(51) Int Cl.: G06F 7/58 ( )

Transkript

1 (19) (11) EP B1 (12) EUROPEAN PATENT SPECIFICATION (4) Date of publication and mention of the grant of the patent: Bulletin 09/27 (1) Int Cl.: G06F 7/8 (06.01) (21) Application number: (22) Date of filing: (4) System and method for generating initial vectors System und Methode zur Erzeugung von Anfangs-Vektoren Système et procédé pe production de vecteurs initiaux (84) Designated Contracting States: DE FR GB () Priority: US 7329 (43) Date of publication of application: Bulletin 04/ (73) Proprietor: Broadcom Corporation Irvine, CA (US) (72) Inventors: Buer, Mark 8296 Gilbert, AZ (US) Qi, Zheng 903 Milpitas, CA (US) (74) Representative: Jehle, Volker Armin et al Bosch Jehle Patentanwaltsgesellschaft mbh Flüggenstrasse München (DE) (6) References cited: WO-A-01/39417 US-A US-A LO C-C ET AL: "Stream ciphers for GSM networks" COMPUTER COMMUNICATIONS, ELSEVIER SCIENCE PUBLISHERS BV, AMSTERDAM, NL, vol. 24, no. 11, June 01 (01-06-), pages 90-96, XP ISSN: EP B1 Note: Within nine months of the publication of the mention of the grant of the European patent in the European Patent Bulletin, any person may give notice to the European Patent Office of opposition to that patent, in accordance with the Implementing Regulations. Notice of opposition shall not be deemed to have been filed until the opposition fee has been paid. (Art. 99(1) European Patent Convention). Printed by Jouve, 7001 PARIS (FR)

2 1 EP B1 2 Description FIELD OF THE INVENTION [0001] The invention relates generally to the field of cryptography and, more particularly, to systems and methods for generating random numbers and initial vectors. BACKGROUND OF THE INVENTION [0002] Cryptography involves encoding and decoding information so that only authorized persons can access the information. For example, a data file that contains sensitive financial information may need to be encrypted to prevent unauthorized persons from accessing the financial information. The data file may be encrypted before it is stored in a data storage device and/or before it is transmitted over a data network. [0003] Typically, data is encrypted using a cipher algorithm and an encryption key. In addition, some cipher algorithms combine data to be encrypted with an initial vector to increase the randomness of the encrypted data. Data encrypted in this way is then decrypted using the cipher algorithm, a decryption key and the initial vector. [0004] Several cipher algorithms have been developed for encrypting and decrypting data. Common cryptography standards include Data Encryption Standard ("DES"), triple DES ("3DES") and Advanced Encryption Standard ("AES"). [000] Several standards have been developed to secure data transmission over data networks. For example, the Internet Security Protocol (commonly referred to as "IPsec") may be used to establish secure host-to-host pipes and virtual private networks over the Internet. IPsec defines a set of specifications for cryptographic encryption and authentication. [0006] In general, cipher algorithms are relatively complex and upon execution consume a significant amount of processing power. To offload encryption/decryption processing from a host processor, dedicated hardware devices, commonly referred to as cryptographic accelerators, may be used to perform the cipher algorithms. [0007] Moreover, some cryptographic standards such as IPsec encourage or require that the initial vectors be true random numbers. In practice, some systems that support IPsec operate at very high data rates (e.g., data transfer rates on the order of 1 gigabit per second). However, it may be difficult to generate random numbers quickly enough to support these high data rates. Some conventional systems attempt to generate random numbers at higher rates by using faster sampling rates. However, this approach may adversely affect the randomness of the generated number. Accordingly, a need exists for improved initial vector generation techniques. [0008] US,732,138 describes a method for generating pseudo random-numbers, wherein the state of a chaotic system is digitized to form a binary string. This binary string is hashed to produce a second binary string which is used to seed a pseudo random number generator. The output of the pseudo random number generator may be used in forming a password or cryptographic key for use in a security system. [0009] According to the invention, there are provided a method of generating random numbers as defined by independent claim 1 and a parallel random number generator as defined by independent claim 4. [00] Further advantageous features of the invention are defined in the dependent subclaims. [0011] The invention relates to methods and associated systems for generating random numbers and initial vectors. [0012] One embodiment of the invention uses pseudo random number generators to generate random numbers. A random number generator generates random numbers that are used to repetitively seed the pseudo random number generators. This technique improves the number distribution of the pseudo random number generators so that each of the pseudo random number generators generates a random number. Thus, a single random number generator may be used to simultaneously generate several random numbers. Significantly, this is accomplished without compromising the randomness of the random numbers generated by the random number generator. [0013] In one embodiment of the invention the random numbers generated by the pseudo random number generators are used as initial vectors in encryption engines. [0014] In one embodiment of the invention the pseudo random number generators comprise linear feedback shift registers. [00] One embodiment of the invention comprises a random bit generator and a round robin distribution circuit for distributing random bits to the pseudo random number generators. BRIEF DESCRIPTION OF THE DRAWINGS [0016] These and other features, aspects and advantages of the present invention will be more fully understood when considered with respect to the following detailed description, appended claims and accompanying drawings, wherein: Figure 1 is a block diagram of one embodiment of a random number generator constructed in accordance with the invention; Figure 2 is a block diagram of one embodiment of a cryptographic system constructed in accordance with the invention; Figure 3 is a flowchart representative of one embodiment of operations that may be performed in accordance with the embodiment of Figure 2; Figure 4 is a block diagram of one embodiment of an initial vector generator constructed in accordance with the invention; and 2

