Keywords: Internet of Things, Chaos-based Data Security, Pseudo-Chaotic Number Generators, Chaos-Based Stream Cipher, Security Analysis, Computing Performance, Power Consumption, Real-Time

par flux . . . . . . .

List of Tables

First of all thanks to Allah Almighty for giving me the strength to complete the thesis work and making my dream come true. I have for so many years dreamt of the day when I would acquire my PhD and the day has finally come. This thesis could never have been completed without the guidance, help and support of many people.

I would like to first thank the members of my dissertation committee -not only for their time and extreme patience, but for their intellectual contributions to my development as a researcher.

I would like to express my sincere gratitude to my supervisor Pr. Safwan EL ASSAD, for all his guidance, support whenever I needed it, patience and encouragement.

My sincere thanks also goes to my co-supervisor Pr. Maryline CHETTO for her insightful comments, academic and social support and encouragement. I would like also to thank IETR lab directors who provided me an opportunity to join their team as intern, and who gave access to the laboratory and research facilities. Without they precious support it would not be possible to conduct this research.

I gratefully acknowledge the funding received towards my PhD from the Erasmus Program -EGOVTN. I would like to thank deeply my parents, who have helped, guided and supported me spiritually all my life. My deepest gratitude goes to my wonderful sister and brother, for all the love, prayers and best wishes during my studies. Nowadays, mobile and embedded devices have become ubiquitous. This is due to recent advanced technologies in communications and computer science. We find numerous applications in various fields such as digital electronics, telecommunications, computing networks, smart cards, satellite systems, military defence system equipments, research system equipments, and so on [START_REF] Kortuem | Smart objects as building blocks for the internet of things[END_REF][START_REF] Bandyopadhyay | Internet of things: Applications and challenges in technology and standardization[END_REF]. These devices are interconnected either locally or over the internet. This phenomenon is called the Internet of Things (IoT) [START_REF] Feki | The internet of things: the next technological revolution[END_REF][START_REF] Ericsson | More than 50 billion connected devices[END_REF]. The term of IoT was firstly introduced, as a title of a presentation made at Procter & Gamble (P&G) in 1999 by Kevin Ashton, who was laying the groundwork for what would become the IoT [START_REF] Ashton | That 'internet of things' thing[END_REF]. The core idea of this concept lies in the presence of everyday physical objects known as things which are connected to the internet. Interconnection is ensured by technologies such as Radio Frequency IDentification (RFID) [START_REF] Welbourne | Building the internet of things using rfid: the rfid ecosystem experience[END_REF], Wireless Sensor Networking (WSN) [START_REF] Christin | Wireless sensor networks and the internet of things: selected challenges[END_REF], cloud servicing, machine-to-machine interfacing (M2M) [START_REF] Holler | From Machine-tomachine to the Internet of Things: Introduction to a New Age of Intelligence[END_REF], etc. The IoT is currently emerging: 50 billion devices are estimated to be wirelessly connected to the Internet by 2020 [START_REF] Ericsson | More than 50 billion connected devices[END_REF].

The vast majority of devices that will integrate the IoT are expected to work under severe constrained resources such as limited battery and computing power (e.g., running on tiny batteries) as well as little memory [START_REF] Sehgal | Management of resource constrained devices in the internet of things[END_REF]; These constraints often exacerbate each other. The term constrained device was introduced in 2014 by Bormann, et al. [START_REF] Bormann | Terminology for constrained-node networks[END_REF] to define a class of connected devices with strict resource restrictions in comparison with common desktop computers, such as limited computation power (MegaFLOPS vs. TeraFLOPS), less memory (KiloBytes vs. GigaBytes) and significantly reduced power consumption (mWatt vs. Watt): a typical node has a 8 MHz micro-controller with less than 128 KB of instructions memory and approximately 10 KB of RAM memory [START_REF] Roman | A survey of cryptographic primitives and implementations for hardware-constrained sensor network nodes[END_REF][START_REF] Trappe | Low-energy security: Limits and opportunities in the internet of things[END_REF]. Moreover, micro-controllers that are used for constrained devices typically provide a limited set of features, e.g, they are not commonly equipped with memory management units (MMU), which in fact prevent using operating systems such as Linux on such devices [START_REF] Petersen | Interoperable services on constrained devices in the internet of things[END_REF].

The mass deployment of pervasive devices provides on the one hand several benefits such as lower logistic costs, optimized supply-chains, higher process granularity, etc. On the other hand, many applications are very security sensitive (e.g., defence, military, financial, automotive or aerospace applications), not to mention ones which require a baseline of privacy. The communication technique among a large number of constrained devices that generate huge amount of data has an impact on security and privacy of applications. Such devices have to be invulnerable to malicious attempts of communication jamming which can limit their functionalities. Furthermore, pervasive devices have to include protection strategies against physical attacks. Consequently, it is necessary to increase the security of data to be transmitted in order to avoid hacking of informations and fraud and to not outweigh any of IoT benefits.

To provide security foundations, such as data confidentiality, data integrity and authentication, one solution is to use appropriate cryptographic algorithms.

Cryptography is the art and science that concerns the transformation of informations so that it is not possible to other people different from the legitimate source and destination to access these informations while it is stored or transferred over insecure networks; This can be achieved by designing crypto-systems [START_REF] Kahn | The Codebreakers: The comprehensive history of secret communication from ancient times to the internet[END_REF][START_REF] Mao | Modern cryptography: theory and practice[END_REF]. A crypto-system is a cryptographic algorithm that depends on certain parameters and initial conditions called secret key. Cryptography algorithms are categorized into two main categories: symmetric crypto-system and asymmetric crypto-system [START_REF] Fujisaki | Secure integration of asymmetric and symmetric encryption schemes[END_REF][START_REF] Simmons | Symmetric and asymmetric encryption[END_REF][START_REF] Kumar | Comparison of symmetric and asymmetric cryptography with existing vulnerabilities and countermeasures[END_REF]]. An asymmetric crypto-system uses a public key and a private key, to encrypt/decrypt a message. On the other hand, a symmetric crypto-system uses only one key to encrypt and decrypt messages, which should be distributed before transmission of the emitter and the receiver. A symmetric key primitive can be further divided into two main categories: block ciphers and stream ciphers [START_REF] Mao | Modern cryptography: theory and practice[END_REF][START_REF] Menezes | Chapter 7: Block Ciphers[END_REF]. A block cipher encrypts a fixed-length n-bits of data, -known as a block -at one time (typically equal to 64-256 bits). Stream cipher encrypts one bit or byte or a group of bytes at a time. It is based on generating an "infinite" cryptographic keystream, and using that to encrypt data. To remain secure, the keystream should be unpredictable and should be never used.

In the literature, a growing number of cryptographic techniques to secure transmitted information have been developed [START_REF] Shah | Performance study on image encryption schemes[END_REF][START_REF] Maniccam | Image and video encryption using scan patterns[END_REF][START_REF] Chang | A new encryption algorithm for image cryptosystems[END_REF][START_REF] Cheng | Partial encryption of compressed images and videos[END_REF][START_REF] Massoudi | Overview on selective encryption of image and video: challenges and perspectives[END_REF]. In recent years, chaotic cryptography has received much attention. Chaos in cryptography was introduced by Matthews in 1990s [START_REF] Matthews | On the derivation of a "chaotic" encryption algorithm[END_REF]. Since then, investigation on chaotic image encryption has become an active field of research due to the interesting properties of chaos such as ergodicity, sensitivity to initial conditions and parameters of the system, similarity to random behaviour, and broad-band power spectrum [START_REF] Kocarev | Chaos-based cryptography: Theory, algorithms and applications[END_REF]. Many chaotic image encryption methods have been proposed in the litterature [START_REF] Gao | A new chaotic algorithm for image encryption[END_REF][START_REF] Li | Image encryption techniques: A survey [j[END_REF][START_REF] Mazloom | Color image encryption based on coupled nonlinear chaotic map[END_REF][START_REF] Jolfaei | Image encryption using chaos and block cipher[END_REF][START_REF] Pakshwar | A survey on different image encryption and decryption techniques[END_REF]. Most of them can not be applied directly in constrained devices, because their design goals focus in providing high levels of security and do not meet the specific limitations offered by such innovative technologies and capabilities devices of the IoT [START_REF] Ranasinghe | Low cost rfid systems: confronting security and privacy[END_REF][START_REF] Ranasinghe | Confronting security and privacy threats in modern rfid systems[END_REF]. Hence, the main challenge is to design and develop new efficient cryptographic techniques capable of guaranteeing secure data transmission and providing an optimized security/cost/performance trade-off. The implementation of cryptographic primitives under such limited resource availability represents the research field of LightWeight Cryptography (LWC) [START_REF] Eisenbarth | A survey of lightweight-cryptography implementations[END_REF]. LWC focuses in designing primitives for constrained devices with very limited resources in terms of memory, computing power, and battery supply [START_REF] Alippi | Lightweight cryptography for constrained devices[END_REF][START_REF] Poschmann | Lightweight cryptography: cryptographic engineering for a pervasive world[END_REF].

Stream ciphers are characterized by their simplicity and high speed compared to block ciphers since they work on a few bits at a time and have relatively low memory requirements. In the other hand, block ciphers work on larger block of data and often have feedbacks from previous ones. Stream ciphers are more appropriate in some applications (e.g. some telecommunications applications) where the amount of data is either unknown, or when data must be individually processed as it is received or when buffering is limited. Also, they are less susceptible to noise in transmission since bytes are individually encrypted with no relation with other blocks of data. Contrary to block ciphers where in most ciphers modes, bytes are encrypted using previous encrypted bytes. Consequently, if one part of the data is modified, all the rest is probably unrecoverable. Due to all these reasons, stream ciphers are well suited to constrained devices. This explains the recent evolution researchers efforts in the field of lightweight stream ciphers.

Certainly, security is an important key issue for the IoT applications which is well treated by many research works. In the same context, IoT will be confronted with other severe challenges among them, producing correct output at the correct time. In some real-time applications, real time performance becomes critical. The correctness of a real-time system depends not only on the correctness of the logical result of the computation but also on the physical time when this result is produced. The role of an operating system in communication devices is important.

Embedded systems require a Real-time Operating System (RTOS) that has real time capabilities in terms of scheduling and synchronization. Using such RTOS enables the applications to guarantee timing constraints on response times, even in desktop computers. Such a system can take in charge the analysis of an application ensuring that the input is given from a real time system at a predetermined interval of time. Then, the cryptographic system will permit both the checking of the validity of the key as well as the time interval at which the key is presented to the system.

Motivations and objectives

Using cryptographic techniques provides many of the security services required by the pervasive applications such that protecting data transmission against attacks. Yet, existing cryptographic techniques developed for enterprise and desktop computing might not satisfy embedded application requirements as they can be huge and have a high energy consumption. In fact, smart devices of the IoT, including sensors, are inherently resource constrained with regard to memory, communication band-width, processing power and energy availability. Hence, a challenging topic concerns the design of efficient and lightweight cryptographic techniques to guarantee secure data transmission in the IoT. Such techniques should fit the low energy, computation and memory capabilities of cyber-physical systems. Nonetheless, they should also provide an optimized security/cost/performance trade-off.

The purpose of this thesis is to study the problem of information security under real-time and energy constraints and to design new chaos-based crypto-systems that answer these challenges. This research work, first, will focus on designing, implementing and analysing three pseudo-chaotic number generators (PCNGs). These generators use basic chaotic maps, a weak coupling matrix or a high diffusion binary coupling matrix, and a chaotic multiplexing technique. Then, three secure chaotic stream ciphers based on the proposed PCNGs are realized. The cryptographic analysis of the chaotic systems realized shows their robustness against known attacks. The performance obtained in computational complexity indicates their uses in real-time applications. We integrated these chaotic crypto-systems through a real-time operating system called Xenomai [14]. We comparatively measured energy, power and processing time consumption of the three proposed chaotic systems. We showed how to adapt the degree of security of these systems according to the time energy availability.

Thesis Outline and Contributions

This thesis is organized as follows:

Chapter 2 is dedicated to explaining the fundamental concepts of cryptography primitives. We start by discussing principles of foundation and basic concepts of cryptography and the two major categories of modern cryptographic primitives, namely symmetric and asymmetric algorithms. We present block ciphers and stream ciphers. After that, we introduce chaos theory and briefly present some chaotic maps including Gauss map, Tent map, Hénon map, Lozi map, Lorenz attractor and Rössler attractor. Then, we provide the state of the art of block ciphers, pseudo-random number generators and stream ciphers based on chaotic maps.

Chapter 3 presents a security and computing performance study of some discrete chaotic maps including: Logistic, Skew Tent and PWLCM maps, as base of proposed chaos-based stream ciphers during this thesis. First, we present a collection of common and standard security tools useful to define that assessment. Second, we discretize the chaotic maps making them running over a finite precision (N=32), and we analyze their cryptographic properties and speed. Then, we introduce a perturbation technique which permits to decrease the degradation caused by the discretizing process. We perform some security analysis of chaotic maps using this perturbation technique. In order to improve the cryptographic performance of chaotic maps, we propose a recursive structure. Then, we give the security and speed performance of chaotic maps using the perturbation technique and the recursive structure.

Chapter 4 presents our first contribution. It consists of designing and implementing, in an efficient and secure manner, three stream ciphers based on three proposed robust Pseudo-Chaotic Numbers Generators (PCNGs). We describe in details the general structure of the three proposed PCNGs. The first proposed PCNG, called CM-PCNG, uses three weakly coupled chaotic maps: PWLCM, Skew Tent and Logistic and includes a multiplexing chaotic technique. In comparison with the architecture of CM-PCNG, the second PCNG -DM-PCNG -uses a binary diffusion matrix as a coupling technique. The architecture of the third proposed PCNG, named CS-PCNG, is based on using two chaotic maps, namely PWLCM and SkewTent, and includes coupling and swap chaotic techniques. We give the security and statistical analysis, and the computing performance measures of the proposed PCNGs and the corresponding stream ciphers. The proposed crypto-systems are very secure, due to the use of chaotic coupling, swap and multiplexing techniques, while they offer a high speed performance.

Chapter 5 first focuses on studying the performance of two proposed chaotic stream ciphers CM-SC & CS-SC in terms of energy and power consumption and memory assessment. We show that the proposed stream ciphers are lightweight crypto-systems. Compared to other crypto-systems presented in the literature, we demonstrate that our designed stream ciphers are suitable for practical secure applications of the IoT in a constrained resources environment. The second part of this chapter concerns the integration of the proposed crypto-systems with real-time features. We show how to implement a crypto-system in the framework of a real time application which is managed by a well known free open-source real-time operating system, Xenomai. And we present the results of our experiment, giving execution time measures of the two proposed real time crypto-systems.

Chapter 6 concludes the manuscript. We report a summary of the main new ideas and contributions that were brought by our work in the domain of real-time cryptography. Finally, we present a short list of open problems and future research issues.

Introduction

Over the last several years, there has been tremendous interest world-wide in the possibility of using chaos in numerous fields, such as electronic systems, fluid dynamics, lasers, weather and communication systems [START_REF] Hubler | Adaptive-control of chaotic systems[END_REF][START_REF] Zeng | Chaos theory and its applications to the atmosphere[END_REF]. Chaos theory studies the behaviour of complex dynamic systems which have high sensitivity to small change in their parameters and makes the generated results entirely "unpredictable". The idea of using chaos theory in the cryptography field to enrich the design of new ciphers, has attracted more and more attention. Many fundamental characteristics of chaos, such as the ergodicity, deterministic nature, unpredictability, random-look nature and its sensitivity to initial conditions, can be connected with the "confusion" and "diffusion" property in cryptography [START_REF] Maqableh | New hash function based on chaos theory (cha-1)[END_REF][START_REF] Kocarev | Chaos-based cryptography: Theory, algorithms and applications[END_REF]. Chaotic systems have potential applications in such cryptography algorithms as block cipher, stream cipher and pseudo random number generator.

Some proposed cryptographic algorithms are not suitable for constrained devices or pervasive devices in the Internet of Things (IoT), including RFID (Radio Frequency Identification) tags, Wireless Sensors and mobile phones. Such devices are inherently resource constrained with regard to memory, communication band-width, processing power and energy [START_REF] Good | A low-frequency rfid to challenge security and privacy concerns[END_REF]. Therefore, due to its low computation capabilities, there is a need to build a lightweight security cipher that can fit these devices. The design of lightweight cryptographic algorithm is always a great challenge that the designer needs to cope with the trade-off between achieving robust security with low cost and enhanced performance [START_REF] Eisenbarth | A survey of lightweight-cryptography implementations[END_REF].

We dedicate this chapter to explain first the fundamental concepts of cryptography primitives. We start by discussing principles of foundation and basic concepts of cryptography and the two major categories of modern cryptographic primitives, namely symmetric and asymmetric algorithms. We discuss in detail block ciphers and stream ciphers. Furthermore, we focus on chaos theory and briefly introduce some chaotic maps including Gauss map, Tent map, Hénon map, Lozi map, Lorenz attractor and Rössler attractor. Finally, we will provide a review of block ciphers, pseudo-random number generators and stream ciphers based on chaotic maps.

Cryptography: foundation and basic concepts

Almost since the beginning of the writing language, it was necessary to find ways to hide valuable information [START_REF] Singh | The code book: the science of secrecy from ancient Egypt to quantum cryptography[END_REF]. Cryptography is the science that concerns the transformation of information so that it is not possible to other people different from the legitimate source and destination to access this information. The Cryptology process requires two different and complementary stages. The first step is cryptography which presents selection of the tools and the framework which guide the concealing of the information. The second one is cryptanalysis. It means the evaluation of the transformation system. The word 'Cryptography' has a Greek etymology. It is derived from krýpto "hidden" and the verb gráfo "to write". Cryptography is the process of converting a message (or plaintext) into unintelligible form or ciphertext and viceversa [START_REF] Kahn | The Codebreakers: The comprehensive history of secret communication from ancient times to the internet[END_REF]. The transformation of the plaintext into the ciphertext is called encryption, while the inverse process is named decryption. The algorithm used for performing encryption is named the cipher. The document history of 'Cryptography' begins with ancient Egyptian hieroglyphic. It has predominantly been used by the governments and military for the confidentiality of information. The modern cryptography begins with the Shannon theory [START_REF] Shannon | A mathematical theory of communication[END_REF], in which three fundamental goals must be achieved:

-Confidentiality: It is roughly equivalent to privacy. It ensures that information is not made available or disclosed to an adversary who has access to a communication channel and he is not able to derive messages exchanged by the emitter and the receiver; -Integrity: It is the assurance that the information is trustworthy and accurate. It ensures that an adversary who has access to a communication channel is not able to change and modify the content of messages exchanged by the emitter and the receiver; -Availability: It ensures that information are available to authorized people when it is needed. There are two major categories of modern cryptographic primitives, namely symmetric and asymmetric algorithms [START_REF] Fujisaki | Secure integration of asymmetric and symmetric encryption schemes[END_REF][START_REF] Simmons | Symmetric and asymmetric encryption[END_REF][START_REF] Kumar | Comparison of symmetric and asymmetric cryptography with existing vulnerabilities and countermeasures[END_REF]. The main distinguishing property of these categories is the different usage of the key.

