# A Lightweight BCH Code Corrector of TRNG with Measurable Dependence

Authors: Hojoong Park; Yongjin Yeom; Ju-Sung Kang
Journal: Security and Communication Networks
 (2019)

---

## Abstract

We propose a new lightweight BCH code corrector of the random number generator such that the bitwise dependence of the output value is controllable. The proposed corrector is applicable to a lightweight environment and the degree of dependence among the output bits of the corrector is adjustable depending on the bias of the input bits. Hitherto, most correctors using a linear code are studied on the direction of reducing the bias among the output bits, where the biased input bits are independent. On the other hand, the output bits of a linear code corrector are inherently not independent even though the input bits are independent. However, there are no results dealing with the independence of the output bits. The well-known von Neumann corrector has an inefficient compression rate and the length of output bits is nondeterministic. Since the heavy cryptographic algorithms are used in the NIST’s conditioning component to reduce the bias of input bits, it is not appropriate in a lightweight environment. Thus we have concentrated on the linear code corrector and obtained the lightweight BCH code corrector with measurable dependence among the output bits as well as the bias. Moreover, we provide some simulations to examine our results.


---

## Body

## 1. Introduction

Random number generator (RNG) is essential in the modern cryptography system and used to generate the security parameters such as secret key, initialization vector, nonce, salt, and so on. The random numbers used for cryptographic purposes should be generated by the cryptographically secure random number generator [1]. The cryptographically secure random number generator is composed of the true random number generator (TRNG) and the pseudorandom number generator (PRNG) [1–3] as shown in Figure 1. The nondeterministic outputs are generated by TRNG and are the root of security, also known as the entropy source, for the cryptographically secure random number generator. In PRNG process, the cryptographically secure random numbers are finally generated by a deterministic algorithm using the seed, the output of TRNG, as input value. Hence the security of the cryptographically secure random number generator depends on the nondeterministic entropy source and all its constituent parts [3]. In order to generate the cryptographically secure random number, we first collect the entropy from the noise source such as thermal noise, ring oscillator, noise from quantum effect, outputs of crypto API in operation system, and CPU jitter noise source [4, 5] in TRNG process.Figure 1
Cryptographically secure random number generator and post-processing components in TRNG.It is difficult to directly utilize the noise source as a seed, the input value of PRNG, since the bias of noise source is able to be exploited to attack the cryptosystem by using the statistical estimation of the next TRNG output bits [6]. To solve this problem, various post-processing components in TRNG are used as shown in Figure 1. The principal role of the post-processing component is reducing the bias of the noise source in TRNG. There are well-known post-processing components such as von Neumann corrector [7], XOR corrector [8], NIST’s conditioning component [4], and correctors using linear code and nonlinear code (code corrector). Until now most researches related to the post-processing components have been conducted on the subject of reducing the bias of output bits [6, 9–12]. The outputs of von Neumann corrector [7] are perfectly unbiased if the input bits are independent. The bias of the output bits from XOR corrector [8] is proven to be 2ϵ2, where the bias of input bits is ϵ, for any 0<ϵ<1, and the input bits are independent. In the NIST’s conditioning component [4], the FIPS-approved or NIST-recommended cryptographic algorithms are used to reduce the bias of input values. The quality of the output bits from the NIST’s conditioning component is only empirically ensured by the pseudorandomness and the statistical randomness of the used cryptographic algorithms which are heavy to a lightweight environment. The linear code and nonlinear code are employed as the code corrector for reducing the bias of input bits. The advantage of the code corrector is that the bias of output value is theoretically determined by the bias of input bits and the used code.Meanwhile, the results of research on the independence of the output bits of post-processing component are known as follows: The output bits of the von Neumann corrector and XOR corrector are proven to be bitwise independent when the input bits are independent and stationary [9]. We concede that the output bits of NIST’s conditioning component are heuristically independent since the outputs are generated by heavy cryptographic algorithms. On the other hand, the output bits of the code corrector are intrinsically not independent even though the input bits are independent; however, there are no results dealing with the independence of the output bits. Therefore we inspect the code corrector from the view point of independence in this paper.Related Works. There are a number of works to design post-processing component using linear code and to study on the direction of reducing the bias of the output bits where the biased input bits are independent and stationary. As a noticeable result, Markovski et al. [10] have proposed a new linear corrector using quasigroup and have analyzed the output of linear corrector using KStest. Then, they have provided some simulation results and mentioned that the linear corrector is efficiently implemented in both hardware and software. Dichtl [11] has refuted the post-processing component of Markovski and proposed a new linear corrector using XOR compression function. He has analyzed the compression function for input bias in order to reduce the output bias. Lacharme [12] has proposed post-processing components using a resilient function and a cyclic code. He has calculated the upper bound of output bias using relation between resilient function and cyclic code and analyzed a bias and minimal entropy of output. Kim et al. [6] have designed a linear corrector overcoming the minimum distance limitation using quadratic residue code. They have analyzed outputs of the corrector using entropy test in AIS.31 standard and mutual information and have provided a hardware architecture. Kwok et al. [9] have compared code corrector and von Neumann corrector using compression rate, output’s bias, and adversary bias. They have also provided good ways to implement linear code corrector in hardware based on their analysis of linear code corrector.Our Contribution. We propose a new lightweight BCH code corrector that bitwise dependence of the output value is adjustable. Since most code correctors have been studied on the subject of reducing the bias of the output bits where the biased input bits are independent, we concentrate on the dependence of the output bits and define a new measure,degree of dependence, in order to make the lightweight BCH code corrector with controllable dependence as shown in Figure 2. We obtain the fact thatdegree of dependence is related to the bias of input bits through theoretical and simulation results. Moreover, the [7,4,3] BCH code corrector is applicable to the lightweight environment such as IoT, embedded, and mobile devices because of its small code size. In other words, the proposed BCH code corrector is applicable to the lightweight environment as post-processing component of TRNG, and the dependence among the output bits of this corrector is controllable depending on the bias of the input bits.Figure 2
A new lightweight BCH code corrector with controllable dependence.Organization. The rest of this paper is organized as follows. In Section 2, we introduce the post-processing components and their properties. In Section 3, we examine the output bits of the BCH code corrector from the view point of mutual independence. In Section 4, we formally define a new measure,degree of dependence, and compare another method measuring dependence. In Section 5, we exploitdegree of dependence in order to measure the dependence of the output bits of [7,4,3] BCH code corrector. In Section 6, we provide some experimental results for inspecting our results, and we propose the application of the BCH code corrector of TRNG in a lightweight environment. Finally, Section 7 is the conclusion of this paper.