3 3 EP B1 4 Figure is a block diagram of one embodiment of a cryptographic system in a packet data network, constructed in accordance with the invention. DETAILED DESCRIPTION OF THE INVENTION [0017] The invention is described below, with reference to detailed illustrative embodiments. It will be apparent that the invention can be embodied in a wide variety of forms, some of which may be quite different from those of the disclosed embodiments. Consequently, the specific structural and functional details disclosed herein are merely representative and do not limit the scope of the invention. [0018] Figure 1 is a block diagram of one embodiment of a parallel random number generator R constructed in accordance with the invention. A random number generator 0 generates random numbers that seed several pseudo random number generators (e.g., 2A and 2B) which, in turn, may generate random numbers in parallel. As represented by the random number distribution circuit 4, the random number may be distributed to the pseudo random number generators 2A and 2B in a variety of ways. [0019] The pseudo random number generators 2A and 2B include inputs for seeding the computation of the pseudo random numbers. For example, a simple pseudo random number generator may have a number generation algorithm of x(n+1) = x(n) 4 + x(n) + 1. Thus, in normal operation the next output (x(n+1)) of the pseudo random number generator is based on the current output (x(n)). When the pseudo random number generator is reseeded, however, the seed is used to generate the next output. For example, x(n+1) = seed 4 + seed + 1. In other words, as a random number is received by each pseudo random number generator 2A and 2B, the pseudo random number computation is affected by the random number. [00] In one embodiment of the invention the random number generator 0 continuously generates random numbers. Thus, the pseudo random number generators 2A and 2B may be continuously re-seeded. In particular, the pseudo random number generators 2A and 2B may be re-seeded before their number generation algorithms repeat (i.e., before the generators generate a number a second time). [0021] Typically, the pseudo random number generators 2A and 2B are free running. That is, they continuously generate random numbers. Significantly, by generating random numbers using as many parallel pseudo random number generators as is needed for a particular application, this aspect of the invention provides a mechanism for generating a relatively large number of random numbers at a relatively high rate of speed. [0022] As discussed in more detail below, this technique is particularly advantageous when used to generate initial vectors for encryption algorithms [0023] Figure 2 is a block diagram of one embodiment of a cryptographic system S constructed in accordance with the invention. A random number generator 0 generates random numbers that seed linear feedback shift registers 2A and 2B in several security processors 4A and 4B. The linear feedback shift registers 2A and 2B generate initial vectors (e.g., random numbers) for cipher engines (partially represented by ciphers 6A, 6B and multiplexers 212A, 212B) in the security processors 4A and 4B. Thus, in this embodiment pseudo random number generators are implemented as linear feedback shift registers 2A and 2B. A random number distribution circuit 8 distributes the random numbers to the security processors 4A and 4B. [0024] The operation of the system S of Figure 2 will be treated in more detail in conjunction with the flowchart depicted in Figure 3. The blocks and lines 2 through 8 beginning at block 0 represent the process of continuously seeding the linear feedback shift registers 2A and 2B with random numbers. The blocks and lines 3 through 316 beginning at block 0A represent the process of continuously encrypting packets using unique initial vectors generated for each packet. [002] As represented by block 2, the random number generator 0 continuously generates random numbers. The random number generator 0 is a true random number generator. For example, it may be implemented in an integrated circuit and generate numbers based on noise signals. [0026] As represented by block 4, the random number distribution circuit 8 distributes the random number to pseudo random number generators (e.g., the linear feedback shift registers 2A and 2B). [0027] In one embodiment of the invention, the random number generator 0 generates a stream of random data bits. In this case, the random number distribution circuit 8 may distribute these data bits in a round robin manner to the security processors 4A and 4B. For example, in one embodiment the random number distribution circuit 8 alternately routes each random data bit to one of the registers 2A, 2B in the security processors 4A, 4B. The registers then, in effect, assemble the bits into an appropriate word width to seed the linear feedback shift registers 2A, 2B. [0028] An example of this embodiment is depicted in Figure 4. Figure 4 depicts a system including a security processor 412 that incorporates two free running 64 bit linear feedback shift registers to generate 128 bits of data required for AES-CBC encryption. [0029] In Figure 4 a random bit generator 0 distributes some of the random data bits to a 32 bit shift register 2 in the security processor 412. For example, each of eight security processors (not shown) may receive one bit for every eight bits generated by the random bit generator 0. An adder 4 adds the 32 bit random number output of the shift register 2 to a 32 bit word (0xAAAA) 6 to reduce the probability that the input to the linear feedback shift registers will be zero. 3