Symmetric encryption algorithms use only one key for both encryption and decryption, which should be distributed before transmission to the emitter and the receiver. Figure 2.1 gives an overview on the symmetric encryption primitive. Symmetric ciphers are based on a combination of mathematics and cryptographic principles that usually call for simple primitives such as rotation, substitution, permutation, shift, bit-wise XOR etc. The key plays an important role in the encryption/decryption process. Its effectiveness directly depends on the size of key. An adversary may access and decrypt message if a weak key is used in the encryption algorithm. The strength of symmetric encryption algorithm depends also on the size of the used key. For the same algorithm, encryption is more robust and harder to break when using longer key than the one performed using smaller key. A main problem with these categories is securing the key transmission over the malicious network. Asymmetric encryption algorithm is used to solve the problem of key distribution. In asymmetric algorithms, each participant possesses a pair of keys: a public key and a private key. The public key is known by all the public while the private key is known only by the user. There is no need to distribute them before transmission. The two keys are strongly related to each other and each has its own purpose: The public key is used for encryption, whereas the private key is used for decryption. We give in Fig. 2.2 the principle of the asymmetric encryption. The public key encryption is based on mathematical primitives so that they are computationally intensive. Asymmetric encryption relies on mathematical functions which are computationally intensive such as modular addition, subtraction, modular multiplication, variable length rotations, etc. It is almost 1000 times slower than symmetric ones. This makes asymmetric encryption not well-suited to most of wireless sensors of the IoT which are low-cost computing devices [START_REF] Charlwood | Evaluation of the xc6200-series architecture for cryptographic applications[END_REF][START_REF] Hardjono | Security in Wireless LANS and MANS[END_REF][START_REF] Stallings | Cryptography and network security: principles and practices[END_REF].

In this thesis, we focus on symmetric cryptography and we introduce in next section its essential principles.

Symmetric encryption algorithms

There are two main kinds of modern symmetric encryption algorithms: block ciphers and stream ciphers. In the following, we describe these types in more details. In 1883, Kerckhoffs proposed six principles of designing practical symmetric encryption algorithms [START_REF] Kerckhoffs | La cryptographie militaire[END_REF]. Among these, the most important and relevant for modern ciphers, known as Kerckhoff's principles, is the principle that the security of a cipher should not depend on keeping secret the cipher, but only the key must be secret. Kerckhoffs' principle was later restated Shannon as "the enemy knows the system being used", i.e., "one ought to design systems under the assumption that the enemy will immediately gain full familiarity with them". In that form, it is called Shannon's maxim [START_REF] Shannon | Communication theory of secrecy systems[END_REF]. The idea is that the security of the cipher rests only in the keys and not in the algorithm. This presents one of the main concepts of modern cryptography. In fact, in cryptography, the key can be compromised and replaced with different one, without requirement of redesign cipher. This concept applies to the cipher security in general. We apply this principle when designing our proposed crypto-systems. We now briefly describe the above listed types of symmetric encryption algorithms.

Block ciphers

A block cipher is a deterministic algorithm which maps fixed-length n-bits of plaintext, called a block, to n-bits ciphertext blocks; n is called the blocklength (typically equal to 64-256 bits). Block cipher is an invertible transformation that takes as inputs the secret key K and n-bits plaintext and outputs n-bits ciphertext. It consists of two paired algorithms, one for encryption (E), and the other for decryption, (D) [START_REF] Cusick | Cryptographic Boolean functions and applications[END_REF]. The decryption algorithm presents the inverse function of encryption, i.e., D = E -1 [START_REF] Menezes | Chapter 7: Block Ciphers[END_REF]. The encryption cipher is given by the following equation:

E K (P ) := E(K, P ) : {0, 1} k × {0, 1} n → {0, 1} n . (2.1)
Where K is a secret key of length k bits and P is plaintext of length n. E K (P ) returns a ciphertext C of n bits. For each K, the function E K (P ) is required to be invertible mapping on {0, 1} n . The inverse for E K (P ) which presents the decryption function is defined as:

E -1 K (P ) := D K (C) := D(K, C) : {0, 1} k × {0, 1} n → {0, 1} n . (2.2)
D K (C) takes a key K and a ciphertext C to return a plaintext P, such that ∀K : D K (E K (P )) = P . In most contemporary block ciphers, the blocklength is at least equal to 128 bits. In order to encrypt a long plaintext P, it must first be partitionned into separate blocks, each one is small enough to be input to a block cipher. In the simplest case, called the Electronic CodeBook (ECB) mode, the plaintext is split into separate blocks and then each one is encrypted and decrypted independently. However, this native mode is generally not secure because of if plaintext block p 1 ,p 2 ,..., are encrypted twice under the same key, or equal plaintext blocks are encrypted, the same output ciphertext will be produced. Therefore, patterns in the plaintext become evident in the ciphertext output evidently. To overcome this disadvantage, several modes of employing block ciphers ( so-called modes of operation) have been designed. The four most common modes are CBC, CFB, OFB and CTR [START_REF] Menezes | Chapter 7: Block Ciphers[END_REF]. The CBC mode is used in block ciphers, the other modes (CFB, OFB and CTR) are used in stream ciphers. The general concept is to use an additional random input value, called an initial vector IV to create probabilistic encryption [START_REF] Bellare | Introduction to modern cryptography[END_REF].

Many block cipher algorithms have been proposed in the literature [START_REF] Rivest | The rc5 encryption algorithm[END_REF][START_REF] Rivest | The rc6tm block cipher[END_REF][START_REF] Daemen | The rijndael block cipher: Aes proposal[END_REF][START_REF] Schneier | Twofish: A 128-bit block cipher[END_REF][START_REF] Matsui | New block encryption algorithm misty[END_REF][START_REF] Schneier | Description of a new variable-length key, 64-bit block cipher (blowfish)[END_REF]. The most and best-known proposed algorithms of block ciphers are the DES and the AES. The DES was developed in the early 1970s, by IBM as a symmetric-key algorithm for the encryption of electronic data. It was selected by the National Security Agency (NSA) an official Federal Information Processing Standard (FIPS) for the United States in 1977 and became a standard for most communication protocols [START_REF] Standard | Federal information processing standards publication 46[END_REF]. By the mid '90s, the DES considered to be not secure for many applications due to its short 56-bit key size.

And it has been superseded by the Advanced Encryption Standard (AES) in 2001 as the US standard.

The AES algorithm is the most widely used symmetric cipher today in several industries and in many commercial systems. To date, there are no classical cryptanalysis better than brute-force attack against AES algorithm. However, the AES algorithm is vulnerable against Implementation attacks. This standard specifies the Rijndael algorithm [START_REF]The estream portfolio[END_REF], [4], [5], [6], a symmetric block cipher that can process data blocks of 128 bits, using secret keys with lengths of 128, 192, and 256 bits, and may be referred to as "AES-128", "AES-192", and "AES-256" (see Figure 2.3). AES is an iterated cipher; the number of rounds, which denoted by N r, depends on the key length according to Internally, the operations in the AES algorithm are performed on a two-dimensional array of bytes called the State. The state consists of four rows of bytes, each containing Nb bytes, where Nb = 128/32 = 4. All operation in AES are byte-oriented operations, and all variables used are considered to be formed from an appropriate number of bytes. The state is referred to as either s r,c or s[r, c], where r and c are the row number and the column number, with: 0 ≤ r < 4 and 0 ≤ c < 4.

At the start of the cipher or inverse cipher, the input (plain text) -the array of bytes in 0 , in 1 , ..., in 15 is copied into the state array. The cipher or inverse cipher operations are then conducted on this state array, after which its final value (cipher text) is copied to the output -the array of bytes out 0 , out 1 , ..., out 15 .

CHAPTER 2. STATE OF THE ART

The input array is copied to the state array according to:

s[r, c] = in[r + 4c] (2.3)
for 0 ≤ r < 4 and 0 ≤ c < 4.

At the end of the cipher or inverse cipher, the state is copied to the output array as follows:

out[r + 4c] = s[r, c] (2.4)
for 0 ≤ r < 4 and 0 ≤ c < 4.

Stream ciphers

Stream ciphers are an important class of symmetric encryption algorithms. They encrypt, with a timevarying transformation, individual data (usually binary digits) of plaintext one at a time, contrary to block ciphers (section 2.2.2) which simultaneously operate with a fixed transformation on large groups of plaintext; thus block ciphers are memoryless. Stream ciphers are generally characterized by their hight speed compared to block ciphers in hardware, and less complex hardware implementation. Also, they are more appropriate in some applications (e.g. some telecommunications applications) when data must be individually processed as it is received or when buffering is limited. Moreover, synchronous stream ciphers (described in later) are more suitable in some cases where transmission errors are highly possible, since they are not affected by error-propagation.

Stream ciphers process plaintext in single bit and the cipher function may change as plaintext is processed. This is achieved by combining, bit by bit, the plaintext and a keystream sequence -also called running-key -to obtain the cipher text. The keystream is generally generated by a finite state function called the keystream generator or the running-key generator. Stream ciphers can be either synchronous or asynchronous stream ciphers [START_REF] Menezes | Chapter 6: Stream Ciphers[END_REF][START_REF] Rueppel | Analysis and design of stream ciphers[END_REF].

A synchronous stream cipher (see Fig. 2.4) is one in which the keystream is produced independently of the plaintext message and of the ciphertext. It depends only on the secret key. The OFB mode of a block cipher is an example of a synchronous stream cipher. The sender and the receiver must be synchronized. They used the same secret key to obtain proper decryption. If the decryption fails due to lost of synchronization or ciphertext bits are inserted or deleted during transmission, then decryption process can be only restored through additional re-synchronization techniques. In addition, a cipher text bit which is changed ( but not deleted) does not affect the decryption of other bits of ciphertext. In contrast, an asynchronous stream cipher or self-synchronizing stream cipher is one where the keystream also depends on the ciphertext. The keystream is produced as a function of the key and a fixed number of previous ciphertext bits. The most common example of this is provided by some block cipher in what is termed cipher-feedback (CFB) mode. The encryption process of an asynchronous stream cipher is described in Figure 2.5. Suppose that the asynchronous stream cipher depends on l previous ciphertext bits. If one ciphertext bit is modified or deleted during transmission, then decryption of up to l ciphertext bits can be incorrect.

The most famous stream cipher that has been proposed to date in the literature is the Vernam cipher, also called One-Time Pad (OTP). It is a synchronous stream cipher in which the plaintext is combined with a random "keystream" of the same length, used only once, to generate the ciphertext, using the Boolean "exclusive or" (XOR) function. The keystream is produced by a pseudo-random sequence generator, having as an input a secret shared key K. The XOR operation is symbolised by . Figure 2.6 presents the encryption process using an OTP stream cipher. The OTP stream cipher is unconditionally secure [START_REF] Robshaw | Stream ciphers, rsa laboratories[END_REF]. In recent years, several research efforts have investigated secure stream cipher designs. Many of these have been proposed in software implementation.

The RC4 stream cipher (also known as ARC4 or ARCFOUR meaning Alleged RC4,) [START_REF] Paul | RC4 stream cipher and its variants[END_REF][START_REF] Rivest | The rc4 encryption algorithm[END_REF] was designed by Ron Rivest for RSA Data Security in 1987. It was the most commonly used in industrial applications, Internet protection using sing the SSL (Secure Sockets Layer) and TLS (Transport Layer Security) protocols... RC4 was characterized by its simple implementation. It produces a pseudo-random stream of bits (the keystream). The cipher is based on using a random permutation technique, which is initialized with a variable-length key of from 1 to 256 bytes to initialize a 256-byte state vector S, using the key-scheduling algorithm (KSA). Once these operations were carried out and have been complete, the keystream is produced using the pseudo-random generation algorithm (PRGA), by outputting some values of the S permutation updated at each clock. Several papers have been published analyzing the security of RC4 [START_REF] Knudsen | Analysis methods for (alleged) rc4[END_REF][START_REF] Mister | Cryptanalysis of rc4-like ciphers[END_REF][START_REF] Fluhrer | Weaknesses in the key scheduling algorithm of rc4[END_REF][START_REF] Klein | Attacks on the rc4 stream cipher[END_REF]. Multiple vulnerabilities have been discovered which rend it insecure [START_REF] Popov | Prohibiting rc4 cipher suites[END_REF], especially when the beginning of the generated keystream is not discarded, or when non-random or related secret keys are used [START_REF] Katz | Introduction to modern cryptography[END_REF]. In 2014, Ronald L. Rivest reconsiders the design of the RC4, and proposes an improved variant -called Spritz -which attempts to repair weak design decisions in RC4 while keeping its original principles. Spritz uses a sponge (or sponge-like) function, which can discard bits of keystream at any time and from which one can produce pseudo random output bytes of arbitrary length. Spritz can be used as an encryption algorithm, a message-authentication code generator or as a cryptographic hash function. But it is rather slow compared to other hash functions such as SHA-3 and best known hardware implementation of RC4 [START_REF] Rivest | Spritz-a spongy rc4-like stream cipher and hash function[END_REF][START_REF] Bhattacharjee | Hardware accelerator for stream cipher spritz[END_REF].

AES-CTR algorithm is used as a stream cipher. In fact, it is the AES block cipher in Counter mode (CTR). The CTR mode was introduced by Whitfield Diffie and Martin Hellman in 1979 [START_REF] Lipmaa | Comments to nist concerning aes modes of operation: Ctr-mode encryption[END_REF][START_REF] Jueneman | Analysis of certain aspects of output feedback mode[END_REF]. The AES-CTR requires an initialization vector IV and the secret key of length 128, 192 or 256 bits. The same IV and key combination must not be used more than once. Many approaches are possible to IV generation that ensures uniqueness, including incrementing a counter for each packet and linear feedback shift registers (LFSRs). The AES-CTR cipher operation consists in ciphering a counter value which must be nonce, with the secret key and xoring the obtained keystream with the corresponding block of the plaintext. The counter corresponding with a IV value is then updated to cipher in "one-time pad" mode the next plaintext block. Figure 2.7 presents the principle of the encryption process of the AES-CTR stream cipher. The AES-CTR mode is one of the best known modes of the AES block cipher and recommended by Niels Ferguson and Bruce Schneier in [START_REF] Lipmaa | Comments to nist concerning aes modes of operation: Ctr-mode encryption[END_REF]. The CTR mode has similar characteristics to the AES algorithm which has been standardized by the NIST. Thus, we say that the AES-CTR is secure. The AES-CTR model is fully parallelizable and enables effective utilization of many architectural features of modern processors including aggressive pipelining, multiple instruction dispatch per clock cycle, a large number of registers, and SIMD instruction.

A5/1 is a stream cipher used in most European country in order to provide communication privacy in the Global System for Mobile Communications (GSM) standards. A5/1 was developed in 1987. It was initially kept secret by the GSM companies, but it was entirely reverse engineered and published in 1999 by Marc Briceno from an actual GSM telephone [START_REF] Briceno | A pedagogical implementation of the gsm a5/1 and a5/2 "voice privacy" encryption algorithms[END_REF][START_REF] Briceno | A pedagogical implementation of a5/1[END_REF]. A5/1 is based on irregular clocking of three short Linear Feedback Shift Registers (LFSR) of lengths 19, 22 and 23, denoted by R1, R2, R3, respectively. The key size is equal to 64 bits and the keystream is produced by xoring the output from the three registers. A GSM transmission is organised as sequences of frames. A new session key K is used for each conversation. One frame is sent every 4.165 milliseconds and contains 114 bits representing the communication between the emitter and the receiver. For each frame, A5/1 is used to produce 114 bits of keystream which is xored with 114 bits of plaintext to produce the cipher text. Several attacks on the A5/1 have been published [START_REF] Biryukov | Real time cryptanalysis of a5/1 on a pc[END_REF][START_REF] Biham | Cryptanalysis of the a5/1 gsm stream cipher[END_REF][START_REF] Ekdahl | Another attack on a5/1[END_REF] and serious weaknesses have been identified.

In 2004, a project under the Information Societies Technology (IST) Program of the European Network of Excellence for Cryptology (ECRYPT), called "eStream" was tasked with seeking a strong stream cipher [START_REF] Robshaw | The estream project[END_REF][START_REF]The estream portfolio[END_REF].

Its goal was to give rise to a standardization of fast and secure stream ciphers. Thirty-four candidate ciphers were submitted. Only a few proposals were chosen to belong to the current official "eStream" project and the others were rejected because of security vulnerabilities or lower overall performance. Currently, none of these ciphers have been used in a widespread application, but all show advanced developments in the state of the art of stream cipher design. Two profiles of stream ciphers for software and hardware implementations were defined in the eStream project. The first profile is oriented to software-ciphers with high throughput and is faster than the 128-bits AES-CTR. The second profile is oriented to hardware ciphers that are suitable for highly constrained environments and are more compact than the 80-bits AES. The finalist ciphers for the two profiles are given in Table 2.3. These ciphers were found to be secure against known attacks. However, some tangible results have been reported by newer cryptanalysis attempts for some of these ciphers (Rabbit, Salsa12, SOSEMANUK, Grain, Trivium and MICKEY2.0) [START_REF] Manifavas | A survey of lightweight stream ciphers for embedded systems[END_REF]. We briefly describe below two examples of the finalist stream ciphers for the first profile oriented to software implementation namely Rabbit and HC-128.

Profiles

The finalist stream ciphers First profile Rabbit, HC-128, Salsa20/12, SOSEMANUK second profile Grain, Trivium, MICKEY 2.0 Table 2.3 -The finalist stream ciphers for the eStream project.

The Rabbit is a synchronous stream cipher developed by Martin Boesgaard, Mette Vesterager, Thomas Pedersen, Jesper Christiansen, and Ove Scavenius [START_REF] Boesgaard | Rabbit: A new highperformance stream cipher[END_REF]. The design of Rabbit was inspired by the complex behaviour of chaotic maps and their heigh sensitivity to small change which lead to that chaotic systems can be used for cryptographic purposes (more explanations in next sections). Rabbit works internally on a finite precision N bits equal to 32 which makes it suitable for software implementation. The Rabbit algorithm is based on iterating a set of coupled non-linear functions. It takes as input a 128-bit secret key and produces for each iteration an output sequence of 128 pseudo random bits using a combination of the internal state bits. The internal state consists of 513 bits divided between eight 32-bit state variables x j,t , eight 32-bit counters c j,t (0 ≤ j < 8 and t denotes the number of iterations) and one counter carry bit φ 7,t , which needs to be stored between iterations. Initially, φ 7,t is set to zero and the eight x j,t and c j,t are derived from the key at initialization using a next-state function.