## 2. Post-Processing Component

The post-processing component has been utilized in TRNG mainly for decreasing the bias of noise source. The basic role of post-processing component in TRNG is to make seed having high entropy rate, since the security of the cryptographically secure random number generator essentially depends on the entropy of the seed [4]. There are the representative post-processing components applied in TRNG such as von Neumann corrector [7], XOR corrector [8], NIST’s conditioning component [4], and code corrector. Some properties and limitations of the post-processing components are summarized in Table 1.Table 1
Comparison of post-processing components of TRNG.
Properties Limitations von Neumann corrector The output is unbiased and independent. The output length is nondeterministic since compression rate is 0.25 on average.  XOR corrector The post-processed data is independent and implementation is easy. Compression rate is fixed as 0.5. The bias of output is fixed as2ϵ2 if the bias of input is ϵ.  NIST’s conditioning component The output bits of conditioning component are regarded as heuristically unbiased and independent. The output bits have not been theoretically proven from the viewpoint of unbias and independence.  Code corrector It is able to adjust the bias of output bits depending on used code and input bias. The output bits of the code corrector are not independent even though the input sequence is independent.On the other hand, most post-processing components have been studied on the direction of reducing the bias of output bits. The von Neumann corrector generates perfectly unbiased and independent outputs when the input bits are independent. Letx and y be an input bit and output bit, respectively, and let ϵin and ϵout be a bias of input bit and a bias of output bit, respectively; then the bias of input bit is defined as ϵin=1/2(P(x=0)-P(x=1)). When two input bits are ‘01’, the von Neumann corrector outputs ‘0’ and when two input bits are ‘10’, it outputs ‘1’ in the von Neumann corrector. On the other hand, the other cases such as two bits of noise source are ‘00’ or ‘11’, and there is no output from the von Neumann corrector. Then, the probabilities of the output bit are calculated as P(y=0)=P(y=1)=1/4-ϵin2 due to independence of input bits. Since the bias of output bit is ϵout=1/2(P(y=0)-P(y=1))=0, the output bit of the von Neumann corrector is perfectly unbiased. However, the von Neumann corrector has some problems that not only the output length is nondeterministic but also the expected output length is one-fourth of the input length since the compression rate is 0.25 on average.The XOR corrector has properties such that the output bits of XOR corrector are independent when the input bit is independent and stationary, and the XOR corrector is also easy to implement [9]. However, it is not flexible since the compression rate is fixed to one-twice and the fixed output’s bias is fixed to 2ϵ2 when input bias is ϵ [8]. In NIST’s conditioning component, FIPS-approved or NIST-recommended cryptographic algorithms such as Hash function in FIPS 180-4 [13] or in FIPS 202 [14], HMAC in FIPS 198-1 [15], CBC-MAC in SP 800-90B [4] and so on are used to reduce the bias of input bits. Hence the unbiased outputs are heuristically guaranteed by the pseudorandomness of outputs of the cryptographic algorithms. In addition, because it is difficult to theoretically analyze the conditioning component from the viewpoint of the output’s bias and independence, there is no theoretical result as other post-processing functions.The linear codes such as dual code [6], BCH code [9], and cyclic code [12] are useful to the code corrector. Until now, the code corrector has been actively studied on the direction of reducing the bias of output bits [9–12], since the compression rate and bias of the output bits could be adjusted by the bias of input value and the characteristics of used code. On the other hand, the output bits of the code corrector are intrinsically not independent even though the input bits are bitwise independent; however, there are no results pertaining to the independence of the output bits. Hence we examine the code corrector from the viewpoint of independence in this paper.


## 3. Mutual Independence of BCH Code Corrector

In this section, we examine the BCH code corrector from the viewpoint of the mutual independence. In order to inspect the properties of BCH code corrector, we choose the[7,4,3] BCH code, the smallest BCH code, and also take the same assumption as in [9–12]: the input bits are bitwise independent, biased, and stationary. We verify the fact that the output bits of BCH code corrector are not independent even though the input bits are bitwise independent.Let the input bits of noise source bex=(x0,x1,…,xn-1) and let the post-processed bits be y=(y0,y1,…,yk-1). The [n,k,d] BCH code corrector is generally operated as the multiplication of a generator matrix M and the input bits x. In other words, the output bits y of the BCH code corrector are defined as yT=M·xT, and we are able to strictly describe them as(1)yT=cn-kcn-k-1⋯c00⋯00cn-kcn-k-1⋯c0⋯0⋮⋱⋱⋱⋮0⋯0cn-kcn-k-1⋯c0k×n·xT.Note thatxT denotes the transpose of x, and the generate matrix M is composed of the coefficient of generator polynomial G(x)=cn-kxn-k+cn-k-1xn-k-1+⋯+c1x+c0 [6, 9].


### 3.1. Output Distribution of[7,4,3] BCH Code Corrector

The[7,4,3] BCH code corrector is generated by a generator polynomial G(x) of [7,4,3] BCH code. Since the generator polynomial of [7,4,3] BCH code is G(x)=x3+x+1, therefore the generator matrix M is generated as(2)M=1011000010110000101100001011.Let the input bits bex=(x1,x2,x3,x4,x5,x6,x7) and let the output bits of the [7,4,3] BCH code corrector be y=(y1,y2,y3,y4); then we should represent the output bits as yi=xi⊕xi+2⊕xi+3, where 1≤i≤4. Let X be a random variable on the input bit, and let ϵ be the input bias; we are able to describe the distribution of input bit as P(X=0)=1/2+ϵ and P(X=1)=1/2-ϵ. Let Z be a random variable on the input bits which are operated by multiplication where the value of matrix entry is 1, and let Y be a random variable on the output bit. The distribution of output bit is represented as P(Y=0)=1/2+4ϵ3 and P(Y=1)=1/2-4ϵ3. Since the input bits are independent by our assumptions, the distribution of output bit of the BCH code corrector is calculated as in Table 2. Table 2 is used to verify the properties of the BCH code corrector as well.Table 2
Distribution of output bit of[7,4,3] BCH code corrector.
z 000 001 010 011 100 101 110 111 Sum y=0 ( 1 / 2 + ϵ ) 3 0 0 ( 1 / 2 + ϵ ) ⋅ ( 1 / 2 - ϵ ) 2 0 ( 1 / 2 + ϵ ) ⋅ ( 1 / 2 - ϵ ) 2 ( 1 / 2 + ϵ ) ⋅ ( 1 / 2 - ϵ ) 2 0 1 / 2 + 4 ϵ 3  y=1 0 ( 1 / 2 - ϵ ) ⋅ ( 1 / 2 + ϵ ) 2 ( 1 / 2 - ϵ ) ⋅ ( 1 / 2 + ϵ ) 2 0 ( 1 / 2 - ϵ ) ⋅ ( 1 / 2 + ϵ ) 2 0 0 ( 1 / 2 - ϵ ) 3 1/2-4ϵ3


