Source: https://patents.google.com/patent/US8787564B2/en
Timestamp: 2019-04-26 06:38:21
Document Index: 231801403

Matched Legal Cases: ['art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2']

US8787564B2 - Assessing cryptographic entropy - Google Patents
Assessing cryptographic entropy Download PDF
US8787564B2
US8787564B2 US13/307,078 US201113307078A US8787564B2 US 8787564 B2 US8787564 B2 US 8787564B2 US 201113307078 A US201113307078 A US 201113307078A US 8787564 B2 US8787564 B2 US 8787564B2
US13/307,078
US20130136255A1 (en
2011-11-30 Application filed by Certicom Corp filed Critical Certicom Corp
2011-11-30 Priority to US13/307,078 priority Critical patent/US8787564B2/en
2012-02-21 Assigned to CERTICOM CORP. reassignment CERTICOM CORP. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: BROWN, DANIEL RICHARD L.
2013-05-30 Publication of US20130136255A1 publication Critical patent/US20130136255A1/en
2014-07-22 Publication of US8787564B2 publication Critical patent/US8787564B2/en
FIG. 1 is a schematic diagram of an example cryptography system 100. The example cryptography system 100 includes an entropy source system 102, a cryptographic secret generator module 106, an entropy assessor module 108, and a cryptographic communication module 110 a. In some instances, as in the example shown in FIG. 1, the cryptography system 100 includes additional cryptographic communication modules (e.g., the cryptographic communication module 110 b, and possibly more) and an adversary 112. The cryptography system 100 can include additional or different features and components, and the cryptography system 100 may be configured as shown and described with respect to FIG. 1 or in a different manner.
In one example aspect of operation, the entropy source system 102 provides output values to the cryptographic secret generator module 106. The output values provided by the entropy source system 102 can serve as a source of entropy for the cryptographic secret generator module 106. For example, the cryptographic secret generator module 106 can be a pseudorandom number generator module that is seeded by the output values from the entropy source system 102. The cryptographic secret generator module 106 produces a cryptographic secret (e.g., a private key) and provides the cryptographic secret to the cryptographic communication module 110 a. The cryptographic communication module 110 a communicates with other entities in the cryptography system 100 based on the cryptographic secret. For example, the cryptographic communication module 110 a may produce encrypted messages, digital signatures, digital certificates, cryptographic keys (e.g., public and private keys, ephemeral and long-term keys, etc.), or a combination of these and other types of cryptographic data based on the secret key provided by the cryptographic secret generator module 106. The secret value provided by the cryptographic secret generator module 106 can be used as, or can be used to produce, a cryptographic key for cryptographic communications.
The components of the example cryptography system 100 shown in FIG. 1 can be implemented in any suitable combination of hardware, software, firmware, or combinations thereof. In some instances, the entropy source system 102, the cryptographic secret generator module 106, the entropy assessor module 108, and the cryptographic communication module 110 a can be implemented as software modules that are executed by one or more general purpose processors. In some instances, one or more of the entropy source system 102, the cryptographic secret generator module 106, the entropy assessor module 108, or the cryptographic communication module 110 a can be implemented as one or more hardware components. The hardware components may include specialized processors or pre-programmed logic, general purpose processors executing software, or other types of data processing apparatus.
The cryptographic communication module 110 a can include any suitable hardware, software, firmware, or combinations thereof, operable to execute cryptographic operations. In some instances, the cryptographic communication module 110 a is configured to perform data encryption. For example, the cryptographic communication module 110 a may be configured to encrypt messages or other types of data based on a secret key provided by the cryptographic secret generator module 106. In some instances, the cryptographic communication module 110 a is configured to provide data authentication. For example, the cryptographic communication module 110 a may be configured to generate a digital signature or authentication tag based on a secret key provided by the cryptographic secret generator module 106. In some instances, the cryptographic communication module 110 a is configured to generate digital certificates or other types of cryptographic objects. For example, the cryptographic communication module 110 a may be configured as a certificate authority to issue digital certificates based on a secret key provided by the cryptographic secret generator module 106. The cryptographic communication module 110 a may be configured to perform additional or different types of operations.