The core of the Rabbit algorithm is the iteration of the system with the next-state function defined by the following equations:

x 0,t+1 = g 0,t + (g 7,t <<< 16) + (g 6,t <<< 16)

x 1,t+1 = g 1,t + (g 0,t <<< 8) + g 7,t x 2,t+1 = g 2,t + (g 1,t <<< 16) + (g 0,t <<< 16)

x 3,t+1 = g 3,t + (g 2,t <<< 8) + g 1,t x 4,t+1 = g 4,t + (g 3,t <<< 16) + (g 2,t <<< 16)

x 5,t+1 = g 5,t + (g 4,t <<< 8) + g 3,t x 6,t+1 = g 6,t + (g 5,t <<< 16) + (g 4,t <<< 16)

x 7,t+1 = g 7,t + (g 6,t <<< 8) + g 5,t

(2.5)

x j,t = (x j,t + c j,t+1 ) 2 ⊕ [(x j,t + c j,t+1 ) 2 >> 32]mod2 32 (2.6)
Where <<< and >> denote left bit-wise rotation and right logical bit-wise shift respectively. All additions are modulo 2 32 . Figure 2.9 illustrates schematically the next-state function. The counters are incremented as follows: c 0,t+1 = c 0,t + a 0 + φ 7,t mod 2 32 c 1,t+1 = c 1,t + a 1 + φ 0,t+1 mod 2 32 c 2,t+1 = c 2,t + a 2 + φ 1,t+1 mod 2 32 c 3,t+1 = c 3,t + a 3 + φ 2,t+1 mod 2 32 c 4,t+1 = c 4,t + a 4 + φ 3,t+1 mod 2 32 c 5,t+1 = c 5,t + a 5 + φ 4,t+1 mod 2 32 c 6,t+1 = c 6,t + a 6 + φ 5,t+1 mod 2 32 c 7,t+1 = c 7,t + a 7 + φ 6,t+1 mod 2 32 (2.7)

where the carry φ 7,t+1 is given by:

φ j,t+1 =      1 ifc 0,t + a 0 + φ 7,t ≥ 2 32 ˆj = 0 1 ifc j,t + a j + φ j-1,t+1 ≥ 2 32 ˆj = 0 0 otherwise (2.8)
Furthermore, the a j constants are equal to:

a 0 = a 3 = a 6 = Ox4D34D34D, a 1 = a 4 = a 7 = 0xD34D34D3 a 2 = a 5 = 0x34D34D34 (2.9)
After each iteration, 128 bits of keystream are generated according to an extraction technique. Once the extraction function is completed, the extracted bits are xored with the plaintext/ciphertext for encryption/decryption.

Rabbit is a high speed stream cipher. Its simple design also helps in hardware implementation. The computing performance of Rabbit algorithm is much better than some modern stream ciphers but is far behind a stream cipher designed for hardware implementation such as Trivium. The cryptanalysis of Rabbit did not reveal any attacks against Rabbit. Only the existence of a non-null bias in the keystream generated by Rabbit is demonstrated [START_REF] Aumasson | On a bias of rabbit[END_REF]. The keystream bias is greater than 2 -124.5 for certain bits, and this leads to a distinguisher requiring about 2 247 128-bit samples of keystream derived from random keys, which remains much higher than the cost of exhaustive key search.

The HC-128 is a synchronous stream cipher designed by Hongjun Wu [4,[START_REF] Paul | A theoretical analysis of the structure of hc-128[END_REF] and is currently a member of the eSTREAM software portfolio. The HC-128 design is suitable for modern super-scalar processors. It makes use of a 128-bit key K and 128-bit initialization vector IV. Its state contains two tables P and Q, each with 512 registers of length equal to 32 bits. At each step, a non-linear feedback function is used to update one register of one of the tables. All the elements of the two tables get updated every 1024 steps. A non-linear output filtering function generates a 32-bit keystream output word. The cipher specification states that a keystream with length up to 2 64 bits can be generated from 128-bit key K and a 128-bit IV.

HC-128 is the simplified version of HC-256 which uses a 256-bit key and 256-bit IV [START_REF] Wu | A new stream cipher hc-256[END_REF]. There are six functions being used in HC-128: f 1 (x), f 2 (x), g 1 (x), g 2 (x), h 1 (x) and h 2 (x). P is used as a S-box in h 2 and Q is used in the same purpose for h 1 . The used functions are described in Table 2.4 and 2.5 where x is a 32-bit word and x = x 3 || x 2 || x 1 || x 0 , x 0 , x 1 , x 2 , and x 3 are four bytes. The bytes x 3 and x 0 respectively denote the most and least significant byte of x.

The generation process starts with the initialization step i.e. with the Key and IV setup algorithms: K and IV are expanded into the two table P and Q, and the cipher runs 1024 steps.The Key and IV setup function is described in Algorithm 1. Once the initialization step completes, the algorithm is ready to generate keystream. Function Description

f 1 (x) (x ≫ 7) ⊕ (x ≫ 18) ⊕ (x 3) f 2 (x) (x ≫ 17) ⊕ (x ≫ 19) ⊕ (x 10) g 1 (x) ((x ≫ 10) ⊕(z ≫ 23)) + (y ≫8) g 2 (x) ((x ≪ 10) ⊕(z ≪ 23)) + (y ≪ 8) h 1 (x) Q[x 0 ] + Q[256+x 2 ] h 2 (x) P[x 0 ] + P[256+x 2 ]
Table 2.5 -Functions used in HC-128 stream cipher and their description.

Algorithm 1 KEY-IV-SETUP

Step-1: Expanding Key & IV into an array W i (0 ≤ i ≤1279)...

for i =0 → 7 do W i ← K i end for for i =8 → 15 do W i ← IV i-8 end for for i =16 → 1279 do W i = f 2 (W i-2 ) + W i-7 + f 1 (W i-15 ) + W i-16 + i end for
Step-2: Update the tables P and Q with the array W for i =0 → 511 do

P [i] ← W i+256 Q[i] ← W i+768 end for
Step-3: Run the cipher for 1024 steps and use the outputs to replace the table elements... for i =0 → 511 do

P [i] = (P [i] + g 1 (P [i 3], P [i 10], P [i 511])) ⊕ h 1 (p[i 12]) Q[i] = (Q[i] + g 2 (P [i 3], P [i 10], P [i 511])) ⊕ h 2 (p[i 12]) end for
At each step, one element of a table is updated and one 32-bit output is generated. Each S-box is used to generate only 512 outputs, then it is updated in the next 512 steps. The keystream generation algorithm of HC-128 is given in Figure 2

s i = h 1 (P [j] ⊕ P [j 12]) else Q[j] ← Q[j] + g 1 (Q[j 3], Q[j 10], Q[j 511]) s i = h 1 (Q[j] ⊕ Q[j 12]) end if i ← i+1 end for
Many other stream ciphers have been proposed in software form, e.g., LEVIATHAN (Cisco), MUGI (Hitachi-K.U. Leuven), SNOW [START_REF] Ekdahl | Snow-a new stream cipher[END_REF], SOBER (Qualcomm) and [START_REF] Rogaway | A software-optimized encryption algorithm[END_REF]. These stream ciphers have proven to be very weak and insecure. This has incited researchers to search for new methodologies that are immune to many attacks that can be applied.

Chaos-based cryptography 2.3.1 Chaos Theory

The word chaos is derived from the ancient Greek 'xαos', which means unpredictable behaviour or a state without order. Chaos theory has been established since 1970s. It is a branch of mathematics that focused on the behaviour of dynamical systems. In chaos theory, a chaotic system is a simple, non-linear dynamic process that reflects completely unpredictable behaviour, and hence randomness. Moreover, it is a deterministic system and high sensitive to initial conditions, such that, if two identical chaotic systems are in two slightly different initial conditions, they will evolve toward amazingly different results [START_REF] Batterman | Defining chaos[END_REF][START_REF] Zeng | Chaos theory and its applications to the atmosphere[END_REF]. A system is called a chaotic system if it is high sensitive to initial conditions and parameters and if periodic orbits are dense [START_REF] Bertuglia | Nonlinearity, chaos, and complexity: the dynamics of natural and social systems[END_REF]. Chaos theory has many applications in several disciplines, including meteorology, physics, computer science, engineering, economics, philosophy, and biology [START_REF] Hubler | Adaptive-control of chaotic systems[END_REF].

Chaos-based cryptography is the use of chaos theory in cryptographic systems. Since 1980s, the idea of using chaotic systems to design crypto-systems has attracted more and more attention. It can be traced to Shanon's classical paper on theory of secrecy systems [START_REF] Shannon | Communication theory of secrecy systems[END_REF]. The good dynamical properties of chaotic systems implies good cryptographical properties of crypto-systems. And, the basic method to make cryptosystems have good and strong cryptographical properties implies quasi-chaos.

Chaos theory and nonlinear dynamic have been used in the design of cryptographic primitives including image encryption algorithms, hash functions, secure pseudo-random number generators, block ciphers, stream ciphers, watermarking and steganography [START_REF] Akhavan | A symmetric image encryption scheme based on combination of nonlinear chaotic maps[END_REF].

The chaotic cryptographic primitives are generally made by combination of two operations called confusion and diffusion, which are modelled well by chaos theory [START_REF] Ansari | A review on chaotic map based cryptography[END_REF]. Both operations are repeatedly performed till the sufficient security level is achieved. The quality of security is tested by its capability to defend different attacks including known plaintext attack, statistical attack, deferential attack, and brute-force attack, etc.

Most of the cryptographic algorithms are based on using uni-modal chaotic maps, their control parameters and their initial conditions as their keys [START_REF] Behnia | A novel algorithm for image encryption based on mixture of chaotic maps[END_REF]. Many chaotic maps are proposed in the literature that have been applying to cryptography in several ways. In the following sections, we will give a brief introduction to some chaotic maps, and their applications in cryptography particularly proposed chaotic pseudo-random number generators, chaos-based block ciphers and chaos-based stream ciphers of the literature.

Chaotic maps

In mathematics, a chaotic map is a function which exhibits some sort of chaotic behaviour. It often takes the form of iterated function and occurs in the study of dynamical systems. Chaotic maps may be parametrized by a continuous-time or a discrete-time parameter.

According to Alligood et al., [START_REF] Alligood | Chaos: an introduction to dynamical systems[END_REF] a chaotic map is a function of its domain onto itself, the starting point of the trajectory (the sate from which the system starts) is called the initial condition. Chaotic maps clearly illustrate statements of many characteristics of chaotic behaviour such us sensitivity to initial conditions, complex behaviour and the evolution of information in deterministic and unpredictable behaviour [START_REF] Baker | Chaotic dynamics: an introduction[END_REF]. Several chaotic maps with one-dimension (1-D), two-dimensions (2-D) and three-dimensions (3-D) are proposed in the literature. In this subsection, we will give a brief description to some chaotic maps including Gauss map, Tent map, Hénon map, Lozi map, Lorenz attractor and Rössler attractor. Other maps such as Logistic map, Skew Tent and Piecewise Linear Chaotic Map (PWLCM) will be described in Chapter 3 since they will be used in this thesis as base of the proposed pseudo-chaotic number generators.

Gauss map

The Gauss map (also known as Gaussian map), is a 1-D non-linear iterated map of the reals into a real interval given by the Gaussian function:

x n+1 = exp(-αx 2 n ) + β (2.10)
where α and β are real parameters. The Gauss map is also called the mouse map because its bifurcation diagram resembles a mouse (see Figure 2.10). The discrete Gauss function is given by the following equation [START_REF] Manchein | Gauss map and lyapunov exponents of interacting particles in a billiard[END_REF]:

X n+1 = G(X n ) =      0 if X n = 0, 1 Xn -[ 1 Xn ] otherwise (2.11)
where the notation [.] means to take the fractional part.

The researches have shown that the Gauss is a good example of a chaotic discrete dynamical system, in that it exhibits in an accessible fashion all the common features of such systems [START_REF] Corless | Chaos and continued fractions[END_REF].

Tent map The Tent map is an iterated function of a dynamical system which exhibits chaotic behaviours. It is a 1-D simple map, on the unit interval J = [0, 1] into itself and governed by Eq.(2.12):

x n+1 =      ax n+1 if x n < 1 2 a(1 -x n+1 ) ifx n ≤ x n (2.12)
where a is a control parameter which is varied between 0 and 2. The mapping of the Tent map function and its bifurcation diagram are given in Figure 2.11. The Tent map has been shown to have a uniform distribution. Therefore, the tent map is often used to design chaos-based crypto-systems [START_REF] Yoshida | Analytic study of chaos of the tent map: band structures, power spectra, and critical behaviors[END_REF].

Hénon map The Hénon map is a 2-D discrete-time dynamical map. It was introduced in 1976 by Michel Hénon as a simplified model of the Poincaré section of the Lorenz model [START_REF] Hénon | A two-dimensional mapping with a strange attractor[END_REF]. The Hénon map takes one point (x, y) and maps this point to a new point in the plane. It is elaborated as follows:

x n+1 = 1 -αx 2 n + y n y n+1 = βx n (2.13)
The Hénon map depends on two control parameters, α and β. It is known to display chaos for certain parameter values and initial conditions. The Hénon map is chaotic for of α = 1.4 and β = 0.3. For other values of α and β the map may be chaotic, intermittent, or converge to a periodic orbit.

The Hénon map tends toward a "strange attractor" (see Figure 2.12). The Hénon map is an excellent system that bears all the classical chaotic characteristics, yet, it has its own disadvantages. Due its simplicity, it has become a benchmark system which is frequently used as an example to demonstrate scheme, analyse and control chaotic behaviour [START_REF] Richter | The generalized henon maps: examples for higher-dimensional chaos[END_REF].

Lozi map Lozi Map is a 2-D map introduced by René Lozi in 1978 [START_REF] Lozi | Un attracteur étrange (?) du type attracteur de hénon[END_REF]. Lozi Map equations and attractors resemble the Hénon map, but with the term -αx 2 n replaced by -α|x n |. It is given by the following equation:

x n+1 = 1 -α|x n | + βy n y n+1 = x n (2.14)
where α and β are bifurcation parameters The strange attractor [START_REF] Misiurewicz | Strange attractors for the lozi mappings[END_REF] illustrated in Figure 2.13 results from α=1.4, β=0.3. This Lozi map is the subject of many works focused on its various properties [START_REF] Zeraoulia | Lozi mappings: Theory and applications[END_REF].

Lorenz attractor

The Lorenz attractor is one of the most know 3-D chaotic attractors. It was first studied and introduced by Edward Lorenz in 1963 [START_REF] Lorenz | Deterministic nonperiodic flow[END_REF][START_REF] Sparrow | The Lorenz equations: bifurcations, chaos, and strange attractors[END_REF] as a simplified mathematical model for atmospheric convection. Edward Lorenz showed that a slight change in the initial conditions of a weather model would affect the whole system and could give large differences in the resulting weather. This is called sensitivity to the initial conditions. Lorenz's dynamic system is nonlinear, non-periodic, deterministic and very sensitive to the initial value. It presents a chaotic attractor which resembles a butterfly (see Figure 2.14). The Lorenz attractor is a system of three ordinary differential equations now known as the Lorenz equations, defined as follows:

     dx dt = σ(y -x) dx dt = x(ρ -z) -y dz dt = xy -βz (2.15)
where x, y, and z make up the system state, t is time, and σ, ρ and β are the system control parameters. They also arise in simplified models for other applications such as lasers, dynamos,thermosyphons, electric circuits and chemical reactions.

Rössler attractor

The Rössler attractor was created by Otto Rössler in 1976, with a system of three non-linear ordinary differential equations [START_REF] Rössler | An equation for continuous chaos[END_REF][START_REF] Rossler | An equation for hyperchaos[END_REF]. These differential equations define a continuous-time dynamical system that exhibits chaotic dynamics. The defining equations of the Rössler system are:

     dx dt = -y -z dx dt = x + ay dz dt = b + z(x -c) (2.16)
where a,b and c are constants. O.Rössler studied the chaotic attractor with a=0.2, b=0.2 and c=5.7. The plotted attractor is a quite nice but is not famous attractor (see Figure 2.15).

Chaos Applications in Cryptography

Block ciphers based on Chaotic Systems As we discussed before, a block cipher is an algorithm that operates on fixed length of bits called block, with a transformation function which maps block of plaintext bits to ciphertext bits of equal bits size, specified by a symmetric key. The decryption algorithm is defined to be the inverse function of encryption: the ciphertext is divided into blocks of the same bit size and then the decryption function is applied to each block using the same shared secret key. The security of a block cipher is evaluated with assuming that the attacker have access all transmitted ciphers and knows the encryption cipher details but he ignores the shared secret key. If the shared secret key is discovered, the block cipher is considered totally broken. Whereas, if part of the plaintext is retrieved, the block cipher is considered partially broken [START_REF] Stamp | Applied cryptanalysis: breaking ciphers in the real world[END_REF]. A well-designed block cipher should contains two layers: a confusion layer and a diffusion one. Confusion refers to how making each binary bit of the ciphertext should depend on several parts of the secret key, obscuring the connections between both. Diffusion means how a single bit change of the plaintext affects the ciphered bits. Several chaos-based block ciphers are based on the Fridrich structure in which the confusion and diffusion layers are separated.

A general structure of chaos-based block cipher is given in Figure 2. [START_REF] Addabbo | Long period pseudo random bit generators derived from a discretized chaotic map[END_REF], where the confusion and the diffusion layers are working separately. First, the confusion process is applied rc times on the block (or on the whole image), then the diffusion process is applied rd times on the output of the confusion process, and finally, the two processes are repeated r times. As we can see, both layers required image-scanning (for rc = rd = r =1). The confusion process is usually done by substitution operation. The substitution can be achieved by any 2-D chaotic permutation map, such as: Cat map, Standard map, or Baker map [START_REF] Fridrich | Symmetric ciphers based on two-dimensional chaotic maps[END_REF], and also, by using any nonlinear chaotic function as the 1-D finite state Skew tent map. In the permutation case, the image pixels are relocated, but their values remain unchanged. The diffusion process changes the statistical properties of the plain-image by spreading the influence of each bit of the plain-image over all the ciphered ones. The diffusion process is essential for any secure cryptosystem, otherwise it is easy to break the system. The dynamic keys Kc and Kd are supplied by the chaotic generator(s) (keys generator(s)). Over the past two decades, many researchers have used a chaotic system to design block cipher encryp-tion algorithms in order to provide high security. These algorithms were studied and analyzed. Among these algorithms, there are those which are considered robust and secure and can be used in data transmission applications. But, unfortunately, some of them are described as insecure and/or slow algorithms. Therefore, further research is still needed to design fast and secure chaos-based block ciphers. In this section, we will review some chaos-based block ciphers and give brief details of their algorithms.

