Latest revision as of 13:42, 28 May 2021

Abstract

For some applications that use pseudorandom numbers it is essential to keep the record of numbers generated so far. Such a representative example is cryptanalytic TMTO approach. In order to save the space, instead of straightforward recording of individual numbers generated, an ordered tree-like data structure which tracks the intervals of generated numbers is proposed. For estimating the memory requirements of this structure as a function of pseudorandom numbers range size, an analytical probabilistic model is established and used. This model determines the maximum number of intervals during recording which corresponds to the tree size. The result obtained from analytical model is fully validated experimentally by means of simulation for a wide spectrum of range sizes.

Keywords: Pseudorandom numbers, interval trees, simulation analysis

1. Introduction

Random events are immanent to numerous natural phenomena. Being fully unpredictable they can be modelled by random number sequences which do not follow any specific rules. Computer simulation of random processes requires computer-based generation of random numbers [1]. However, in practice such computer generated number sequences are not entirely random since detereministic algorithms are employed for this purpose. It means that for the same initial state these algorithms always produce the same sequences of numbers. This is the reason why the computer generated numbers are regarded as pseudorandom. Although true randomness can not be expected to achieve in a computer environment, quite often a sequence of pseudorandom numbers satisfies the most of the statistical testes of randomness [2-6]. Without a precise definition of relevant tests which would guarantee the reliability of obtained results, the implementation of pseudorandom generators is usually based on detailed mathematical analysis of their characteristics.

Pseudorandom numbers have a widespread application in various fields. The examples of their intensive use are the areas of statistics, gambling, probability and chance games, computer simulations, cryptography, etc. In some aplications, it is quite essential to constantly keep the record of already generated pseudorandom numbers.

An example that represents an immediate motivation for the analysis conducted in this paper is found in the area of cryptanalysis. This is a well-known Hellman TMTO algorithm which solves the main cryptanalytical problem of inverting one-way function in order to find the secret key [7]. This method, as well as its follow-up improvements [8,9], tries to achive a trade-off between time and memory requirements in this very computationally demanding task. An off-line, precomputation phase of the algorithm generates the fixed-length chains of keys (which can be regarded as pseudorandom), so that an on-line, attack phase can perform more efficient search. However, the main problem is that no record is kept during generation of chains about keys already included, so the multiple occurence of some keys in chains is inevitable. This leads to some irregular situations like looping and merging of chains. On the other hand, since the total number of keys in chains is equal to the size of the key space, multiple occurence of some keys prevents some other keys to be included into chains which incures a lower coverage of the key space. The consequence is that such keys can not be found at all, while the repeated key values are responsible for erroneous situations (false alarms). Therefore, the success of the attack is impaired, making the method probabilistic. The problems can be avoided by keeping the record of the randomly chosen keys which are already included into chains during off-line phase. In this way, resulted perfect chains avoid key repetion and attain full key space coverage, making the method deterministic. The relevant characteristics of perfect chains are examined in [10] by using probabilitic analytical and simulation model.

Pseudorandom number generator produces the numbers by a random choice from a given set, usually a range of numbers. If the range of possible numbers is quite large, which is an often case, the tracking of already generated numbers can be practically infeasible because of the extreme space demands. In order to decrease the memory required for tracking, instead of keeping each individual generated number, only the record of intervals of generated numbers can be kept. Consequently, an ordered dynamic tree-like structure is proposed where each node represents an interval of generated numbers with its lower and upper bounds. As the new numbers are generated and the tree updated accordingly, it is expected that number of nodes increases from one to some maximum number. Then, as new numbers are generated, the nodes are expeted to coalesce and the number of nodes decreases until all numbers are generated and the tree colapses to one node. The main goal of this paper is to determine the maximum number of nodes as a function of size of the generated numbers range.

A precise formal procedure of keeping the record during random number generation and the problem statement are given in Section 2. Then, problem is theoretically solved by an analytical approach which is described in Section 3. The result of this analysis is validated by means of simulation evaluation presented in Section 4. Finally, the conclusion is drawn in Section 5.