### 3.2. Mutual Independence of[7,4,3] BCH Code Corrector

We examine the[7,4,3] BCH code corrector from the viewpoint of mutual independence. Table 2 is used to verify the dependence of output bits of the BCH code corrector in our inspection. In this subsection, we first describe the definition of mutual independence and verify that the output bits of the BCH code corrector are not mutually independent. Finally, we derive the conjecture that the output bits of the BCH code corrector are not mutually independent, even though the input bits are bitwise independent, due to the intrinsic property of the generator matrix of the BCH code.Definition 1 (mutual independence [16]).
Let the random variablesX1,X2,…,Xn on {0,1,…,2m-1} have the joint probability density distribution f(x1,x2,…,xn), where x1,x2,…,xn∈{0,1}m, and the marginal probability density distributions f1x1,f2x2,…,fn(xn), respectively, for every k(k=2,3,…,n) and every subset {i1,i2,…,ik} of k distinct values drawn from the set of the first n natural numbers. Then, Xi1,Xi2,…,Xik are mutually independent if and only if(3)fxi1,xi2,…,xik=fi1xi1·fi2xi2⋯fikxik.Since the output length of[7,4,3] BCH code corrector is 4 bits, we have to validate the independence of two bits, three bits, and four bits, respectively, in order to verify the mutual independence among the output bits.Proposition 2.
The two output bits of the[7,4,3] BCH code corrector are not independent.Proof (Proof of Proposition2).
For1≤n≤7 and 1≤m≤4, let Xn be a random variable on the n-th bit of the input and let Ym be a random variable on the m-th bit of the output. Without loss of generality, we are able to describe the two bits for independence analysis as Y1 and Y2, due to the fact that the input bits are independent by the assumption. Thus, P(Y1=0,Y2=0) is calculated as(4)PY1=0,Y2=0=PX1⊕X3⊕X4=0,X2⊕X4⊕X5=0=∑i=01PX1⊕X3⊕X4=0,X2⊕X4⊕X5=0∣X4=i·PX4=i=∑i=01PX1⊕X3=i,X2⊕X5=i∣X4=i·PX4=i=∑i=01PX1⊕X3=i,X2⊕X5=i·PX4=i=∑i=01PX1⊕X3=i·PX2⊕X5=i·PX4=i=12+ϵ2+12-ϵ22·12+ϵ+212+ϵ12-ϵ2·12-ϵ=4ϵ4+4ϵ3+14≠12+4ϵ32=PY1=0·PY2=0.
Similarly,P(Y1=0,Y2=1), P(Y1=1,Y2=0), and P(Y1=1,Y2=1) are proven as P(Y1=0,Y2=0). The results are as follows: (5)PY1=0,Y2=1=14-4ϵ4≠14-16ϵ6=PY1=0·PY2=1,PY1=1,Y2=0=14-4ϵ4≠14-16ϵ6=PY1=1·PY2=0,PY1=1,Y2=1=4ϵ4-4ϵ3+14≠16ϵ6-4ϵ3+14=PY1=1·PY2=1.
Therefore, the output bits of the[7,4,3] BCH code corrector are not pairwise independent.Proposition 3.
The three output bits of the[7,4,3] BCH code corrector are not mutually independent.Proof (Proof of Proposition3).
Similarly, Proposition3 is proven by using the same method as Proposition 2. In the proving of the mutual independence of three bits, we classify two cases: Case 1 is the joint distribution of (Y1,Y2,Y3), (Y1,Y3,Y4), and (Y2,Y3,Y4), and Case 2 is the joint distribution of (Y1,Y2,Y4). Due to the characteristic of the generator matrix and generator polynomial, Case 1 shares two bits in the post-processing operation; on the other hand, Case 2 shares only one bit in the post-processing operation. The proofs of Cases 1 and 2 are as follows.Case 1 (joint distribution of(Y1,Y2,Y3), (Y1,Y3,Y4) and (Y2,Y3,Y4)).
For1≤n≤7 and 1≤m≤4, let Xn be a random variable on the n-th bit of the input and let Ym be a random variable on the m-th bit of the output. Without loss of generality, we are able to represent the three output bits for verifying the mutual independence as Y1, Y2, and Y3, due to the fact that the input bits are bitwise independent by the assumption. Thus, P(Y1=0,Y2=0,Y3=0) is calculated as (6)PY1=0,Y2=0,Y3=0=PX1⊕X3⊕X4=0,X2⊕X4⊕X5=0,X3⊕X5⊕X6=0=∑i=01∑j=01PX1⊕X3=i,X2=i⊕j,X3⊕X6=j·PX4=i,X5=j=∑i=01∑j=01PX1⊕X3=i,X2=i⊕j,X3⊕X6=j·PX4=i·PX5=j=6ϵ4+4ϵ3+18≠64ϵ9+24ϵ6+3ϵ3+18=PY1=0·PY2=0·PY3=0.
The similar arguments can be applied toP(Y1=0,Y2=0,Y3=1), P(Y1=0,Y2=1,Y3=0),…,P(Y1=1,Y2=1,Y3=1).Case 2 (joint distribution of(Y1,Y2,Y4)).
For1≤n≤7 and 1≤m≤4, let Xn be a random variable on the n-th bit of the input and let Ym be a random variable on the m-th bit of the output. We can represent the three bits for analysis as Y1, Y2, and Y4, due to the fact that the input bits are independent by the assumption. Thus, P(Y1=0,Y2=0,Y4=0) is calculated as (7)PY1=0,Y2=0,Y4=0=PX1⊕X3⊕X4=0,X2⊕X4⊕X5=0,X4⊕X6⊕X7=0=∑i=01PX1⊕X3=i,X2⊕X5=i,X6⊕X7=i·PX4=i=∑i=01PX1⊕X3=i·PX2⊕X5=i·PX6⊕X7=i·PX4=i=16ϵ7+6ϵ4+3ϵ3+18≠64ϵ9+24ϵ6+3ϵ3+18=PY1=0·PY2=0·PY4=0.
The similar arguments can be applied toP(Y1=0,Y2=0,Y4=1), P(Y1=0,Y2=1,Y4=0),…,P(Y1=1,Y2=1,Y4=1). Therefore the three output bits of the [7,4,3] BCH code corrector are not mutually independent.Proposition 4.
The four output bits of the[7,4,3] BCH code corrector are not mutually independent.Proof (Proof of Proposition4).
For1≤n≤7 and 1≤m≤4, let Xn be a random variable on the n-th bit of the input and let Ym be a random variable on the m-th bit of the output. We represent the four bits for analysis as Y1, Y2, Y3, and Y4. We can prove Proposition 4 using the same method as Proposition 2. The following are the results of the mutual independence of four bits.(8)PY1=0,Y2=0,Y3=0,Y4=0=PX1⊕X3⊕X4=0,X2⊕X4⊕X5=0,X3⊕X5⊕X6=0,X4⊕X6⊕X7=0=∑i=01∑j=01∑k=01∑l=01PX1=i⊕j,X2=j⊕k,i⊕k⊕l=0,X7=j⊕l·PX3=i·PX4=j·PX5=k·PX6=l=8ϵ7+7ϵ4+72ϵ3+116≠256ϵ12+128ϵ9+24ϵ6+2ϵ3+116=PY1=0·PY2=0·PY3=0·PY4=0.
The similar arguments can be applied toP(Y1=0,Y2=0,Y3=0,Y4=1), P(Y1=0,Y2=0,Y3=1,Y4=0),…,P(Y1=1,Y2=1,Y3=1,Y4=1), and we obtain the fact that the four output bits of the [7,4,3] BCH code corrector are not mutually independent.We find out the fact that the output bits of the[7,4,3] BCH code corrector are not mutually independent even though the input bits are bitwise independent. We should also conjecture that the output bits of the BCH code corrector are not mutually independent due to the inherent characteristic of the generator polynomial and generator matrix such that there are sequential degrees in the generator polynomial of BCH code, or the rank of generator matrix. The following are the examples of the generator polynomials of BCH code [9, 17].(i)
The generator polynomial of[15,11,1] BCH code is G(x)=x4+x+1.(ii)
The generator polynomial of[15,5,3] BCH code is G(x)=x10+x8+x5+x4+x2+x+1.(iii)
The generator polynomial of[31,26,1] BCH code is G(x)=x5+x2+1.(iv)
The generator polynomial of[31,21,2] BCH code is G(x)=x10+x9+x8+x6+x5+x4+x3+1.(v)
The generator polynomial of[255,247,3] BCH code is G(x)=x8+x4+x3+x2+1.(vi)
The generator polynomial of[255,231,7] BCH code is G(x)=x24+x23+x21+x20+x19+x17+x16+x15+x13+x9+x7+x6+x5+x4+x3+x2+1.