In 1997, Fridrich introduced a symmetric block encryption technique based on two-dimensional chaotic map [START_REF] Fridrich | Image encryption based on chaotic maps[END_REF][START_REF] Fridrich | Symmetric ciphers based on two-dimensional chaotic maps[END_REF]. The general architecture of this crypto-system is shown in Figure 2.17. Fridrich cryptosystem became the main structure of the most proposed chaos-based crypto-systems and it has been widely referenced since 1997. Fridrich's crypto-system consists of two parts: chaotic confusion and pixel diffusion. The former process is achieved by permuting all the pixels of a plain-image as a whole, using one of the three types of 2-D chaotic maps, namely, Standard map, Cat map, and generalized Baker map defined. The parameters of the chaotic map serve as the confusion key. The diffusion process changes sequentially the value of each pixel one by one, in such a manner that the change to a particular pixel depends on the accumulated effect of all previous pixel values. The parameters of the chaotic map as the initial value or control parameter of the diffusion function serve as the diffusion key (see Eq (1.18), (1.19) and (1.20)) [START_REF] Lian | Security analysis of a chaos-based image encryption algorithm[END_REF].

x j+1 = (x j + y j ) mod N y j+1 = (y j + k sin

x j+1 N 2π ) mod N
(1.18) [START_REF] Lian | Security analysis of a chaos-based image encryption algorithm[END_REF] studied the performance of Fridrich's crypto-system and its security against bruteforce attack, statistical attack, known-plaintext attack, select-plaintext attack and so on, by investigating the properties of the involved chaotic maps and diffusion functions. Furthermore, They found some weaknesses and proposed some enhancement means to strengthen the overall performance of the focused crypto-system, and some advices to select suitable chaotic map, diffusion function and iteration time. In 2010, Solak et al., [START_REF] Solak | Cryptanalysis of fridrich's chaotic image encryption[END_REF] cryptanalyzed Fridrich's chaotic crypto-system and showed that the later could be broken using chosen-ciphertext attacks.

x j+1 y j+1 = 1 u v uv + 1 x j y j (modN ) (1.19) x j+1 = N k i (x j -N i ) +y j mod N K i , y j+1 = k i N (y j -y j mod N K i ) +N i . with        k 1 +k 2 + ... + k t = N N i = k 1 + ... + k i-1 (1.20) N i ≤ x j < N i + k i 0 ≤ y j < N Lian et al.,
In 1998, M.S. Baptista [START_REF] Baptista | Cryptography with chaos[END_REF] published a new crypto-system based on ergodic property of the simple low-dimensional and chaotic logistic map. In such crypto-system, the logistic map is used as a chaotic source and its output range is divided into intervals [Xmin, Xmax). The number of intervals are S (where S is the number of symbols can be used in plaintext). Consider a plain text having S different characters set Ca 1 , Ca 2 ...Ca S , use a one to one onto mapping f S : X t = X 1 , X 2 , ..., X S → A t = Ca 1 , Ca 2 , ..., Ca S to associate S different intervals with S different characters. After Baptista's system publication, there have been several attacks [START_REF] Li | Baptista-type chaotic cryptosystems: problems and countermeasures[END_REF][START_REF] Jakimoski | Analysis of some recently proposed chaos-based encryption algorithms[END_REF][START_REF] Alvarez | Cryptanalysis of an ergodic chaotic cipher[END_REF][START_REF] Alvarez | Keystream cryptanalysis of a chaotic cryptographic method[END_REF] on it and several modified versions have been proposed [START_REF] Rhouma | A piecewice linear chaotic map for baptista-type cryptosystem[END_REF][START_REF] Li | Performance analysis of jakimoski-kocarev attack on a class of chaotic cryptosystems[END_REF][START_REF] Wong | A modified chaotic cryptographic method[END_REF][START_REF] Wong | A fast chaotic cryptographic scheme with dynamic look-up table[END_REF][START_REF] Wong | A combined chaotic cryptographic and hashing scheme[END_REF][START_REF] Palacios | Cryptography with cycling chaos[END_REF].

According to Alvarez et al., [START_REF] Alvarez | Cryptanalysis of an ergodic chaotic cipher[END_REF], Baptista's encryption scheme has several weaknesses. They found that three types of cryptanalysis attacks: the chosen plain text attack, the entropy attack and the key recovery attack. Wong et al., [START_REF] Wong | A modified chaotic cryptographic method[END_REF] found that Baptista's approach has two main drawbacks. First, the resultant ciphertext is usually concentrated at few number of iterations. The second drawback is that the algorithm has low encryption speed and random numbers are repeated early. After these drawbacks, Baptista's crypstosystem is not competitive for standard algorithms of secure applications.

In 2004, Mao et al., [START_REF] Mao | A novel fast image encryption scheme based on 3d chaotic baker maps[END_REF] extended the two-dimensional chaotic baker map to be three-dimensional and proposed a new Symmetric block encryption scheme based on this map. The 3-D baker map was used to speed up image encryption while retaining its high degree of security. The proposed algorithm contains confusion and diffusion stage, and aims to obey traditional block cipher's principles (see Figure 2.18). Figure 2.18 -Block cipher encryption scheme proposed in [START_REF] Mao | A novel fast image encryption scheme based on 3d chaotic baker maps[END_REF].

Compared to other existing similar schemes that were designed on the 2-D baker map, Mao et al., scheme [START_REF] Mao | A novel fast image encryption scheme based on 3d chaotic baker maps[END_REF] has higher security and faster encryption/decryption speeds, which makes it a potential candidate for real-time image encryption applications.

In 2005, Lian et al., [START_REF] Lian | A block cipher based on a suitable use of the chaotic standard map[END_REF] designed a block cipher based on the discretized chaotic standard map, which can be presented for encrypting large-volume data sets. It is composed of three parts: a confusion process based on chaotic standard map which consists of the random-scan process, a diffusion function realized by a logistic map, and a key generator based on the chaotic Skew Tent. Some cryptanalysis on the security of the designed cipher is carried out. The cipher has satisfactory security with a low cost: it is of high key-sensitivity, and high security against brute-force attack, statistical attack and differential attack. Thus, it may provide a choice for multimedia encryption applications such as images, audios and even videos.

In 2011, Wang et al., [START_REF] Wang | A new chaos-based fast image encryption algorithm[END_REF] introduced the idea of combining the permutation and diffusion layers into one single layer. As a result, one image scanning is required and the algorithm may win at least two-time on image-scanning (see Figure 2

.19).

In Wang's algorithm, the image is first partitioned into a number of blocks N b blocks = L×P 64 , where L and P are the height and the width of the image, respectively. Then, the pseudo-random numbers, generated from the nearest-neighboring coupled-map lattices (NCML) given in Eq.(2.17) [START_REF] Kaneko | Pattern dynamics in spatiotemporal chaos: Pattern selection, diffusion of defect and pattern competition intermettency[END_REF], are used to modify the pixel values in the blocks. Meanwhile, the blocks are moved to new positions according to the lattice values of the NCML and some lattice values are exchanged. These steps are repeated R rounds until the required security level is reached.

x n+1 (i) = (1 -)f (x n (i)) + f (x n (i + 1)) (2.17)
Using multiplication and conversion from floating points to integers operations when generating pseudorandom numbers from NCML can avoid time-consuming, which greatly increases the encryption speed. Also, the mixing of the permutation and diffusion layers makes the image scan required only once in each encryption round, which also improves the encryption speed. In addition, the new algorithm has high security level, it can well resist brute-force attack, statistical attack, differential attack, known/chosen-Figure 2.19 -Image crypto-system combining the permutation-diffusion architecture [START_REF] Wang | A new chaos-based fast image encryption algorithm[END_REF]. plaintext attacks. Therefore, the algorithm indeed has excellent potential for practical image encryption applications.

In 2016, Farajallah et al., [START_REF] Farajallah | Fast and secure chaos-based cryptosystem for images[END_REF] proposed an efficient crypto-system that overcome the weaknesses of Zhang crypto-system [START_REF] Zhang | An image encryption scheme using reverse 2dimensional chaotic map and dependent diffusion[END_REF] while keeping a very high speed compared to the main chaos-based cryptosystem of the literature. The encryption side of the proposed cryptosystem is given in Figure 2.20, for the first block. Each pixel from the plain block p 0 (k) is XOR-ed with the initial byte iv(k) from the initial vector IV, then the output is XOR-ed with the discrete logistic map output to carry out the diffusion process. Then, the 8 least significant bits resulting from the diffusion process LSB 8 (y 0 (k)) are relocated using the modified 2-D cat map to obtain the ciphered pixel at the new position c 0 (k n ). It is important to note that the input of the discrete logistic map is based on the previous ciphered pixel (since c 0 (k n ) = LSB 8 (y 0 (k)) and the input of the discrete logistic map is 32 bits and the ciphered pixel is 8 bits. That is why the crypto-system takes y 0 (k -1) before the LSB 8 function and not after. For the first encrypted byte, the input of the discrete logistic map is Kd m and this value is re-initialized every new encryption round. Because the c 0 (k n ) is only a part of the logistic map input, it is impossible to recover y 0 (k -1) from c 0 (k n ) only. The encryption of the next blocks is almost the same. Each pixel from the plain block p l (k) is XOR-ed with ciphered byte from the previous block at the same position(i.e., c ( l -1)(k) to achieve the CBC mode). Then the rest of the operations are the same as in the first encryption block.

The security level of the proposed cryptosystem is verified by testing different kinds of known mathematical attacks and statistical analysis. The proposed crypto-system in proved to be more resistant against known attacks and faster than Zhang crypto-systems; the dynamic key space is much larger. All results prove that such crypto-system is suitable for securing real-time applications.

Pseudo-random number generators and stream ciphers based on chaotic maps

Noise like appearance and unpredictable behavior of the results generated by chaotic systems have attracted the researchers' interest in applying such systems for designing Pseudo-random number generators (PRNGs) [START_REF] Martínez-Ñonthe | Chaotic block cryptosystem using high precision approaches to tent map[END_REF][START_REF] Zheng | Pseudo-random sequence generator based on the generalized henon map[END_REF][START_REF] Shuai | Chaotic block iterating method for pseudo-random sequence generator[END_REF][START_REF] Alvarez | New approach to chaotic encryption[END_REF][START_REF] Kocarev | Pseudorandom bits generated by chaotic maps[END_REF][START_REF] Tong | The production algorithm of pseudo-random number generator based on compound non-linear chaos system[END_REF]. PRNGs are the main element on stream cipher algorithms as keystreams are combined, using an XOR operation, to the plaintext to generate the corresponding ciphertext [START_REF] Shujun | Pseudo-random bit generator based on couple chaotic systems and its applications in stream-cipher cryptography[END_REF]. The keystream must be random enough and different at each new execution to ensure that if an attacker knows at instant t the keystream, he cannot recover the secret key or derive the internal state. Thus, the security of any stream cipher depends on the randomness of the keystream, therefore on the robustness of the used PRNG. In addition, it is very important to use RNG and PRNGs when generating the secret keys and initialization variables [START_REF] Stojanovski | Chaos-based random number generators-part i: analysis [cryptography[END_REF]. Many stream cipher algorithms have been proposed in the literature, based on pseudo chaotic number generators (PCNGs). In the design of PCNGs, many chaotic maps have been utilized including Logistic map, Tent map, Piecewise non-linear chaotic map and Hénon map. Some researchers have used multiple chaotic maps to enhance the PCNG security [START_REF] Wolfram | Cryptography with cellular automata[END_REF].

Over the past two decades, many researchers have utilized chaotic maps for the design of PRNGs and stream ciphers to obtain high security performance [START_REF] Martínez-Ñonthe | Chaotic block cryptosystem using high precision approaches to tent map[END_REF][START_REF] Zheng | Pseudo-random sequence generator based on the generalized henon map[END_REF][START_REF] Shuai | Chaotic block iterating method for pseudo-random sequence generator[END_REF][START_REF] Alvarez | New approach to chaotic encryption[END_REF][START_REF] Kocarev | Pseudorandom bits generated by chaotic maps[END_REF][START_REF] Tong | The production algorithm of pseudo-random number generator based on compound non-linear chaos system[END_REF]. Unfortunately, some of the proposed PCNGs are considered as insecure and/or slow algorithms. Therefore, further research is still needed to design fast and secure pseudo-random number generators. In this section, we will review some of pseudo-chaotic number generators and stream ciphers, and we will give brief details of insecure and slow algorithms.

In 1985, Wolfram published the first paper on a dynamical system; this was a stream cipher based on a simple one-dimensional cellular automation [START_REF] Wolfram | Cryptography with cellular automata[END_REF]. The cellular automation which consists of a circular register with N cells, is used to generate a random binary keystream sequence that is XORed with the plaintext to produce the correspondence ciphertext.

In 1989, Matthews et al., [START_REF] Matthews | On the derivation of a "chaotic" encryption algorithm[END_REF] used discrete chaotic dynamical systems for the first time, to design chaos-based stream cipher algorithm. This work has attracted the attention of many researchers. Matthews suggested using a one-dimensional chaotic map, which exhibits chaotic behavior for a range of parameter and initial values. This map is used for generating a random sequence as system keys, which serves as a one time pad for encrypting plaintext. Matthews's algorithm has been criticized later by Wheeler [START_REF] Wheeler | Problems with chaotic cryptosystems[END_REF], who demonstrated that this map, when implemented on digital computer systems, produces repeating cycles of values, which are unpredictable and often have short length. Therefore, the map is not suitable for cryptographic use in the manner proposed by Matthews. In 2001, Shujuna et al., [START_REF] Shujuna | Pseudo-random bit generator based on couple chaotic systems and its applications in stream-cipher cryptography[END_REF] presented a novel pseudo-random binary sequence generator based on a couple of chaotic systems called CCS-PRBG. The general structure of CCS-PRBG is given in Figure 2.21. Authors used two different chaotic maps instead of one in order to provide higher security.

In the same year, another stream cipher based on the logistic map was presented [START_REF] Philip | Chaos for stream cipher[END_REF]. Two nearby logistic map trajectories were used to generate the pseudo-random sequences with high complexity. The plaintext is Xored with the generated sequence to obtain the ciphertext. The simplified block diagram of this algorithm is shown on Figure 2.22 [START_REF] Skrobek | Cryptanalysis of chaotic stream cipher[END_REF] where: y n is the plaintext stream, C n is a ciphertext, ⊕ means a bitwise xor operation, x 0 , x 0 and λ are the cipher's key. f is the logistic map function. Skrobek [START_REF] Skrobek | Cryptanalysis of chaotic stream cipher[END_REF] presented an efficient attack on the values of the key of this algorithm. Other weaknesses of this cipher are presented, and proposals of algorithm's improvement as well.

In 2003, Lee et al., [START_REF] Lee | Generating chaotic stream ciphers using chaotic systems[END_REF] proposed a new scheme for generating good pseudo-rando mnumbers, based on the composition of multiple chaotic maps. The proposed algorithm generates first a sequence of pseudorandom bytes by using a known chaotic dynamical system, then applies certain permutations to them, using the discretized version of another two-dimensional chaotic map. The proposed cipher can generate a high percentage of usable pseudo-random numbers, while maintaining a large key space for potential use in encryption. Thus far, there have been no successful attacks on this cipher. In the same year, a new chaosbased PRNG were proposed for cryptographic applications [START_REF] Kocarev | Pseudorandom bits generated by chaotic maps[END_REF]. Its construction is based on the fact that the inverse of a function is not a well-defined function, and has a large number of branches, although the inverse can be easily computed on a particular branch. The proposed generator uses only binary operations.

In 2005, Addabbo et al., [START_REF] Addabbo | Long period pseudo random bit generators derived from a discretized chaotic map[END_REF] proposed a pseudo random number generator, based on a family of digital maps derived from the discretized chaotic Sawtooth map, as a source of long-period pseudo random bits. Several statistical parameters and tests showed that these PRNG have a good performance in terms of period length and statistical properties of the generated sequences, while requiring a moderate increase in silicon area in comparison with LFSRs, that are the reference for low hardware complexity PRNGs.

In 2006, Wang et al., [START_REF] Wang | Chaotic pseudorandom bit generator using n-dimensional nonlinear digital filter[END_REF] proposed a new chaotic pseudo-random bit generator (PRBG), named NDF-PRBG, using n-dimensional non-linear digital filter (NDF) and chaotic maps. They used a coupling method followed by a quantization function to overcome the effects of finite wordlength to NDF and to hide its dynamic behaviour (see Figure 2.23). Proposed PRBG is confirmed to have perfect cryptographic properties, and can be used to construct stream ciphers with high level security. Moreover, it is much faster than other chaotic pseudo random number generators due to the inherent parallel structure of NDF. Yu and Cao [START_REF] Yu | Cryptography based on delayed chaotic neural networks[END_REF] proposed a novel approach of encryption based on chaotic Hopfield neural networks with time varying delay. They used the chaotic neural network to generate a binary pseudo-random sequence, which will be used for masking plaintext. The plaintext is masked by switching of chaotic neural network maps and permutation of generated binary sequences. Li et al., [START_REF] Li | Cryptanalysis of two chaotic encryption schemes based on circular bit shift and xor operations[END_REF] studied the performance of this chaos-based encryption algorithm. They proved that the generated pseudo-random sequence does not have uniform distribution and sufficient randomness. In addition, this scheme is insecure against the differential known-plaintext attack and the chosen-plaintext attack, in which only two known/chosen plaintexts are required to achieve a perfect breaking performance.

Kwok et al., [START_REF] Kwok | A fast image encryption system based on chaotic maps with finite precision representation[END_REF] proposed a fast chaos-based image encryption system with stream cipher structure. A 32-bit precision representation with fixed point arithmetic is assumed. The major core of the encryption system is a pseudo-random keystream generator. It consists of two parts, serving for the generation of initial keystream and mixing, based on a cascade of chaotic high-dimensional cat map and tent map, respectively. It is found that such a design not only achieves a very fast throughput, but also enhance the randomness, even under finite precision implementation. Thus far, there have been no successful attacks on this algorithm.