4 EP B1 6 [00] A multiplexer 8 distributes the data bits from the 32 bit random number to the seed inputs of linear feedback shift registers 4A and 4B. In this embodiment, the multiplexer 8 is used to re-seed the most significant word of each of the 64 bit linear feedback shift registers in a round robin fashion each time 32 bits of data are detected in the shift register 2. [0031] The width of the initial vector may depend on the type of encryption. For example, in a block cipher the width of the initial vector may equal the width of a block. In one embodiment, when DES encryption is activated the initial vector is 64 bits and, alternatively, when AES is activated the initial vector is 128 bits. Thus, for 3DES and DES the initial vector may be constructed using WORD2 and WORD0 from the two 64 bit linear feedback shift registers 4A and 4B. For AES the initial vector may be constructed using WORD3, WORD2, WORD1 and WORD0 from the two 64 bit linear feedback shift registers 4A and 4B. [0032] This implementation of a random number generator helps to ensure that the initial vectors are picked at random as often as possible for each packet. In addition, this implementation of free running linear feedback shift registers helps to ensure that back to back packets have initial vectors with a relatively high Hamming distance as recommended for IPsec. [0033] This embodiment may be used to support encryption at relatively high data rates. For example, one embodiment of the invention uses a random bit generator operating at 2 million bits per second ("2 Mbits/s") in conjunction with eight security processors, each of which provides cryptographic processing at 600 Mbits/s. In this case, using 64 bit linear feedback shift registers the linear feedback shift registers are re-seeded every 26 random bits. It should be noted, however, that the linear feedback shift registers typically are "clocked" every clock cycle (e.g., at a 600 Mbit/s rate). [0034] To ensure that the pseudo random number generators do not repeat before they are re-seeded, it is important to select proper polynomials for the pseudo random number generators. For example, for a 64 bit linear feedback shift register, a polynomial on the order of 2 64 typically may be used. In one embodiment, the polynomial for the first linear feedback shift register is x 64 + x 4 + x 3 + x + 1 and the polynomial for the second linear feedback shift register is x 6 + x [003] Referring again to the process in Figure 3, as represented by block 6, the random numbers in the registers 2A and 2B (Figure 2) are used to seed the linear feedback shift registers 2A and 2B. [0036] The linear feedback shift registers 2A and 2B generate initial vectors (block 3) that are used by cipher engines to encrypt data (block 312). For example, when a new packet is to be encrypted, a multiplexer 212A adds the initial vector to unencrypted data received over line 214A. A cipher 6A (e.g., a block cipher) encrypts a portion of the data and outputs it over line 216A (block 314). In addition, the encrypted data is fed back to the multiplexer 212A so it may be subsequently added to the unencrypted data in place of the initial vector. [0037] As represented by the line 316, this operation repeats as necessary to encrypt the incoming data stream. In this embodiment, as each new packet is to be encrypted, a new initial vector is added to the data to improve the randomness of the encrypted data. To this end, the linear feedback shift registers 2A and 2B continuously generate new initial vectors. [0038] To maintain the randomness of the initial vectors, as represented by the line 8, the linear feedback shift registers 2A and 2B are continuously re-seeded with random numbers. In particular, in accordance with one embodiment of the invention, the linear feedback shift registers are re-seeded on a per-packet basis. [0039] In one embodiment, all of the components in the system S of Figure 2 are implemented in a cryptographic accelerator integrated circuit. For example, the cryptographic accelerator may incorporate four, eight or more security processors. Such a device may be used, for example, to offload cryptographic computations from a host processor as depicted in Figure. [00] In Figure, host processors 00A and 00B connected to a data network 02 send messages to one another via network controller / packet processor components 04A and 04B. When one host processor sends secured data (e.g., per the IPsec standard) to the other host processor they may use cryptographic accelerators 06A and 06B to encrypt and decrypt the associated data packets. For example, a host processor (e.g., 00A) initially sends unencrypted packets to a cryptographic accelerator (e.g., 06A). The cryptographic accelerator includes cipher engines (e.g., A) that encrypt the packets. The cryptographic accelerator 06A may then send the encrypted packets over the network 02 or it may send the encrypted packets back to the host processor 00A and the host processor sends the encrypted packets over the network 02. In accordance with one embodiment of the invention, the cryptographic accelerators 06A and 06B may incorporate initial vector generators 08A and 08B as discussed herein. [0041] It should be appreciated that the inventions described herein are applicable to and may utilize many different protocols and standards and modifications and extensions of those protocols and standards including, for example and without limitation, IPsec, SSL and FCsec. Moreover, a variety of cryptographic algorithms and modifications and extensions thereof may be used including, for example and without limitation, DES, 3DES and AES. [0042] A variety of pseudo random number generators and associated algorithms may be used in implementing the inventions described herein. For example, different linear feedback algorithms and cyclic redundancy check ("CRC") algorithms may be used. In addition, the pseudo random number generators may be implemented using hashing techniques such as SHA-1and MD. [0043] The pseudo random number generators may 4