In some implementations, the cryptographic communication modules 110 a and 110 b can communicate with each other over an open channel. For example, the cryptographic communication module 110 a may send cryptographic data (e.g., encrypted messages, signed messages, cryptographic certificates, public keys, key-agreement data, etc.) to the cryptographic communication module 110 b over a communication channel that is observable, partially or wholly, by the adversary 112. In some instances, the cryptographic communication modules 110 a and 110 b can communicate over one or more data communication networks, over wireless or wired communication links, or other types of communication channels. A communication network may include, for example, a cellular network, a telecommunications network, an enterprise network, an application-specific public network, a Local Area Network (LAN), a Wide Area Network (WAN), a private network, a public network (such as the Internet), a WiFi network, a network that includes a satellite link, or another type of data communication network. Communication links may include wired or contact-based communication links, short-range wireless communication links (e.g., BLUETOOTH®, optical, NFC, etc.), or any suitable combination of these and other types of links.
The entropy source system 102 can include one or more entropy sources. For example, as illustrated in FIG. 1, the entropy source system 102 includes two entropy sources 104 a and 104 b (“entropy sources 104 a-b”). In some instances, entropy sources can be modified or added to the entropy source system 102 as needed, for example, to achieve sufficient entropy. The entropy sources 104 a-b can provide information that has entropy. For example, the entropy sources 104 a-b can include a ring oscillator, a noisy diode, mouse movements, variances in disk read time, system process usages, or other quantifiable but unpredictable phenomena or behaviors. In some implementations, the entropy sources 104 a-b generate a collection of samples (e.g., logged signal, measurement history, saved variation) that are accumulated into an entropy pool by using a deterministic process. For example, the entropy pool can be a concatenation of all the samples values. Compression may be applied to the concatenation on account of memory restrictions. The compression process may be a group addition, a cryptographic hash function, a random extraction, or any other appropriate compression method.
The cryptographic secret generator module 106 may use the entropy pool of the entropy sources 104 a-b to generate the cryptographic secret (i.e., keys). For example, a seed can be extracted from the entropy pool for the secret generation. The cryptographic secret generator module 106 can be operated as a well-seeded and well-designed deterministic pseudorandom number generator to generate random numbers as the keys. The initial seed can provide the cryptographic entropy to the number generated. In some instances, the random numbers generated by the cryptographic secret generator module 106 can appear as indistinguishable from uniformly distributed random numbers. The cryptographic secret generator module 106 may employ backtracking resistance and other techniques. For example, output values can be generated by a pseudorandom number generator in a manner that avoids the output values feasibly being used to recover the internal state of the pseudorandom number generator, and avoids the output values feasibly being used together with the internal state of the pseudorandom number generator to determine past internal states. In some implementations, the backtracking resistance of the cryptographic secret generator module 106 can provide forward secrecy of key agreement schemes.
The processing of the samples from the entropy sources 104 a-b to the cryptographic secret generator module 106, can be deterministic and without additional entropy. The deterministic algorithms in a cryptography system may not be kept sufficiently secret, or it may be unrealistic in some instances to assess the entropy of an algorithm. For example, if the adversary does not know the algorithm, it may be unrealistic in some instances to measure or quantify the information that is unknown to the adversary as a result of the adversary not knowing the algorithm. The entropy sources 104 a-b may behave according to a probability distribution that can be used to assess the entropy sources 104 a-b. This probability distribution may be less than exactly defined, but can be assumed to at least belong to some known set of probability distributions. Under such assumption, statistical inferences can be applied to assess the cryptographic entropy provided by the entropy sources 104 a-b, and/or other entropy sources in general.
In some implementations, the entropy sources 104 a-b include or access processes of an operating system (e.g. the operating system of a computing device). In some implementations, for software to have an entropy source, one common practice is to examine the set of processes running on a computer on which the software is installed. In some example operating systems where multiple processes are sharing processor time, the list of processes with amount of processor time each has used, may have some entropy. For example, some processes may need to write to a hard disk. When writing to a hard disk, the disk-seek-time is known to vary depending on where data is located on the hard disk and other factors. An advantage of such entropy sources is that special hardware or user actions are not required for the entropy source.