## 3.1. Output Distribution of[7,4,3] BCH Code Corrector

The[7,4,3] BCH code corrector is generated by a generator polynomial G(x) of [7,4,3] BCH code. Since the generator polynomial of [7,4,3] BCH code is G(x)=x3+x+1, therefore the generator matrix M is generated as(2)M=1011000010110000101100001011.Let the input bits bex=(x1,x2,x3,x4,x5,x6,x7) and let the output bits of the [7,4,3] BCH code corrector be y=(y1,y2,y3,y4); then we should represent the output bits as yi=xi⊕xi+2⊕xi+3, where 1≤i≤4. Let X be a random variable on the input bit, and let ϵ be the input bias; we are able to describe the distribution of input bit as P(X=0)=1/2+ϵ and P(X=1)=1/2-ϵ. Let Z be a random variable on the input bits which are operated by multiplication where the value of matrix entry is 1, and let Y be a random variable on the output bit. The distribution of output bit is represented as P(Y=0)=1/2+4ϵ3 and P(Y=1)=1/2-4ϵ3. Since the input bits are independent by our assumptions, the distribution of output bit of the BCH code corrector is calculated as in Table 2. Table 2 is used to verify the properties of the BCH code corrector as well.Table 2
Distribution of output bit of[7,4,3] BCH code corrector.
z 000 001 010 011 100 101 110 111 Sum y=0 ( 1 / 2 + ϵ ) 3 0 0 ( 1 / 2 + ϵ ) ⋅ ( 1 / 2 - ϵ ) 2 0 ( 1 / 2 + ϵ ) ⋅ ( 1 / 2 - ϵ ) 2 ( 1 / 2 + ϵ ) ⋅ ( 1 / 2 - ϵ ) 2 0 1 / 2 + 4 ϵ 3  y=1 0 ( 1 / 2 - ϵ ) ⋅ ( 1 / 2 + ϵ ) 2 ( 1 / 2 - ϵ ) ⋅ ( 1 / 2 + ϵ ) 2 0 ( 1 / 2 - ϵ ) ⋅ ( 1 / 2 + ϵ ) 2 0 0 ( 1 / 2 - ϵ ) 3 1/2-4ϵ3