5 7 EP B1 8 be seeded in several different ways. For example, the pseudo random number generators may be free running, i.e., they are continuously clocked. Alternatively, the pseudo random number generators may be clocked every time a new packet arrives. [0044] It should also be appreciated that the inventions described herein may be constructed using a variety of physical components and configurations. For example, a variety of hardware and software processing components may be used to implement the functions and components described herein. These functions and components may be combined on one or more integrated circuits. [004] In addition, the components and functions described herein may be connected in many different ways. Some of the connections represented by the lead lines in the drawings may be in an integrated circuit, on a circuit board, over a backplane to other circuit boards, over a local network and/or over a wide area network (e.g., the Internet). [0046] A wide variety of devices may be used to implement the data memories discussed herein. For example, a data memory may comprise one or more RAM, disk drive, SDRAM, FLASH or other types of data storage devices. [0047] The invention may be practiced using different types of cipher engines. For example, a stream cipher may be used rather than a block cipher. [0048] Distribution of random numbers to the pseudo random number generators may be accomplished in a variety of ways. For example, the numbers may be distributed a bit at a time or a word at a time. Here, different word widths may be used depending on the particular application. [0049] The random numbers also may be distributed using a variety of hardware and software techniques. For example, relatively simple signal lines and/or busses and/or associated registers may be used to distribute the random numbers. In addition, packet routing techniques may be used to route the random numbers and/or bits between various components in a system or an integrated circuit. [000] In summary, the invention described herein teaches improved techniques for generating random numbers and initial vectors. While certain exemplary embodiments have been described in detail and shown in the accompanying drawings, it is to be understood that such embodiments are merely illustrative of and not restrictive of the broad invention. It will thus be recognized that various modifications may be made to the illustrated and other embodiments of the invention described above, without departing from the broad inventive scope thereof. In view of the above it will be understood that the invention is not limited to the particular embodiments or arrangements disclosed, but is rather intended to cover any changes, adaptations or modifications which are within the scope of the invention as defined by the appended claims Claims 1. A method of generating random numbers, comprising: generating (2) at least one random number; distributing (4) the at least one random number to a plurality of pseudo random number generators (1 02A, 2B), where distributing comprises adding a predetermined number to the at least one random number to reduce the probability that the input to the plurality of pseudo random number generators (2A, 2B) will be zero; repetitively seeding (6) the plurality of pseudo random number generators (2A, 2B) with the at least one random number, such that the number distribution of the pseudo random number generators (1 02A, 2B) is improved; simultaneously generating several random numbers using the pseudo random number generators (2A, 2B) for generating a relatively large number of random numbers at a relatively high rate of speed, without compromising the randomness of the random numbers generated by the random number generator; generating (3) a plurality of initial vectors using the several random numbers; and using the initial vectors in encryption engines. 2. The method of claim 1 wherein the plurality of pseudo random number generators (2A, 2B) comprise a plurality of linear feedback shift registers. 3. The method of claim 1 or 2 wherein the pseudo random number generators (2A, 2B) may be reseeded before their number generation algorithms repeat. 4. A parallel random number generator, comprising: at least one random number generator (0) for generating at least one random number; and a plurality of parallel pseudo random number generators (2A, 2B), connected to receive the at least one random number, a distribution circuit (4) adapted to distribute the at least one random number to the plurality of pseudo random number generators (2A, 2B), an adder adapted to add a predetermined number to the at least one random number to reduce the probability that the input to the plurality of pseudo random number generators (2A, 2B) will be zero; wherein the plurality of parallel pseudo random number generators (2A, 2B) is adapted to be repetitively seeded with the at least one ran-

6 9 EP B1 dom number, such that the number distribution of the pseudo random number generators (2A, 2B) is improved; for simultaneously generating a plurality of random numbers in parallel for generating a relatively large number of random numbers at a relatively high rate of speed, without compromising the randomness of the random numbers generated by the random number generator.. The parallel random number generator of claim 4 wherein the plurality of parallel pseudo random number generators (2A, 2B) comprise a plurality of linear feedback shift registers. 6. The parallel random number generator of claim 4 or wherein the pseudo random number generators (2A, 2B) may be free running or may be clocked every time a new packet arrives. 7. The method of claim 2 wherein: the step of generating at least one random number comprises generating random data bits by a random bit generator; the step of distributing the at least one random number to a plurality of pseudo random number generators (2A, 2B) comprises distributing some of the random data bits to a shift register of predetermined width; the method further comprising: adding the random number output of the shift register to a word of corresponding width to reduce the probability that the input to the linear feedback shift registers will be zero; distributing the random data bits from the random number to the seed inputs of a plurality of linear feedback shift registers of predetermined width by a multiplexer, wherein the width of the linear feedback shift registers and the initial vector generated at the outputs of the linear feedback shift registers may depend on the type of encryption; using the multiplexer to re-seed at least a part of each of the linear feedback shift registers in a round robin fashion each time a predetermined number of bits of data are detected in the shift register, such that the random number generator (0) helps to ensure that the initial vectors are picked at random as often as possible for each packet; wherein the linear feedback shift registers are free running helping to ensure that back to back packets have initial vectors with a relatively high Hamming distance The method of claim 2 or 7 wherein the several random numbers are used to seed the plurality of linear feedback shift registers; further comprising the steps of: using the linear feedback shift registers to generate the initial vectors used by the cipher engines to encrypt data; adding the initial vectors to unencrypted data by a plurality of multiplexers; encrypting portions of the unencrypted data by a plurality of ciphers; outputting the encrypted data; feeding back the encrypted data to the plurality of multiplexers such that the encrypted data may be subsequently added to the unencrypted data in place of the initial vectors; continuously re-seeding the linear feedback shift registers with random numbers; continuously generating new initial vectors by the plurality of linear feedback shift registers to maintain the randomness of the initial vectors; adding the new initial vectors to the unencrypted data to improve the randomness of the encrypted data; repeating the prior steps as often as necessary to encrypt the incoming streams of unencrypted data. 9. The parallel random number generator of claim, wherein the random number generator is adapted to generate a stream of random data bits, wherein the distribution circuit (4) adapted to distribute these data bits in a round robin manner, and to alternately route each random data bit to one of a plurality of registers, wherein the registers are adapted to assemble the data bits into an appropriate word width to seed the plurality of linear feedback shift registers.. The method of claim 8 wherein the plurality of linear feedback shift registers are re-seeded on a per-packet basis. 11. The parallel random number generator of any of claims 4-6 or 9 comprising: at least one random bit generator for generating a plurality of random bits; at least one register, connected to receive the random bits, for storing the at least one random number; and wherein the plurality of pseudo random number generators (2A, 2B) is connected to receive the at least one random number for generating a plurality of initial vectors. 12. The parallel random number generator of any of 6