In some implementations, the entropy sources 104 a-b include or access environmental conditions. For example, some systems have inputs which can be used as an entropy source, such as a microphone for monitoring the sound in the local environment. The audio recording may be a combination of noises and ambient activities that cannot be predicted. An advantage of such an entropy source is that the entropy source may not require user actions or special or additional hardware (e.g., because microphones, video cameras, and other computer peripheral hardware are commonly available). A possible disadvantage is any adversary close enough may also have partial access to the entropy source. For example, the adversary 112 may place a microphone in the same environment to record the sound of the same ambient activities.
In some implementations, the entropy sources 104 a-b include or access user inputs. In some systems, users often supply inputs, such as, for example, mouse movements, keyboard strokes, touchpad gestures, etc. These inputs may be used as the entropy sources 104 a-b. The inputs used for entropy may be gathered incidentally through normal use or through a procedure where the user is requested to enter inputs with the instruction to produce something random. In addition to treating user inputs as an entropy source from which entropy can be extracted to derive a secret cryptographic key, a system can rely on the user to directly provide a secret value, for example, in form of a user-selected password. The user-selected passwords may require entropy. Thus, the entropy of user-selected passwords can be assessed. In some implementations, system-generated passwords can also be used as the secret value. The system-generated passwords can apply a deterministic function to the output of random number generator. The deterministic function renders the random value in a more user-friendly format, such as alphanumeric. The result is a password that may need entropy, and the source of entropy may be some other entropy source. Thus, the entropy of the password can be assessed.
In some implementations, the entropy sources 104 a-b may include or access coin flipping. In some examples, the coin flipping entropy source may be realized as follows. A coin is thrown by a person into the air, with some rotation about an axis passing nearly through a diameter of the coin. The coin is either allowed to land on some surface or to be caught by hand. A result is either heads or tails, determined by which side of the flipped coin is facing up. Coin flips are often modeled such that each result is independent of all previous results. Furthermore, for a typical coin, it is often modeled that heads and tails are equally likely. A sequence of coin flips can be converted to a bit string by converting each result of head to a 1 and each tail to 0. In such a simple model, the resulting bit string is uniformly distributed among all bit strings of the given length.
In some implementations, the entropy sources 104 a-b may include or access one or more dice. Dice, or cubes with numbers on the sides, can be used in games of chance. Provided that adequate procedures are used in the rolling, the number that ends up at the top of the die, when its motion has ceased, is believed to at least be independent of previous events. On the one hand, the roll of a die seems to be governed mainly by deterministic laws of mechanics once it is released, so it may seem that all the randomness is supplied by the hand that rolled the die. On the other hand, it may be apparent that the rollers of dice cannot control the results of the dice rolls, and in particular the source of the randomness is the actual rolling process. This discrepancy can be explained as follows.
In some implementations, the entropy sources 104 a-b may include or access a ring oscillator, which has been a common source for entropy. Ring oscillators can be implemented as odd cycles of delayed not-gates. Whereas even cycles of delayed not gates can be used for memory storage, ring oscillators tend to oscillate between 0 and 1 (low and high voltage) at a rate proportional to the number of gates in the oscillator. Since the average oscillation rate can be calculated from the number of gates and general environmental factors, such as temperature, the variations in the oscillation may be regarded as the entropy source. Ring oscillators are not available in some general purpose computer systems, but they can be included in other types of hardware (e.g., custom systems, field programmable gate arrays (FPGA), etc).
In some implementations, the entropy sources 104 a-b may include or access a radioactive decay. Some smoke detectors use the radioactive element americium which emits alpha particles. The same method may be used as a cryptographic entropy source, such as for the generation of organization-level secret keys.
