From Random Numbers to Random Objects

Abstract

Many security-related scenarios including cryptography depend on the random generation of passwords, permutations, Latin squares, CAPTCHAs and other types of non-numerical entities. Random generation of each entity type is a different problem with different solutions. This study is an attempt at a unified solution for all of the mentioned problems. This paper is the first of its kind to pose, formulate, analyze and solve the problem of random object generation as the general problem of generating random non-numerical entities. We examine solving the problem via connecting it to the well-studied random number generation problem. To this end, we highlight the challenges and propose solutions for each of them. We explain our method using a case study; random Latin square generation.

1. Introduction and Basic Concepts

Random password generation [1], random CAPTCHA generation (Completely Automated Public Turing test to tell Computers and Humans Apart) [2,3], random permutation generation [4,5] and random Latin square generation [6,7] are critical cryptographic problems. There are many other similar problems that play critical roles in different branches of science and technology. Each of these problems is about random generation of non-numeric entity, to all of which we refer using the general name object in this paper. Although the mentioned problems may appear conceptually similar, solutions proposed for each of them may not be applicable to others. In this paper, we unify these problems and formalize the general problem of random object generation as the problem of generating random instances of any non-numeric entity type. Afterwards, we examine solving the newly-posed problem via connecting it to the well-known problem of random number generation. The primary idea behind our proposed approach is to assign numeric codes to objects, and generate random object codes using Random Number Generators (RNGs) (Please see more details in Section 2.3). However, there are challenges that need to be resolved. We analyze and resolve each of these challenges (Section 2.2).

In this study, we first formalize the problem of random object generation. Then, we introduce the notion of S-restricted RNGs as RNGs capable of generating random numbers derived from an arbitrary set S. We show how the use of S-restricted RNGs along with proper encoding schemes can lead to a solution to the problem of random object generation. We present our proposed random object generation method based on these two components. In the next step, we will propose a method based on integer compositions for automatic design of parallel LFSRs. Furthermore, we present an architecture based on parallel LFSRs (as parallel RNGs) for designing S-restricted RNGs. Lastly, we present a case study for illustrating the proposed method. We design a circuit for generating random Latin squares of order 4 with the help of a novel encoding scheme.

Before formalizing the ROG problem and discussing our approach towards its solution, we need to introduce some concepts in the next subsection.

1.1. Basic Concepts

In the following, we define integer composition, parallel LFSRs, S-restricted RNGs and Latin squares, which will be used later while describing our solution to the problem of random object generation.

1.1.1. Integer Compositions

A composition C of a positive integer n is a sequence of positive integers called parts (summands) that add up to n. Different aspects and applications of integer compositions have been studied by researchers [8]. In this paper, we represent compositions by tuples, and denote the set of compositions of a positive integer n by $\mathcal{C}\left(n\right)$. As an example, $\mathcal{C}\left(3\right)=\left\{\right(1,1,1),(1,2),(2,1),(3\left)\right\}$. It can easily be shown that $\left|\mathcal{C}\left(n\right)\right|=2^{n-1}$ for every $n\in \mathbb{N}$. For a composition $\mathcal{C}=\left({\mathcal{C}}_1,{\mathcal{C}}_2,\dots ,{\mathcal{C}}_{l-1},{\mathcal{C}}_l\right)$ and $i\in \{1,2,\dots ,l\}$, we define $\tilde{\mathcal{C}}=\left({\mathcal{C}}_l,{\mathcal{C}}_{l-1},\dots ,{\mathcal{C}}_2,{\mathcal{C}}_1\right)$, $\lambda (\mathcal{C},i)={\mathcal{C}}_i$, $\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left(\mathcal{C}\right)=\lambda (\mathcal{C},1)={\mathcal{C}}_1$, $last\left(\mathcal{C}\right)=\lambda (\mathcal{C},l)={\mathcal{C}}_l$, $\mathrm{l}\mathrm{e}\mathrm{n}\mathrm{g}\mathrm{t}\mathrm{h}\left(\mathcal{C}\right)=l$, $f^{-}\left(\mathcal{C}\right)=\left({\mathcal{C}}_2,\dots ,{\mathcal{C}}_{l-1},{\mathcal{C}}_l\right)$ and $l^{-}\left(\mathcal{C}\right)=\left({\mathcal{C}}_1,{\mathcal{C}}_2,\dots ,{\mathcal{C}}_{l-1}\right)$. Moreover, for a positive integer x, we represent $\left(x,{\mathcal{C}}_1,{\mathcal{C}}_2,\dots ,{\mathcal{C}}_{l-1},{\mathcal{C}}_l\right)$ and $\left({\mathcal{C}}_1,{\mathcal{C}}_2,\dots ,{\mathcal{C}}_{l-1},{\mathcal{C}}_l,x\right)$ by $x;\mathcal{C}$ and $\mathcal{C};x$, respectively. It is immediate that $f^{-}\left(\mathcal{C}\right)=l^{-}\left(\mathcal{C}\right)=\phi =\left(\right)$ if $\mathrm{l}\mathrm{e}\mathrm{n}\mathrm{g}\mathrm{t}\mathrm{h}\left(\mathcal{C}\right)=1$, and  $x;\mathcal{C}=\mathcal{C};x=\left(x\right)$ if $\mathcal{C}=\phi$.

An S-restricted composition of n is a composition in which all parts are chosen from a given set $S\subset \{1,2,\dots ,n\}$. Several properties of S-restricted compositions as well as related problems have been investigated in various research works [9]. We use ${\mathcal{C}}^{\left(S\right)}\left(n\right)$ to represent the set of S-restricted compositions of n. For example, ${\mathcal{C}}^{\left(\right\{1,2\left\}\right)}\left(3\right)=\{(1,1,1),(1,2),(2,1)\}$. Different types and aspects of S-restricted compositions have been investigated by researchers [10]. However, to the best of our knowledge, there is no closed form solution for calculating the number of S-restricted compositions.

A palindromic composition (a palindrome) of n is a composition of n that is read in the same way from the left and the right. The notation ${\mathcal{C}}_P\left(n\right)$ is used in this paper to represent the set of palindromic compositions of n. For example, ${\mathcal{C}}_P\left(3\right)=\{(1,1,1),\left(3\right)\}$. It can easily be shown that $|{\mathcal{C}}_P\left(n\right)|=2^{\lfloor \frac{n}{2}\rfloor }$. An S-restricted palindromic composition (S-restricted palindrome) of n is a palindrome in which parts are chosen from a given set $S\subset \{1,2,\dots ,n\}$. For example, ${\mathcal{C}}_P^{\{1,2\}}\left(3\right)=\left\{(1,1,1)\right\}$.

1.1.2. Parallel LFSRs

An LFSR is constructed of a shift register for keeping the state of the LFSR, along with a feedback loop, which controls the state transition. We denote an LFSR with n flip-flops and the generating polynomial G by ${\mathcal{P}}_n(G,M)$, where M is the input string. There are two common representations for ${\mathcal{P}}_n(G,M)$; Fibonacci representation and Galois representation. Galois and Fibonacci representations are mathematically equivalent in the sense that every sequence generated by a Fibonacci LFSR can be generated by a Galois LFSR, and vice versa [11,12]. Since the delay in the corresponding logic circuit is not dependent on the size of the LFSR, we choose to use Galois LFSR defined by Equation (1):

$$F_i(k+1)=\left\{\begin{array}{cc}{F}_n\left(k\right)+M_k,\hfill & i=1,\hfill \\ F_{i-1}\left(k\right)+G_{i-1}{F}_n\left(k\right),\hfill & i\in \{2,3,\dots ,n\}.\hfill \end{array}\right.$$

(1)

In Equation (1), n is referred to as the size of the LFSR, and the vector ${\mathcal{S}}^k\left({\mathcal{P}}_n(G,M)\right)=\left[F_1\left(k\right),F_2\left(k\right),\dots ,F_n\left(k\right)\right]$ is called the $k^{th}$ state of the LFSR. Especially, ${\mathcal{S}}^0\left({\mathcal{P}}_n(G,M)\right)=\left[F_1\left(0\right),F_2\left(0\right),\dots ,F_n\left(0\right)\right]$ is referred to as the initial state of the LFSR. An implementation of an LFSR of size n is called a programmable implementation if it is capable of working with any arbitrary generating polynomial of degree n. A programmable LFSR implemented on the basis of Equation (1) is shown in Figure 1.

In the programmable LFSR shown in Figure 1, ⊕ and ⊙ represent $GF\left(2\right)$ addition and multiplication, respectively, which can be implemented at the hardware layer using XOR and AND gates. Given a fixed generating polynomial, the ⊙ operations will obviously be no longer needed. Moreover, in an implementation with a fixed generating polynomial, the output of each ⊙ operation will be equal to 0 if its G input is 0. This eliminates the need for the corresponding ⊕ operation. As an example, an LFSR with generating polynomial $G=x^8+x^4+x^3+x^2+1$ is shown in Figure 2. In this paper, we use $\mathcal{P}$ to represent programmable LFSRs and $\mathcal{L}$ for LFSRs that work with a fixed generating polynomial.

An LFSR with n flip-flops and a primitive polynomial G guarantees to generate $2^n-1$ different numbers $\{1,2,\dots ,2^n-1\}$ in each $2^n-1$ consecutive clock cycles by an order $r_1,r_2,\dots ,r_{2^n-1}$, which depends on G. This capability makes it possible to use LFSRs in the design of pseudo-random number generators.

The definition of parallel LFSR (as suggested by the related literature) is a little tricky. A parallel LFSR with generating polynomial G and a sampling rate equal to j generates the sequence $r_1,r_{j+1},r_{2j+1},\dots$ where $r_1,r_2,\dots ,r_{2^n-1}$ is the sequence generated by a serial LFSR with the same generating polynomial, and $r_1$ is equal to the seed. As stated by the definition, a parallel LFSR skips $j-1$ consecutive random numbers and outputs the $j^{th}$ one in each invocation or clock cycle.