7 11 EP B1 12 claims 4-6 or 9, wherein the pseudo random number generators (2A, 2B) comprise: at least one input for receiving the at least one random number; and at least one computational circuit for incorporating the received at least one random number into at least one pseudo random number generation operation. 13. A cryptographic accelerator, comprising: at least one parallel number generator according to claim 4 for generating a plurality of initial vectors; and at least one cipher engine, connected to receive the initial vectors, for encrypting data. 14. The cryptographic accelerator of claim 13 wherein the plurality of pseudo random number generators (2A, 2B) comprise a plurality of linear feedback shift registers. Patentansprüche 1. Verfahren zum Erzeugen von Zufallszahlen, das umfasst: Erzeugen (2) wenigstens einer Zufallszahl; Verteilen (4) der wenigstens einen Zufallszahl an eine Vielzahl von Pseudozufallszahlengeneratoren (2A, 2B), wobei das Verteilen das Addieren einer vorgegebenen Zahl zu der wenigstens einen Zufallszahl umfasst, um die Wahrscheinlichkeit zu verringern, dass die Eingabe in die Vielzahl von Pseudozufallszahlengeneratoren (2A, 2B) Null ist; wiederholtes Seeden (6) der Vielzahl von Pseudozufallszahlengeneratoren (2A, 2B) mit der wenigstens einen Zufallszahl, so dass die Zahlenverteilung der Pseudozufallszahlengeneratoren (2A, 2B) verbessert wird; gleichzeitiges Erzeugen mehrerer Zufallszahlen mittels der Pseudozufallszahlengeneratoren (2A, 2B) zum Erzeugen einer relativ großen Anzahl von Zufallszahlen mit einer relativ hohen Geschwindigkeitsrate, ohne die Zufälligkeit der von dem Zufallszahlengenerator erzeugten Zufallszahlen zu gefährden; Erzeugen (3) einer Vielzahl von Anfangsvektoren mittels der mehreren Zufallszahlen; und Verwenden der Anfangsvektoren in Verschlüsselungsmaschinen. 2. Verfahren nach Anspruch 1, wobei die Vielzahl von Pseudozufallszahlengeneratoren (2A, 3B) eine Vielzahl von linearen Rückkopplungs-Schieberegistern aufweist. 3. Verfahren nach Anspruch 1 oder 2, wobei die Pseudozufallszahlengeneratoren (2A, 2B) neu geseedet werden können, bevor sich ihre Zahlenerzeugungsalgorithmen wiederholen. 4. Paralleler Zufallszahlengenerator, der aufweist: wenigstens einen Zufallszahlengenerator (0) zum Erzeugen wenigstens einer Zufallszahl; und eine Vielzahl von parallelen Pseudozufallszahlengeneratoren (2A, 2B), die so verbunden sind, dass sie die wenigstens eine Zufallszahl empfangen; eine Verteilerschaltung (4), die so ausgelegt ist, dass sie die wenigstens eine Zufallszahl an die Vielzahl von Pseudozufallszahlengeneratoren (2A, 2B) verteilt; einen Addierer, der so ausgelegt ist, dass er eine vorgegebene Zahl zu der wenigstens einen Zufallszahl addiert, um die Wahrscheinlichkeit zu verringern, dass die Eingabe in die Vielzahl von Pseudozufallszahlengeneratoren (2A, 2B) Null ist; wobei die Vielzahl von parallelen Pseudozufallszahlengeneratoren (2A, 2B) so ausgelegt ist, dass sie wiederholt mit der wenigstens einen Zufallszahl geseedet werden, so dass die Zahlenverteilung der Pseudozufallszahlengeneratoren (2A, 2B) verbessert wird; um gleichzeitig eine Vielzahl von Zufallszahlen parallel zu erzeugen, um eine relativ große Anzahl von Zufallszahlen mit einer relativ hohen Geschwindigkeitsrate zu erzeugen, ohne die Zufälligkeit der von dem Zufallszahlengenerator erzeugten Zufallszahlen zu gefährden.. Paralleler Zufallszahlengenerator nach Anspruch 4, wobei die Vielzahl von parallelen Pseudozufallszahlengeneratoren (2A, 2B) eine Vielzahl von linearen Rückkopplungs-Schieberegistern aufweist. 6. Paralleler Zufallszahlengenerator nach Anspruch 4 oder, wobei die Pseudozufallszahlengeneratoren (2A, 2B) frei laufend sein können oder jedes Mal, wenn ein neues Paket ankommt, getaktet werden können. 7. Verfahren nach Anspruch 2, wobei: der Schritt des Erzeugens wenigstens einer Zufallszahl das Erzeugen von Zufallsdatenbits durch einen Zufallsbitgenerator umfasst; der Schritt des Verteilens der wenigstens einen Zufallszahl an eine Vielzahl von Pseudozufalls- 7