Chong Fu et al. [START_REF] Fu | An improved chaos-based image encryption scheme[END_REF], proposed an improved chaos-based key stream generator to enlarge the key space, extend the period and improve the linear complexity of the key stream under precision restricted condition so as to enhance the security of a chaos-based image encryption system. The generator is constructed by three Logistic maps and a nonlinear transform. The balance and correlation properties of the generated sequence are analyzed in this work.

Ahmed et al., [START_REF] -D | An efficient chaos-based feedback stream cipher (ecbfsc) for image encryption and decryption[END_REF] published a chaos-based feedback stream cipher (ECBFSC) for image cryptosystems. The proposed stream cipher is based on the use of a logistic map and an external secret key of 256-bit. The initial conditions for the logistic map are derived using the external secret key by providing weight to its bits corresponding to their position in the key. Furthermore, new features of the proposed stream cipher include the heavy use of data-dependent iterations, data-dependent inputs, and the inclusion of three independent feedback mechanisms.

In 2008, Kurian et al., [START_REF] Kurian | Self-synchronizing chaotic stream ciphers[END_REF] proposed a new chaotic stream cipher for digital communication. It uses one-dimensional chaotic systems such as Logistic map and Tent map. The algorithm utilized the Symbolic dynamics (SD) of chaotic system based synchronisation to produce a pseudo-random sequence as a keystream. The plaintext is then encrypted using the SD of the Tent map or the Logistic map with certain values of its initial conditions and parameters. Statistical tests reveal that the proposed system qualifies as random binary source. In [START_REF] Arroyo | Cryptanalysis of a family of self-synchronizing chaotic stream ciphers[END_REF], the authors studied the proposed stream cipher encryption scheme. Analysis of the keystream reveals the existence of some security problems, since a chosen-plaintext attack makes possible to estimate the control parameter of the underlying chaotic map, based on a "noisy" version of the keystream.

Patidar et al., [START_REF] Patidar | A new substitution-diffusion based image cipher using chaotic standard and logistic maps[END_REF] presented an image encryption scheme based on chaotic standard and logistic maps with simple mixing operation. Rhouma et al., proposed an equivalent description of the Patidar et al.'s cryptosystem which facilitated them in the cryptanalysis of the original cipher in terms of chosen plainext and known plaintext attacks. They found that the scheme can be broken with only one known/chosenplaintext and the corresponding ciphertext. [START_REF] Rhouma | Cryptanalysis of a new substitution-diffusion based image cipher[END_REF]. Later, Patidar et al., proposed modifications in their image cipher to make it robust against these two cryptanalytic attacks [START_REF] Patidar | Modified substitution-diffusion image cipher using chaotic standard and logistic maps[END_REF]. In [START_REF] Li | Breaking a modified substitution-diffusion image cipher based on chaotic standard and logistic maps[END_REF], Li et al., pointed out that the modified scheme is still insecure against the same known/chosen-plaintext attack. In addition, some other security defects existing in both the original and the modified schemes are also reported.

In 2010, Liu et al., [START_REF] Liu | Color image encryption based on one-time keys and robust chaotic maps[END_REF] designed a stream-cipher algorithm based on one-time keys and robust chaotic maps, in order to obtain high security and improve the dynamic degradation. They used the piecewise linear chaotic map as the generator of a pseudo-random key stream sequence. The initial conditions were generated by the true random number generators, the Message-Digest algorithm 5 (MD5) of the mouse positions.

In 2013, Goumidi et al. [START_REF] Goumidi | Hybrid chaos-based image encryption approach using block and stream ciphers[END_REF], two schemes are combined to enhance the encryption process complexity, the key space and the robustness of the cryptosystem. First, the image is divided into two sub-images. Next, these two sub-images are encrypted using respectively stream and block cipher schemes. After that, the two sub-images are merged to create enciphered image.

In 2014, cheng et al., proposed in [START_REF] Cheng | An efficient image encryption scheme based on zuc stream cipher and chaotic logistic map[END_REF] an efficient image encryption scheme. Logistic chaos-based stream cipher is utilized to permute the color image. The MD5 hash function and the ZUC stream cipher algorithm are combined to diffuse the color image. ZUC is a new stream cipher due for possible inclusion in the Long Term Evolution standards for mobile devices. The ZUC algorithms are the new crypto-graphic algorithms recommended by CCSA to be used in 3GPP LTE (Long Term Evolution).

Vidal et al., [START_REF] Vidal | A fast and light stream cipher for smartphones[END_REF] proposed a new fast and light stream cipher based on a hyper-chaotic dynamic system, a codifying method with a whitening technique and a non linear transformation. This stream cipher has been implemented in video-conference applications for smart phones.

In 2016, Jallouli et al., [START_REF] Jallouli | Comparative study of two pseudo chaotic number generators for securing the iot[END_REF] presented two pseudo-chaotic number generators (PCNGs). The first PCNG is based on two nonlinear recursive filters of order one using a Skew Tent map (STmap) and a Piece-Wise Linear Chaotic map (PWLCmap) as non linear functions. Whereas the second one consists of four coupled chaotic maps, namely: PWLCmaps, STmap, Logistic map by means a binary diffusion matrix A comparative analysis of the performance in terms of computation time and security of the two PCNGs is carried out. The analysis study and the obtained results of the two PCNGs show that the two proposed PCNGs have strong cryptographic properties. Security performance of the first proposed PCNG is better than the second one but it is slightly slower.

Conclusion

Researchers have been attracted by chaos theory in the cryptography field due to its interesting such as deterministic nature, sensitivity to initial conditions, unpredictability, and complex structure. Over the past two decades, several cryptographic systems based on chaotic systems / maps have been proposed such as pseudo random number generators and cipher encryption algorithms. Unfortunately, there are those which suffer from security problems or slow performance. Also, some of them are not suitable to smart devices that have very limited resources in terms of memory, computing power, and battery supply. For such cipher algorithms that are particularly suited for this purpose, the main challenge is to design lightweight cryptographic ciphers that cope with the trade-offs between security, cost, and performance. In this chapter, we provided the fundamental concepts of cryptography primitives and the two major categories of modern cryptographic primitives, namely symmetric and asymmetric algorithms. We gave an overview of block ciphers and stream ciphers. Also, we introduce chaos theory and some chaotic maps are briefed. Finally, we presented a review of block ciphers, pseudo-random number generators and stream ciphers based on chaotic maps.

Introduction

Random number sequences are used for a variety of purposes in various contexts like statistical mechanics, gaming industry, cryptography and communications, etc. The generation of such sequences may be carried out by a generator based on an algorithmic process or on a physical process. There are two basic types of random number generators: True Random Number Generators (TRNGs) and Pseudo-Random Number Generators (PRNGs). TRNGs produce a random bit stream from a non-deterministic natural source. They extract randomness from certain physical phenomena such as thermal and atmospheric noises. TRNGs are characterized by a higher security. However, their implementation requires additional devices, which make them more tedious (cost and slow) [START_REF] Sunar | A provably secure true random number generator with built-in tolerance to active attacks[END_REF]. A PRNG is a deterministic algorithm that produces numbers whose distribution is uniform, by inputting an initial seed (often generated by a TRNG). PRNGs are important in practice for their rapidity in number generation, reproducibility of the pseudo-random sequences and use of less memory for storage [START_REF] Karimi | On the combination of self-organized systems to generate pseudo-random numbers[END_REF].

Over the past years, Pseudo Chaotic Number Generators (PCNGs) have been one of the most important elements of chaos-based crypto-systems. Indeed, chaotic signals have very interesting characteristics for security and for digital communications such as: ergodicity, high sensitivity to initial conditions and parameters, good cryptographic properties, identical reproducibility (deterministic), broadband spectrum, auto and cross-correlation similar to pseudo-random signals [START_REF] Kocarev | Chaos-based cryptography: Theory, algorithms and applications[END_REF]. The chaotic maps present potential elements in the design of a PCNG. Several generators based on continuous-time chaotic maps have been studied and proposed in the literature. However, using chaotic maps in continuous-time cannot avoid the floating data operations, which make the encryption and decryption depend on the computer's resolution. Indeed, it may be difficult to realize synchronization between the sender and the receiver if they use computers with different resolutions, because of chaos properties of high initial-value sensitivity and parameter sensitivity.

To solve this problem, discrete chaotic maps are proposed [START_REF] Fridrich | Symmetric ciphers based on two-dimensional chaotic maps[END_REF][START_REF] Kotulski | Discrete chaotic cryptography (dcc)[END_REF][START_REF] Masuda | Cryptosystems with discretized chaotic maps[END_REF], which permits to discrete chaotic maps and make them run in integer domain. Based on these chaotic maps, the security of the corresponding crypto-system [START_REF] Alvarez | Some basic cryptographic requirements for chaos-based cryptosystems[END_REF] is determined by the property of the discrete chaotic map and the cryptosystem architecture.

In this chapter, we study the security performance of some discrete chaotic maps including: Logistic, Skew Tent and PWLCM maps, as base of proposed chaos-based stream ciphers during this thesis. We present the cryptographic properties of studied maps as well as their time computing performance. First, we define in Section 3.2 a collection of common and standard security tools useful for that assessment. Second, the chaotic maps are discretized making them run over a finite precision N=32, and their cryptographic properties and speed are analyzed in Section 3.3. As we know that the discretizing process degrades the original chaotic map's properties according to the high initial-value sensitivity, we introduce in Section 3.4.1 a perturbation technique that permits the decrease of the degradation. The security analysis of chaotic maps using the perturbation technique are performed (presented) in Section 3.4. In order to improve the cryptographic performance of chaotic maps, we propose a recursive structure described in Section 3.5.1. Then, we give in Section 3.4.4 the security and speed performance of chaotic maps using the perturbation technique and the recursive structure. Finally, some conclusions are presented in Section 3.6.

Common and standard security performance evaluation tools

In order to quantify and compare the cryptographic properties of the generated pseudo-chaotic sequences, a series of statistical security measurements and evaluation tools must be performed. These security tests check the randomness degree of the produced sequences. This is done by measuring different characteristics such as the uniformity degree of the sequence distribution. In this section, we describe in details the well-known statistical security measurements and evaluation tools. These tools are used in this chapter to study the cryptographic properties of some chaotic maps and also in Chapter 4 to evaluate the security performance of the proposed PCNGs. These security tests include phase space or mapping, histogram, Chi-square test, auto and cross-correlation and the NIST test. Also, we present the used metrics to evaluate the speed performance of PCNGs and stream ciphers.

Phase space

The phase space or mapping is a diagram that reflects the signature of a chaotic map. It is a tool to visualize the behaviour of a dynamical system and does not provide any additional information about the system. The phase space refers to the graphic presentation of the corresponding differential equation or chaotic function [START_REF] Kim | The Physics of Phase Space: Nonlinear Dynamics and Chaos, Geometric Quantization, and Wigner Function[END_REF]. In this thesis, for all phase space analysis, we plot the mapping of a decimal random sequence formed by 31250 samples.

Histogram analysis

The histogram is a graphical representation of the numerical data distribution. It is an estimation of the probability distribution of a random or pseudo-random variable. It was first introduced by Karl Pearson [START_REF] Pearson | Contributions to the mathematical theory of evolution[END_REF]. We use the histogram test to study the distribution uniformity of the generated random sequences.

Chi-square test analysis

A random sequence that has a good cryptographic properties must provide a uniform distribution. The histogram is a visual test of uniformity. It is necessary, but it is not sufficient. To ensure the uniformity, the Chi-square test is applied to statistically confirm the uniformity of the histogram [START_REF] Wuensch | Chi-square tests[END_REF][START_REF] Pace | Chi-square tests[END_REF].

The experimental Chi-square χ 2 value is given by:

χ 2 exp = K-1 i=0 (O i -E i ) 2 E i . (3.1)
where K is the number of classes (sub-intervals) chosen in our experiment equal to 1000, O i is the number of observed (calculated) samples in the i-th class and E i is the expected number of samples of a uniform distribution, E i = 10 7 /K.

To prove the uniformity of a sequence, the experimental value of Chi-Square must be lower than the theoretical one. Also, the smaller the experimental value of Chi-Square is than the theoretical one, the better the uniformity of the histogram.

For the histogram and Chi-square experiments, we generate 320 different decimal sequences, each one with a different secret key formed by 31250 samples.

Correlation analysis

Correlation analysis is also one of the statistical test that are used to evaluate the security performance of a generated random sequence. Correlation reflects the intensity of connection which may exist between two random variables. For cryptographic application, the values in a random sequence must not be repeated nor correlated. To evaluate the statistical analysis, three metrics can be used: the cross correlation which is a measure of similarity of two series, the auto-correlation, which is the cross-correlation of a signal with itself, and the correlation coefficient. The cross and auto-correlation give information about how much the sequence of a random numbers as a whole depends on the other sequence or on the value of the preceding members in the sequence itself. If two sequences X and Y are not correlated, then the correlation coefficient ρ XY between X and Y should be close to zero. Else if sequences X and Y are highly correlated, then ρ XY should be close to one. ρ XY is given by the following equation [START_REF] Recipes | Wh press, bp flannery, sa teukolsky, wt vetterling[END_REF]:

ρ XY = N i=1 (x i -X)(y i -Ȳ ) [ N i=1 (X i -X) 2 ] 1/2 × [ N i=1 (Y i -ȳ) 2 ] 1/2 . (3.2)
where

X = 1 N N i=1 x i and Ȳ = 1 N N i=1
Y i are the mean values of two sequences X and Y respectively. We produce two sequences of a random numbers computed with nearby initial conditions, each composed of 31250 samples, to analyse its correlation properties.

NIST test analysis

We apply the NIST statistical test, which presents one of the most popular standard test for analysing randomness of binary data [START_REF] Rukhin | A statistical test suite for random and pseudorandom number generators for cryptographic applications[END_REF]. The STS 2.1.2 version statistical test suite published in [START_REF] Elaine | Recommendation for random number generation using deterministic random bit generators[END_REF] is used. It consists of a battery of 188 tests (globally 15 different tests) to conclude regarding the randomness or nonrandomness of binary sequences. For each test, a set of m P-values are expected to indicate failure. Indeed, an α = 0.01, indicates that 1% of the sequences are expected to fail.

• A P -value ≥ α = 0.01 would mean that the sequence would be random with a confidence of (1 -α) = 99%. • A P -value < α = 0.01 would mean that the conclusion was that the sequence is non-random with a confidence of (1 -α) = 99%. To apply the NIST test, we generate 100 different binary sequences, each one with a different secret key (size of each sequence equal to 31250 samples = 10 6 bits) and α = 0.01.

Computing performance analysis

Computing performance is an important factor for evaluating the performance of a chaotic maps and PCNGs. For that, we calculate the Bit Rate (in Mega bits per second) and the number of needed cycles to generate one byte (NCpB). The later permits to compare the speed performance of different systems working on different platforms. The Bit Rate and NCpB are calculated respectively as follows:

Bit Rate(M bps) = Generated data size(M bits) Average generation time(s)

(3.3) N CpB = CP U speed(Hz) Bit Rate(Byte/s) (3.4)
In this thesis, all experiments are performed on a personal computer with Intel(R) Core(TM) i5-4300M CPU @2.60GHz and memory 15,6 GB and the operating system is Ubuntu 14.04 Trusty Linux distribution, using GNU GCC Compiler. For all speed performance evaluations, we give, over 100 different secret keys, the average Bit Rate in Mbps and the average number of needed cycles to generate one byte (NCpB).

Performance Evaluation of some chaotic maps

Chaotic maps are dynamic systems defined in real by recurrence relations, given by the following equation:

x i (n) = f (x 1 (n -1), x 2 (n -1), ..., x m (n -1)), i = 1, 2..m (3.5) where x ∈ S, f : S → S is a function with m variables, S ⊂ [0, 1]ou[-1, 1].
Some one-dimensional chaotic maps such as the Logistic map, the Piecewise Linear Chaotic Maps (PWLCM), and the Skew Tent [START_REF] Kocarev | Pseudorandom bits generated by chaotic maps[END_REF][START_REF] Phatak | Logistic map: A possible random-number generator[END_REF][START_REF] Shujun | Pseudo-random bit generator based on couple chaotic systems and its applications in stream-cipher cryptography[END_REF], and two-dimensional chaotic maps such as: the Cat map, the baker map, the standard map [START_REF] Fridrich | Symmetric ciphers based on two-dimensional chaotic maps[END_REF] And the Lozi map [START_REF] Lozi | New enhanced chaotic number generators[END_REF][START_REF] Lozi | Noise-resisting ciphering based on a chaotic multi-stream pseudo-random number generator[END_REF] are studied in the literature and widely used for the design of random number generators and in chaos based crypto-systems.

The chaotic generators proposed in this thesis are based on the following discrete chaotic maps: Logistic map, Skew Tent and PWLCM map, using finite precision N = 32 bits. Fig. 3.1 shows the general scheme of generating a pseudo-random sequence using a chaotic map. In the following sections, we discuss the performance of each discrete chaotic map namely Logistic map, Skew Tent and PWLCM, by presenting the results of the various security performance tests performed.

Performance Evaluation of the Logistic map

The logistic map is a one-dimensional map displaying a singularity, that is characterized by the simplicity of its recurrence equation depending on a single parameter λ. The logistic equation first created by Pierre Francois Verhulst [START_REF] Verhulst | Recherches mathématiques sur la loi d'accroissement de la population[END_REF] as a discrete-time demographic model and it was popularized by Robert May who used it as a pseudo random generator [START_REF] May | Simple mathematical models with very complicated dynamics[END_REF]. Since then, it is one of the most used maps in cryptographic applications. The basic form of the logistic map is given by the following equation 3.6.

F L (x n-1 ) = x n = λx n-1 (1 -x n-1 ) (3.6) with F L : S → S =]0, 1], x n ∈ S.
The values of interest for the growth rate parameter λ are those in the interval [0,4]. The Logistic map exhibits an astonishing range of behavior as the growth rate λ is varied [START_REF] Pastijn | Chaotic growth with the logistic model of p.-f. verhulst[END_REF][START_REF] Strogatz | Nonlinear dynamics and chaos: with applications to physics, biology, chemistry, and engineering[END_REF].

In Fig. 3.2, we present the known curves of the bifurcation diagram and the Lyapunov exponent of the Logistic map, with a growth rate λ values between 0 and 4. Fig. 3.2a shows that for growth rates λ less than one, the system always eventually collapses to zero. For growth rates λ between 1 and 3, the system always settles into an exact stable population level. At a growth rate between 3 and 3.4, the system oscillates between two population values. Just beyond a growth rate of 3.4, the diagram bifurcates into 4 paths and with r increasing beyond a growth rate of 3.5, beyond a growth rate of 3.5, the system oscillates over 8 population values, then 16, 32, etc.