For a positive integer j, an n-bit j-parallel LFSR ${\mathcal{L}}_n^j(G,M)$ is defined by Equation (2):

$$\forall k\ge 0:{\mathcal{S}}^k\left({\mathcal{L}}_n^j(G,M)\right)={\mathcal{S}}^{kj}\left({\mathcal{L}}_n(G,M)\right).$$

(2)

In Equation (2), j is referred to as the sampling rate or the degree of parallelism. Parallel LFSRs are designed to achieve higher performance [13].

The LFSR ${\mathcal{L}}_n^1(G,M)={\mathcal{L}}_n(G,M)$ is sometimes called a serial LFSR in order to distinguish it from parallel LFSRs. Similar to the case of serial LFSRs, parallel LFSRs can be implemented in a programmable way. We represent a programmable n-bit j-parallel LFSR by ${\mathcal{P}}_n^j(G,M))$. Programmable LFSRS have been of particular interest for designers during the last few decades [14]. Figure 3 shows the block diagram of ${\mathcal{P}}_n^j(G,M))$.

In Figure 3, the state transition logic calculates ${\mathcal{S}}^1\left({\mathcal{P}}_n^j(G,M)\right)={\mathcal{S}}^j\left({\mathcal{P}}_n(G,M)\right)$ using ${\mathcal{S}}^0\left({\mathcal{P}}_8(G,M)\right)$, G and M in the first clock cycle. Afterwards, the state calculated in each cycle is considered as the initial state for the next cycle. In the rest of this paper, the term "LFSR" refers to non-programmable serial Galois-type LFSR, unless we clearly specify another type of LFSR. An LFSR with n flip-flops and a primitive polynomial G guarantees to generate $2^n-1$ different numbers $\{1,2,\dots ,2^n-1\}$ in each $2^n-1$ consecutive clock cycles by an order $r_1,r_2,\dots ,r_{2^n-1}$, which depends on G. This helps LFSRs be used as random number generators. Figure 4 shows how LFSRs and parallel LFSRs can be used to build a parallel RNG.

1.1.3. S-Restricted RNGs

Assume the set S of positive integers, not necessarily consisting of consecutive integers. Furthermore, assume a random sequence of positive integers $\mathcal{I}:{\left(i_l\right)}_{l=1}^t$ in a way that $\left\{i_l\right|i_l\in \mathcal{I}\}=\mathcal{S}$. Any RNG capable of generating $\mathcal{I}$ is referred to as an S-restricted RNG. Simply put, S-restricted RNG, which takes an arbitrary set S of integers as the input, and randomly generates the elements of S without generating any other random number. The notion of S-restricted RNG is introduced for the first time in this paper. We use it as part of our solution to the problem of random object generation.

1.1.4. Latin Squares

A Latin square of order q contains $1,2,\dots ,q$ in each row and each column in a way that no number is repeated in a row or a column. Latin squares are of many applications in cryptography [15,16,17] and related areas [18].

Table 1. A sample Latin square of order 10.

1	8	9	10	2	4	6	3	5	7
7	2	8	9	10	3	5	4	6	1
6	1	3	8	9	10	4	5	7	2
5	7	2	4	8	9	10	6	1	3
10	6	1	3	5	8	9	7	2	4
9	10	7	2	4	6	8	1	3	5
8	9	10	1	3	5	7	2	4	6
2	3	4	5	6	7	1	8	9	10
3	4	5	6	7	1	2	10	8	9
4	5	6	7	1	2	3	9	10	8

shows a Latin square of order 10.

1.2. Organization

The rest of this paper is organized as follows: Section 2 formalizes the problem of random object generation, discusses the challenges raised by the problem and presents our proposed solution based on S-restricted RNGs and encoding schemes. Section 3 reviews related research works. This section compares the most relevant works with our work in this paper. Section 4 presents a novel method based on integer compositions for designing parallel LFSRs. Section 5 proposes an architecture for designing S-restricted RNGs using parallel LFSRs. Section 6 presents the case study. The first subsection in this section presents a novel encoding scheme for Latin squares. The second subsection designs a circuit for generating random Latin squares of order 4. Lastly, Section 7 concludes the paper and suggests further research.

2. Preliminaries

In this section, we preset some preliminary discussions. In Section 2.1, we state the problem of random object generation. Section 2.2 discusses the challenges raised by the formulated problem. Section 2.3 introduces our approach to solving the problem. Lastly, Section 2.4 explains the novelties and achievements of this paper.

2.1. Problem Statement

For $n\in \mathbb{N}$, let $\mathcal{O}=\{o_1,o_2,\dots ,o_n\}$ and $\mathcal{S}=\{s_1,s_2,\dots ,s_n\}\subset {\mathbb{Z}}^{+}$ represent a set of objects and a set of non-negative integers, respectively. Furthermore, let $\mathcal{M}:\mathcal{O}\mapsto \mathcal{S}$ be an injective and surjective map. In the presence of $\mathcal{M}$, we refer to each element of S as a valid object code, and any other integer is considered as an invalid object code. The problem of random object generation is defined as the problem of generating a random sequence of positive integers $\mathcal{I}:{\left(i_l\right)}_{l=1}^t$ in a way that $\left\{i_l\right|i_l\in \mathcal{I}\}=\mathcal{S}$. Solving this problem requires an RNG that generates the sequence $\mathcal{I}$. For $n\in \mathbb{N}$, let $\mathcal{O}=\{o_1,o_2,\dots ,o_n\}$ and $\mathcal{S}=\{s_1,s_2,\dots ,s_n\}\subset {\mathbb{Z}}^{+}$ representing a set of objects and a set of non-negative integers, respectively. Furthermore, let $\mathcal{M}:\mathcal{O}\mapsto \mathcal{S}$ be an injective and surjective one-to-one map, playing the role of an encoding scheme. In the presence of $\mathcal{M}$, we refer to each element of S as a valid object code, and any other integer is considered as an invalid object code. The problem of random object generation is defined as the problem of generating a random sequence of positive integers $\mathcal{I}:{\left(i_l\right)}_{l=1}^t$ in a way that $\left\{i_l\right|i_l\in \mathcal{I}\}=\mathcal{S}$. Solving this problem requires an RNG that generates the sequence $\mathcal{I}$.

2.2. Challenges

A naive solution to the problem of random object generation is to assign numerical codes to objects, let an RNG generate random numbers and interpret the generated random numbers as object codes. However, there are some challenges. These challenges are discussed below.

1.

The first challenge here is to find or to build an RNG for which the set of possible outputs is exactly equal to the set of codes assigned to the objects. For example, for random permutations, we require encoding schemes that assign codes from $S=\{1,2,\dots ,q!\}$ to permutations of q objects [19]. Each of the mentioned codes can be represented by $l=\lceil logq!\rceil$ binary digits. However, a l-bit RNG usually generates all $2^l$ elements of $\{0,1,\dots ,2^l-1\}$, while $2^l-q!=2^{\lceil logq!\rceil }-2^{logq!}$ of them are invalid. We address this challenge by introducing S-restricted RNGs, which generate random numbers drawn from a given set S.

2.

The second challenge is that the encoding scheme will most likely be different from one problem to another. For example, an encoding scheme proposed for passwords may not be applicable to CAPTCHAs as the statistical properties of valid passwords are totally different from those of valid CAPTCHAs.

3.

Third, the S-restricted RNG will be dependent on the encoding scheme and consequently on the target set of objects. This component will vary from Latin squares of order n to the same squares of order $m\ne n$. We address this challenge as well as the above one via proposing the use of reconfigurable S-restricted RNGs. In our case study, this challenge is resolved in two ways. First, our proposed architecture for designing S-restricted RNG is capable of adopting any kind of parallel RNG. Second, we use programmable parallel LFSRs instead of fixed-polynomial parallel LFSRs to improve the reconfigurability of the design. Existing methods for designing parallel LFSRs work only with a fixed generating polynomial [20,21]. In addition to inadequate reconfigurability, fixed-polynomial LFSRs make the system more vulnerable against some well-known security attacks [22].

2.3. Problem Solving Approach

Figure 5 shows our solution to the problem of random object generation.

The solution illustrated in Figure 5 depends on an encoding scheme and an S-restricted RNG. The encoding scheme is inevitably dependent on the specific set of target objects. We compensate this dependence via the use of flexible S-restricted RNGs. This way, our method can be used for solving any kind of random non-numerical object generation problem with the help of a proper encoding scheme and an s-restricted RNG that generates exactly the set of numeric codes assigned to the objects.

In our proposal, the S-restricted RNG is constructed of a few parallel RNGs, which simultaneously generate multiple random numbers, along with a selection mechanism that chooses a valid object code among the generated random numbers. As a case study, we will show later how S-restricted RNGs can be used to generate Latin squares. We use parallel LFSRs to build parallel RNGs and subsequently S-restricted RNGs for generating Latin squares of order 4. We have chosen LFSRs due to their lightweight implementation.

Figure 6 demonstrates our proposed architecture for the design of S-restricted RNGs. This architecture is based on parallel RNGs. A parallel RNG is capable of creating multiple simultaneous random numbers at its output [23]. In addition to parallel RNGs, the proposed architecture uses an Invalid Run length calculation module as well as a feedback selection module. In Figure 6, the delay module is initialized to $d_l$. In each clock, the parallel RNG generates $\{d_l,r_{l+1},d_{l+2},\dots ,d_{l+j-1}\}$ where j is the sampling rate of the parallel RNG. $r_i=r$. An invalid run length equal to k allows $i_l=d_{l+k}$ in the output and loads it on the feedback loop as well.

2.4. Novelties and Contributions

The contributions of this paper can be listed as follows:

1.

In this paper, we unify all problems related to random generation of non-numerical entities for the first time. We bring all these problems under a single umbrella via posing and formulating the general problem of random object generation (Section 2.1).