8 13 EP B1 14 zahlengeneratoren (2A, 2B) das Verteilen einiger der Zufallsdatenbits an ein Schieberegister vorgegebener Breite umfasst; wobei das Verfahren des Weiteren umfasst: Addieren des Zufallszahlenausgangs des Schieberegisters zu einem Wort entsprechender Breite, um die Wahrscheinlichkeit zu verringern, dass die Eingabe in die linearen Rückkopplungs-Schieberegister Null ist; Verteilen der Zufallsdatenbits von der Zufallszahl an die Seed-Eingänge einer Vielzahl von linearen Rückkopplungs- Schieberegistern vorgegebener Breite durch einen Multiplexer, wobei die Breite der linearen Rückkopplungs-Schieberegister und der an den Ausgängen der linearen Rückkopplungs-Schieberegister erzeugte Anfangsvektor von der Art der Verschlüsselung abhängig sein können; Verwenden des Multiplexers, um wenigstens einen Teil jedes der linearen Rückkopplungs-Schieberegister in einer Round- Robin-Art jedes Mal neu zu seeden, wenn eine vorgegebene Anzahl von Datenbits in dem Schieberegister ermittelt wird, so dass der Zufallszahlengenerator (0) dazu beiträgt sicherzustellen, dass die Anfangsvektoren so oft wie möglich für jedes Paket zufällig entnommen werden; wobei die linearen Rückkopplungs-Schieberegister frei laufend sind, um sicherzustellen, dass aufeinander folgende Pakete Anfangsvektoren mit einem relativ großen Hamming-Abstand haben. 8. Verfahren nach Anspruch 2 oder 7, wobei die mehreren Zufallszahlen verwendet werden, um die Vielzahl von linearen Rückkopplungs-Schieberegistern zu seeden, wobei das Verfahren des Weiteren die folgenden Schritte umfasst: Verwenden der linearen Rückkopplungs-Schieberegister, um die von den Verschlüsselungsmaschinen zum Verschlüsseln von Daten verwendeten Anfangsvektoren zu erzeugen; Addieren der Anfangsvektoren zu unverschlüsselten Daten durch eine Vielzahl von Multiplexern; Verschlüsseln von Teilen der nichtverschlüsselten Daten durch eine Vielzahl von Verschlüsselungsmaschinen; Ausgeben der verschlüsselten Daten; Rückführen der verschlüsselten Daten an die Vielzahl von Multiplexern, so dass die verschlüsselten Daten dann anstelle der Anfangsvektoren zu den unverschlüsselten Daten addiert werden können; Kontinuierliches Neuseeden der linearen Rückkopplungs-Schieberegister mit Zufallszahlen; kontinuierliches Erzeugen neuer Anfangsvektoren durch die Vielzahl von linearen Rückkopplungs-Schieberegistern, um die Zufälligkeit der Anfangsvektoren aufrecht zu erhalten; Addieren der neuen Anfangsvektoren zu den nichtverschlüsselten Daten, um die Zufälligkeit der verschlüsselten Daten zu verbessern; Wiederholen der vorherigen Schritte so oft wie nötig, um die ankommenden Ströme unverschlüsselter Daten zu verschlüsseln. 9. Paralleler Zufallszahlengenerator nach Anspruch, wobei der Zufallszahlengenerator so ausgelegt ist, dass er einen Strom von Zufallsdatenbits erzeugt, wobei die Verteilerschaltung (4) so ausgelegt ist, dass sie diese Datenbits in einer Round-Robin-Art verteilt, und dass sie jedes Zufallsdatenbit abwechselnd an eines einer Vielzahl von Registern routet, wobei die Register so ausgelegt sind, dass sie die Datenbits zu einer geeigneten Wortbreite zusammenfügen, um die Vielzahl von linearen Rückkopplungs-Schieberegistern zu seeden.. Verfahren nach Anspruch 8, wobei die Vielzahl von linearen Rückkopplungs-Schieberegistern auf einer Pro-Paket-Basis neu geseedet werden. 11. Paralleler Zufallszahlengenerator nach einem der Ansprüche 4 bis 6 oder 9, der aufweist: wenigstens einen Zufallsbitgenerator zum Erzeugen einer Vielzahl von Zufallsbits; wenigstens ein Register, das so verbunden ist, dass es die Zufallsbits empfängt, zum Speichern der wenigstens einen Zufallszahl; und wobei die Vielzahl von Pseudozufallszahlengeneratoren (2A, 2B) so verbunden ist, dass sie die wenigstens eine Zufallszahl zum Erzeugen einer Vielzahl von Anfangsvektoren empfängt. 12. Paralleler Zufallszahlengenerator nach einem der Ansprüche 4 bis 6 oder 9, wobei die Pseudozufallszahlengeneratoren (2A, 2B) aufweisen: wenigstens einen Eingang zum Empfangen der wenigstens einen Zufallszahl; und wenigstens eine Rechenschaltung zum Eingliedern der empfangenen wenigstens einen Zufallszahl in wenigstens eine Pseudozufallszahlenerzeugungsoperation. 13. Kryptographischer Beschleuniger, der aufweist: wenigstens einen parallelen Zahlengenerator nach Anspruch 4 zum Erzeugen einer Vielzahl 8