## 3.2. Mutual Independence of[7,4,3] BCH Code Corrector

We examine the[7,4,3] BCH code corrector from the viewpoint of mutual independence. Table 2 is used to verify the dependence of output bits of the BCH code corrector in our inspection. In this subsection, we first describe the definition of mutual independence and verify that the output bits of the BCH code corrector are not mutually independent. Finally, we derive the conjecture that the output bits of the BCH code corrector are not mutually independent, even though the input bits are bitwise independent, due to the intrinsic property of the generator matrix of the BCH code.Definition 1 (mutual independence [16]).
Let the random variablesX1,X2,…,Xn on {0,1,…,2m-1} have the joint probability density distribution f(x1,x2,…,xn), where x1,x2,…,xn∈{0,1}m, and the marginal probability density distributions f1x1,f2x2,…,fn(xn), respectively, for every k(k=2,3,…,n) and every subset {i1,i2,…,ik} of k distinct values drawn from the set of the first n natural numbers. Then, Xi1,Xi2,…,Xik are mutually independent if and only if(3)fxi1,xi2,…,xik=fi1xi1·fi2xi2⋯fikxik.Since the output length of[7,4,3] BCH code corrector is 4 bits, we have to validate the independence of two bits, three bits, and four bits, respectively, in order to verify the mutual independence among the output bits.Proposition 2.
The two output bits of the[7,4,3] BCH code corrector are not independent.Proof (Proof of Proposition2).
For1≤n≤7 and 1≤m≤4, let Xn be a random variable on the n-th bit of the input and let Ym be a random variable on the m-th bit of the output. Without loss of generality, we are able to describe the two bits for independence analysis as Y1 and Y2, due to the fact that the input bits are independent by the assumption. Thus, P(Y1=0,Y2=0) is calculated as(4)PY1=0,Y2=0=PX1⊕X3⊕X4=0,X2⊕X4⊕X5=0=∑i=01PX1⊕X3⊕X4=0,X2⊕X4⊕X5=0∣X4=i·PX4=i=∑i=01PX1⊕X3=i,X2⊕X5=i∣X4=i·PX4=i=∑i=01PX1⊕X3=i,X2⊕X5=i·PX4=i=∑i=01PX1⊕X3=i·PX2⊕X5=i·PX4=i=12+ϵ2+12-ϵ22·12+ϵ+212+ϵ12-ϵ2·12-ϵ=4ϵ4+4ϵ3+14≠12+4ϵ32=PY1=0·PY2=0.
Similarly,P(Y1=0,Y2=1), P(Y1=1,Y2=0), and P(Y1=1,Y2=1) are proven as P(Y1=0,Y2=0). The results are as follows: (5)PY1=0,Y2=1=14-4ϵ4≠14-16ϵ6=PY1=0·PY2=1,PY1=1,Y2=0=14-4ϵ4≠14-16ϵ6=PY1=1·PY2=0,PY1=1,Y2=1=4ϵ4-4ϵ3+14≠16ϵ6-4ϵ3+14=PY1=1·PY2=1.
Therefore, the output bits of the[7,4,3] BCH code corrector are not pairwise independent.Proposition 3.
The three output bits of the[7,4,3] BCH code corrector are not mutually independent.Proof (Proof of Proposition3).
Similarly, Proposition3 is proven by using the same method as Proposition 2. In the proving of the mutual independence of three bits, we classify two cases: Case 1 is the joint distribution of (Y1,Y2,Y3), (Y1,Y3,Y4), and (Y2,Y3,Y4), and Case 2 is the joint distribution of (Y1,Y2,Y4). Due to the characteristic of the generator matrix and generator polynomial, Case 1 shares two bits in the post-processing operation; on the other hand, Case 2 shares only one bit in the post-processing operation. The proofs of Cases 1 and 2 are as follows.Case 1 (joint distribution of(Y1,Y2,Y3), (Y1,Y3,Y4) and (Y2,Y3,Y4)).
For1≤n≤7 and 1≤m≤4, let Xn be a random variable on the n-th bit of the input and let Ym be a random variable on the m-th bit of the output. Without loss of generality, we are able to represent the three output bits for verifying the mutual independence as Y1, Y2, and Y3, due to the fact that the input bits are bitwise independent by the assumption. Thus, P(Y1=0,Y2=0,Y3=0) is calculated as (6)PY1=0,Y2=0,Y3=0=PX1⊕X3⊕X4=0,X2⊕X4⊕X5=0,X3⊕X5⊕X6=0=∑i=01∑j=01PX1⊕X3=i,X2=i⊕j,X3⊕X6=j·PX4=i,X5=j=∑i=01∑j=01PX1⊕X3=i,X2=i⊕j,X3⊕X6=j·PX4=i·PX5=j=6ϵ4+4ϵ3+18≠64ϵ9+24ϵ6+3ϵ3+18=PY1=0·PY2=0·PY3=0.
The similar arguments can be applied toP(Y1=0,Y2=0,Y3=1), P(Y1=0,Y2=1,Y3=0),…,P(Y1=1,Y2=1,Y3=1).Case 2 (joint distribution of(Y1,Y2,Y4)).
For1≤n≤7 and 1≤m≤4, let Xn be a random variable on the n-th bit of the input and let Ym be a random variable on the m-th bit of the output. We can represent the three bits for analysis as Y1, Y2, and Y4, due to the fact that the input bits are independent by the assumption. Thus, P(Y1=0,Y2=0,Y4=0) is calculated as (7)PY1=0,Y2=0,Y4=0=PX1⊕X3⊕X4=0,X2⊕X4⊕X5=0,X4⊕X6⊕X7=0=∑i=01PX1⊕X3=i,X2⊕X5=i,X6⊕X7=i·PX4=i=∑i=01PX1⊕X3=i·PX2⊕X5=i·PX6⊕X7=i·PX4=i=16ϵ7+6ϵ4+3ϵ3+18≠64ϵ9+24ϵ6+3ϵ3+18=PY1=0·PY2=0·PY4=0.
The similar arguments can be applied toP(Y1=0,Y2=0,Y4=1), P(Y1=0,Y2=1,Y4=0),…,P(Y1=1,Y2=1,Y4=1). Therefore the three output bits of the [7,4,3] BCH code corrector are not mutually independent.Proposition 4.
The four output bits of the[7,4,3] BCH code corrector are not mutually independent.Proof (Proof of Proposition4).
For1≤n≤7 and 1≤m≤4, let Xn be a random variable on the n-th bit of the input and let Ym be a random variable on the m-th bit of the output. We represent the four bits for analysis as Y1, Y2, Y3, and Y4. We can prove Proposition 4 using the same method as Proposition 2. The following are the results of the mutual independence of four bits.(8)PY1=0,Y2=0,Y3=0,Y4=0=PX1⊕X3⊕X4=0,X2⊕X4⊕X5=0,X3⊕X5⊕X6=0,X4⊕X6⊕X7=0=∑i=01∑j=01∑k=01∑l=01PX1=i⊕j,X2=j⊕k,i⊕k⊕l=0,X7=j⊕l·PX3=i·PX4=j·PX5=k·PX6=l=8ϵ7+7ϵ4+72ϵ3+116≠256ϵ12+128ϵ9+24ϵ6+2ϵ3+116=PY1=0·PY2=0·PY3=0·PY4=0.
The similar arguments can be applied toP(Y1=0,Y2=0,Y3=0,Y4=1), P(Y1=0,Y2=0,Y3=1,Y4=0),…,P(Y1=1,Y2=1,Y3=1,Y4=1), and we obtain the fact that the four output bits of the [7,4,3] BCH code corrector are not mutually independent.We find out the fact that the output bits of the[7,4,3] BCH code corrector are not mutually independent even though the input bits are bitwise independent. We should also conjecture that the output bits of the BCH code corrector are not mutually independent due to the inherent characteristic of the generator polynomial and generator matrix such that there are sequential degrees in the generator polynomial of BCH code, or the rank of generator matrix. The following are the examples of the generator polynomials of BCH code [9, 17].(i)
The generator polynomial of[15,11,1] BCH code is G(x)=x4+x+1.(ii)
The generator polynomial of[15,5,3] BCH code is G(x)=x10+x8+x5+x4+x2+x+1.(iii)
The generator polynomial of[31,26,1] BCH code is G(x)=x5+x2+1.(iv)
The generator polynomial of[31,21,2] BCH code is G(x)=x10+x9+x8+x6+x5+x4+x3+1.(v)
The generator polynomial of[255,247,3] BCH code is G(x)=x8+x4+x3+x2+1.(vi)
The generator polynomial of[255,231,7] BCH code is G(x)=x24+x23+x21+x20+x19+x17+x16+x15+x13+x9+x7+x6+x5+x4+x3+x2+1.