2.

This paper is the first to propose a solution suitable for generating random instances of any kind of non-numerical entity. Our solution depends on two core components. The first component is a proper encoding scheme assigning a unique code to every individual object. The second component is an RNG capable of generating random numbers restricted to the set of assigned numeric codes (Section 2.3).

3.

In this paper, we propose a novel approach based on integer compositions for automatic design of programmable parallel LFSRs (Section 4);

4.

In this paper, we introduce the notion of S-restricted, RNGs for the first time. Moreover, we present a novel method for designing S-restricted RNGs using parallel LFSRs (Section 5);

5.

This paper presents the first encoding scheme for Latin squares. This encoding is essentially en extended variant of Lehmer’s code previously proposed for encoding permutations of a set of objects (Section 6.1);

6.

We propose the first circuit for generating random Latin squares of degree 4 (Section 6.2).

Figure 7 shows the achievements of this paper and how they are connected to each other.

3. Background and Related Works

In this section, we take a quick look at the background of research on random number generation as well as the random generation of non-numerical entities. We compare the most relevant research works with our work in this paper.

3.1. Random Numbers

Random number generation is an old problem. Random bit generation [24], random sequence generation [25], and random vector generation [26] can be mentioned as variants of this problem. There are two main types of random numbers, namely true-random numbers and pseudo-random numbers.

True random numbers are generated using an unpredictable physical object, phenomenon or process referred to as the source of randomness. Among these sources, one may refer to the following:

• Noises [27,28];
• Waves [29,30];
• Hardware Sources [31].

Pseudo-random numbers are completely computer-generated. They are generated using computer algorithms or devices. Pseudo-random numbers are used in a variety of applications ranging from sensor networks [32] to cryptography [33]. Different approaches have been used for designing pseudo-random number generators [34,35]. Moreover, several enabling technologies including artificial intelligence [36,37], fuzzy logic [38] and chaos theory [39] are used for this purpose.

3.2. LFSRs and Parallel LFSRs

Among existing random umber generators, LFSRs are most relevant as we are using them in our case study. The research community has considered LFSRs as promising choices for random number generation and cryptographic purposes because of their low area and power consumption as well as their high throughput [40,41]. They have been widely used for both pseudo-random [42] and true-random number [43,44] generation. Different variants of LFSRs have been used for this purpose [22,45,46]. LFSRs are particularly used for random key generation in stream ciphers [47]. In addition to serial LFSRs, parallel LFSRs have been of interest to the research community in recent years [48]. They have been widely used in random number generation [49] and many other applications [50,51].

3.3. Random Non-Numerical Entities

Generating random non-numeric entities dates back to the last few decades [52,53,54]. Random network coding [55], random decision trees [56] or random device IDs [57] are required in different domains. Just as an example, random deadlines [58], random power levels [59] and random linear network codes [60] are required to be generated in IoT applications for traffic management, attack resistance and bandwidth management purposes, respectively. Particularly, random permutations [61], random passwords [1], and random CAPTCHAs [2] play significant roles in cryptography.

Different Approaches can be used to generate random non-numeric entities [62,63]. A variety of enabling technologies including chaos theory [64], information theory [65] and artificial intelligence [66] are utilized in this area.

Random Latin Squares

Latin squares appear as part of our case study in this paper. This is why we would like to discuss them separately. Random Latin squares have been widely used in IoT environments for channel access arbitration [67], encryption [15], secret sharing [18], etc. Generating random Latin squares is a critical problem in the realm of combinatorial cryptography [6,7,68,69]. Currently, there is no systematic solution for this problem.

3.4. Most Relevant Works

According to the above discussions, many existing research reports are somehow relevant to this study. However, the most relevant research works are those focusing on restricted random number generation or generating random non-numerical entities using RNGs. These works are studied in the following:

3.4.1. Restricted RNGs

By a restricted RNG, we mean an RNG that generates a certain subset of $\{0,1,2,\dots ,2^m-1\}$. The literature comes with some RNGs of this type.

As an example, one may refer to constrained random number generators, which have been of interest to researchers in recent years [70]. A constrained random number generator is defined as follows [71]. Let x be an element of the Cartesian product ${\chi }^n$ of a given set $\chi$. Constrained RNG uses a sequence of random numbers subject to a distribution v on ${\chi }^n$ defined by Equation (3):

$$v\left(x\right)=\left\{\begin{array}{cc}\frac{\mu \left(x\right)}{\mu \left(\{x:Ax=\mathcal{c}\}\right)},\hfill & Ax=\mathcal{C};\hfill \\ 0,\hfill & Otherwise.\hfill \end{array}\right.$$

(3)

In Equation (3), $\mu$ is a probability distribution on ${\chi }^n$, A is a function $A:{\chi }^n\to \{Ax:x\in {\chi }^n\}$, and $\mathcal{C}\in \{Ax:x\in {\chi }^n\}$. Constrained RNGs are used in channel coding [72].

A constrained RNG is similar to an S-restricted RNG in that both of them filter the output of a traditional RNG. However, the difference is that a constrained RNG uses the value of a function to filter the generated random numbers, while an S-restricted RNG checks them against a given set S of valid numbers.

Another relevant research has been reported in [23], which presents a VLSI (Very Large Scale Integration) design for a parallel RNG, and uses it to generate random numbers drawn from an interval of integers. This work is different from ours in three aspects. First, the parallel RNG designed in [23] generates multiple streams of random numbers, while our proposed S-restricted RNG architecture depends on parallel RNGs that generate multiple random numbers from the same stream as their output each time. Second, their designed RNG generates random numbers is a contiguous interval of integers, while our S-restricted RNG can generate elements of any arbitrary set S. Third, in our work, parallel RNGs are based on parallel LFSRs and can be automatically designed with arbitrary generating polynomials.

3.4.2. RNGs and Random Non-Numerical Entities

Some researchers have proposed methods based on random number generators for generating random decision trees [56], random permutations, and random device IDs [73]. However, none of these methods are capable of being applied on all kinds of non-numerical entities.

3.5. Motivations

There are a wide range of problems, each of which can be considered as a spacial instance of the problem posed in this paper: random object generation. However, they have not been formulated as a single general problem. The reason is the lack of a general-purpose solution applicable to all of these problems. This is the gap we are addressing in this paper. We formalize the general problem and provide a general solution for it.

4. Automatic Design of Parallel LFSRs Using Integer Compositions

Existing methods for designing parallel LFSRs work only with a fixed generating polynomial [20,21]. However, in security-related applications, we are usually interested in randomizing the generating polynomial. Thus, we need an automatic method for designing programmable parallel LFSRs.

In this section, we present a framework for automatic design of parallel LFSRs using the mathematical properties of integer compositions. This framework consists of two parts. In the first part, we present a method for automatic derivation of Reed–Muller expressions describing programmable parallel LFSRs using compositions and palindromes. Afterwards, we modify the framework to describe (non-programmable A.K.A fixed-polynomial) parallel LFSRs by Reed–Muller expressions using S-restricted palindromes. In the second part of the framework, we present procedures for automatic generation of compositions, palindromes and S-restricted palindromes. For $j\in \{0,1,\dots ,n-1\}$, let $b_j\left(i\right)$ represent the ${\left(n-j\right)}^{th}$ most significant digit of $B_n\left(i\right)=b_{n-1}\left(i\right)b_{n-2}\left(i\right)\dots b_j\left(i\right)\dots b_1\left(i\right)b_0\left(i\right)$ being the binary representation of $i\in {\mathbb{Z}}^{+}$ in n digits. The Reed–Muller canonical form represents a Boolean function $f(x_{n-1},x_{n-2},\dots ,x_1,x_0)$ in the form of Equation (4),

$$f(x_{n-1},x_{n-2},\dots ,x_1,x_0)=\sum _{i=0}^{2^n-1}\left(a_i\prod _{b_j\left(i\right)=1}{x}_j\right).$$

(4)

In Equation (4), the addition and multiplication operations are defined over $GF\left(2\right)$. A Boolean function described in the Reed–Muller canonical form can be uniquely converted to other canonical forms such as CNF (Conjunctive Normal Form) and DNF (Disjunctive Normal Form). An advantage of Reed–Muller canonical form is that it does not need any NOT gates to be implemented. This canonical form is commonly used in the description and design of logic circuits [74].

In the second part of our framework for designing parallel LFSRs, we present procedures for automatic generation of compositions, palindromes and S-restricted palindromes.

4.1. Expression Derivation

In this subsection, we take an inductive approach to derive a Boolean expression for describing a programmable parallel LFSR. We begin with Equation (1) and expand it. Induction helps us describe consecutive expansions of this equation using palindromic integer composition.

Before beginning to derive the expressions, let us prove Lemma 1, which presents a procedure for creating $\mathcal{C}(i+1)$ (the set of compositions of $i+1$) given $\mathcal{C}\left(i\right)$ (the set of compositions of i).

Lemma 1.

Procedure CreateNextComp in Algorithm 1 returns ${\mathcal{C}}_{i+1}=\mathcal{C}(i+1)$ provided that ${\mathcal{C}}_i=\mathcal{C}\left(i\right)$.

Algorithm 1 create $\mathcal{C}(i+1)$ given $\mathcal{C}\left(i\right)$

Requires:  ${\mathcal{C}}_i=\mathcal{C}\left(i\right)$.

Ensures:  ${\mathcal{C}}_{i+1}=\mathcal{C}(i+1)$.

1: procedure  CreateNextComp(${\mathcal{C}}_i$)

2:    ${\mathcal{C}}_{i+1}=\varnothing$

3:    for all  $\mathcal{C}\in {\mathcal{C}}_i$  do

4:        ${\mathcal{C}}_{i+1}\leftarrow {\mathcal{C}}_{i+1}\cup \{\left(\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left(\mathcal{C}\right)+1\right);f^{-}\left(\mathcal{C}\right)\}$

5:        ${\mathcal{C}}_{i+1}\leftarrow {\mathcal{C}}_{i+1}\cup \{1;\mathcal{C}\}$

6:    end  for

7:    return${\mathcal{C}}_{i+1}$

8: end  procedure

Proof. 

