Report on Present State ofTAO TIME Evaluation(screening evaluation)
January 28, 2002
Kazuo Takaragi, Member
Symmetric-Key Cryptography Subcommittee

1Basic flow of remote party authentication with TAO TIME
Secretly shared information α
Client cognition
ServerChallengef(α)…

Responseg(α)

ClientServer cognition
Secretly shared information α2Overview of processing sequencesR(n-2)↑
V_STIME(n-2)↑STIME(n-2)

ServerX_cR(n-3)sR(n-1)↑
V_STIME(n-1)↑STIME(n-1)

V_STIME(n-2)

cS(n-3)C(n-2)

X_cR(n-2)sR(n)↑V_STIME(n)↑STIME(n)V_STIME(n-1)

C(n-1)

X(n-4)

V_STIME(n)cS(n-1)cS(n-2)S(n-3)

X_cR(n-2)S(n-2)

X(n-3)C(n)S(n-1)

X(n-2)

ClientcS(n-2)↑CTIME(n-2)→Random numbera(n-2) generationcR(n-2)cS(n-1)↑CTIME(n-1)→Random numbera(n-1) generationcR(n-1)cS(n)↑CTIME(n)→Random numbera(n) generationcR(n)cR(n-2)=<V_STIME(n-2)…+{cR(n-3)-cS(n-3)} + … + a(n-2)> + 1
X_cR(n-2) = cR(n-2) + {α(X(n-2)) + β(X(n-2))}− − − The red characters are TAO data which is not exposed to the network − − −3

Pseudo-random number generating functions to be evaluatedFocus points
forCRYPTREC

Is random number a(n) a pseudo-random number generator
for the call?
→ Evaluated this way because it is not seen elsewhere.
→ Is a(n) recognized as a pseudo-random number generator?

a(n) calculation formulas to be evaluated:[CTIME(n) calculation formula]: CTIME(n) = Client local
clock sending event time (current time in milliseconds)[rand() initial value calculation formula]: a(n-1) ∗ 1000 +CTIME(n)mod 1000
The above calculation is performed each time a(n-1) is generated.
a(n)=a(n-1)+{rand( )+1} ∗ 100000 +CTIME(n) mod 100000
4

Rand function in ANSI C• The rand function generates random integers between 0 andRAND_MAX.
• The only requirement specified by the ANSI C standard is that
RAND_MAX must be at least 32767.
• ANSI C standard permits that the calculation method mayvary.
• However, pseudo-random numbers generated by rand() are infact as shown below (example for Visual C++), as in the caseof numbers based on the linear congruence method).
x1 = 1 (This is the seed. It can be changed using srand().)
xn≡ 214013 ∗ xn-1 + 2531011 mod 231
X = Integer portion of (xn/216) (0 < X < 215)5

a(n) Series• CTIME(n) is the current time (sending time) displayed inmilliseconds; i.e., the physical time.
• Calculation formulaa(n)=a(n-1)+{rand( )+1}∗100000 +CTIME(n) mod 100000
Thus, the last five digits, when a(n)-a(n-1) is given indecimal notation, are matched to the last five digits in
CTIME(n) (decimal notation).
This means that the last five digits of a(n)-a(n-1) are always
the physical time.

6

Evaluation by Evaluator 1
Conclusion: There is no need for a full evaluation.
Comments(excerpts):• The specifications describe the primary objective as providing simple
authentication functions between client and server.
• With minor modifications, it is possible to change the specifications so as togenerate pseudo-random numbers.
• However, these specifications make absolutely no use of cryptographic
functions (basic operations used in asymmetric-key cryptography (e.g., addition
and multiplication in prime field, extension field, and rings and groups basedthereon), hash functions, pseudo-random number generators (key streamgenerators), block ciphers). Thus regardless of the type of modification, it is notpossible to expect random number generation for use in secure key generationand the like.
7

Evaluation by Evaluator 2Conclusion: There is no need for a full evaluation.
Comments(excerpts):• In Section 1 (Introduction) of the cryptographic technique specifications, thesubmitter claims the following: “The TAO TIME cognition algorithm is acognition algorithm whose purpose is to build a mutual cognition system
between client and server, existing at any two points in the network”. Thespecifications describe this cognition algorithm.
• In my opinion, these cryptographic technique specifications do not describe a“deterministic algorithm that outputs a (pseudo-random) sequence with respect
to a seed (input value)”, which is required for the specifications of a pseudorandom number generator.
• Therefore, the cryptographic technique is not considered to be a candidate forscreening evaluation due to insufficiencies in the submitted documents. Inconclusion, I believe a full evaluation is not needed.
8

Evaluation by Evaluator 3
Conclusion: There is no need for a full evaluation.
Comments(excerpts):• This proposal was submitted as a random number generating technique, but it isactually a proposal for a “cognition” system that uses random numbergeneration. In addition, the random number generation consists of nothing morethan using known methods. Even as a “cognition” system, it is not sufficiently
described, and seems to have security problems as well.
• The introduction of random numbers seems to be important for “cognition”, but
this is not discussed.

9Evaluation by Evaluator 4
Conclusion: There is no need for a full evaluation.
Comments(excerpts):• The submitter claims the TAO TIME cognition algorithm is a pseudo-random
number generator, but I see absolutely no grounds for this claim. I believe thismethod is not a pseudo-random number generator. Therefore, a full evaluation
is not necessary.
• The submitter provides no grounds for the claim that the TAO TIME
cognition algorithm is a pseudo-random number generator. If the submitteris to claim this, then it would be necessary to evaluate aspects such as thegenerated pseudo-random number sequence’s period, linear complexity,
and 0/1-balancedness, etc.

10

Evaluation by CRYPTREC SymmetricKey Cryptography Subcommittee
Opinion: Full evaluation is not necessary.
Reasons:• This proposal was submitted as a random number generating technique, but it isin fact a “cognition” system that uses random number generation.
• With minor modifications, it is possible to change the specifications to a
proposal for a random number generating technique.
• However, we believe the submitter has weak grounds for claiming that the TAO
TIME cognition algorithm is a pseudo-random number generator.

11