Beyond a growth rate of 3.75, the bifurcations ramp up until the system is able to land on any population value. The length of the parameter intervals that yield oscillations decreases rapidly; the ratio between the lengths of two successive bifurcation intervals tends to the Feigenbaum constant δ 4.66920. This behavior gives a concrete example of a period-doubling cascade. However, for a growth rate value equal to 4, the population value covers the whole interval ]0,1]. For that, in the discrete version of the map, we set the value of the growth rate (control parameter) to the optimal value corresponding to 4 (λ = 4) [START_REF] Boeing | Visual analysis of nonlinear dynamical systems: Chaos, fractals, self-similarity and the limits of prediction[END_REF].

The discrete Logistic map equation for the control parameter set to 4 is given by the following equation [START_REF] Peng | Research on a block encryption cipher based on chaotic dynamical system[END_REF]:

F L [X(n -1)] = X(n) =        X(n-1)×[2 N -X(n-1)] 2 N -2 if X(n -1) = [3 × 2 N -2 ; 2 N ] 2 N -1 if X(n -1) = [3 × 2 N -2 ; 2 N ] (3.7)
where Z (f unctionF loor) is the greatest integer less than or equal to Z. X(n) takes an integer value ∈ [0, 2 N -1] and N = 32 is the used precision.

Phase space trajectory analysis We draw in Fig. 3.3, the phase space (mapping) of a sequence X L (n) produced by the discrete chaotic Logistic map and formed of 31250 samples, the attractor and the discrete variation. The chosen initial condition X L (0) is equal to 1488169157. The produced phase space trajectory clearly shows the signature relating to the Logistic map.

Histogram and Chi-square test analysis We plotted in Fig. 3.4 the histogram of the generated sequence

X L (n). Visually, the generated sequence X L (n) is not uniform over all values [1, 2 32 -1]. This is intuitively confirmed since the invariant measure of X L (n) is given by P (X L (n)) = 1 π× √ X L (n)(1-X L (n))
.

We confirm the non-uniformity of the sequence using the Chi-square test. The calculated experimental value χ 2 exp is equal to 12546727 which is significantly higher than the theoretical one χ 2 th , equal to 1073,64. This asserts the non-uniformity of the sequence. However, as the Logistic map is the most used chaotic map in cryptographic applications, only the following interval [ 0.2 × 2 32 , 0.8 × 2 32 ] is useful and in which the values follow a uniform distribution.

Correlation analysis To evaluate the correlation between two sequences X L and X L generated using slightly different keys, we calculate the correlation coefficient ρ X L ,X L . The obtained value is equal to -0,0019. Also, we draw the auto-correlation of sequence X L and a zoom of this autocorrelation on 200 samples in Fig. 3.5. And we plot in Fig. 3.6, the cross-correlation between the two sequences X L and X L , a zoom on it and a zoom of the auto and cross-correlation. Obtained results show that the different generated sequences X L and X L have good auto and cross-correlation properties. This asserts the pseudo-randomness of the generated sequences.

NIST test analysis We performed the NIST test by generating 100 different sequences, each of size equal to 31250 samples and using different secret key for each sequence (the total size of sequences is equal to 10 7 bits). In Table 3.1 and Fig. 3.7, we present the obtained results of the NIST test.

The obtained results show that the sequences do not pass all the NIST tests and that some tests are far from the acceptance threshold of a test materialized by the red line. This shows that the Logistic map does not have good cryptographic statistical properties for all values [1,

2 N -1] or ]0, 1].
Computing performance of the Logistic map We evaluate the computing performance of the Logistic map and we report in Table 3.2, the obtained results in average for the Generation Time in µs, the Bit Rate in Mbits/s and the number of cycle needed to generate one byte (NCpB). Obtained values show that the Logistic map is characterized by a high bit rate compared to the bit rates of the other chaotic maps presented in the following sections.

Performance Evaluation of the Skew Tent map

The Skew Tent map is a one dimensional piecewise map, exhibiting chaotic dynamics. It is a non invertible transformation of the unit interval onto itself. It depends on the one parameter p. The Skew Tent map is given by:

F S (x n-1 ) = x n =      x n-1 p if 0 ≤ x n-1 ≤ p x n-1 -1 p-1 if p < x n-1 ≤ 1 (3.8)
where: F S : S → S, S =]0, 1] and p is the control parameter with p ∈ ]0,1[, x n ∈ S.

If p is equal to 0.5, F S becomes the regular tent map. The equation of the discretized Skew Tent function is defined by Eq(3.9):

F S [X(n -1)] = X(n) =                  2 N × X(n-1) P if 0 < X(n -1) < P 2 N -1 if X(n -1) = P 2 N × 2 N -X(n-1) 2 N -P if P < X(n -1) < 2 N (3.9)
where Z (ceiling function) is the least integer greater than or equal to Z, X(n) takes an integer value that belongs to the interval [0, 2 N -1], and P is the control parameter with: 0 < P ≤ 2 N -1. Histogram and Chi-square test analysis Fig. 3.9 presents the histogram of a sequence X S (n) which is visually more uniform than the histogram of a sequence X L (n) generated by the Logistic map. However, the Skew Tent map is not uniform. This is proved by the Chi-square test. The experimental value of the Chi-square test is bigger than the theoretical one (χ 2 th = 1073.64, χ 2 exp = 1111.62).

Correlation analysis

The Skew tent map has good auto and cross-correlation properties as shown in Fig. 3.10 and Fig. 3.11 respectively. This result is confirmed by the value of the coefficient of correlation of two sequences X S and X S generated with nearby initial, which is very low ( ρ X S ,X S = -0.0013). NIST test analysis Table 3.3 and Fig. 3.12 give the results of NIST test applied on a sequence X S (n).

Obtained results show that sequences X S (n) does not pass all the NIST tests but they remains better than the results obtained for a sequence X L (n) generated by the Logistic map ( the number of passed tests is higher and the passed tests are closer to the threshold).

Computing performance of the Skew Tent map Table 3.4 shows the computing performance of the Skew Tent map. We note that the Skewtent map is slower than the Logistic map.

Performance Evaluation of the PWLCM map

The Piecewise Linear Chaotic Maps (PWLCM) map is another piecewise linear chaotic map, described by the following equation (3.10):

F P (x n-1 ) = x n =                    x n-1 p if 0 ≤ x n-1 < p x n-1 -p 0.5-p if p ≤ x n-1 < 0.5 F P (1 -x n-1 ) otherwise (3.10)
where: F S : S → S, S =]0, 1], x n ∈ S and p is the control parameter with p ∈ [0, 0.5].

The PWLCM is known to be chaotic when its control parameter p is within [0, 0.5] and its initial condition is chosen within the interval ]0, 1] [START_REF] Zhou | A design methodology of chaotic stream ciphers and the realization problems in finite precision[END_REF]. The PWLCM has been used in data encryption due to its features of parameter-controllable and good randomness [START_REF] Papadimitriou | A probabilistic symmetric encryption scheme for very fast secure communication based on chaotic systems of difference equations[END_REF].

Eq (3.11) gives the discrete PWLCM function [START_REF] Lian | A chaotic stream cipher and the usage in video protection[END_REF]

X(n) = F [X(n -1)] =                              2 N × X(n-1) P if 0 < X(n -1) ≤ P 2 N × X(n-1)-P 2 N -1 -P if P < X(n -1) ≤ 2 N -1 2 N × 2 N -P -X(n-1) 2 N -1 -P if 2 N -1 < X(n -1) ≤ 2 N -P 2 N × 2 N -X(n-1) P if 2 N -P < X(n -1) ≤ 2 N -1 (3.11)
where X(n -1) ∈ [1, 2 N -1] and P is the discrete control parameter and satisfies 0 < P < 2 N -1 .

Phase space trajectory analysis We give in the Fig. 3.13 the phase space, attractor and discrete variation of a sequence X P , formed by 31250 samples and generated by the discrete PWLCM map, with P = 1210290246, and an initial state X(0) = 830235384. Resulted mapping shows the signature of the PWLCM map.

Histogram and Chi-square test analysis Fig. 3.14 represents the histogram of a sequence X P generated by the PWLCM. Visually, the distribution of the sequence X P looks uniform. The experimental value of the Chi-square test χ 2 exp which is equal to 1219.97, is greater than the theoretical value χ 2 th , equals 1073.64. Therefore, the distribution of the discrete PWLCM map is non-uniform. Also, χ 2 exp is higher than that of the Skew Tent map. Thus, the Skew Tent map has better uniform distribution than the PWLCM map. In fact, studies have shown that the periodicity of the Skew Tent map is greater than the periodicity of the PWLCM, this may explain the fact that the Skew Tent map has a better uniformity.

Correlation analysis

We give in Fig. 3.15, the auto-correlation function of sequence X P and a zoom of the autocorrelation on 200 samples of this sequence. Fig. 3.16 presents the Cross-correlation functions of sequences X P and X P generated by the PWLCM map, and a zoom of the auto and cross-correlation. We note that the cross-correlation function is very low (maximum value = 0.025). Consequently, there is no correlation between the generated sequences, that are produced using slightly different seeds. The correlation coefficient ρ X P ,X P which is equal 0.0028 confirms this result.

NIST test analysis

We give in Fig. 3.17 and Table 3.5 the obtained NIST test results of a sequence X P generated by the discrete PWLCM map. Some sub-tests have not passed but they are close to the acceptance threshold. Also, we remark that the PWLCM map has better security performance than the other studied chaotic maps Skew Tent and Logistic map.

Computing performance of the PWLCM map Table 3.6 shows the PWLCM map's computing performance. Compared to the other chaotic maps, the PWLCM is slower than the Skew Tent and the Logistic map. 3.4 Performance Evaluation of some disturbed chaotic maps

Description of the used perturbation technique

The discretizing process and the usage of a finite precision N bits cause a degradation of the chaotic signals and may cause some state circles [START_REF] Li | On the dynamical degradation of digital piecewise linear chaotic maps[END_REF], which degrades the chaotic properties. Indeed, for a system of N bits, the maximum number of different chaotic levels is smaller than 2 N . The limited space values (assumed to be infinite for analogue chaos) causes periodic cycles of the different chaotic orbits, each having a maximum length necessarily less than 2 N [START_REF] Shujun | Pseudo-random bit generator based on couple chaotic systems and its applications in stream-cipher cryptography[END_REF][START_REF] Assad | Generator of chaotic sequences and corresponding generating system[END_REF]. Moreover, for each initial condition, we have a chaotic orbit formed generally of two parts: a transient branch of length l and a cycle of period c. The In order to decrease the degradation and to circumvent the effect of finite precision on chaotic signal, we use a perturbation technique. This technique permits to increase the length of the cycles and to impose a minimum length of cycle, depending directly on the disturbing signal. The perturbation technique results in the fact that no stable cycle exists, ie, if the chaotic system describes a given cycle at a given time, it can, by application of a perturbation, leave this cycle immediately to go to another cycle. Fig. 3.19 shows the principle of the perturbation technique. The disturbed structure is composed of a chaotic map, an XOR function and a disturbing generator. A good candidate for the generation of disturbing sequences is the Linear Feedback Shift Register (LFSR), whose role is to disrupt the chaotic orbit, thus allowing it to reach a new orbit. The choice of the disturbing sequence is made according to the following rules: it should have a long controllable cycle length and a uniform distribution; It should not degrade the good statistical properties of the chaotic dynamics, so the amplitude of the disturbing signal must be much smaller than that of the chaotic signal [START_REF] Assad | Generator of chaotic sequences and corresponding generating system[END_REF][START_REF] Assad | Design and analyses of efficient chaotic generators for cryptosystems[END_REF]. We choose the disturbing sequence by choosing a polynomial of perturbations. We list in Appendix B the list of disturbance polynomials.

In the next sections, we study the security performance of disturbed chaotic maps: Logistic map, Skew Tent and PWLCM which include a perturbation technique. Also, we present their computing performance. Security Performance Evaluation In order to carry out the various cryptographic tests, we choose the polynomial number 24 to generate different sequences X L (n). We recall that for the different tests, the size of a generated sequence, apart from the NIST test (which requires 100 sequences) and the Chi-square test (320 sequences), is equal to 31250 samples. We give in Fig. 3.20 and Table 3.7 the mapping, histogram, correlation and NIST test results of a sequence X L (n) generated by the disturbed Logistic map. We notice that the phase space, given in Fig. 3.20a, looks like that of a sequence generated by the non-disturbed Logistic map and clearly shows the signature relating to the map. This indicates that the perturbation technique has no effect on the phase space. This remark remains true for the phase space of the other disturbed Skew Tent and PWLCM maps.

Performance Evaluation of the disturbed Logistic map

Visually, the histogram is non-uniform (see Fig. 3.20b). This non-uniformity is confirmed by the Chisquare test. Indeed, the experimental value is equal to 925222 and it still higher than the theoretical one. But, it is less than the experimental value of an undisturbed sequence, i.e the uniformity is improved when using a perturbation technique. Fig. 3.20c gives a zoom of the cross-correlation of sequences X L and X L and a zoom of the autocorrelation of sequence X L . Obtained results shows that the generated sequences X L and X L possess good auto and cross correlation properties. This is confirmed by ρ X L X L with is equal to 0.002. Computing Performance Evaluation In Table 3.8, we present the computing performance measures of the disturbed Logistic map. The additional perturbation technique decreases the computing performance of the map. All of these results show that the disturbed Skew Tent map using the perturbation technique has better cryptographic properties than the non-disturbed Skew Tent map. Indeed, the generated sequences are uniform (The experimental value of chi-square test equal to 1020.97 is less than the theoretical one which is equal to 1073.64. There are no correlation between sequences generated with slightly different secret keys (ρ X S X S = 0.0015). The number of passed NIST tests increases as compared to the number of tests passed from the ordinary map. This intensifies the importance of the perturbation technique in the generation of

Performance Evaluation of the disturbed PWLCM map

Security Performance Evaluation We use the polynomial P number 7 to integrate the perturbation technique in the generation of the different sequences. As for the Logistic and Skew Tent maps, the perturbation technique improves the cryptographic performance of the produced sequences. This result is shown in Fig. 3.22 and Table 3.11. Despite the used perturbation technique, according to Fig. 3.22b, the histogram and the Chi-square test demonstrated that the generated sequences are not uniform (Experimental value of Chi-square test equal to 1697.81 is higher than the theoretical value). However, the disturbed PWLCM map has a better NIST test and cross-correlation results (ρ X P X P = -0.001).

Computing Performance Evaluation Table 3.12 gives the computing performance of the PWLCM map incorporating a perturbation technique. The PWLCM becomes slower than the Skew Tent map. Another technique used to decrease the degradation caused by the finite precision usage and to improve the cryptographic performance of generated pseudo-chaotic sequences is the recursive structure. Fig. 3.23 shows the principle scheme of a chaotic map inserted in a recursive structure. The produced sample X(n) depends not only on the previous sample X(n -1) but also on other previous samples. The number of samples to be dependent is chosen by the user, called "delay". In Fig. 3.23, we present a recursive structure with number of delays equal to three.

To produce a sample X(n), the system uses the previous samples, calculated as follows:

X(n -1) = U = 3 i=1 X i × K i (3.12)
where K i are integers, 0 < K i < 2 N and X 1 = X(n-1), X 2 = X(n-2), X 3 = X(n-3). We study the performance of the non linear recursive structure with the Logistic, Skew Tent and PWLCM disturbed maps as non linear functions. Fig. 3.24 presents the general scheme of the non linear recursive structure based on disturbed chaotic map. We generate different chaotic sequences, using the 70CHAPTER 3. PERFORMANCE EVALUATION OF SOME CHAOTIC MAPS AS BASE OF PROPOSED CHAO same previously chosen perturbation polynomials for each map and random coefficients K i . We give in Fig. 3.27 the histograms of sequences generated with the perturbation technique in recursive structure with delays equal to 1, 2 and 3 respectively. The obtained histograms are visually non-uniform. This result is confirmed by the Chi-square test (see Table 3 Computing Performance Evaluation We study the speed of the disturbed Logistic map in recursive structure (see 3.5.3 Performance evaluation of the non linear recursive structure using the disturbed Skew Tent map Security Performance Evaluation Fig. 3.29 gives the mapping and a zoom on this mapping of sequence X S (n) generated by the disturbed Skew Tent map used in a recursive structure with a delay equal to 1. The mapping seems random. This is due to the used recursive structure when generating sequences. It should also be noted that the mapping of the sequences generated with a delay equal to 2 and 3 is practically identical to the phase space of Fig. 3.29. We show in Fig. 3.30 the auto and cross-correlation of two sequences X S and X S generated by the cited recursive structure with a delay equal to 1. The sequences possess good auto and cross-correlation properties (see also Table 3.17).

Correlation coefficient delay = 1 delay = 2 delay = 3 ρ X S ,X S -0.0015 -0.002 0.0013 Table 3.17 -Correlation coefficient values for sequences generated by the structure of Fig. 3.5.2 using the disturbed Skew Tent map with delays equal to 1, 2 and 3.

We give in Fig. 3.31 the histograms of generated sequences produced with the same structure with delays equal to 1, 2 and 3 respectively. Visually, generated sequences have uniform distribution. Table 3.18 presents the theoretical and experimental values of the Chi-square test. We note that the sequences generated with a delay equal to 2 and 3 are uniform. Also, the uniformity of the sequence with a delay of 3 is the best. This demonstrate that, the more the number of delay increase, the more the uniformity is better. The results of the NIST test given in Fig. 3.32 and Table 3.19 show that, by integrating the perturbation technique and the recursion structure, the success rate of the various tests increases. Also, the more the number of delay increases, the more the number of tests that pass increases. Hence the interest of the perturbation technique and the recursive structure.

Chi

Computing Performance Evaluation We present in Table 3.20 the computing performance measures of a disturbed Skew Tent map in a recursive structure.

Performance evaluation of the non linear recursive structure using the disturbed PWLCM map

Security Performance Evaluation We present the mapping of a sequence X P (n) generated by a disturbed PWLCM map used in a recursive structure with a delay equal to 1 and a zoom on this mapping in Fig. 3.33. The obtained mapping is random. We draw in Fig. 3.34 the autocorrelation and cross-correlation of sequences X P and X P generated by the disturbed PWLCM map used in a recursive structure with a delay equal to 1. And we give in Table 3.21 the correlation coefficients values of sequences X P and X P . Good correlation properties are obtained for the generated sequences X P and X P .

We plot in Fig. 3.35 the histograms of sequences X P generated by the disturbed PWLCM map used in a recursive structure with a delay equal to 1, 2 and 3 respectively. The obtained histograms seems to be uniform.