Since ${\mathcal{C}}_i=\mathcal{C}\left(i\right)$, it is obvious that $\forall \mathcal{C}\in {\mathcal{C}}_i:\left(\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left(\mathcal{C}\right)+1\right);f^{-}\left(\mathcal{C}\right)\in \mathcal{C}(i+1)\wedge 1;\mathcal{C}\in \mathcal{C}(i+1)$ Thus, ${\mathcal{C}}_{i+1}\subset \mathcal{C}(i+1)$. On the other hand, $\forall {\mathcal{C}}^{\prime }\in \mathcal{C}(i+1):(\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left({\mathcal{C}}^{\prime }\right)=1\wedge f^{-}\left({\mathcal{C}}^{\prime }\right)$$\in \mathcal{C}\left(i\right))\vee \left(\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left({\mathcal{C}}^{\prime }\right)-1\right);f^{-}\left({\mathcal{C}}^{\prime }\right)\in \mathcal{C}\left(i\right)$. Thus, $\mathcal{C}(i+1)\subset {\mathcal{C}}_{i+1}$, and the lemma is proved.    □

Equation (5) is immediate from Lemma 1:

$$\forall i>0:\mathcal{C}(i+1)=\{\left(\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left(\mathcal{c}\right)+1\right);f^{-}\left(\mathcal{C}\right)|\mathcal{C}\in \mathcal{C}\left(i\right)\}\cup \{1;\mathcal{C}|\mathcal{C}\in \mathcal{C}\left(i\right)\}$$

(5)

Now, let us continue by proving Theorem 1, which gives a Reed–Muller description of ${\mathcal{P}}_n^j(G,M)$ using integer compositions.

Theorem 1.

A Reed–Muller expression of ${\mathcal{P}}_n^j(G,M)$ (shown in Figure 3) is given by Equation (6), wherein ${\mathcal{C}}^{\prime }=f^{-}\left(\mathcal{C}\right)$, $G_t=0$ for $t\le 0$ and $F_t=M_{-t}$ for $t\le 0$.

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill & F_i\left(j\right)=F_{i-j}\left(0\right)+\hfill \\ \hfill & \sum _{r=0}^{j-1}\sum _{\mathcal{C}\in \mathcal{C}(j-r)}\left(G_{i-first\left(\mathcal{C}\right)}\left(\prod _{u=1}^{length\left({\mathcal{C}}^{\prime }\right)}{G}_{n-\lambda \left({\mathcal{C}}^{\prime },u\right)}\right)F_{n-r}\left(0\right)\right),\hfill \end{array}\end{array}$$

(6)

where $i\in \{1,2,\dots ,n\}$.

Proof. 

We take an induction-based approach to prove Theorem 1. For $j=1$, considering $\mathcal{C}\left(1\right)=\left\{\right(1\left)\right\}$, $\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left(\right(1\left)\right)=1$ and $\mathrm{l}\mathrm{e}\mathrm{n}\mathrm{g}\mathrm{t}\mathrm{h}\left(f^{-}\left(\left(1\right)\right)\right)=0$, Equation (6) is converted to Equation (1). Thus, Equation (6) holds for $j=1$. On the other hand, if this equation holds for $j=q$, we can use it to derive Equation (7) via replacing i by $i-1$.

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill & F_{i-1}\left(q\right)=F_{i-(q+1)}\left(0\right)+\hfill \\ \hfill & \sum _{r=0}^{q-1}\sum _{\mathcal{C}\in \mathcal{C}(q-r)}\left(G_{i-\left(\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\right(\mathcal{C})+1)}\left(\prod _{u=1}^{\mathrm{l}\mathrm{e}\mathrm{n}\mathrm{g}\mathrm{t}\mathrm{h}\left({\mathcal{C}}^{\prime }\right)}{G}_{n-\lambda \left({\mathcal{C}}^{\prime },u\right)}\right)F_{n-r}\left(0\right)\right),\hfill \end{array}\end{array}$$

(7)

where $i\in \{2,3,\dots ,n+1\}$.

In the derivation of Equation (7), we have replaced $i-1-q$ by $i-(q+1)$, and $i-1-\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left(\mathcal{C}\right)$ by $i-\left(\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\right(\mathcal{c})+1)$. Furthermore, Equation (8) can be obtained by substituting n for i in Equation (6) (rewritten for q instead of j) and multiplying the equation by $G_{i-1}$:

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill & G_{i-1}{F}_n\left(q\right)=G_{i-1}{F}_{n-q}\left(0\right)+\hfill \\ \hfill & \sum _{r=0}^{q-1}\sum _{\mathcal{C}\in \mathcal{C}(q-r)}\left(G_{i-1}\left(G_{n-\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left(\mathcal{C}\right)}\prod _{u=1}^{\mathrm{length}\left({\mathcal{C}}^{\prime }\right)}{G}_{n-\lambda \left({\mathcal{C}}^{\prime },u\right)}\right)F_{n-r}\left(0\right)\right).\hfill \end{array}\end{array}$$

(8)

Considering Equations (1) and (5), we can add Equations (7) and (8) together to obtain Equation (9) via some simple algebraic operations:

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill & F_i(q+1)=F_{i-(q+1)}\left(0\right)+\hfill \\ \hfill & \sum _{r=0}^q\sum _{\mathcal{C}\in \mathcal{C}(q+1-r)}\left(G_{i-\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left(\mathcal{C}\right)}\left(\prod _{u=1}^{\mathrm{l}\mathrm{e}\mathrm{n}\mathrm{g}\mathrm{t}\mathrm{h}\left({\mathcal{C}}^{\prime }\right)}{G}_{n-\lambda \left({\mathcal{C}}^{\prime },u\right)}\right)F_{n-r}\left(0\right)\right),\hfill \end{array}\end{array}$$

(9)

where $i\in \{1,2,\dots ,n\}$.

Equation (9) states that, if Equation (6) holds for $j=q$, it will hold for $j=q+1$ as well, and the theorem is proved.

   □

It is obvious that ${\mathcal{P}}_n^j(G,M)$ can be implemented using logical AND and XOR gates on the basis of the Reed–Muller representation given in Equation (6). Corollary 1 presents an equivalent Reed–Muller description of ${\mathcal{P}}_n^j(G,M)$ using palindromes. This can be considered as a simplification to the representation of Theorem 1 because  $|{\mathcal{C}}_P\left(x\right)|<|\mathcal{C}\left(x\right)|$ for every $x>2$ and $|{\mathcal{C}}_P\left(x\right)|=|\mathcal{C}\left(x\right)|$ for every $x\in \{1,2\}$.

Corollary 1.

A Reed–Muller expression of ${\mathcal{P}}_n^j(G,M)$ (shown in Figure 3) is given by Equation (10), wherein ${\mathcal{C}}^{\prime }=f^{-}\left(\mathcal{C}\right)$.

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill & F_i\left(j\right)=F_{i-j}\left(0\right)+\hfill \\ \hfill & \sum _{r=0}^{j-1}\sum _{\mathcal{C}\in {\mathcal{C}}_P(j-r)}\left(G_{i-\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left(\mathcal{C}\right)}\left(\prod _{u=1}^{\mathrm{l}\mathrm{e}\mathrm{n}\mathrm{g}\mathrm{t}\mathrm{h}\left({\mathcal{C}}^{\prime }\right)}{G}_{n-\lambda \left({\mathcal{C}}^{\prime },u\right)}\right)F_{n-r}\left(0\right)\right),\hfill \end{array}\end{array}$$

(10)

where $i\in \{1,2,\dots ,n\}$.

Proof. 

In order to prove Corollary 1, we note that

$$\forall \mathcal{C}\in \mathcal{C}(j-r):\mathcal{C}\notin {\mathcal{C}}_P(j-r)\Rightarrow \mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left(\mathcal{C}\right);{\mathcal{C}}^{\prime }=\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left(\tilde{\mathcal{C}}\right);{\tilde{\mathcal{C}}}^{\prime }\Rightarrow$$

$$\begin{array}{c}\hfill G_{i-\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left(\mathcal{C}\right)}\left(\prod _{u=1}^{\mathrm{l}\mathrm{e}\mathrm{n}\mathrm{g}\mathrm{t}\mathrm{h}\left({\mathcal{C}}^{\prime }\right)}{G}_{n-\lambda \left({\mathcal{C}}^{\prime },u\right)}\right)+\\ \hfill G_{i-\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left(\tilde{\mathcal{C}}\right)}\left(\prod _{u=1}^{\mathrm{l}\mathrm{e}\mathrm{n}\mathrm{g}\mathrm{t}\mathrm{h}\left({\tilde{\mathcal{C}}}^{\prime }\right)}{G}_{n-\lambda \left({\tilde{\mathcal{C}}}^{\prime },u\right)}\right)=0.\end{array}$$

Thus,

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill & \sum _{\mathcal{C}\in \mathcal{C}(j-r)}\left(G_{i-\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left(\mathcal{C}\right)}\left(\prod _{u=1}^{\mathrm{l}\mathrm{e}\mathrm{n}\mathrm{g}\mathrm{t}\mathrm{h}\left({\mathcal{C}}^{\prime }\right)}{G}_{n-\lambda \left({\mathcal{C}}^{\prime },u\right)}\right)F_{n-r}\left(0\right)\right)=\hfill \\ \hfill & \sum _{\mathcal{C}\in {\mathcal{C}}_P(j-r)}\left(G_{i-\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left(\mathcal{C}\right)}\left(\prod _{u=1}^{\mathrm{l}\mathrm{e}\mathrm{n}\mathrm{g}\mathrm{t}\mathrm{h}\left({\mathcal{C}}^{\prime }\right)}{G}_{n-\lambda \left({\mathcal{C}}^{\prime },u\right)}\right)F_{n-r}\left(0\right)\right).\hfill \end{array}\end{array}$$

   □

Given a fixed generating polynomial, ${\mathcal{P}}_n^j(G,M)$ can be converted to ${\mathcal{L}}_n^j(G,M)$. To show how this can be done, let us prove Corollary 2, which gives a Reed–Muller representation of ${\mathcal{L}}_n^j(G,M)$ using S-restricted palindromes.