## 4. Degree of Dependence

In this section, we define a new measuredegree of dependence which calculates the difference between the distribution of output bits of the BCH code corrector and the distribution where the output bits are independent. In order to formally define thedegree of dependence of a given distribution, we first define Δk which denotes the maximum difference between the k-dimensional distributions of the given distribution and the distributions given by k independent random variables, where the degree of dependence among k bits is assessed.Definition 5 (degree of dependence).
Let(Y1,Y2,…,Yn) be a given random vector on {0,1}n with the joint distribution D. For any k=2,3,…,n, Δk(D) denotes the maximum difference between the joint distribution D and the distribution given by k independent random variables. That is, Δk(D) is defined as(9)ΔkD=max1≤i1<⋯<ik≤n⁡PYi1=yi1,…,Yik=yik-PYi1=yi1⋯PYik=yik,and then thedegree of dependence of the given distribution D, DoDD, is denoted by(10)DoDD=maxΔ2D,Δ3D,…,ΔnD.
On the other hand, there is another method measuring the dependence such ask-wiseδ-dependent [18]. k-wiseδ-dependent is determined by using the distance between the joint uniform distribution of k random variables and the joint distribution of k random variables. It is defined as follows.Definition 6 (k-wise δ-dependent).
LetD be a given joint distribution on {0,1}n and let U be the uniform distribution on {0,1}n. Then D is said to be k-wise δ-dependent if for any subset S of the index set {1,2,…,n} such that S≤k≤n,(11)DS-US≤δ,where the variation distance between two distributions D1 and D2 defined over the same probability space Ω is denoted by(12)D1-D2=∑ω∈ΩPD1ω-PD2ω,and D(S) and U(S) are the distributions D and U, respectively, restricted to the subset S.Degree of dependence is similar to the concept of k-wiseδ-dependence. By Definition 6, k-wiseδ-dependence is measured as the sum of the difference between the joint uniform distribution of k random variables and the given k dimensional joint distributions. However,degree of dependence measures the maximum difference between the distribution of output bits of the BCH code corrector and the distribution where the output bits are independent. The distribution where the output bits are independent is not a fixed distribution such as the uniform distribution, since it just satisfies (3) in Definition 1. Hence the joint uniform distribution is not equal to the distribution where the output bits are independent. In order to show the difference betweendegree of dependence and k-wiseδ-dependence, we describe the following example.Example. For 1 ≤i, m≤ 4, let Yi be a random variable on the i-th bit, and let U(m) be the m-dimensional joint uniform distribution. That is, PU(m)(Y1=y1,Y2=y2,…,Ym=ym)=(1/2)m, for all yi∈0,1. For example, PU(4)(Y1=y1,Y2=y2,Y3=y3,Y4=y4)=1/16, for all yi∈0,1. Let D(4) be the joint distribution on {0,1}4 given by Figure 3.Figure 3
DistributionD(4) for comparingdegree of dependence and k-wiseδ-dependence.Then, the marginal distribution from the joint distribution is calculated as(13)PYi=yi=12,for1≤i≤4,PYi=yi,Yj=yj=14,for1≤i<j≤4,PYi=yi,Yj=yj,Yk=yk=18,for1≤i<j<k≤4.By Definition5,degree of dependence is calculated as 1/32, since (14)Δ2D4=max1≤i<j≤4⁡PYi=yi,Yj=yj-PYi=yi·PYj=yj=0,Δ3D4=max1≤i<j<k≤4⁡PYi=yi,Yj=yj,Yk=yk-PYi=yi·PYj=yj·PYk=yk=0,Δ4D4=max⁡PY1=y1,Y2=y2,Y3=y3,Y4=y4-PY1=y1·PY2=y2·PY3=y3·PY4=y4=max⁡132-116,332-116=132.Therefore,(15)DoDD=max⁡Δ2D4,Δ3D4,Δ4D4=max⁡0,0,132=132.On the other hand, by Definition6, D4 is 4-wise 1/2-dependent (δ=1/2) and is calculated as(16)∑PY1=y1,Y2=y2,Y3=y3,Y4=y4-PU4Y1=y1,Y2=y2,Y3=y3,Y4=y4=8×132-116+8×332-116=12.


## 5. Degree of Dependence of the [7, 4, 3] BCH Code Corrector

We verify the fact that the output bits of the[7,4,3] BCH code corrector are not mutually independent in Section 3 and formally definedegree of dependence of a given distribution in Section 4. In this section, we exploitdegree of dependence in order to measure the difference between the distribution of output bits of the [7,4,3] BCH code corrector and the distribution given by four independent random variables. In order to examinedegree of dependence of the [7,4,3] BCH code corrector, we assume that the input bits are bitwise independent, biased, and stationary as in Section 3. Figure 4 shows the assumption of our inspection anddegree of dependence of the [7,4,3] BCH code corrector.Figure 4
Degree of dependence of the [7,4,3] BCH code corrector.For1≤i≤7 and 1≤j≤4, let the input bits be x=(x1,x2,x3,x4,x5,x6,x7), for all xi∈{0,1}, and let ϵ be the bias of input bits where the range of input bias is 0<ϵ<1/2. Then the distribution of input bits is represented as(17)PXi=0=12+ϵandPXi=1=12-ϵ.Let D be the distribution of output bits of the [7,4,3] BCH code corrector, and let the output bits be y=(y1,y2,y3,y4) for all yj∈{0,1}. From Table 2, the output distribution of the [7,4,3] BCH code corrector is described as(18)PYj=0=12+4ϵ3andPYj=1=12-4ϵ3.In order to examinedegree of dependence of the [7,4,3] BCH code corrector, we employ the results which are the output distribution of the [7,4,3] BCH code corrector in Table 2, Propositions 2, 3, and 4, and our assumption. For 2≤j≤4, Δj(D) is calculated as the maximum difference between the j-dimensional distribution of output bits of the [7,4,3] BCH code corrector and the distribution where the j bits among the outputs are independent. We obtain Δ2(D), Δ3(D), and Δ4(D) by using (9) in Definition 5, and they can be represented as functions on ϵ for 0<ϵ<1/2: (19)Δ2D=16ϵ6-4ϵ4,Δ3D=64ϵ9+24ϵ6-6ϵ4-ϵ3,Δ4D=256ϵ12+128ϵ9-8ϵ7+24ϵ6-7ϵ4-32ϵ3.Based on these results, Figure5 is depicted as the graphs of Δ2(D), Δ3(D), and Δ4(D) for 0<ϵ<1/2. Since DoDD is determined by (10), the maximum value of Δ2(D), Δ3(D), and Δ4(D), we can derive DoDD of the [7,4,3] BCH code corrector as(20)DoDD=256ϵ12+128ϵ9-8ϵ7+24ϵ6-7ϵ4-32ϵ3for0<ϵ<12.When ϵ is 0.25,0.125,0.1, and 0.01, Δ2(D),Δ3(D), Δ4(D), and DoDD are described in Table 3. From Figure 5 and Table 3, we should conjecture that DoDD of the [7,4,3] BCH code corrector is determined by Δ4(D) and also derive the fact that DoDD is close to 0, when the bias ϵ of input bits is close to 0.Table 3
Theoretical results forϵ=0.25,0.125, and 0.1.
Δ 2 ( D ) Δ 3 ( D ) Δ 4 ( D ) D o D D ϵ=0.25 1.17 × 1 0 - 2 3.30 × 1 0 - 2 4.49 × 1 0 - 2 4.49 × 1 0 - 2 ϵ=0.125 9.16 × 1 0 - 4 3.33 × 1 0 - 3 4.55 × 1 0 - 3 4.55 × 1 0 - 3 ϵ=0.1 3.84 × 1 0 - 4 1.58 × 1 0 - 3 2.18 × 1 0 - 3 2.18 × 1 0 - 3Figure 5
The graph ofΔ2,Δ3, and Δ4 depending on ϵ.