9 EP B1 16 von Anfangsvektoren; und wenigstens eine Verschlüsselungsmaschine, die so verbunden ist, dass sie die Anfangsvektoren empfängt, um Daten zu verschlüsseln. 14. Kryptographischer Beschleuniger nach Anspruch 13, wobei die Vielzahl von Pseudozufallszahlengeneratoren (2A, 2B) eine Vielzahl von linearen Rückkopplungs-Schieberegistern aufweist. Revendications 1. Procédé de génération de nombres aléatoires, comprenant les étapes consistant à : générer (2) au moins un nombre aléatoire ; fournir (4) ledit au moins un nombre aléatoire à une pluralité de générateurs de nombres pseudo aléatoires (2A, 2B), dans lequel la fourniture comprend l étape consistant à ajouter un nombre prédéterminé audit au moins un nombre aléatoire pour réduire la probabilité qu un nombre fourni à la pluralité de générateurs de nombres pseudo aléatoires (2A, 2B) ne soit nulle ; alimenter (6) à répétition la pluralité de générateurs de nombres pseudo aléatoires (2A, 2B) avec ledit au moins un nombre aléatoire, de manière à améliorer la fourniture de nombres des générateurs de nombres pseudo aléatoires (2A, 2B) ; générer simultanément plusieurs nombres aléatoires en utilisant les générateurs de nombres pseudo aléatoires (2A, 2B) pour générer un nombre relativement grand de nombres aléatoires à une vitesse relativement élevée, sans compromettre le caractère aléatoire des nombres aléatoires générés par le générateur de nombres aléatoires ; générer (3) une pluralité de vecteurs initiaux en utilisant plusieurs nombres aléatoires ; et utiliser les vecteurs initiaux dans des moteurs de chiffrement. 2. Procédé selon la revendication 1, dans lequel la pluralité de générateurs de nombres pseudo aléatoires (2A, 2B) comprend une pluralité de registres à décalage de rebouclés. 3. Procédé selon la revendication 1 ou 2, dans lequel les générateurs de nombres pseudo aléatoires (2A, 2B) peuvent être ré-alimentés avant que leurs algorithmes de génération de nombres ne se répètent. 4. Générateur de nombres aléatoires parallèle, comprenant : au moins un générateur de nombres aléatoires (0) pour générer au moins un nombre aléatoire ; et une pluralité de générateurs de nombres pseudo aléatoires parallèles (2A, 2B), connectés pour recevoir au moins un nombre aléatoire, un circuit de distribution (4) apte à fournir ledit au moins un nombre aléatoire à la pluralité de générateurs de nombres pseudo aléatoires (2A, 2B), un additionneur apte à ajouter un nombre prédéterminé audit au moins un nombre aléatoire pour réduire la probabilité que le nombre fourni à la pluralité de générateurs de nombres pseudo aléatoires (2A, 2B) ne soit nulle ; dans lequel la pluralité de générateurs de nombres pseudo aléatoires parallèles (2A, 2B) est apte à être alimentée à répétition avec ledit au moins un nombre aléatoire, de manière à améliorer la fourniture de nombres des générateurs de nombres pseudo aléatoires (2A, 2B) ; pour générer simultanément une pluralité de nombres aléatoires en parallèle pour générer un nombre relativement grand de nombres aléatoires à une vitesse relativement grande, sans compromettre le caractère aléatoire des nombres aléatoires générés par le générateur de nombres aléatoires.. Générateur de nombres aléatoires parallèle selon la revendication 4, dans lequel la pluralité de générateurs de nombres pseudo aléatoires parallèles (2A, 2B) comprend une pluralité de registres à décalage rebouclés. 6. Générateur de nombres aléatoires parallèle selon la revendication 4 ou, dans lequel les générateurs de nombres pseudo aléatoires (2A, 2B) peuvent fonctionner librement ou peuvent être cadencés chaque fois qu un nouveau paquet arrive. 7. Procédé selon la revendication 2, dans lequel : l étape de génération d au moins un nombre aléatoire comprend l étape consistant à générer des bits de données aléatoires par un générateur de bits aléatoires ; l étape de fourniture dudit au moins un nombre aléatoire à une pluralité de générateurs de nombres pseudo aléatoires (2A, 2B) comprend l étape consistant à fournir certains des bits de données aléatoires à un registre à décalage d une largeur prédéterminée ; le procédé comprenant en outre les étapes consistant à : ajouter la sortie de nombre aléatoire du registre à décalage à un mot d une largeur 9