Corollary 2.

A Reed–Muller expression of ${\mathcal{L}}_n^j(G,M)$ is given by

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill & F_i\left(j\right)=F_{i-j}\left(0\right)+\hfill \\ \hfill & \sum _{r=0}^{j-1}\sum _{\mathcal{C}\in {\mathcal{C}}_P^{S(j-r)}(j-r)}\left(G_{i-\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left(\mathcal{C}\right)}\left(\prod _{u=1}^{\mathrm{l}\mathrm{e}\mathrm{n}\mathrm{g}\mathrm{t}\mathrm{h}\left({\mathcal{C}}^{\prime }\right)}{G}_{n-\lambda \left({\mathcal{C}}^{\prime },u\right)}\right)F_{n-r}\left(0\right)\right),\hfill \end{array}\end{array}$$

(11)

where $i\in \{1,2,\dots ,n\}$ and ${\mathcal{C}}^{\prime }=f^{-}\left(\mathcal{C}\right)$.

Proof. 

In Equation (10), it is obvious that $\exists i\in {\mathcal{C}}_P(j-r):G_{n-\lambda \left({\mathcal{C}}^{\prime },u\right)}=0\Rightarrow {\prod }_{u=1}^{\mathrm{l}\mathrm{e}\mathrm{n}\mathrm{g}\mathrm{t}\mathrm{h}\left({\mathcal{C}}^{\prime }\right)}$$G_{n-\lambda \left({\mathcal{C}}^{\prime },u\right)}=0$. Thus, given a fixed generating polynomial G, the set ${\mathcal{C}}_P(j-r)$ can be replaced with $\mathcal{X}(j-r,G)=\left\{\mathcal{C}\right|\mathcal{C}\in {\mathcal{C}}_P(j-r)\wedge \forall u\in \{1,1,\dots ,\mathrm{l}\mathrm{e}\mathrm{n}\mathrm{g}\mathrm{t}\mathrm{h}\left({\mathcal{C}}^{\prime }\right)\}:G_{n-\lambda \left({\mathcal{C}}^{\prime },u\right)}=1\}$. On the other hand, for each $\mathcal{C}\in {\mathcal{C}}_P(j-r)$, the set of summands in C is equal to that of ${\mathcal{C}}^{\prime }$, except for $(j-r)$. Thus, $\mathcal{X}(j-r,G)={\mathcal{C}}_P^{S(j-r,G)}(j-r)$, where $S(j-r,G)=\left\{(j-r)\right\}\cup \left\{x\right|G_{n-x}=1\}.$    □

4.2. Generation Procedures

In this subsection, we complete our automatic parallel LFSR design framework by presenting procedures for generating compositions, palindromes and S-restricted palindromes of a positive integer n.

Let us begin with systematic generation of $\mathcal{C}\left(n\right)$. It can be done as shown by procedure CreateComp in Algorithm 1 via the use of procedure CreateComp in Algorithm 1, which was proved to be correct in Section 4.1.

Algorithm 2 Create $\mathcal{C}\left(n\right)$

Requires: n is a positive integer.

Ensures: ${\mathcal{C}}_n=\mathcal{C}\left(n\right)$.

1: procedureCreateComp(n)

2:     if $n==1$ then

3:         ${\mathcal{C}}_n\leftarrow \left\{\left(1\right)\right\}$

4:     else

5:         ${\mathcal{C}}_{n-1}\leftarrow \mathrm{CreateComp}(n-1)$

6:         ${\mathcal{C}}_n\leftarrow \mathrm{CreateNextComp}\left({\mathcal{C}}_{n-1}\right)$

7:     end if

8:     return  ${\mathcal{C}}_n$

9:end procedure

Lemma 2 introduces a procedure for systematic creation of ${\mathcal{C}}_P\left(n\right)$ for a positive integer n.

Lemma 2.

Procedure CreatePal in Algorithm 3 returns ${\mathcal{C}}_P\left(n\right)$ for a positive integer n.

Algorithm 3 Create ${\mathcal{C}}_P\left(n\right)$

Requires:  n is a positive integer.

Ensures:  ${\mathcal{C}}_{{}_{p}n}=\mathcal{C}\left(n\right)$.

1: procedure  CreatePal(n)

2:    if  $n==1\left|\right|n==2$  then

3:        ${\mathcal{C}}_{{}_{p}n}\leftarrow \mathrm{CreateComp}\left(n\right)$

4:     else

5:        ${\mathcal{C}}_{{}_{p}n}\leftarrow \varnothing$

6:         ${\mathcal{C}}_{{}_{p}n-2}\leftarrow \mathrm{CreatePal}(n-2)$

7:          for all$\mathcal{C}\in {\mathcal{C}}_{{}_{p}n-2}$  do

8:            $T=\left(\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left(\mathcal{C}\right)+1\right);f^{-}\left(\mathcal{C}\right)$

9:            ${\mathcal{C}}_{{}_{p}n}\leftarrow {\mathcal{C}}_{{}_{p}n}\cup \{l^{-}\left(T\right);\left(last\left(T\right)+1\right)\}$

10:            ${\mathcal{C}}_{{}_{p}n}\leftarrow {\mathcal{C}}_{{}_{p}n}\cup \{1;\mathcal{C};1\}$

11:          end  for

12:      end  if

13:     return ${\mathcal{C}}_{{}_{p}n}$

14: end  procedure

Proof. 

This lemma can be proved in a very similar way to the case of Lemma 1.    □

Lemma 3 introduces a procedure for generating ${\mathcal{C}}_P^S\left(n\right)$ for a positive integer n and a set S of positive integers.

Lemma 3.

For a positive integer n and a set $S\subset$ of positive integers, procedure CreateSRestPal in Algorithm 4 returns ${\mathcal{C}}_P^S\left(n\right)$ if ${\mathcal{C}}_P^S\left(n\right)\ne \varnothing$ and $\left\{\right(\left)\right\}$ (a set consisting of only an empty composition) if ${\mathcal{C}}_P^S\left(n\right)=\varnothing$.

Algorithm 4 Create S-restricted palindromic compositions

Requires:  n a positive integer, S a set of positive integers.

Ensures:  ${\mathcal{C}}_P^S={\mathcal{C}}_P^S\left(n\right)$ if ${\mathcal{C}}_P^S\left(n\right)\ne \varnothing$, ${\mathcal{C}}_P^S=\left\{\left(\right)\right\}$ if ${\mathcal{C}}_P^S\left(n\right)=\varnothing$.

1: procedure  CreateSRestPal(n,S)

2:     $G\leftarrow 0$

3:     $S_1\leftarrow S$

4:      if  $S_1==\varnothing$  then

5:         ${\mathcal{C}}_P^S\leftarrow \left\{\left(\right)\right\}$        ▹ A set consisting of an empty composition

6:         return

7:      end  if

8:     if  $n\in S_1$  then

9:         ${\mathcal{C}}_P^S\leftarrow {\mathcal{C}}_P^S\cup \left\{\left(n\right)\right\}$

10:        $G\leftarrow 1$

11:     end  if

12:    ${\mathcal{C}}_P^S\leftarrow \varnothing$

13:     for all  $s\in S_1\setminus \left\{n\right\}$  do

14:          for all  $\mathcal{c}\in \mathcal{C}reateSRestPal(n-2s,S_1\setminus \left\{n\right\})$   do

15:            ${\mathcal{c}}^{\prime }\leftarrow \left(s\right);\mathcal{c};\left(s\right)$        ▹ Concatenate s to the left and the right of c

16:            ${\mathcal{C}}_P^S\leftarrow {\mathcal{C}}_P^S\cup \left\{{\mathcal{c}}^{\prime }\right\}$

17:            $G\leftarrow 1$

18:          end  for

19:      end  for

20:      if  $G==0$  then

21:         ${\mathcal{C}}_P^S\leftarrow \left\{\left(\right)\right\}$

22:     end  if

23:      return

24: end  procedure

Proof. 

In order to prove this lemma, we prove the following statements:

1.

${\mathcal{C}}_P^S\subset {\mathcal{C}}_P^S\left(n\right)$ if ${\mathcal{C}}_P^S\left(n\right)\ne \varnothing$. There are only two statements in Procedure CreateSRestPa that add compositions to ${\mathcal{C}}_P^S$: Statement 9 and Statement 16. Statement 9 adds $\left(n\right)$, which is definitely an element of ${\mathcal{C}}_P^S\left(n\right)$ considering $n\in S$. Moreover, Statement 16 adds ${\mathcal{c}}^{\prime }=\left(s\right);\mathcal{c};\left(s\right)$, which is an element of ${\mathcal{C}}_P^S\left(n\right)$ since $\mathcal{c}\in {\mathcal{C}}_P^S(n-2s)$, and $s\in S$. Thus, whatever Procedure CreateSRestPa adds to C is an element of ${\mathcal{C}}_P^S\left(n\right)$.

2.

${\mathcal{C}}_P^S\left(n\right)\subset {\mathcal{C}}_P^S$ if ${\mathcal{C}}_P^S\left(n\right)\ne \varnothing$. $P_s(n,S)$ may consist of two kinds of compositions.