In some implementations, the entropy sources 104 a-b may include a hypothetical muon measurer. A muon measurer can provide a 32-bit measure of the speed of each muon passing through the device. In some examples, one muon passes through the detector per minute on average. Because of the underlying physics of muons, this entropy source may be viewed as providing a robust entropy source, whose rate of entropy cannot be affected by an adversary.
In some implementations, the entropy sources 104 a-b may include or access a quantum particle measurement. The theory of quantum mechanics implies that quantum particles, such as photons or electrons, can exist in a superposition of states under which measurement causes a wave function collapse. The theory states that wave function collapse is a fully random process independent of all other events in the universe. Under this theory, an entropy source derived from such wave function collapse would be absolutely unpredictable, which is highly useful for cryptography.
The entropy sources 104 a-b can be assessed for reliable risk analysis so that the cryptographic secret generator module 106 can produce a secret key useful against adversaries. As an example, unclear responsibility for properly seeding of pseudorandom number generators can result in problems. Suppose a manufacturer of cryptographic software implements a pseudorandom number generator but does not provide a source of entropy. If the manufacturer sets the seed to a default value, and user of the software may mistakenly generate “random” values with the default seed, unwittingly believing that random number generator includes a source of entropy, then the outputs of the pseudorandom number generator may be considered to have zero entropy (e.g., to the adversary who knows the default seed). An assessment of entropy may help to avoid such vulnerabilities.
Assessment on the entropy sources 104 a-b can be performed by the entropy assessor module 108 before deployment, during deployment, or at any appropriate combination of these and other instances. For example, one or more sample values from the entropy sources 104 a-b can be used to infer something about their distribution. In some cases, the sample values are discarded, and the inferences about the sources are used to assess their ability to generate entropy in the future. This approach provides prospective assessment, performed before deployment. In another case, the sample values can be used for some cryptographic application, such as forming some of the input to the cryptographic secret generator module 106, which derives a secret key. For example, there may be environments or contexts where entropy is believed to be so scarce that it is not affordable to discard the sample values. This approach provides retrospective assessment, performed during deployment. In some situations, retrospective assessment can leak information to an adversary. As such, contingent entropy may need to be assessed, as appropriate.
In some example aspects of operation, the entropy assessor module 108 can assess whether a cryptographic secret is guessable by the example adversary 112. The entropy assessor module 108 may observe sample output values from the entropy sources 104 a-b. The entropy assessor module 108 may rely on a hypothesized probability model for the possible distributions of the entropy sources 104 a-b. The probability model can be hypothesized based on theoretical understanding of the entropy sources 104 a-b, observations of sample output value from the entropy sources 104 a-b, or any suitable combination of these and other information. The entropy assessor module 108 may infer, from the observed sample output values produced by the entropy sources 104 a-b, a set of distributions for the entropy sources 104 a-b within the hypothesized probability model. The set of distributions can be inferred by considering a grading between sample output values and the distributions. The grading can be based on likelihood, typicality, or a combination of these and others. The set of distributions can be inferred based on maximizing or thresholding the grading from the observed sample values.
In some example aspects of operation, the entropy assessor module 108 may quantify the entropy or unguessability of the entropy sources 104 a-b. For example, by the entropy assessor module 108 may quantify the entropy of the entropy sources 104 a-b by characterizing the workload of the adversary 112; by determining the possible side channel information leaked to the adversary 112; by considering what function of the sample values will be used in derivation of a cryptographic key; by determining, for each distribution, a value of the conditional applied working entropy of the distribution (e.g., taking the logarithm of the adversary's maximal probability of guessing the cryptographic key); by taking the minimal value of the entropy over the inferred set of distributions; or by any suitable combination of such techniques.
In some example aspects of operation, the entropy assessor module 108 may take steps to ensure that the total entropy of the values used by the cryptographic secret generator module 106 to derive the cryptographic secret is sufficient for a specified level of security. For example, the entropy assessor module 108 may determine from the specified security level, an adequate level of entropy at the given workload characterized for the adversary 112. In some instances, if the assessed entropy is inadequate, then the entropy assessor module 108 may obtain more samples from the entropy sources 104 a-b or obtain more entropy sources, and reassess the entropy until the amount of entropy is adequate for the desired security level. In so doing, the entropy assessor module 108 may account for the possibility that the process used to make decisions may leak some portion of this information to the adversary 112. In some instances, a cryptographic key can be derived from samples obtained from the sources.
