LFSR based RNG on low cost FPGA for QKD applications

In any digital encryption scheme, random numbers are an indispensable resource, as proposed by Claude Shannon [1]. The applications of random numbers are stratified from cryptography to simulations and the gambling industry. For cryptographic applications, in an ideal world, one would like to use quantum random number generators (QRNGs), which are innately random. However, pertaining to the resource intensiveness, the real-time use case for QRNGs is a little far. The next best alternatives available are pseudo random number generators (PRNGs) and chaotic random number generators. Chaotic ones cannot be used for security applications primarily because Eve can exploit the fact that there is no good way of characterising noise. Amongst PRNGs, one of the earliest, extremely fast and easy to generate known techniques for generating random numbers is using linear feedback shift registers (LFSRs). Being hardware friendly, they are used in testing for power consumption in integrated circuits. In particular, it is typically used to create test patterns for built-in self-test [2]. On the low power front, LFSR based Random Number generators (LRNGs) are widely used in providing encryption to wireless technology such as Bluetooth, where they are used to encrypt frequency hopping spread spectrum systems to protect against signal jamming kind of attacks [3].

Such random number generators are easily implementable on hardware like Field Programmable Gate Array (FPGA) [4] and, thus, could provide an easy access to “randomness” resources for ongoing applications like Quantum Key Distribution (QKD). Succinctly, QKD is the study of securely distributing keys between two communicating parties (say, Alice and Bob) using properties of photons (quanta of light). The field is proposed to takeover the current encryption technique (particularly, ubiquitously used Rivest-Shamir-Adleman (RSA) algorithm) for the latter being inefficient against upcoming quantum computers. The premise being that laws of quantum physics are more fundamental compared to increasingly accessible computational resources (built on fundamentals of physics) against an eavesdropper [5]. The major application for LRNG in QKD applications comes into the picture for prepare-and-measure (P&M) protocols. Pertaining to the particular property of photons being used, there are different P&M based QKD protocols such as those proposed by Bennet and Brassard in 1984 (BB84) and coherent one-way protocol. In the context of BB84 protocol, Alice selects the polarization degree of freedom as her encoding mechanism. To achieve an unbiased distribution of signals across the four polarization states, Alice requires a random bit stream based on LFSR. It generates random numbers that Alice utilizes for preparing the four polarization states in a randomized manner, ensuring equal probability and impartiality among the different polarization states. This requirement is a pre-requisite for unconditional security of any P&M based QKD protocol. In addition to being used at Alice’s end, Bob could also use LRNG sequence to choose the measurement basis by feeding this random bit stream into a liquid crystal polarisation rotator. This requirement at Bob’s end is true for every QKD protocol (not restraining to P&M protocols). This, however, is not a strict requirement as there are other alternatives with certain trade-offs. Hence, we focus on a stronger requirement of “randomness” resource at Alice’s end.

In this work, we aim to obtain a LRNG bit stream, which is implementable on low cost, low powered FPGA boards suitable for BB84 protocol. It is varied for different parameters, say input seed value and post-processed so that it is sufficiently random for QKD applications. The paper is divided into four further sections. Section II discusses preliminaries such as why such random numbers are a good candidate for QKD applications, how it works, and what classifies as a sufficiently random bit stream. In section III, we first discuss our numerical approach followed by hardware implementation of LFSR based random numbers, where we elaborate on how the randomness gets affected by introducing non-linearities. Towards the end, we show one practical application where we have used this in practical BB84 setup for preparing polarisation states randomly. In Section IV, we list possible improvements that are hardware and application dependent. In section V, we conclude the article by summarizing this study.

Here, we focus on generating pseudo random numbers that are sufficiently random and easily implementable on FPGA. LFSR fits this overlap naturally compared to any other pseudo random number algorithm.

The following subsections show results for all four variants in tabular form. Broadly speaking, the NIST test suite has 15 statistical tests, and LCT has the stringiest requirement against the LFSR generated bit streams and hence is explicitly mentioned in another column. We have generated the bit stream first on software, and later, hardware implementation is performed only for cases where it passes the NIST test suite for all 15 statistical tests. We have mentioned all the less-sensitive tests (14 of 15) under the column name NIST-tests, while LCT is explicitly mentioned in another column in the tabular representation.

