applications