10 17 EP B1 18 correspondante pour réduire la probabilité que l entrée dans les registres à décalage de rebouclés ne soit nulle ; distribuer les bits de données aléatoires du nombre aléatoire aux entrées d alimentation d une pluralité de registres à décalage rebouclés d une largeur prédéterminée par un multiplexeur, dans lequel la largeur des registres à décalage rebouclés et le vecteur initial généré aux sorties des registres à décalage rebouclés peuvent dépendre du type de chiffrement ; utiliser le multiplexeur pour ré-alimenter au moins une partie de chacun des registres à décalage rebouclés à tour de rôle chaque fois qu un nombre prédéterminé de bits de données sont détectés dans le registre à décalage, de sorte que le générateur de nombres aléatoires (0) aide à assurer que les vecteurs initiaux soient pris au hasard le plus souvent possible pour chaque paquet ; dans lequel les registres à décalage rebouclés fonctionnent librement en aidant à assurer que des paquets successifs ont des vecteurs initiaux avec une distance de Hamming relativement grande. 8. Procédé selon la revendication 2 ou 7, dans lequel plusieurs nombres aléatoires sont utilisés pour alimenter la pluralité de registres à décalage rebouclés, comprenant en outre les étapes consistant à : utiliser les registres à décalage rebouclés pour générer les vecteurs initiaux utilisés par les moteurs de chiffrement pour chiffrer les données ; ajouter les vecteurs initiaux aux données non chiffrées par une pluralité de multiplexeurs ; chiffrer des portions des données non chiffrées par une pluralité de chiffreurs ; délivrer les données chiffrées ; retourner les données chiffrées à la pluralité de multiplexeurs de sorte que les données chiffrées puissent être ensuite ajoutées aux données non chiffrées à la place des vecteurs initiaux ; ré-alimenter continuellement les registres à décalage rebouclés avec des nombres aléatoires ; générer continuellement de nouveaux vecteurs initiaux par la pluralité de registres à décalage rebouclés pour maintenir le caractère aléatoire des vecteurs initiaux ; ajouter les nouveaux vecteurs initiaux aux données non chiffrées pour améliorer le caractère aléatoire des données chiffrées ; répéter les étapes précédentes aussi souvent qu il le faut pour chiffrer les flux entrants de données non chiffrées Générateur de nombres aléatoires parallèle selon la revendication, dans lequel le générateur de nombres aléatoires est apte à générer un flux de bits de données aléatoires ; dans lequel le circuit de distribution (4) est apte à fournir ces bits de données à tour de rôle et à acheminer alternativement chaque bit de données aléatoire à l un d une pluralité de registres, dans lequel les registres sont aptes à assembler les bits de données à une largeur de mot appropriée pour alimenter la pluralité de registres à décalage rebouclés linéaire.. Procédé selon la revendication 8, dans lequel la pluralité de registres à décalage rebouclés sont ré-alimentés pour chaque paquet. 11. Générateur de nombres aléatoires parallèle selon l une quelconque des revendications 4 à 6 ou 9 comprenant : au moins un générateur de bits aléatoires pour générer une pluralité de bits aléatoires ; au moins un registre, connecté pour recevoir les bits aléatoires, pour stocker ledit au moins un nombre aléatoire ; et dans lequel la pluralité de générateurs de nombres pseudo aléatoires (2A, 2B) sont connectés pour recevoir ledit au moins un nombre aléatoire pour générer une pluralité de vecteurs initiaux. 12. Générateur de nombres aléatoires parallèle selon l une quelconque des revendications 4 à 6 ou 9, dans lequel les générateurs de nombres pseudo aléatoires (2A, 2B) comprennent : au moins une entrée pour recevoir ledit au moins un nombre aléatoire ; et au moins un circuit de calcul pour incorporer ledit au moins un nombre aléatoire reçu à au moins une opération de génération de nombres pseudo aléatoires. 13. Accélérateur cryptographique, comprenant : au moins un générateur de nombres parallèle selon la revendication 4 pour générer une pluralité de vecteurs initiaux ; et au moins un moteur de chiffrement, connecté pour recevoir les vecteurs initiaux, pour chiffrer des données. 14. Accélérateur cryptographique selon la revendication 13, dans lequel la pluralité de générateurs de nombres pseudo aléatoires (2A, 2B) comprend une pluralité de registres à décalage rebouclés.

11 EP B1 11

12 EP B1 12

13 EP B1 13

14 EP B1 14

15 EP B1

16 EP B1 REFERENCES CITED IN THE DESCRIPTION This list of references cited by the applicant is for the reader s convenience only. It does not form part of the European patent document. Even though great care has been taken in compiling the references, errors or omissions cannot be excluded and the EPO disclaims all liability in this regard. Patent documents cited in the description US A [0008] 16