## 6. Experimental Results and Applications

### 6.1. Experimental Results

We have conducted experiments to support the theoretical results and examinedegree of dependence depending on the bias of input bits. In order to verify our examination, we have obtained experimental data sequences from Numpy [19]. Numpy is the library of Python and provides various probability distributions such as Binomial distribution, Normal distribution, and Poisson distribution. We have collected the experimental data from the Bernoulli distribution with success probability p of each trial by using Numpy, in order to make experimental data satisfying our assumptions that the input bits are biased, independent, and stationary. In this experiment, we have set that the success probability p of the Bernoulli distribution is 0.25,0.375, and 0.4, and then we have collected experimental data; data size is 30 MB, 300 MB, and 3 GB, respectively. Note that p=0.25 denotes that the bias of input bits is 0.25, p=0.375 denotes that the bias of input bits is 0.125, and p=0.4 denotes that the bias of input bits is 0.1.Table4 shows the experimental results for Δ2(D),Δ3(D),Δ4(D), and DoDD where the input bias ϵ is 0.25,0.125, and 0.1, and the experimental data size is 30 MB, and Tables 5 and 6 show the results of the experimental data of size 300 MB and 3 GB, respectively. The reason for performing the experiments for different data sizes is to accurately inspect our theoretical result. Since the difference values between the theoretical result and experimental results in Tables 4, 5, and 6 are less than 7.83·10-4, 1.52·10-4, and 1.10·10-4, respectively, we are able to state thatdegree of dependence in Tables 4, 5, and 6 is similar to the theoretical results in Table 3. Specially, as the data size increases, and the accuracy of the experiment increases; thus, the values in Table 6 are more approximate to the theoretical results. Therefore the experimental results support our theoretical result fordegree of dependence.Table 4
Experimental results for 30 MB data whereϵ is 0.25,0.125, and 0.1.
Δ 2 ( D ) Δ 3 ( D ) Δ 4 ( D ) D o D D ϵ=0.25 1.25 × 1 0 - 2 3.31 × 1 0 - 2 4.48 × 1 0 - 2 4.48 × 1 0 - 2 ϵ=0.125 7.19 × 1 0 - 4 3.16 × 1 0 - 3 4.70 × 1 0 - 3 4.70 × 1 0 - 3 ϵ=0.1 5.95 × 1 0 - 4 1.42 × 1 0 - 3 2.20 × 1 0 - 3 2.20 × 1 0 - 3Table 5
Experimental results for 300 MB data whereϵ is 0.25,0.125, and 0.1.
Δ 2 ( D ) Δ 3 ( D ) Δ 4 ( D ) D o D D ϵ=0.25 1.19 × 1 0 - 2 3.30 × 1 0 - 2 4.50 × 1 0 - 2 4.50 × 1 0 - 2 ϵ=0.125 9.87 × 1 0 - 4 3.33 × 1 0 - 3 4.58 × 1 0 - 3 4.58 × 1 0 - 3 ϵ=0.1 5.23 × 1 0 - 4 1.71 × 1 0 - 3 2.18 × 1 0 - 3 2.18 × 1 0 - 3Table 6
Experimental results for 3 GB data whereϵ is 0.25,0.125, and 0.1.
Δ 2 ( D ) Δ 3 ( D ) Δ 4 ( D ) D o D D ϵ=0.25 1.18 × 1 0 - 2 3.30 × 1 0 - 2 4.50 × 1 0 - 2 4.50 × 1 0 - 2 ϵ=0.125 9.66 × 1 0 - 4 3.38 × 1 0 - 3 4.56 × 1 0 - 3 4.56 × 1 0 - 3 ϵ=0.1 4.50 × 1 0 - 4 1.64 × 1 0 - 3 2.23 × 1 0 - 3 2.23 × 1 0 - 3


### 6.2. Application of the[7,4,3] BCH Code Corrector in TRNG

In order to harvest the entropy from the noise source, RNGs in the lightweight environment usually collect sensor-based noise sources such as microphone, accelerometer, magnetometer, gyroscope, temperature, and humidity [20, 21]. However, since these noise sources have low entropy [20, 21], RNGs have to apply post-processing component so as to reduce biases and to increase the entropy per bit.It is possible to consider various post-processing components which are appropriate in the lightweight environment, except for NIST conditioning components where the heavy cryptographic algorithm is involved. Although the von Neumann corrector is lightweight, it is also not suitable from the security point of view due to some drawbacks such as adversary bias; on the contrary, the linear code correctors perform much better than von Neumann corrector [9]. The [7,4,3] BCH code corrector is applicable to resource constrained environments, such as IoT, embedded, and mobile devices [22, 23], since the code size and the circuit complexity of the proposed code corrector are small as compared with other code correctors and NIST’s conditioning components.It is also possible to iteratively use the[7,4,3] BCH code corrector, when the size of the collected noise source is bigger than the input size of the BCH code corrector. For instance, if the size of the collected noise source is 32 bits, the [7,4,3] BCH code corrector is four times iteratively processed with separated 7 input bits, and the residual 4 input bits are discarded or stored for the next generation. From our result which finds out the relation between the bias of input bits anddegree of dependence among output bits, the [7,4,3] BCH code corrector is controllable todegree of dependence corresponding to the bias of input bits. The entropy sources are able to be effectively managed by the [7,4,3] BCH code corrector according to the environment of collecting the noise sources.