• ${\mathcal{c}}_1=\left(n\right)$: This composition is added by Statement 9 if $n\in S$.
• $\left\{{\mathcal{c}}_2\right|\mathrm{f}\mathrm{i}\mathrm{r}\mathrm{s}\mathrm{t}\left({\mathcal{c}}_2\right)=\mathrm{l}\mathrm{a}\mathrm{s}\mathrm{t}\left({\mathcal{c}}_2\right)=s\in S\setminus \left\{n\right\},f^{-}\left(l^{-}\left({\mathcal{c}}_2\right)\right)\in {\mathcal{C}}_P^{S\setminus \left\{n\right\}}(n-2s)\}$: All of these compositions are added by Statement 16.

Thus, every element of ${\mathcal{C}}_P^S\left(n\right)$ is guaranteed to be generated by Procedure CreateSRestPa.

converted to $\left(\right)$.

3.

${\mathcal{C}}_P^S=\left\{\left(\right)\right\}$ if and only if ${\mathcal{C}}_P^S\left(n\right)=\varnothing$.

The above two statements show that ${\mathcal{C}}_P^S={\mathcal{C}}_P^S\left(n\right)$. It is immediate that, if ${\mathcal{C}}_P^S\left(n\right)=\varnothing$, Procedure CreateSRestPa will generate no composition. Since 1 is assigned to G only after adding compositions to ${\mathcal{C}}_P^S$ (by Statements 9 and 16), Statement 21 sets ${\mathcal{C}}_P^S=\left\{\left(\right)\right\}$ if ${\mathcal{C}}_P^S\left(n\right)=\varnothing$. On the other hand, ${\mathcal{C}}_P^S$ will not be equal to $\left\{\right(\left)\right\}$ if ${\mathcal{C}}_P^S\left(n\right)\ne \varnothing$ because $G=1$ is executed after generating each composition.

□

5. Designing the $\mathbf{S}$-Restricted Random Number Generator

In this section, we propose an architecture for designing S-restricted RNGs. The architecture is based on parallel RNGs that generate multiple simultaneous random numbers. While any kind of parallel RNGs can be used in the proposed architecture, we use parallel RNGs constructed of parallel LFSRs to explain the design procedure. The rationale underlying this choice is that LFSRs (and parallel LFSRs) are simple devices with lightweight implementations using a few flip-flops along with a few logical gates, the layout of which is defined by a generating polynomial.

An LFSR ${\mathcal{L}}_n\left(G\right)$ of degree n with generating polynomial G can be used to implement an RNG ${\mathcal{R}}_n\left(G\right)$ that periodically generates a sequence of $2^n-1$ mutually different values ${\mathcal{C}}_y\left(\mathcal{R}\right)=r_0,r_1,\dots ,r_{2^n-3},r_{2^n-2}$ provided that $S^0\left({\mathcal{L}}_n\left(G\right)\right)\ne 000\dots 00$[75]. In this case, each state of ${\mathcal{L}}_n\left(G\right)$ is considered as a random number generated by ${\mathcal{R}}_n\left(G\right)$. We define $\Delta \left({\mathcal{R}}_n\left(G\right)\right)=\{r_0,r_1,\dots ,r_{2^n-3},r_{2^n-2}\}$. Moreover, we define the period length of ${\mathcal{R}}_n\left(G\right)$ as the length of the sequence ${\mathcal{C}}_y\left(\mathcal{R}\right)$, and represent it $|{\mathcal{C}}_y\left({\mathcal{R}}_n\left(G\right)\right)|=|\Delta \left({\mathcal{R}}_n\left(G\right)\right)|$.

For a positive integer number n and a set $S\subset \{1,2,\dots ,2^{n-1}\}$, we define an (LFSR-based) S-restricted RNG ${\mathcal{R}}_n^S\left(G\right)$ as an RNG, for which $\Delta \left({\mathcal{R}}_n^S\left(G\right)\right)=S$. We refer to S as the set of valid states for ${\mathcal{R}}_n^S\left(G\right)$. Moreover, we refer to $I\left({\mathcal{R}}_n^S\left(G\right)\right))=\{1,2,\dots ,2^{n-1}\}\setminus S$ as the set of invalid states of ${\mathcal{R}}_n^S\left(G\right))$.

A traditional LFSR-based RNG ${\mathcal{R}}_n\left(G\right)$ is obviously incapable of serving as an S-restricted RNG as it will generate some invalid outputs (outputs which are not valid numeric codes assigned to the objects), and ${\mathcal{C}}_y\left({\mathcal{R}}_n\left(G\right)\right)$ will consist of alternate runs of valid and invalid numbers (valid runs and invalid runs) unless $S=\{1,2,\dots ,2^n-1\}$. Figure 8 compares ${\mathcal{R}}_n\left(G\right)$ with ${\mathcal{R}}_n^S\left(G\right))$.

In Figure 8, valid runs ($V{R}_1,V{R}_2,\dots ,V{R}_r$) and invalid runs ($I{R}_1,I{R}_2,\dots ,I{R}_r$) are highlighted by blue and red colors, respectively. In this figure, $v{l}_i$ and $i{l}_i$ represent the length of the $i^{th}$ valid run and that of the $i^{th}$ invalid run, respectively. This figure shows how invalid runs are bypassed by ${\mathcal{R}}_n^S\left(G\right))$.

A parallel LFSR ${\mathcal{L}}_n^j\left(G\right)$ with a sampling rate of j can bypass $j-1$ consecutive states generated by ${\mathcal{L}}_n^j\left(G\right)$ in each clock cycle. Thus, a number of parallel LFSRs with different degrees of parallelism can be used to bypass invalid runs with different lengths. In this section, we use this idea for the design of S-restricted RNGs. Figure 9 shows our proposed architecture for the design of ${\mathcal{R}}_n^S\left(G\right))$.

As shown in Figure 9, the proposed architecture consists of a serial (1-parallel) LFSR (${\mathcal{L}}_n\left(G\right)$) and a set of parallel LFSRs (${\mathcal{L}}_n^2\left(G\right)$, ${\mathcal{L}}_n^3\left(G\right)$,…,${\mathcal{L}}_n^{MIRL}\left(G\right)$), which share n flip-flops along with an Invalid Run Length Calculation Logic (ILCL) and a multiplexing logic, which control the feedback loop. In this figure, MDP (Maximum Degree of Parallelism) is calculated as $MDP=MIRL+1$, and MIRL (Maximum Invalid Run Length) is calculated as $MIRL=Max\{i{l}_1,i{l}_2,\dots ,i{l}_r\}$. The architecture includes a j-parallel state transition logic if and only if $\exists v\in \{1,2,\dots ,r\}:i{l}_v=j$.

In the architecture of Figure 9, each state transition logic circuit is fed by the outputs of the flip-flops $F_1,F_2,\dots ,F_n$ (the current state of the circuit). In each clock cycle, the ILCL generates (at most) $MDP$ enabling signals (enablers), which we denote by $e_1,e_2,\dots ,e_{MDP}$. The signal $e_1$ will carry the logic value 1 if the current state of the circuit is a valid state. For $i\in \{2,3,\dots ,MDP\}$, the enabler $e_i$ will be active if the current state is the beginning of an invalid run of length $i-1$. The enablers are encoded to the proper degree of parallelism using an encoding logic to provide proper select signals for the multiplexing logic. Finally, we have the multiplexing logic Multiplexes among the outputs of the state transition logic modules to feed the next valid state back into the flip-flops.

$I{R}_{1,1},I{R}_{2,1},\dots ,I{R}_{r,1}$ can be used to design logical signals $e_2,e_3,\dots ,e_{MDP}$, where $e_t$ (if equal to 1) indicates that the RNG should bypass $t-1$ invalid states. An encoder converts these signals to proper select inputs for the multiplexer.

6. Case Study: Random Latin Squares of Order 4

In this section, we first present a method for assigning numerical codes to Latin squares of an arbitrary order q. Afterwards, we design an S-restricted RNG that generates random valid codes for Latin codes of order 4.

6.1. Encoding Latin Squares

A Latin square $\lambda$ of order q can be modeled by $\langle {\lambda }_1,{\lambda }_2,\dots ,{\lambda }_q\rangle$, where $\forall i,j\in \{1,2,\dots ,q\}:\lambda \left(i\right)={\lambda }_i\in \mathrm{\Gamma }\left(\{1,2,\dots ,q\}\right)\wedge {\lambda }_i\in \mathcal{D}\left({\lambda }_j\right)$. Thus, the methods that are used for encoding permutations [19] can be modified to encode Latin squares. In this paper, we modify Lehmer’s encoding scheme [19] to assign numerical codes to Latin squares of degree q. For every $\mathrm{\Xi }\subset \{1,2,\dots ,q\}$, and every $\xi \in \mathrm{\Xi }$, let us define $\mathrm{\Phi }(\xi ,\mathrm{\Xi })=\left|\right\{x|x\in \mathrm{\Xi }\wedge x<\xi \}|$. Lehmer’s encoding scheme assigns a numerical code $0\le \mathcal{H}\left(\gamma \right)\le q!-1$ to each $\gamma \in \mathrm{\Gamma }\left(\right\{1,2,\dots ,q\left\}\right)$ on the basis of Equation (12),

$$\mathcal{H}\left(\gamma \right)=\sum _{i=1}^q\left(q-i\right)!\mathcal{H}\left(\gamma \left(i\right),\{1,2,\dots ,q\}\setminus \left\{\gamma \right(j\left)\right|0<j<i\}\right).$$

(12)

As an example, consider $\mathcal{H}(\langle 3,1,2\rangle )=2!\ast 2+1!\ast 0+0!\ast 0=4$. Now let us define the total order ⩽ on $\mathrm{\Gamma }\left(\right\{1,2,\dots ,q\left\}\right)$ as $\forall {\gamma }_1,{\gamma }_2\in \mathrm{\Gamma }\left(\{1,2,\dots ,q\}\right):{\gamma }_1⩽{\gamma }_2\iff \mathcal{H}\left({\gamma }_1\right)\le \mathcal{H}\left({\gamma }_2\right)$. Using the total order ⩽ on $\mathrm{\Gamma }\left(\right\{1,2,\dots ,q\left\}\right)$, we define ⪯ on ${\Lambda }_q$ as $\forall {\lambda }_1,{\lambda }_2\in {\Lambda }_q:{\lambda }_1⪯{\lambda }_2\iff \exists i\in \{1,1,\dots ,q\}:\left(\forall 1\le j\le i:{\lambda }_1\left(j\right)={\lambda }_2\left(j\right)\wedge {\lambda }_2(i+1)⩽{\lambda }_1(i+1)\right)$. In our proposed encoding scheme, the numerical code of each $\lambda \in {\Lambda }_q$ is calculated as shown in Equation (13),

$$\mathcal{F}\left(\lambda \right)=|\left\{x\right|x\in {\Lambda }_q\wedge x⪯\lambda \}|+1.$$

(13)

The codes assigned to Latin squares of order 4 can be seen in Appendix A.