2. Problem statement

Let the random number generator (RNG) generates integers from the given range ${\displaystyle [1\cdots N]}$ (denoted as set ${\displaystyle R}$) long enough to guarantee that each number from ${\displaystyle R}$ appears at least once. After RNG generates a number, the check is made if this number is already generated before. If not, it is used in application and some record of numbers generated so far is updated; otherwise, RNG generates a new number. The process is carried on until all numbers from ${\displaystyle R}$ are generated and included into the record.

For the sake of clarity of the following presentation and analysis, during the process of random generation we will maintain two sets. The record of numbers generated so far is kept as a set of integers (denoted as ${\displaystyle I}$). In order to save the space, it is implemented in an appropriate form of intervals of consecutive integers. These intervals of already used numbers will be referred as ${\displaystyle I}$–intervals. The remaining numbers from ${\displaystyle R}$ are kept in a set of unused integers (denoted as ${\displaystyle S}$), also implemented in the form of intervals (${\displaystyle S}$–intervals). In both set implementations, only lower and upper bound for each interval are recorded in memory. The interval can have only one element, referred to as single element interval (e.g., ${\displaystyle [a,a]}$), or more than one element, referred to as multiple element interval (e.g., [${\displaystyle a}$, ${\displaystyle b}$], ${\displaystyle a<b}$). Since ${\displaystyle S}$ and ${\displaystyle I}$ sets are complements in respect to set ${\displaystyle R}$ (i.e., ${\displaystyle S+I=R}$), in practical implementation it is sufficient to maintain only one of these sets for memory efficiency. Figure 1 illustrates alternating layout of ${\displaystyle I}$–intervals and ${\displaystyle S}$–intervals within the set ${\displaystyle R}$. Used numbers are denoted as circles and ${\displaystyle I}$–intervals are represented as shaded boxes, while unused numbers are denoted with squares and ${\displaystyle S}$–intervals are represented as white boxes.

Figure 1. Layout of I–intervals and S–intervals

Let we start with set of integers ${\displaystyle S=\left\{x|1\leq x\leq N\right\}}$ (i.e., ${\displaystyle S=R}$) and an empty set ${\displaystyle I=\emptyset }$. In each step, we randomly choose an element ${\displaystyle x_{i}}$ from ${\displaystyle S}$ and move it to ${\displaystyle I}$; i.e., ${\displaystyle S=S-[x_{i}]}$ and ${\displaystyle I=I+[x_{i}]}$. Consequently, after ${\displaystyle N}$ steps we will have ${\displaystyle S=\emptyset }$ and ${\displaystyle I=R}$. In each step, the record of numbers already chosen and included into ${\displaystyle I}$ is updated in the following way:

A. In step ${\displaystyle t=1}$, an element ${\displaystyle x_{1}\in S}$ is randomly chosen and included into ${\displaystyle I}$. Now, there is only one ${\displaystyle I}$-interval, [${\displaystyle x_{1}}$, ${\displaystyle x_{1}}$].

B. In step ${\displaystyle t=i,2\leq i\leq N}$, currently randomly chosen element ${\displaystyle x_{i}\in S}$ is checked for adjacency to existing ${\displaystyle I}$–intervals with three possible outcomes:

1. if it is not adjacent to any of existing ${\displaystyle I}$–intervals, a new ${\displaystyle I}$–interval ${\displaystyle [x_{i},x_{i}]}$ is created,

2. if it is adjacent to only one interval [${\displaystyle a,b]}$, this ${\displaystyle I}$–interval is extended with ${\displaystyle x_{i}}$ (e.g., if ${\displaystyle x_{i}=a-1}$, interval ${\displaystyle [a,b]}$ is extended to ${\displaystyle [x_{i},b]}$ or if ${\displaystyle x_{i}=b+1}$, interval ${\displaystyle [a,b]}$ is extended to ${\displaystyle [a,x_{i}]}$),

3. if it is adjacent to two ${\displaystyle I}$–intervals ${\displaystyle [a,b]}$ and ${\displaystyle [c,d]}$ in a way that ${\displaystyle x_{i}=b+1}$ and ${\displaystyle x_{i}=c-1}$, these two intervals are merged into interval ${\displaystyle [a,d]}$ (${\displaystyle x_{i}}$ previously corresponded to a single element ${\displaystyle S}$–interval).