## 6.1. Experimental Results

We have conducted experiments to support the theoretical results and examinedegree of dependence depending on the bias of input bits. In order to verify our examination, we have obtained experimental data sequences from Numpy [19]. Numpy is the library of Python and provides various probability distributions such as Binomial distribution, Normal distribution, and Poisson distribution. We have collected the experimental data from the Bernoulli distribution with success probability p of each trial by using Numpy, in order to make experimental data satisfying our assumptions that the input bits are biased, independent, and stationary. In this experiment, we have set that the success probability p of the Bernoulli distribution is 0.25,0.375, and 0.4, and then we have collected experimental data; data size is 30 MB, 300 MB, and 3 GB, respectively. Note that p=0.25 denotes that the bias of input bits is 0.25, p=0.375 denotes that the bias of input bits is 0.125, and p=0.4 denotes that the bias of input bits is 0.1.Table4 shows the experimental results for Δ2(D),Δ3(D),Δ4(D), and DoDD where the input bias ϵ is 0.25,0.125, and 0.1, and the experimental data size is 30 MB, and Tables 5 and 6 show the results of the experimental data of size 300 MB and 3 GB, respectively. The reason for performing the experiments for different data sizes is to accurately inspect our theoretical result. Since the difference values between the theoretical result and experimental results in Tables 4, 5, and 6 are less than 7.83·10-4, 1.52·10-4, and 1.10·10-4, respectively, we are able to state thatdegree of dependence in Tables 4, 5, and 6 is similar to the theoretical results in Table 3. Specially, as the data size increases, and the accuracy of the experiment increases; thus, the values in Table 6 are more approximate to the theoretical results. Therefore the experimental results support our theoretical result fordegree of dependence.Table 4
Experimental results for 30 MB data whereϵ is 0.25,0.125, and 0.1.
Δ 2 ( D ) Δ 3 ( D ) Δ 4 ( D ) D o D D ϵ=0.25 1.25 × 1 0 - 2 3.31 × 1 0 - 2 4.48 × 1 0 - 2 4.48 × 1 0 - 2 ϵ=0.125 7.19 × 1 0 - 4 3.16 × 1 0 - 3 4.70 × 1 0 - 3 4.70 × 1 0 - 3 ϵ=0.1 5.95 × 1 0 - 4 1.42 × 1 0 - 3 2.20 × 1 0 - 3 2.20 × 1 0 - 3Table 5
Experimental results for 300 MB data whereϵ is 0.25,0.125, and 0.1.
Δ 2 ( D ) Δ 3 ( D ) Δ 4 ( D ) D o D D ϵ=0.25 1.19 × 1 0 - 2 3.30 × 1 0 - 2 4.50 × 1 0 - 2 4.50 × 1 0 - 2 ϵ=0.125 9.87 × 1 0 - 4 3.33 × 1 0 - 3 4.58 × 1 0 - 3 4.58 × 1 0 - 3 ϵ=0.1 5.23 × 1 0 - 4 1.71 × 1 0 - 3 2.18 × 1 0 - 3 2.18 × 1 0 - 3Table 6
Experimental results for 3 GB data whereϵ is 0.25,0.125, and 0.1.
Δ 2 ( D ) Δ 3 ( D ) Δ 4 ( D ) D o D D ϵ=0.25 1.18 × 1 0 - 2 3.30 × 1 0 - 2 4.50 × 1 0 - 2 4.50 × 1 0 - 2 ϵ=0.125 9.66 × 1 0 - 4 3.38 × 1 0 - 3 4.56 × 1 0 - 3 4.56 × 1 0 - 3 ϵ=0.1 4.50 × 1 0 - 4 1.64 × 1 0 - 3 2.23 × 1 0 - 3 2.23 × 1 0 - 3


## 6.2. Application of the[7,4,3] BCH Code Corrector in TRNG

In order to harvest the entropy from the noise source, RNGs in the lightweight environment usually collect sensor-based noise sources such as microphone, accelerometer, magnetometer, gyroscope, temperature, and humidity [20, 21]. However, since these noise sources have low entropy [20, 21], RNGs have to apply post-processing component so as to reduce biases and to increase the entropy per bit.It is possible to consider various post-processing components which are appropriate in the lightweight environment, except for NIST conditioning components where the heavy cryptographic algorithm is involved. Although the von Neumann corrector is lightweight, it is also not suitable from the security point of view due to some drawbacks such as adversary bias; on the contrary, the linear code correctors perform much better than von Neumann corrector [9]. The [7,4,3] BCH code corrector is applicable to resource constrained environments, such as IoT, embedded, and mobile devices [22, 23], since the code size and the circuit complexity of the proposed code corrector are small as compared with other code correctors and NIST’s conditioning components.It is also possible to iteratively use the[7,4,3] BCH code corrector, when the size of the collected noise source is bigger than the input size of the BCH code corrector. For instance, if the size of the collected noise source is 32 bits, the [7,4,3] BCH code corrector is four times iteratively processed with separated 7 input bits, and the residual 4 input bits are discarded or stored for the next generation. From our result which finds out the relation between the bias of input bits anddegree of dependence among output bits, the [7,4,3] BCH code corrector is controllable todegree of dependence corresponding to the bias of input bits. The entropy sources are able to be effectively managed by the [7,4,3] BCH code corrector according to the environment of collecting the noise sources.


## 7. Conclusion

We have proposed a new lightweight BCH code corrector that the bitwise dependence of the output bits is controllable. We have focused on the dependence of the output bits and define a new measuredegree of dependence for making the lightweight BCH code corrector with adjustable dependence corresponding to the bias of input bits. Note that most code correctors have been studied on the subject of reducing the bias of the output bits where the input bits are independent and biased. We have examined the [7,4,3] BCH code corrector from the viewpoint of independence in order to utilize it in the lightweight environment. We have obtained the relation betweendegree of dependence and the bias of input bits through theoretical results and some simulations. Due to its simple structure with small code size and low circuit complexity, the proposed code corrector is able to be applied to lightweight environments such as IoT, embedded, and mobile devices. Moreover the proposed code corrector has the properties of measurable and controllable dependence among output bits as well as reducing the bias of input bits. We expect that the proposed BCH code corrector is utilized to efficiently manage the entropy source in the lightweight environment. In future works, we are planning to study on measuring thedegree of dependence of various probability distributions from other post-processing components, and we will also study how to applydegree of dependence for evaluation of some cryptographically secure random bit sequences.



---

*Source: 9684239-2019-05-13.xml*