6.2. S-Restricted RNG for $S=\left\{\mathcal{F}\left(\lambda \right)\right|\lambda \in {\Lambda }_4\}$

The first step towards the design of an S-restricted RNG is to list the set S of valid states, and to decide the size of the LFSRs (the number of flip-flops) accordingly. It is well known that $|{\Lambda }_q|=576$. Therefore, using the method explained above, the elements of ${\Lambda }_4$ can be encoded by the elements of $S=\{1,2,\dots ,576\}$. Moreover, the size of each LFSR should be $\lceil log576\rceil =10$.

The second step is to decide the generating polynomial for the serial and parallel LFSRs. There are 60 different primitive polynomials of degree 10 over $GF\left(2\right)$. In this case study, we have chosen $G=x^{10}+x^3+1$ because it has the minimum number of non-zero coefficients, and this reduces the number of gates required to implement the state transition logic modules. One can obviously choose polynomials with more non-zero coefficients in order to improve resistance against algebraic attacks.

Now we need to analyze the period of ${\mathcal{L}}_{10}\left(G\right)$ to identify the beginning state and the length of each invalid run to decide the set of sampling rates and design the corresponding state transition logic modules. We have analyzed a whole period of ${\mathcal{L}}_{10}\left(G\right)$ beginning from the initial state 0000000001, and identified 221 invalid runs. These runs are shown in the supplementary file. Runs of lengths 1 through 8 as well as 9 and 10 have been identified in the period. The beginning states of the runs are shown in

Table 2. Run beginners.

L	Begin
1	580 608 834 656 596 706 752 686 694 848 602 726 654 632 640 578 720 598 650 738 760 588 836 610 728 630 688 666 742 584 612 832 582 626 732 638 674 744 622 646 854 642 736 700 684 842 658 740 862 680 618 730 758 604 696 702 644 592 594 724 710 600 668 676 704 664 692 648 616 614 850 660 708 590 718 860 698 750 712 620 838 624 716 844 852 714 754 764 856 670 858 662 652 840 628 606 682 746 762 766 672 586 722 756 634 734 690 748 846 636 678
2	585 749 653 641 577 589 665 757 637 685 645 725 705 621 669 593 733 597 761 717 649 721 845 697 849 693 737 601 661 833 857 765 837 677 753 673 613 841 605 689 625 581 617 709 729 609 701 861 853 681 657 629 741 633 745 713
3	747 739 859 643 635 651 851 731 587 843 619 627 835 667 715 603 723 755 699 691 763 595 707 683 659 611 579 675
4	599 615 679 583 663 631 647 695 743 727 711 759 839 855
L	Begin	L	Begin	L	Begin	L	Begin	L	Begin	L	Begin
5	623 591 655 751 687 719 847	6	671 735 863 607	7	703	8	767	9	-	10	639

along with the corresponding run lengths. In Table 2, the columns labeled “L” show the run lengths, and the ones labeled “Begin” show the beginning states of the runs.

Now we can design the components of the S-restricted RNG in the form of black boxes. These components are shown in Figure 10.

In the next step, the state transition logic should be designed. This can be done using the method presented in Section 4.

Table 3. Logic descriptions of the state transition logic modules in the S-restricted RNG for generating random Latin squares of order 4 (Part 1).

j	Equation
2	$\left\{\begin{array}{c}{F}_1\left(2\right)=F_8\left(0\right),F_2\left(2\right)=F_9\left(0\right),F_3\left(2\right)=F_{10}\left(0\right)\hfill \\ F_4\left(2\right)=F_1\left(0\right)+F_8\left(0\right),F_5\left(2\right)=F_2\left(0\right)+F_9\left(0\right)\hfill \\ F_6\left(2\right)=F_3\left(0\right),F_7\left(2\right)=F_4\left(0\right),F_8\left(2\right)=F_5\left(0\right)\hfill \\ F_9\left(2\right)=F_6\left(0\right),F_{10}\left(2\right)=F_7\left(0\right),\hfill \end{array}\right.$
3	$\left\{\begin{array}{c}{F}_1\left(3\right)=F_7\left(0\right),F_2\left(3\right)=F_8\left(0\right),F_3\left(3\right)=F_9\left(0\right)\hfill \\ F_4\left(3\right)=F_{10}\left(0\right)+F_7\left(0\right),F_5\left(3\right)=F_1\left(0\right)+F_8\left(0\right)\hfill \\ F_6\left(3\right)=F_2\left(0\right)+F_9\left(0\right),F_7\left(3\right)=F_3\left(0\right)\hfill \\ F_8\left(3\right)=F_4\left(0\right),F_9\left(3\right)=F_5\left(0\right),F_{10}\left(3\right)=F_6\left(0\right)\hfill \end{array}\right.$
4	$\left\{\begin{array}{c}{F}_1\left(4\right)=F_6\left(0\right),F_2\left(4\right)=F_7\left(0\right),F_3\left(4\right)=F_8\left(0\right)\hfill \\ F_4\left(4\right)=F_9\left(0\right)+F_6\left(0\right),F_5\left(4\right)=F_{10}\left(0\right)+F_7\left(0\right)\hfill \\ F_6\left(4\right)=F_1\left(0\right)+F_8\left(0\right),F_7\left(4\right)=F_2\left(0\right)+F_9\left(0\right)\hfill \\ F_8\left(4\right)=F_3\left(0\right),F_9\left(4\right)=F_4\left(0\right),F_{10}\left(4\right)=F_5\left(0\right)\hfill \end{array}\right.$
5	$\left\{\begin{array}{c}{F}_1\left(5\right)=F_5\left(0\right),F_2\left(5\right)=F_6\left(0\right),F_3\left(5\right)=F_7\left(0\right)\hfill \\ F_4\left(5\right)=F_8\left(0\right)+F_5\left(0\right),F_5\left(5\right)=F_9\left(0\right)+F_6\left(0\right)\hfill \\ F_6\left(5\right)=F_{10}\left(0\right)+F_7\left(0\right),F_7\left(5\right)=F_1\left(0\right)+F_8\left(0\right)\hfill \\ F_8\left(5\right)=F_2\left(0\right)+F_9\left(0\right),F_9\left(5\right)=F_3\left(0\right),F_{10}\left(5\right)=F_4\left(0\right)\hfill \end{array}\right.$
6	$\left\{\begin{array}{c}{F}_1\left(6\right)=F_4\left(0\right),F_2\left(6\right)=F_5\left(0\right),F_3\left(6\right)=F_6\left(0\right)\hfill \\ F_4\left(6\right)=F_7\left(0\right)+F_4\left(0\right),F_5\left(6\right)=F_8\left(0\right)+F_5\left(0\right)\hfill \\ F_6\left(6\right)=F_9\left(0\right)+F_6\left(0\right),F_7\left(6\right)=F_{10}\left(0\right)+F_7\left(0\right)\hfill \\ F_8\left(6\right)=F_1\left(0\right)+F_8\left(0\right),F_9\left(6\right)=F_2\left(0\right)+F_9\left(0\right)\hfill \\ F_{10}\left(6\right)=F_3\left(0\right)\hfill \end{array}\right.$
7	$\left\{\begin{array}{c}{F}_1\left(7\right)=F_3\left(0\right),F_2\left(7\right)=F_4\left(0\right),F_3\left(7\right)=F_5\left(0\right)\hfill \\ F_4\left(7\right)=F_6\left(0\right)+F_3\left(0\right),F_5\left(7\right)=F_7\left(0\right)+F_4\left(0\right)\hfill \\ F_6\left(7\right)=F_8\left(0\right)+F_5\left(0\right),F_7\left(7\right)=F_9\left(0\right)+F_6\left(0\right)\hfill \\ F_8\left(7\right)=F_{10}\left(0\right)+F_7\left(0\right),F_9\left(7\right)=F_1\left(0\right)+F_8\left(0\right)\hfill \\ F_{10}\left(7\right)=F_2\left(0\right)+F_9\left(0\right)\hfill \end{array}\right.$

and

Table 4. Logic descriptions of the state transition logic modules in the S-restricted RNG for generating random Latin squares of order 4 (Part 2).