Obviously, after an element ${\displaystyle x_{i}}$ is included into ${\displaystyle I}$, three outcomes are possible in a step:

• number of ${\displaystyle I}$–intervals is increased by 1 (cases A and B.1),

• number of ${\displaystyle I}$–intervals stays the same (case B.2),

• number of ${\displaystyle I}$–intervals is decreased by 1 (case B.3).

In step ${\displaystyle t=1}$, the number of ${\displaystyle I}$–intervals is 1. Then, it increases until some maximum ${\displaystyle M}$ is reached as new ${\displaystyle I}$–intervals are created. After reaching maximum, it is expected that ${\displaystyle I}$–intervals are progessively coalescing, and their number will fall until only one interval, [1, ${\displaystyle N}$], remains in step ${\displaystyle t=N}$ (all elements from ${\displaystyle S}$ are now moved to ${\displaystyle I}$, ${\displaystyle S=\emptyset }$ and ${\displaystyle I=R}$).

For practical viability of this procedure, one of the crucial things is the memory needed for keeping the record of generated elements in set ${\displaystyle I}$ (and also of unused elements in ${\displaystyle S}$). Memory requirements are directly proportional to ${\displaystyle M}$ since ${\displaystyle I}$ can be implemented as a dynamic structure in which only upper and lower bound of each interval are recorded, as it will be explained in Section 4. In the following sections, the maximum number of ${\displaystyle I}$–intervals ${\displaystyle M}$ is determined by both analytical and simulation means.

3. Analytical solution

Let us assume that in step ${\displaystyle t=i}$, ${\displaystyle 1\leq i\leq N}$, an element ${\displaystyle x_{i}}$ is chosen from ${\displaystyle S}$ and moved to ${\displaystyle I}$. After that, the number of elements in ${\displaystyle S}$ is ${\displaystyle N-i}$. Let the number of ${\displaystyle I}$–intervals after adding ${\displaystyle x_{i}}$ to ${\displaystyle I}$ be denoted as ${\displaystyle r_{i}}$. In the next step ${\displaystyle t=i+1}$, ${\displaystyle i\neq N}$, an element ${\displaystyle x_{i+1}}$ is chosen from ${\displaystyle S}$. As previosly elaborated, its inclusion into ${\displaystyle I}$ can lead to:

• decreased number of ${\displaystyle I}$–intervals - ${\displaystyle r_{i}-1}$ (merging of two intervals),

• increased number of ${\displaystyle I}$–intervals - ${\displaystyle r_{i}+1}$ (creating a new interval),

• the same number of ${\displaystyle I}$–intervals - ${\displaystyle r_{i}}$ (extending an existing interval).

Let the symbols ${\textstyle {v}_{g}}$, ${\textstyle {v}_{l}}$ and ${\textstyle {v}_{e}}$ stand for probabilities that the number of ${\displaystyle I}$–intervals will increase, decrease or stay the same, respectively. Also, the following equation must hold

In a given step, these probabilities depend on current positions of ${\displaystyle I}$–intervals of used numbers within range ${\displaystyle R}$. Three possible layouts of range ${\displaystyle R}$ are shown in Figure 2. ${\displaystyle I}$–intervals are sequenced from 1 to ${\displaystyle r_{i}}$ and again represented by shaded boxes, while intervening ${\displaystyle S}$–intervals of unused numbers are represented by white boxes.