We calculate the theoretical and experimental values of the Chi-square test to assert the uniformity of the generated sequences. Obtained measures are given in Table 3.22. The generated sequences with a delay equal to 2 and 3 are uniform. Also, the uniformity is better for a delay of 3. This confirms that the recursion structure improves the uniformity of the chaotic sequences.

We present in Fig. 3.36 and Table 3.23 the results of NIST test applied for sequences generated by the same structure with different delays (1, 2 and 3). The sequence generated with a delay of 3 passes all NIST tests. This asserts the utility of perturbation perturbation and recursive structure in terms of cryptographic robustness.

Computing Performance Evaluation Table 3.24 gives the computing performance measures performed to study the speed performance of a disturbed PWLCM map using a perturbation technique in a recursive structure.

Conclusion

In this chapter, we study the security and computing performance of some chaotic maps in particular Logistic map, Skew Tent and PWLCM map which present the basic elements of the proposed chaotic generator presented in Chapter 4. We first presented the common and standard tools for measuring the performance of chaotic sequences, in order to quantify and compare the cryptographic properties of the generated chaotic sequences including: phase space or mapping, auto and cross-correlation, histogram, Chi-square test and NIST test.

Then, we have presented the equations of different maps in real and discrete domain. We have also performed a series of statistical tests and we have presented the results obtained of these tests. We note that the Logistic map is the fastest one but it has the weakest cryptographic properties compared to the Skew Tent and PWLCM maps. The PWLCM map is characterized by its good cryptographic properties that are better than those of the Skew Tent map but it is less fast than the later. Also, we have showed the importance of integrating a perturbation technique and a recursive structure when generating chaotic sequences. We presented a description for each technique and its effect on the robustness and time performance of each chaotic map. The two proposed techniques improve the cryptographic performance of the chaotic maps, but they increase the computation time of the sequences.

Introduction

Nowadays, the increasing pervasiveness of technologies concerning the Internet of Things (IoT) and the fast development of digital technologies and communication networks, have given rise to dense traffic of information (documents, images, audio, videos...) [START_REF] Feki | The internet of things: the next technological revolution[END_REF]. Therefore, it is particularly important and essential to protect data transmission against attackers. Consequently, security of data transmission has been gaining more and more importance in the last decade and has been a subject of intense research [START_REF] Ukil | Embedded security for internet of things[END_REF][START_REF] Roman | Securing the internet of things[END_REF]. In this context, a growing number of crypto-systems to secure transmitted information have been developed [START_REF] Chang | A new encryption algorithm for image cryptosystems[END_REF][START_REF] Scharinger | Fast encryption of image data using chaotic kolmogorov flows[END_REF][START_REF] Cheng | Partial encryption of compressed images and videos[END_REF][START_REF] François | Image encryption algorithm based on a chaotic iterative process[END_REF][START_REF] François | A new image encryption scheme based on a chaotic function[END_REF]. Among them, chaos-based crypto-systems emerged to be promising. The idea of using digital chaotic systems to design cryptosystems has been extensively studied since 1989 [START_REF] Matthews | On the derivation of a "chaotic" encryption algorithm[END_REF]. Many research works have shown that chaos systems have many interesting properties such as ergodicity, similarity to random behavior, and sensitivity to initial conditions and parameters of the system, that make chaos a good candidate for use in information hiding and security systems. Also, chaotic maps present many desired qualities such as simplicity of implementation that leads to high encryption/decryption rates, and excellent security.

The robustness of any chaos-based crypto-system depends on the quality of the used Pseudo-Chaotic Number Generator (PCNG) which is a fundamental block in cryptography. The robustness of such PCNGs is crucial to ensure secure communication and to avoid all the various and existing attacks. Many PCNGs are proposed in the literature [START_REF] Francois | A new pseudo-random number generator based on two chaotic maps[END_REF][START_REF] Shujun | Pseudo-random bit generator based on couple chaotic systems and its applications in stream-cipher cryptography[END_REF][START_REF] Patidar | A pseudo random bit generator based on chaotic logistic map and its statistical testing[END_REF][START_REF] François | A novel pseudo random number generator based on two plasmonic maps[END_REF]. Generated sequences must be absolutely random (practically very close to random) and have some properties such as: long cycle's length, cross-correlation near to zero, high linear complexity and fully distributed phase space. Existing PCNGs satisfy some of these properties, but most of them suffer from short cycle's length since they are performed in finite precision N which causes a dynamical degradation.

In this chapter, we propose and realize in an effective way three stream ciphers, based on three robust Pseudo-Chaotic Numbers Generators (PCNGs). The proposed crypto-systems are very secure, due to the use of chaotic coupling, swap and multiplexing techniques, while having a high speed performance. They can be used for real-time applications.

The three proposed crypto-systems have the same general structure of PCNGs, presented in Section 4.2.1. The main difference between these PCNGs appears in the Internal State and Output functions. The first proposed PCNG, called CM-PCNG, uses three weakly coupled chaotic maps: PWLCM, Skew Tent and Logistic and includes a multiplexing chaotic technique. Its architecture is described in Section 4.2.1. We illustrate the architecture of the second PCNG -DM-PCNG -in Section 4.2.1. In comparison with the architecture of CM-PCNG, the main difference lies in using a binary diffusion matrix on the chaotic coupling technique. Section 4.2.1 describes also the architecture of the third proposed PCNG, named CS-PCNG which is based on using two chaotic maps, namely PWLCM and SkewTent, and includes coupling and swap chaotic techniques. These proposed PCNGs are defined on finite numbers and implemented in C code. Their implementation in sequential and parallel programming is detailed in Section 4.2.2. In Section 4.2.3 and 4.2.4, we give the security and statistical analysis of the proposed PCNGs. Section 4.2.5 presents the computing performance measures of the two PCNGs in terms of average generation time, average Bit Rate (BR), and average Number of Cycles needed to generate one Byte (NCpB) according to the data size. The security analysis and statistical tests of the three proposed stream ciphers and their speed performance are presented in Section 4.3. Finally, Section 4.4 concludes this chapter.

Proposed Pseudo-Chaotic Number Generators

The proposed PCNGs consists of four main functions: IV-setup, Key-setup, Internal State and Output function. In the following, we describe in detail the general structure of the proposed PCNGs and their architectures. Then, we study the security and computing performance of these PCNGs.

Description of the general proposed structure of PCNGs

The general structure of the proposed PCNGs is presented in Fig. 4.1. It takes the parameters of the system (N and the number of samples N s), a secret key "K" and a 32-bit initial vector "IV" as input, and as output, it generates pseudo-chaotic samples X(n), n=1, 2, ..., each quantified on N = 32 bits.

The structure consists of four function blocks: IV-setup, Key-setup, Internal State and Output function. All the proposed PCNGs have the same general structure but differ in their internal state and slightly change in their Key-setup, IV-setup and Output function. Each function block will be detailed in the architectural description of the proposed PCNGs. The secret key of the system is formed by: -the initial conditions Xp, Xs and Xl of the three chaotic maps: PWLCM, Skewtent and Logistic respectively, ranging from 1 to 2 N -1, -the control parameter Pp and Ps of PWLCM and Skewtent maps, in the range [1, 2 N -1 -1] and [1, 2 N -1] respectively, -the parameters of the coupling matrix A, ε ij , ranging from 1 to 2 k with k≤ 5. All the initial conditions, parameters and initial vector are chosen randomly from the file "/dev/urandom" which presents a special character file in the Linux environment that provides an interface with the Linux Pseudo-Random Number Generator (LRNG). LRNG is based on generating randomness from entropy of operating system events. It allows access to environmental noise collected from device drivers and other sources. The output of LRNG is used by internal kernel functionalities which use random bits and by calls to its application programming interface (API). Generated random data can also be used for other various purposes, such as generating random identifiers, computing TCP sequence numbers, producing passwords, and generating SSL private keys [START_REF] Gutterman | Analysis of the linux random number generator[END_REF].

The initial values Xp(0), Xs(0) and Xl(0) are calculated as follows:

     Xp(0) = Xp ⊕ IV p Xs(0) = Xs ⊕ IV s Xl(0) = Xl ⊕ IV l (4.1)
where

     IV p = lsb(IV ) IV s = L cir [lsb(IV ), 3] IV l = L cir [lsb(IV ), 2] (4.2)
with ⊕ denotes the XOR operator, lsb(IV ) is the 32 least significant bits of IV and L cir [S, q] performs the q-bits left circular shift on the binary sequence S.

The internal state function achieves the weak coupling of the chaotic maps and produces the future samples Xp(n), Xs(n) and Xl(n) from which the output function, by using a chaotic switching technique, produces the output sequence X(n) (see Fig. 4.2).

The system is governed by the following equation :

  Xp(n) Xs(n) Xl(n)   = A ×   F p[Xp(n -1)] F s[Xs(n -1)] F l[Xl(n -1)]   . (4.3)
where A represents the weak coupling matrix:

A =   (2 N -ε 12 -ε 13 ) ε 12 ε 13 ε 21 (2 N -ε 21 -ε 23 ) ε 23 ε 31 ε 32 (2 N -ε 31 -ε 32 )   . (4.4)
with ε ij are the weakly coupling parameters, and F p[Xp(n -1)], F s[Xs(n -1)] and F l[Xl(n -1)] are the discrete functions of the chaotic maps PWLCM, Skew Tent and Logistic respectively defined in Chapter 3.

The obtained multiplexed samples of the sequence X(n) are controlled by the chaotic sample Xth(n) and a threshold T , as shown in Fig. 4.2, and are defined as follows:

X(n) = Xp(n), if 0 < Xth(n) < T Xs(n), otherwise (4.5)
Where

Xth(n) = Xl(n) ⊕ Xs(n).
After the generation of all needed samples X(n), the IV-setup function computes a new IV that will be used for the next running of the PCNG. The new IV is generated from the LRNG.

Architecture of the proposed DM-PCNG

The architecture of the second proposed generator called DM-PCNG is presented in Fig. 4.3. In comparison with the previous architecture, the main difference lies in the internal-state function, which is based on a binary diffusion matrix D. The equation of the system is given by:

  Xp(n) Xs(n) Xl(n)   = D   F p[Xp(n -1)] F s[Xs(n -1)] F l[Xl(n -1)]   . (4.6)
where D is the binary diffusion matrix:

D =   1 1 0 0 1 1 1 0 1   . (4.7)
And is the operator defined as follows :

  Xp(n) Xs(n) Xl(n)   =   F p[Xp(n -1)] ⊕ F s[Xs(n -1)] F s[Xs(n -1)] ⊕ F l[Xl(n -1)] F p[Xp(n -1)] ⊕ F l[Xl(n -1)]   . (4.8)
The choice of the output samples X(n) is governed, as in Eq.(A.5) by a threshold T and the chaotic sample Xth, with Xth(n) = Xp(n) ⊕ Xs(n).

For each new running of the system, the initial vector IV is updated using the LRNG. The secret key is similar to one used in CM-PCNG, but does not include the coupling parameters ε ij .

Architecture of the proposed CS-PCNG

The architecture of CS-PCNG is presented in Fig. 4.4. Compared to the architecture of CM-PCNG, CS-PCNG's architecture is differentiated not only to internal-state function, but also to output function. The internal state uses two chaotic maps (PWLCM and SkewTent), and includes coupling and swap chaotic techniques. The output function is a XOR operation between Xp(n) and Xs(n) samples.

The initial values Xp(0) and Xs(0) are calculated as follows: The equation of the system is governed as follows:

Xp(0) = Xp ⊕ IV p Xs(0) = Xs ⊕ IV s (4.9)
Xp(n) Xs(n) = A × F p[Xs(n -1)] F s[Xp(n -1)] . (4.10) with A = (2 N -ε 11 ) ε 12 ε 21 (2 N -ε 22 ) (4.11)
Output samples X(n) are calculated throughout the produced samples Xp(n) and Xs(n) as follows:

X(n) = Xp(n) ⊕ Xs(n). (4.12)

Implementation of the proposed PCNGs

In order to study the performance evaluation of the proposed PCNGs, we implement the proposed architectures on an Intel Core i5 @ 2.60 GHz with 15.6 GB Running on Ubuntu 14.04 Trusty Linux, in C language and using the GCC GNU compiler. In this section, we will consider the proposed CM-PCNG as an example to well explain the C implementation. Two versions are implemented: a sequential version and a parallel one, based on the "pthread" library. In next sub-sections we will describe in details these implementations.

Sequential implementation of the proposed PCNGs

The general structure of a PCNG as presented in Figure 4.1 has as input the secret "K", the initial "IV" and the parameters of the system, and generates as an output a random sequence X(n).

In our implementation, the secret key and the parameters are taken from the files "key.txt" and "parameters.txt" respectively. For the CM-PCNG, the secret key is composed of the initial conditions Xp, Xs and Xl, the control parameter P p and P s and the parameters of the coupling matrix A, ε ij . The initial conditions and the control parameters are quantified on 4 bytes (32 bits) while ε ij are encoded in one byte (8 bits). The generated sequence X(n) is composed of N s samples. The "parameters.txt" file contains the number of bits N in which each sample of the generated sequences is encoded and the number of samples N s. In this thesis, we choose N equal to 32 bits. Figure 4.5 presents the general structure of a generated sequence. As mentioned in Figure 4.1, in order to generate the required random sequence of Ns samples, once we have the secret key K and the initial vector IV which is chosen randomly from the LRNG, first we calculate the initial samples Xs(0) and Xp(0) using the key-setup function. Second, we generate the samples Xs(n) and Xp(n) and we choose the output sample X(n). These operations (internal state and output function) are repeated N s times to generate all the desired samples of the sequence. All used functions have been implemented in series. The following Alg.3, illustrate the generation of the pseudo random sequence X(n).

Algorithm 3 Generation of the pseudo random sequence X(n).

Key setup function Xs = Xs

⊕ IVs Xp = Xp ⊕ IVp Xl = Xl ⊕ IVl samples generation A 11 = 2 32 -ε 12 -ε 13 A 22 = 2 32 -ε 21 -ε 23 A 33 = 2 32 -ε 31 -ε 32 for int k = 1,

Parallel implementation of the proposed PCNGs

With the progress in computer science field and high computational power available nowadays, parallel implementation has been very ubiquitous. Most laptops, desktops and servers use a multicore processor. The main purpose of parallel implementation is to perform computations faster than can be done with a single processor. In simple terms, parallel software processing provide the possibility to divide a massive computational operation into several separate processes that execute concurrently through different processors to solve a common operation [START_REF] Pacheco | An introduction to parallel programming[END_REF] [START_REF] Quinn | Parallel computing: theory and practice[END_REF].

Many parallel thread libraries for software applications have been implemented in the literature to provide threads -a unit of concurrent/parallel execution-which permit parallel execution according to the system [START_REF] Sakamoto | Design and implementation of a parallel pthread library (ppl) with parallelism and portability[END_REF] [START_REF] Rauchwerger | Standard templates adaptive parallel library (stapl)[END_REF][71] [START_REF] Barney | Posix threads programming[END_REF]. Each library provides a specific model of parallelism such as geometric modeling or graph algorithms which use dynamic linked data structures. The choice among them will be based on the model performance, data dependencies, statistical feedback, current run-time conditions and also its portability in many operating systems.

The library we choose to implement parallelism in the generation of the random sequence is POSIX threads, or, more often, Pthreads [START_REF] Buttlar | Pthreads programming: A POSIX standard for better multiprocessing[END_REF] which is a part of the IEEE standard for Unix-like operating systems, called POSIX [START_REF] Barney | Posix threads programming[END_REF]. Pthreads presents an application programming interface (API) for multithreaded programming. Pthreads is not a programming language (like Java and C), but it is defined as a C library that can be, in principle, linked with a C program.

For our parallel implementation of the proposed PCNG, only the Internal state and output functions are ensured with parallel programming. The used computer to implement our programs is composed of four cores. So, we create four threads in our application which will participate concurrently in the generation of the pseudo random sequence. Each thread T h i with i=1,2,3,4, is given a section of the sequence (or a specified number of samples) to be generated. Each thread works on the generation of its subsequence using a different secret key. In fact, as the system is deterministic, each thread needs to have a different secret key to not generate the same sequence. Also, chaotic systems are highly sensitive to initial conditions. For that, from the initial conditions Xs, Xp and Xl, we create four different sub-initial conditions using a circular shift function (rotation) as described in Alg.4.

Algorithm 4 Generation of initial conditions for each thread.

{left circular shift by 3 bits} {Xp[i], Xs[i] and Xl[i] are initial conditions for thread T h i }. uint32_t shift = 0

for int i = 1, i++, while i ≤ 4 do shif t = Xp[i -1] >> (32 -3) //shifted left by (32-3) bits Xp[i] = Xp[i -1] << 3 //shifted right by 3 bits Xp[i] = Xp[i] | shift shif t = Xs[i -1] >> (32 -3) Xs[i] = Xs[i -1] << 3 Xs[i] = Xs[i] | shift shif t = Xl[i -1] >> (32 -3) Xl[i] = Xl[i -1] << 3 Xl[i] = Xl[i] | shift end for
Each thread has a fixed number of samples to generate. Suppose that our sequence is composed of N s=10 samples. The number of samples generated by each thread is calculated as explained in Alg.5. Table 4.1 presents the number of samples generated by each thread when N s is equal to 10.

Thread min max Number of samples

T h 1 0 2 2 T h 2 2 4 2 T h 3 4 6 2 T h 4 6 10 4
As we already noted, all threads participate concurrently in the generation of the random sequence. Each one generates individually a fixed number of samples. Once generation of samples finishes including a waiting process, generated samples are saved in the sequence following a specific structure. The structure of the sequence with the different generated samples from threads, using a parallel programming, is described in Figure 4.6. Finally, the generated sequence is saved a result file to check the randomness of the sequence.

Software implementation testing

The software testing is an important and integral phase in any software development cycle, responsible for a significant portion of the costs of developing and maintaining software [START_REF] Beizer | Software testing techniques[END_REF] [START_REF] Leung | Insights into regression testing (software testing)[END_REF]. Software testing aims to evaluate the capability of the program and determine that it meets its required results. Software testing is not limited to treating the specification of the program. But it also include analysing and testing of the software implementation and code in various ways to determine the degree of correspondence between code and specifications [START_REF] Fairley | An experimental program-testing facility[END_REF] [START_REF] King | Symbolic execution and program testing[END_REF]. There are an abundance of code testing tools and techniques exist. These can be classified into following two categories: static analysis and dynamic testing, which are complementary approaches to code testing. In static analysis, the structure of the code is analyzed, but the code is not executed. Static analysis inspects program code for all possible run-time behaviours and seek out coding flaws, memory leaks, buffer overflows, and potentially malicious code. It can for example, detect that a particular variable is uninitialized on all possible control paths through a code or that a variable is assigned a value which is never used on any subsequent path through the program. On the other hand, dynamic testing adopts the opposite approach and investigates the runtime behaviour of the code. It involves deriving a test plan, executing test cases, and evaluating the results. Dynamic testing can for example, record the exact sequence of values assigned to a variable, although only on the particular control path traversed during the test.