In this work, we have studied the application of LFSR based RNG implemented on FPGAs to be used in QKD applications. Within the QKD framework, these RNG can also be used to provide robustness against electromagnetic interference while transferring data to a trusted node via Serial Advanced Technology Attachment (SATA) protocol [21]. Outside of QKD, it could be used for carrying out vulnerability analysis of FPGA based computer vision applications [22]. On the premise that there are no specific guidelines on generating a robust non-linear Boolean function, a natural extension of this work could be to look in this direction. LFSRs on FPGAs are being tested for Internet of Things (IoT) applications using Artificial Neural Networks [23]. In this work, we improved the quality of LRNG by modifying the generation process of RNG. The proposed method and proposed $d$ for LFSRs are, one can say, are sufficient to pass the NIST statistical test suite; however, they are not the limit. Depending upon the application requirement and availability of the FPGA board, there are several possible improvements in this technique. Some improvements that are foreseen are listed below:

1. 1.

   One can generate a new seed everytime the device boots such that the linear correlations cannot be deciphered if one models the data for too long.

2. 2.

   Another open direction is to use higher $d$ values, not restricting up to 131. This could be used for other applications. Say, for example, one can choose XOR($\mathcal{L}(785,s_{1})$, $\mathcal{L}(786,s_{2})$) which passes not only the default block length parameter (m=500) in LCT but passes LCT upto m=3100. This direction of inquiry is strictly application and resource dependent.

3. 3.

   In the current work we have synthesised VHDL code of LRNG in FPGA for different clock rate(1 MHz, 5MHz, 10 MHz, 15 MHz, 20 MHz, and 25 MHz) for 2 cases XOR($\mathcal{L}(128,s_{1})$, $\mathcal{L}(129,s_{2})$) and XOR($\mathcal{L}(127,s_{1})$, $\mathcal{L}(131,s_{2})$). However, hardware implementation and verification on FPGA was done only for 1 MHz as per our current requirement for QKD application. As the code is synthesizable for higher bit-rates, this technique promises compatibility for setups with higher key rate. Depending on hardware constraints and use case, and one can generate the bit stream in GHz range which is suitable for video-conferencing using QKD applications.

4. 4.

   Increasing complexity in a controlled manner is another way to circumvent going to higher d values to pass LCT test for higher m values. The amount of controlled complexity that can be introduced is dependent on both hardware and theoretically proof of non-linearity. For example operations like XOR(XOR($\mathcal{L}(d_{1},s_{1})$, $\mathcal{L}(d_{2},s_{2})$), XOR($\mathcal{L}(d_{3},s_{3})$, $\mathcal{L}(d_{4},s_{4})$)) using four different $d$’s and $s$’s.

5. 5.

   On the quality of randomness testing front, one can check for chi-square hypothesis testing against other statistical test suites, say, Dieharder, TestU01, ENT. One could also use other alternatives for hypothesis testing, like the Kolmogorov-Smirnoff test or Borel normality, depending on how stringent the randomness is for specific applications.

In this article, we proposed a method to generate LRNG for QKD applications which passes all th NIST statistical test suites and can be easily theoretically backed. The number of tests failed also cross-verifies the meaning of test specific $p$-value. We verified various cases of single XOR operation, which can introduce enough non-linearity to pass the LCT test. We have shown that amongst the variants XOR($\mathcal{L}(128,s_{1})$, $\mathcal{L}(129,s_{2})$) and XOR($\mathcal{L}(127,s_{3})$, $\mathcal{L}(131,s_{4})$) passed the test for 100 sets with better accuracy and hence, is a better random number generator. Compared to the consensus on the quality of the bit stream, our random bit stream passes stringent conditions (15/15 tests). Further, the proposed method was implemented on a low-cost FPGA board and verified that those random pulses, too, passed the test. On the application side, we use our method for the weak-coherent pulses-based source to study the BB84 protocols.

The authors like to acknowledge the funding support from the Department of Science and Technology (DST), India through QuEST program. The authors also acknowledge initial discussions with Dr. Ayan Biswas, York Centre for Quantum Technologies, School of Physics Engineering and Technology, University of York.

The data that support the findings of this study are available from the corresponding author upon reasonable request.

The authors declare no conflicts of interest related to this article.