FIG. 2 is a flow chart showing an example process 200 for calculating entropy in a cryptography system. The example process 200 can be executed by the entropy assessor module 108, for example, to assess the entropy of the entropy sources 104 a-b shown in FIG. 1. Each of the entropy sources 104 a-b can be assessed individually. The entropy of independent sources can be combined (e.g., added together or combined in another manner). The entropy source system 102 can be assessed as an entropy pool. In some instances, some or all of the operations in the example process 200 can be performed by a computing device, a server, by another type of computing system, or any suitable combination of these. In some implementations, the process 200 is executed in a secure environment, for example, behind a firewall, in secured hardware, or in another type of environment. The example process 200 can include additional or different operations, and the operations may be executed in the order shown or in a different order. In some implementations, one or more operations in the example process 200 can be repeated or executed in an iterative fashion.
At 210, sample values are obtained from one or more entropy sources. The entropy sources can include one or more of the entropy sources 104 a-b in FIG. 1, or other types of entropy sources. For example, the sample values can be obtained from user inputs, a ring oscillator, a noisy diode, variances in disk read times, and/or system usages.
P:Π×X→[0,1]:(p,x)→P p(x)
i max g(x)={p:g(x,q)≦g(x,p)∀qεΠ}
The function imax g can be considered as derived from g or from ig. In some cases g is discontinuous and such a maximum p may not exist. In these cases, an alternative may sometimes be available. Consider the supremum of gradings values at x, written sx=suppεΠg(x,p). Define Sε={p: g(x,p)≧sx−ε}⊂Π, which are nested according to the size ε. As a matter of convenience, S ε can be the closure of Sε in some natural topology on Π. If we define isupg(x)=∩ε>0 S ε is non-empty (which is true if Π is given a compact topology), isupg(x) may serve as a suitable substitute for an empty set imaxg(x), even if values of g(x,p)<sx for pεisupg(x).
In cryptographic applications, entropy parameters may be of more interest than the distributions themselves. If the parameters are continuous then the definition for isupg(x) above will provide the desired answer for the parameters. For discontinuous parameters the parameters on the isupg(x) may not be what is desired. In this case, instead of considering isupg(x) as the intersection of the chain of sets of S ε, isupg(x) can be considered as the limit of the chain of sets Sε. This enables us to consider limits of parameters on Sε, which may differ the value of parameters on the intersection. In many cases, the inferred set imax g(x) is a single element (singleton) set. In these cases, the inference is much like a point-valued inference function. However, there are often some values of x for which several, possibly infinitely many, different distributions p attain the maximal value. If G is a general grading method or IG is grading-valued inference method, then it is possible to derive a set-valued inference method ImaxG using the inference functions above. Maximally graded inferences can be model-dependent in the sense that the equation for imax g (X) include Π. A potential consequence of this model-dependence is that the maximally graded inference in restriction (Θ, X, P) of the model (Π, X, P), may not have a given relation with the maximally graded inference in the model (Π, X, P).
i g>t(x)={p:g(x,p)>t}
i Θ(x)=Θ∩i Θ(x).
g L(x,p)=P p(x).
g 1(x,p)≧g L(x,p)
g 1(x,p)−g 0(x,p)≧g L(x,p)
H ∞(p)=−log2 maxx P P(x)=minx(−log2 P p(x)).