j	Equation
8	$\left\{\begin{array}{c}{F}_1\left(8\right)=F_2\left(0\right)+F_9\left(0\right),F_2\left(8\right)=F_3\left(0\right),F_3\left(8\right)=F_4\left(0\right),\hfill \\ F_4\left(8\right)=F_5\left(0\right)+F_2\left(0\right)+F_9\left(0\right),\hfill \\ F_5\left(8\right)=F_6\left(0\right)+F_3\left(0\right),F_6\left(8\right)=F_7\left(0\right)+F_4\left(0\right),\hfill \\ F_7\left(8\right)=F_8\left(0\right)+F_5\left(0\right),F_8\left(8\right)=F_9\left(0\right)+F_6\left(0\right),\hfill \\ F_9\left(8\right)=F_{10}\left(0\right)+F_7\left(0\right),F_{10}\left(8\right)=F_1\left(0\right)+F_8\left(0\right)\hfill \end{array}\right.$
9	$\left\{\begin{array}{c}{F}_1\left(9\right)=F_1\left(0\right)+F_8\left(0\right),\hfill \\ F_2\left(9\right)=F_2\left(0\right)+F_9\left(0\right),F_3\left(9\right)=F_3\left(0\right),\hfill \\ F_4\left(9\right)=F_4\left(0\right)+F_1\left(0\right)+F_8\left(0\right),\hfill \\ F_5\left(9\right)=F_5\left(0\right)+F_2\left(0\right)+F_9\left(0\right),\hfill \\ F_6\left(9\right)=F_6\left(0\right)+F_3\left(0\right),F_7\left(9\right)=F_7\left(0\right)+F_4\left(0\right),\hfill \\ F_8\left(9\right)=F_8\left(0\right)+F_5\left(0\right),\hfill \\ F_9\left(9\right)=F_9\left(0\right)+F_6\left(0\right)F_{10}\left(9\right)=F_{10}\left(0\right)+F_7\left(0\right)\hfill \end{array}\right.$
10	$\left\{\begin{array}{c}{F}_1\left(9\right)=F_1\left(0\right)+F_8\left(0\right),F_2\left(9\right)=F_2\left(0\right)+F_9\left(0\right),\hfill \\ F_3\left(9\right)=F_3\left(0\right),F_4\left(9\right)=F_4\left(0\right)+F_1\left(0\right)+F_8\left(0\right),\hfill \\ F_5\left(9\right)=F_5\left(0\right)+F_2\left(0\right)+F_9\left(0\right),\hfill \\ F_6\left(9\right)=F_6\left(0\right)+F_3\left(0\right),F_7\left(9\right)=F_7\left(0\right)+F_4\left(0\right),\hfill \\ F_8\left(9\right)=F_8\left(0\right)+F_5\left(0\right),\hfill \\ F_9\left(9\right)=F_9\left(0\right)+F_6\left(0\right)F_{10}\left(9\right)=F_{10}\left(0\right)+F_7\left(0\right)\hfill \end{array}\right.$
11	$\left\{\begin{array}{c}{F}_1\left(11\right)=F_9\left(0\right)+F_6\left(0\right),F_2\left(11\right)=F_{10}\left(0\right)+F_7\left(0\right),\hfill \\ F_3\left(11\right)=F_1\left(0\right)+F_8\left(0\right),\hfill \\ F_4\left(11\right)=F_2\left(0\right)+F_9\left(0\right)+F_9\left(0\right)+F_6\left(0\right),\hfill \\ F_5\left(11\right)=F_3\left(0\right)+F_{10}\left(0\right)+F_7\left(0\right),\hfill \\ F_6\left(11\right)=F_4\left(0\right)+F_1\left(0\right)+F_8\left(0\right),\hfill \\ F_7\left(11\right)=F_5\left(0\right)+F_2\left(0\right)+F_9\left(0\right)F_8\left(11\right)=F_6\left(0\right)+F_3\left(0\right),\hfill \\ F_9\left(11\right)=F_7\left(0\right)+F_4\left(0\right),F_{10}\left(11\right)=F_8\left(0\right)+F_5\left(0\right)\hfill \end{array}\right.$

show the logic expressions describing the output of the state transition logic modules.

Now, let us design the ILCL. It can be designed according to the information given in Table 2. As an example, to show how the ILCL is designed, let us consider the row labeled “L = 6” in Table 2. The beginning states in this row can be represented as 10-digit binary numbers by 1010011111, 1011011111, 1101011111 and 1001011111, respectively. This corresponds to the logic expression given by Equation (14) (In the rest of this section, we simply use `$F_i$’ instead of `$F_i\left(0\right)$’ for $i\in \{1,2,\dots ,10\})$.

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill & e_7=F_1{F}_2^{\prime }{F}_3{F}_4^{\prime }{F}_5^{\prime }{F}_6{F}_7{F}_8{F}_9{F}_{10}†F_1{F}_2^{\prime }{F}_3{F}_4{F}_5^{\prime }{F}_6{F}_7{F}_8{F}_9{F}_{10}†\hfill \\ \hfill & F_1{F}_2{F}_3^{\prime }{F}_4{F}_5^{\prime }{F}_6{F}_7{F}_8{F}_9{F}_{10}†F_1{F}_2^{\prime }{F}_3^{\prime }{F}_4{F}_5^{\prime }{F}_6{F}_7{F}_8{F}_9{F}_{10}.\hfill \end{array}\end{array}$$

(14)

In Equation (14), † represents logical OR (to separate it from logical XOR or $GF\left(2\right)$ addition). The logical expression in Equation (14) can be simplified as shown by Equation (15) using standard logic function simplification methods:

$$e_7=F_1{F}_2^{\prime }{F}_3{F}_5^{\prime }{F}_6{F}_7{F}_8{F}_9{F}_{10}†F_1{F}_3^{\prime }{F}_4{F}_5^{\prime }{F}_6{F}_7{F}_8{F}_9{F}_{10}.$$

(15)

Non-simplified logic expressions of the enablers are listed in the Supplementary File. Simplified enabler expressions are shown in

Table 5. Simplified logic expressions for enablers in the S-restricted RNG for generating random Latin squares of order 4.

j	Simplified Logic Expression
2	$e_2=F_1{F}_2^{\prime }{F}_3{F}_{10}^{\prime }†F_1{F}_2^{\prime }{F}_4{F}_5{F}_{10}^{\prime }†F_1{F}_2{F}_3^{\prime }{F}_4{F}_5^{\prime }{F}_{10}^{\prime }†F_1{F}_3^{\prime }{F}_4{F}_5^{\prime }{F}_6{F}_{10}^{\prime }†F_1{F}_3^{\prime }{F}_4{F}_5^{\prime }{F}_7{F}_{10}^{\prime }†F_1{F}_3^{\prime }{F}_4{F}_5^{\prime }{F}_8{F}_{10}^{\prime }†F_1{F}_3^{\prime }{F}_4{F}_5^{\prime }{F}_9{F}_{10}^{\prime }$
3	$e_3=F_1{F}_2^{\prime }{F}_3{F}_9^{\prime }{F}_{10}†F_1{F}_2^{\prime }{F}_4{F}_9^{\prime }{F}_{10}†F_1{F}_3^{\prime }{F}_4{F}_5^{\prime }{F}_9^{\prime }{F}_{10}$
4	$e_4=F_1{F}_2^{\prime }{F}_3{F}_8^{\prime }{F}_9{F}_{10}†F_1{F}_2^{\prime }{F}_4{F}_8^{\prime }{F}_9{F}_{10}†F_1{F}_3^{\prime }{F}_4{F}_5^{\prime }{F}_8^{\prime }{F}_9{F}_{10}$
5	$e_5=F_1{F}_2^{\prime }{F}_3{F}_7^{\prime }{F}_8{F}_9{F}_{10}†F_1{F}_2^{\prime }{F}_4{F}_7^{\prime }{F}_8{F}_9{F}_{10}†F_1{F}_3^{\prime }{F}_4{F}_5^{\prime }{F}_7^{\prime }{F}_8{F}_9{F}_{10}$
6	$e_6=F_1{F}_2^{\prime }{F}_3{F}_6^{\prime }{F}_7{F}_8{F}_9{F}_{10}†F_1{F}_2^{\prime }{F}_4{F}_6^{\prime }{F}_7{F}_8{F}_9{F}_{10}†F_1{F}_3^{\prime }{F}_4{F}_5^{\prime }{F}_6^{\prime }{F}_7{F}_8{F}_9{F}_{10}$
7	$e_7=F_1{F}_2^{\prime }{F}_3{F}_5^{\prime }{F}_6{F}_7{F}_8{F}_9{F}_{10}†F_1{F}_3^{\prime }{F}_4{F}_5^{\prime }{F}_6{F}_7{F}_8{F}_9{F}_{10}$
8	$e_8=F_1{F}_2^{\prime }{F}_3{F}_4^{\prime }{F}_5{F}_6{F}_7{F}_8{F}_9{F}_{10}$
9	$e_9=F_1{F}_2^{\prime }{F}_3{F}_4{F}_5{F}_6{F}_7{F}_8{F}_9{F}_{10}$
11	$e_{11}=F_1{F}_2^{\prime }{F}_3^{\prime }{F}_4{F}_5{F}_6{F}_7{F}_8{F}_9{F}_{10}$
1	$e_1={\left(e_2†e_3†e_4†e_5†e_6†e_7†e_8†e_9†e_{11}\right)}^{\prime }$

.

The invalid runs and the enablers of the circuit designed in this section can be seen in Appendixes Appendix B and Appendix C, respectively.

7. Conclusions and Further Works

In this paper, we unified the problems of random password generation, random captcha generation and random permutation generation as well as several similar problems into a generalized problem, which we call random object generation. The advantage of this generalization is that every solution proposed for the generalized problem will work for all the aforementioned problems. Moreover, we proposed a solution to the random object generation problem via introducing the notion of S-restricted RNG, which generates random numbers restricted to be drawn from a given set S. Our solution requires S to be the set of numeric codes assigned to objects of a specific type. We demonstrated how S-restricted RNGs can be constructed using parallel RNGs. We illustrated the construction procedure using parallel LFSRs. Moreover, we examined random generation of Latin squares as a case study. The most critical limitation of our work is the dependence of the coding scheme, and consequently the S-restricted RNG, on the set of target objects. This issue can be addressed via further research on encoding schemes for different kinds of non-numerical entities. Moreover, research can be continued by applying other types of parallel RNGs or Non-Linear Feedback Shift Registers (NFSRs) to the construction of S-restricted RNGs. Moreover, interested researchers can analyze the impact of the object encoding scheme as well as the LFSR generating polynomials on the performance and complexity of the S-restricted RNGs proposed in this paper.