1) Layout ${\displaystyle A}$ (only one range bound, 1 or ${\displaystyle N}$, belongs to ${\displaystyle I}$)

2) Layout B (both range bounds, 1 and ${\displaystyle N}$, belong to ${\displaystyle I}$)

3) Layout ${\displaystyle C}$ (neither range bound belongs to ${\displaystyle I}$)

Figure 2. Possible layouts of ${\displaystyle I}$–intervals within range R

Let ${\displaystyle v_{A}(i)}$, ${\displaystyle v_{B}(i)}$ and ${\displaystyle v_{C}(i)}$ denote the probabilities of layouts ${\displaystyle A}$, ${\displaystyle B}$ and ${\displaystyle C}$ after step ${\displaystyle t=i}$, respectively, and ${\textstyle {C}_{i}^{N}}$is the number of ${\displaystyle i}$-combinations from set of ${\displaystyle N}$ elements. Then, these probabilities can be calculated as:

We will now derive the expressions for probabilities ${\displaystyle v_{l}}$, ${\displaystyle v_{g}}$ and ${\displaystyle v_{e}}$ in case of each particular layout. To this end, we define an important parameter denoted as ${\displaystyle m_{i}}$. It represents an average number of single element ${\displaystyle S}$–intervals after step ${\displaystyle t=i}$. This type of interval is important since its only element which belongs to ${\displaystyle S}$ separates two consecutive ${\displaystyle I}$–intervals and its selection from ${\displaystyle S}$ and inclusion into ${\displaystyle I}$ in some later step makes that these two ${\displaystyle I}$–intervals are merged into one.

Let us assume that in step ${\displaystyle t=i+1}$ one of ${\displaystyle N-i}$ elements from ${\displaystyle S}$ is chosen.

Layout A

In case of this layout, the number of ${\displaystyle I}$–intervals (${\displaystyle r_{i}}$) is equal to the number of ${\displaystyle S}$–intervals (Figure 2a). The number of ${\displaystyle I}$–intervals can be decreased only if the chosen number belongs to some single element ${\displaystyle S}$–interval other than [1, 1] and ${\displaystyle [N,N]}$. The probability that single element ${\displaystyle S}$–interval lies at 1 or ${\displaystyle N}$ is ${\displaystyle m_{i}/r_{i}}$, while the probability of the opposite case is 1 – ${\displaystyle m_{i}/r_{i}}$. Therefore, the probability of merging two consecutive ${\displaystyle I}$–intervals is

The number of ${\displaystyle I}$–intervals can be increased only if the chosen number does not belong to some single element ${\displaystyle S}$–interval and also if it is not adjacent to some bound of any ${\displaystyle I}$–interval. The probability of such a case is

The number of ${\displaystyle I}$–intervals stays the same if the chosen number is adjacent to a bound of some I–interval. It can belong to some multiple element ${\displaystyle S}$–interval or to single element ${\displaystyle S}$–interval [1, 1] or ${\displaystyle [N,N]}$. The probability for such a case is

Using expressions (1)–(3), assuming layout ${\displaystyle A}$ after step ${\displaystyle t=i}$ an average number of ${\displaystyle I}$–intervals after step ${\displaystyle t=i+1}$ can be calculated as

Layout B

For this layout, the number of ${\displaystyle I}$–intervals is ${\displaystyle r_{i}}$ while the number of ${\displaystyle S}$–intervals is ${\displaystyle r_{i}}$ – 1 (Figure 2b). The number of ${\displaystyle I}$–intervals will be decreased only if the chosen number corresponds to some single element ${\displaystyle S}$–interval. The probability for such an event when two ${\displaystyle I}$–intervals are merged is

The number of ${\displaystyle I}$–intervals will be increased if the chosen number neither corresponds to any single element ${\displaystyle S}$–interval nor is adjacent to a bound of any ${\displaystyle I}$–interval. Then, a new ${\displaystyle I}$–interval is created with probability

The number of ${\displaystyle I}$–intervals does not change if chosen number corresponds to a bound of some multiple element ${\displaystyle S}$–interval. It can happen with probability

Based on expressions (5)–(7), assuming layout ${\displaystyle B}$ after step ${\displaystyle t=i}$ an average number of I–intervals after step ${\displaystyle t=i+1}$ can be calculated as