H (w)(p)=minxj(−log2 Σj=1 [2 w ] P p(x j)),
(x 0 , . . . ,x m-1)→(x 0 ,x 1 −x 0 , . . . ,x m-1 −x m-2)
The two example sample statistics for the smaller, single-instantiation example model, the Markov model of width 2t and length m are the identity function and the Markov frequency statistic F, can be F(x)=(e(x), U(x)), where e(x)=ex 0 is a 2t dimensional vector all of whose entries are zero except for the entry in position x0 whose value is 1 (vector entry indices run from 0 to m−1); and U(x) is an 2t×2t matrix with non-negative integer entries Uy,z indexed by integers pair (y, z) such that 0≦y, z≦2t with
U y,z =|{i|1≦i≦N−1,x i-1 =y,x i =z}|
In some implementations, a grading can include a real-valued function on the probability space, g: Π→
. The set of gradings may be referred to as Γ(Π). A grading-valued inference function is function i: X→Γ(Π), which may also be thought of as function i: X×Π→
. When clear from context, a grading-valued inference function can just be called a grading. The notation ix(p) can be used to indicate i(x,p) (which indicates i(x)(p)).
A set-valued inference function i can be a grading-valued inference function i in which ix(p)ε{0, 1} for all (x,p)εX×P, and one may identify ix with ix −1(p)={pεΠ: ix(p)=1}, so that i maps X to subsets of Π. A set-valued inference i is a graded inference if it is derived from another grading-valued inference j in one of two ways. Graded inference i is maximally graded if
i(x)={p:j x(p)≧j x(q),∀qεΠ}.
i(x)={p:j x(p)≧t}
H(x)=inf{H f((w))|g(p):pεi(x)}.
1. A method for assessing entropy in a cryptography system, the method comprising:
g k ⁡ ( x , p ) = ( ∑ y : P p ⁡ ( y ) < P p ⁡ ( x ) ⁢ ⁢ P p ⁡ ( y ) ) + k ( ∑ y : P p ⁡ ( y ) = P p ⁡ ( x ) ⁢ ⁢ P p ⁡ ( y ) ) ,
9. A method for assessing entropy in a cryptography system, the method comprising:
( ∑ y : P p ⁡ ( y ) < P p ⁡ ( x ) ⁢ ⁢ P p ⁡ ( y ) ) ,
US13/307,078 2011-11-30 2011-11-30 Assessing cryptographic entropy Active 2031-12-29 US8787564B2 (en)
US13/307,078 US8787564B2 (en) 2011-11-30 2011-11-30 Assessing cryptographic entropy
US14/318,005 US10079673B2 (en) 2011-11-30 2014-06-27 Assessing cryptographic entropy
US14/318,005 Continuation US10079673B2 (en) 2011-11-30 2014-06-27 Assessing cryptographic entropy
US20130136255A1 US20130136255A1 (en) 2013-05-30
US8787564B2 true US8787564B2 (en) 2014-07-22
ID=48466882
US13/307,078 Active 2031-12-29 US8787564B2 (en) 2011-11-30 2011-11-30 Assessing cryptographic entropy
US14/318,005 Active 2032-02-15 US10079673B2 (en) 2011-11-30 2014-06-27 Assessing cryptographic entropy
US (2) US8787564B2 (en)
JP6176076B2 (en) * 2013-11-22 2017-08-09 富士通株式会社 Physical random number generator, a physical random number generating method and a physical random number generating system,
EP2940923B1 (en) * 2014-04-28 2018-09-05 Université de Genève Method and device for optics based quantum random number generator
US20170063536A1 (en) * 2015-04-20 2017-03-02 Certicom Corp. Generating Cryptographic Function Parameters Based on an Observed Astronomical Event
US9780948B1 (en) 2016-06-15 2017-10-03 ISARA Corporation Generating integers for cryptographic protocols
US20060067527A1 (en) 2004-09-27 2006-03-30 Urivskiy Alexey V Method for making seed value used in pseudo random number generator and device thereof
US20080091975A1 (en) * 2006-10-17 2008-04-17 Konstantin Kladko Method and system for side-channel testing a computing device and for improving resistance of a computing device to side-channel attacks
US20100106757A1 (en) 2007-09-18 2010-04-29 Seagate Technology Llc Active Test and Alteration of Sample Times For a Ring Based Random Number Generator
US20110060909A1 (en) 2004-11-11 2011-03-10 Certicom Corp. Trapdoor one-way functions on elliptic curves and their application to shorter signatures and asymmetric encryption
US20110213982A1 (en) 2010-02-26 2011-09-01 Certicom Corp. Elgamal signature schemes
2011-11-30 US US13/307,078 patent/US8787564B2/en active Active
2014-06-27 US US14/318,005 patent/US10079673B2/en active Active
ANSI, Draft ANS X9.82: Part 2-2004, Random Number Generation Part 2: Entropy Sources, dated 2004, 44 pages.
ANSI, Draft ANS X9.82: Part 2-2007, Random Number Generation Part 2: Entropy Sources, dated Dec. 2007, 90 pages.
ANSI, Draft ANS X9.82: Part 2-2007, Random Number Generation Part 2: Entropy Sources, dated Sep. 2007, 90 pages.
Brown, Daniel R.L.: "Formally Assessing Cryptography Entropy", document dated Oct. 20, 2011; 92 pages. (Internet URL: http://eprint.iacr.org/eprint-bin/getfile.pl?entry=2011/659&version=20111209:210029&file=659.pdf) and "Cryptology ePrint Archive: Report 2011/659" (1 page).
C. Cachin. Smooth entropy and R'enyi entropy. In W. Fumy (ed.), Advances in Cryptology-EUROCRYPT '97, Lecture Notes in Computer Science 1233, pp. 193-208. Springer, May 1997.
D. R. L. Brown and K. Gjosteen. A security analysis of the NIST SP 800-90 elliptic curve random number generator. In A. J. Menezes (ed.), Advances in Cryptology-CRYPTO 2007, Lecture Notes in Computer Science 4622, pp. 466-481. Springer, Aug. 2007.
Kelsey et al. "Yarrow-160: Notes on the Design and Analysis of the Yarrow Cryptographic Pseudorandom Number Generator", Selected Areas in Cryptography. Annual International Workshop, XP001012490; Aug. 1999, pp. 13-33.
Kelsey et al. "Yarrow—160: Notes on the Design and Analysis of the Yarrow Cryptographic Pseudorandom Number Generator", Selected Areas in Cryptography. Annual International Workshop, XP001012490; Aug. 1999, pp. 13-33.
Rukhin, Andrew et al.: "A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications", May 15, 2001, XP55026647; 162 pages.
Teixeira, A.; Souto, A.; Matos, A.; Antunes, L., "Entropy measures vs. algorithmic information," Information Theory Proceedings (ISIT), 2010 IEEE International Symposium on , vol., no., pp. 1413,1417, Jun. 13-18, 2010 doi: 10.1109/ISIT.2010.5513643. *
U. Maurer. A universal statistical test for random bit generators. In A. J. Menezes and S. A. Vanstone (eds.), Advances in Cryptology-CRYPTO '90, Lecture Notes in Computer Science 537, pp. 409-420. 1991.
Xinjie Guan; Xili Wan; Junzhou Luo, "A Maximum Entropy Based Multi-dimensional Trust Model," Network and Parallel Computing, 2008. NPC 2008. IFIP International Conference on , vol., no., pp. 226,232, Oct. 18-21, 2008 doi: 10.1109/NPC.2008.54 *
US20140301547A1 (en) 2014-10-09
US20130136255A1 (en) 2013-05-30
US10079673B2 (en) 2018-09-18
Fritz et al. 2013 Local orthogonality as a multipartite principle for quantum correlations
Masanes et al. 2011 Secure device-independent quantum key distribution with causally independent measurement devices
Barrett et al. 2011 How much measurement independence is needed to demonstrate nonlocality?
Datta 2009 Quantum discord between relatively accelerated observers
WO2011052056A1 (en) 2011-05-05 Data processing device
Akhshani et al. 2012 An image encryption scheme based on quantum logistic map
Rührmair et al. 2009 On the Foundations of Physical Unclonable Functions.
JP5771158B2 (en) 2015-08-26 Privacy protection aggregation of time-series data
Feldman et al. 2017 Statistical algorithms and a lower bound for detecting planted cliques
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:BROWN, DANIEL RICHARD L.;REEL/FRAME:027737/0028