We have performed different static and dynamic tools in order to verify and test our program code. Among the static analysis tools that we used, we quote:

-Clang Static Analyzer: It is a industrial-quality static analysis tool for analyzing C, C++, and Objective-C programs. Clang Static Analyzer is part of the Clang project. It is open-source, extensible, and has a high quality of implementation [START_REF][END_REF]. Clang Static Analyzer helps programmer to find bugs, including some issues that might not be easily detected by the programmer. The analyzer is invoked from the command line, and is intended to be run in tandem with a build of a code-base. -GCC compiler on Debugging mode: GCC, the GNU Compiler Collection, is a collection of compilers created by the GNU project [5]. GCC is free software that can compile various programming languages, including C, C++, Java, etc. GCC has a debugging tool, GNU Debugger (gdb) that allows to track the bugs / errors found in any program code [6]. Also, GCC has some options (such as -wall and -Wextra) which enables all the warnings about constructions that some users consider questionable, and that are easy to avoid (or modify to prevent the warning), even in conjunction with macros. The dynamic tests include: -LeakTracer: It is a tiny and efficient memory-leak tracer for C and C++ programs [START_REF]LeakTracer -trace and analyze memory leaks in C++ programs)[END_REF] It performs detailed simulation of the caches (I1, D1 and L2) in the CPU and so can accurately determine the sources of cache misses in the program code. It provides informations about the number of cache misses, memory references, instructions executed for each line of source code and extra information about callgraphs [START_REF] Weidendorfer | Cache performance analysis with callgrind and kcachegrind[END_REF]. -DRD: A Valgrind tool for detecting errors in multithreaded C and C++ programs [2]. It works for any programs that uses threading concepts built on the POSIX threading primitives. We have conducted these static and dynamic analysis tool in order to test our C program code. Obtained results show that our implementations have not memory leaks and anomalies or defects in the code.

Program code security test is another important factor to ensure the software quality and to eliminate every security gaps. In cryptographic applications, ensuring that sensitive data (e.g., cryptographic keys) is no longer accessible, if the application no longer has pointers to it, will reduce the impact of the attack. Therefore, it is often necessary to wipe sensitive data from memory once it is no longer needed. Zeroing buffers which contained sensitive information is an exploit mitigation technique. The memset() function , defined below, is an approach that permits to set a range of memory to a value, and is often used to zero out a series of bytes [8].

void *memset(void *str, int c, size_t n); Where:

str is a pointer to the block of memory to fill; -c is the value to be set. The value is passed as an int, but the function fills the block of memory using the unsigned char conversion of this value; -n is the number of bytes to be set to the value. Some optimizing compiler could employ "dead store removal"; that is, it could decide that str is never accessed after the call to memset(). Thus, the call to memset() could be optimized away. Consequently, the observable behaviour of the program is unchanged by the optimization. The str remains in memory and possibly to be discovered by some other process requesting memory. To work around this, we use the volatile function pointer memset_ptr, as described in Listening 4.1. The volatile type will prevent the compiler from optimizing the code; and so the compiler is forced to emit the function call which causes the key buffer to be zeroed. This approach should work on any standard-compliant platform. Another issue which needs to be taken into account in security code analysis is that confidential data in a process' address space might be saved on secondary storage and survive there beyond the expectations of the programmer. To solve this problem, the memory pages containing the sensitive data can be locked to prevent them from being paged to disk or transmitted over a network. One approach that we used in our implementations to prevent memory from being swapped out, is by using the mlock() system call to lock the physical pages associated with a virtual address range into memory [START_REF] Gutmann | Secure deletion of data from magnetic and solid-state memory[END_REF].

The two functions that locks and unlocks pages are described as follows: int mlock(const void *addr, size_t len); int munlock(const void *addr, size_t len); mlock() locks pages in the address range starting at addr and continuing for len bytes. All pages that contain a part of the specified address range are guaranteed to be resident in RAM when the call returns successfully; the pages are guaranteed to stay in RAM until later unlocked [START_REF]lock/unlock memory -Linux man page[END_REF]. munlock() unlocks pages in the address range starting at addr and continuing for len bytes. After this call, all pages that contain a part of the specified memory range can be moved to external swap space again by the kernel [START_REF]lock/unlock memory -Linux man page[END_REF].

In next sections, we demonstrate the robustness of the proposed chaotic number generators through, first a theoretical analysis in Section 4.2.3 and second several known statistical tests presented in Section 4.2.4.

Security Analysis of the proposed PCNGs Key space analysis

A PCNG should have a large key space in order to make brute-force attack infeasible. It is generally accepted that a key space of size equal or greater to 2 128 is secure. The size of the secret key of the proposed CM-PCNG, DM-PCNG and CS-PCNG are respectively given by: 159 and 2 147 different combinations of the secret key. Therefore the secret key sizes of the three architectures are large enough to make brute-force attack infeasible. Such a large space of keys is a necessary condition, but not sufficient. Indeed, the generated sequences must be cryptographically secure.

|K1| = (|Xp| + |Xs| + |Xl|) + (|P p| + |P s|) + 6 × |ε ij | = 189 bits. ( 4

Key Sensitivity analysis

The sensitivity on the key is an essential property for any PCNG. Naturally, a small change in the secret key causes a large change in the output sequences. In order to verify this characteristic, we calculate the Hamming Distance of two sequences generated with only one bit change (least significant bit of the parameter P p). We calculate the average Hamming Distance D H between two sequences S 1 and S 2 , over 100 random secret keys. The D H (S 1 , S 2 ) is defined by the following equation:

D H (S 1 , S 2 ) = 1 N b × N b n=1 (S 1 [n] ⊕ S 2 [n]) (4.16)
With N b is the number of bits in a sequence. The obtained average value of Hamming distance for the proposed CM-PCNG, DM-PCNG and CS-PCNG are presented in Table 4.2. These values are close to the optimal value of 50%. This result illustrates the heigh sensitivity on the secret key of the proposed PCNGs. The mapping or the phase space trajectory is one of the characteristics of the generated sequence that reflects the dynamic behaviour of the system. We draw in Figures 4.7a The resulting mapping of X1, X2 and X3 seems to be random. This is due to the used techniques of coupling, swapping and chaotic multiplexing. Therefore, it is impossible from the generated sequences to know which type of map is used. However, in the mapping of X2, we observe small empty areas. Then, we can say that the generated sequences of the CM-PCNG and CS-PCNG are more uniform than those generated by the DM-PCNG. This observation will be confirmed by the Chi-square test of the generated sequence. Also, we notice that the mapping of the coupled sequences Xp, Xs and Xl seems to be random. We draw in Figures 4.8a

Approximated Invariant values

To prove the uniformity of the generated sequences, Lozi [START_REF] Lozi | Emergence of randomness from chaos[END_REF] uses the "approximated invariant measures". This function was computed with floating numbers and based on the partition of the mapping space to M 2 small squares (boxes). In finite precision N, we defined the approximated invariant measures P d N (si, tj) in the same manner as in [START_REF] Lozi | Emergence of randomness from chaos[END_REF]. First, the space mapping is divided into M 2 boxes r i,j as follows:

s i = X min + i × l, i = 0, ..., M.
(4.17)

t j = X min + j × l, j = 0, ..., M. (4.18) where l = X max -X min M . (4.19)
with X min = min(Xi(N s)) , X max = max(Xi(N s)) and N s is the number of samples under test. The box r i,j is given by : Theoretically, the number of samples inside each box r i,j is N s/M 2 312. Furthermore, the closer the P d N (si, tj) value is to 1, the better the uniformity.

r i,j = [s i , s i+1 [×[t j , t
As we can see, compared to results in Tables 4.4 and 4.5, results of 4.6, are closer to 1. Indeed, the uniformity is better when the number of samples N s is larger. The same remark is observed for results of CS-PCNG (see Tables 4.5 and4.8). However, these results are not valid for DM-PCNG when comparing Tables 4.4 and 4.7. This is due to the fact that the samples are distributed on a periodic orbit with a small period length. We give also the cumulative relative error calculated by: We observe that, whatever the values of N s and M , the Cumulative Relative Error CRE of sequences generated by CM-PCNG is smaller than the CRE of sequences generated by DM-PCNG. Also, we notice that, for each M, the CRE of CM-PCNG decreases with a factor approximately equal to √ N s, when N s increases. However, sequences generated by DM-PCNG do not follow the previous rule.

CRE = M i,j=1 | N s/M 2 -#r i,j N s/M 2 |. ( 4

Histogram and Chi-square analysis

We study the distribution uniformity of the generated sequences. A PCNG must provide a uniform distribution in the whole phase space. We give in Visually, we observe that the generated sequences X1, X2 and X3 are nearly uniformly distributed. We then apply the Chi-square test to assert the uniformity of these sequences. The experimental Chi-square χ 2 value is given by:

χ 2 exp = K-1 i=0 (O i -E i ) 2 E i . (4. 23
)
where K is the number of classes (sub-intervals) chosen in our experiment equal to 1000, O i is the number of observed (calculated) samples in the i-th class and E i is the expected number of samples of a uniform distribution, E i = 10 7 /K.

We compare the experimental value given by Eq.4.23 with a theoretical value obtained for a threshold α=0.05 and a degree of freedom K-1=999. Smaller is the experimental value of Chi-square test compared to the theoretical one, better is the uniformity of the generated sequence. Experimental and theoretical values of the Chi-Square test for sequences X1, X2 and X3 are presented in Table 4.10. These results confirm the uniformity of the generated sequences. We note that sequence X1 has a better uniform distribution than other sequences and sequence X3 is more uniform than sequence X2.

Correlation analysis

To evaluate the security of the proposed PCNGs regarding to the correlation analysis, we calculate the correlation coefficient between two sequences X and Y which are produced with nearby initial conditions and also the correlation coefficient between a generated sequence X and the coupled sequences Xp, Xs and Xl for the proposed PCNGs. The obtained results are given in Table 4.11.

We give in Figure 4.11, the auto-correlation function of sequence X, a zoom of the autocorrelation on 200 samples of sequence X and of the cross-correlation of the sequences X and Y generated by CM-PCNG, and a zoom of the cross-correlation of sequences X and Y and of the auto-correlation of sequence X. We note the cross-correlation function of sequences X and Y given by Figure 4.11c is very low (maximum value = 0.025) compared to the auto-correlation function of sequence X. Correlation coefficients given in Table 4.11 are close to zero. Consequently, there is no correlation between the generated sequences, that are produced using slightly different keys. Similar observations are concluded for both proposed DM-PCNG and CS-PCNG. (See Figures 4. [START_REF]The tent map -wikipedia[END_REF]

NIST test analysis

We also use one of the most popular standard test for investigating the randomness of binary data, namely the NIST statistical test [START_REF] Elaine | Recommendation for random number generation using deterministic random bit generators[END_REF][START_REF] Rukhin | A statistical test suite for random and pseudorandom number generators for cryptographic applications[END_REF]. It focus on variety of different types of non-randomness that could exist in a binary sequence. For each test, a P -value is calculated. The associated test is a success, if P -value ≥ α (α is a fixed value set for all tests equal to 0.01). Figure 4.14 and Table 4.12 give the results of NIST test obtained for sequences X1, X2 and X3 generated by the proposed CM-PCNG, DM-PCNG and CS-PCNG respectively.

We observe that, sequences X1, X2 and X3 have successfully passed all the NIST tests. Therefore, the proposed chaotic generators are robust against statistical attacks. In addition, we observe that globally, the sequence X1 generated by the CM-PCNG algorithm pass NIST tests more efficiently than sequences X2 and X3 generated by DM-PCNG and CS-PCNG. This is in accordance with results obtained by the others statistical tests.

Speed performance of the proposed PCNGs

Speed performance of a PCNG is an important factor for practical applications, such in encryption algorithms for example. We study the computing performance of the proposed PCNGs. In Tables 4.13, 4.14 and 4.15 we give, the average generation time in microsecond (µs), the average bit rate in Megabits/second (Mbits/s) and the average required number of cycles to generate one byte for different lengths of sequences, From results of Tables 4.13, 4.14 and 4.15, we remark first that, due to its less complex internal state, the speed performance of CS-PCNG is better than one of CM-PCNG and DM-PCNG. Also, DM-PCNG is faster than CM-PCNG. Second, we observe that, for small size data (up to 32768 bytes) the PCNG implemented with sequential programming is faster than that programmed in parallel (see also Figures 4.15,4.16 and 4.17). This is due to the time synchronization between the four threads.

Notice that, in addition of stream ciphers, the proposed PCNGs can be used in several applications that require the generation of a large amount of secure random numbers. In Table 4.16, we give the performance in terms of N CpB of some known pseudo random number generators: Wang et al., [START_REF] Wang | A pseudorandom number generator based on piecewise logistic map[END_REF], Akhshani et al., [START_REF] Akhshani | Pseudo random number generator based on quantum chaotic map[END_REF] and our proposed PCNGs. The comparison is performed for a data size equal to 786432 bytes. It can be observed that the N CpB performance of the proposed PCNGs is better than the others cited.

In the following section, we will study the security analysis and the speed performance of the three proposed stream ciphers CM-SC, DM-SC and CS-SC which use as a pseudo number generator CM-PCNG, DM-PCNG and CS-PCNG respectively.

Proposed chaos-based stream ciphers

A stream cipher, as shown in Figure 4.18, is a symmetric encryption algorithm. It takes a stream of plaintext P i , a secret key K and an initial vector IV as input and then operates the P i with a keystream which is produced by a PCNG using the secret key K and IV to obtain a ciphered text C i . The keystream must be different for each encryption round. As the PCNG is deterministic, the same keystream can be generated in the decryption. Then, one can recover the original plaintext P i , by XORing the same keystream with the cipher text C i . The keystream must be random enough to ensure that if an attacker has access to the keystream, he cannot recover the secret key or derive the internal state. Thus, the security of any stream cipher depends on the randomness of the keystream, therefore on the robustness of the used PCNG which is the main element of a stream cipher. Note that the same secret key and IV must be shared by the emitter and the receiver in order to encrypt/decrypt the message sent through the communication channel and must be protected from access by others. Several techniques have been proposed for the distribution of keys and IV. Concerning our algorithms, a symmetric key distribution is used in the generation and management of the secret keys and IV, in order to provide confidentiality and integrity of the keys. This technique is based on the use of a master key, which is infrequently used and is long lasting, and session keys which are generated and distributed for each communication between emitter and receiver [START_REF] Stallings | Cryptography and Network Security: Principles and Practice, International Edition: Principles and Practice[END_REF].

A good stream cipher algorithm should be robust against cryptanalytic, statistical and brute-force attacks. Also, it should provide a high encryption speed. In this section, we discuss the security analysis of the proposed stream cipher algorithms namely CM-SC, DM-SC and CS-SC, based on the proposed CM-PCNG, DM-PCNG and CS-PCNG respectively, described in Section 4.2 and their speed performance. Key space, Key sensitivity and Statistical analysis are carried out in order to prove that the proposed stream ciphers are secure against the most common attacks.

As most encryption algorithms (AES-CTR, Rabbit, HC-128...) encrypt 128 bits by 128 bits, our stream when generating 128 bits of keystream in sequential programming. For this, we use sequential programming in the implementation of the three proposed stream ciphers.

To evaluate the performance of the proposed stream ciphers, a number of experiments were performed based on several color images, which were used as plain images having the sizes (128 × 128 × 3), (256 × 256 × 3), (512 × 512 × 3) and (1024 × 1024 × 3).

Security analysis of the proposed stream ciphers

In the following part, some classical cryptanalytic analysis is performed.

Key space analysis

For any secure crypto-system, the key space should be large enough to resist a brute-force attack. The spaces of the secret keys for the proposed stream ciphers are related to the key sizes of the used PCNGs, given by Eqs.4.13, 4.14 and 4.15 respectively. Consequently, the key spaces of the secret keys are equal to 2 189 , 2 159 and 2 147 for the proposed stream ciphers CM-SC, DM-SC and CS-SC respectively. Therefore, they are large enough to resist any brute-force attacks.

Key sensitivity analysis

An efficient stream cipher should be very sensitive to the secret key. The change of a single bit in the secret key should produce a completely different encrypted image. Indeed, to verify this feature, we calculate the average Hamming Distance D H (X, Y ) (using 100 secret keys), between two ciphered images C 1 and C 2 , of the same plain image P , with only one change in the least significant bit of the parameter P p. D H (C 1 , C 2 ) is given by the following equation :

D H (C 1 , C 2 ) = 1 N b × N b n=1 (C 1 [n] ⊕ C 2 [n]) (4.26)
With N b is the number of bits in an encrypted image. The obtained results of the Hamming distance for three different ciphered images by the three algorithms are close to the optimal value of 50% (see Table 4.17). Such results are obtained regardless of the position of the changed bit in the secret key. This demonstrates that the proposed algorithms are highly sensitive to the secret key. Other common measures used to test sensitivity to the secret key on the encrypted image when changing one bit are the Number of Pixel Change Rate (NPCR) and Unified Average Changing Intensity (UACI). The former is used to measure the number of different pixels between the two images, whereas the latter is used to measure the average intensity difference. Let C 1 [i, j, p] and C 2 [i, j, p] be the (i,j,p)th pixel of two ciphered images C 1 and C 2 , respectively. The NPCR and UACI are defined by Eqs.(4.27) and (4.29), respectively.

N P CR = 1 L × C × P × P p=1 L i=1 C j=1 D[i, j, p] × 100% (4.27) D[i, j, p] = 0, if C 1 [i, j, p] = C 2 [i, j, p] 1, if C 1 [i, j, p] = C 2 [i, j, p] (4.28)
U ACI = 1 L × C × P × 255 × P p=1 L i=1 C j=1 |C 1 -C 2 | × 100% (4.29)
Table 4.17 also shows the obtained results of NPCR and UACI for the previous three ciphered images.

The resulting values are near to the expected values of NPCR and UACI which are 99.60% and 33.46%, respectively [281] [158]. So, as we can see, the proposed algorithms are very sensitive with respect to small changes in the secret Key.

Chosen plaintext attack analysis

The proposed stream ciphers resist to the chosen plain text attack. Assume one knows a plaintext P i and the corresponding ciphertext C i . For each new encryption of the same P i and using the same secret K, we utilize a new IV. Therefore, as the algorithms have a high sensitivity to small changes in the secret key or the IV, a new ciphertext C i is obtained.

Statistical analysis of the proposed stream ciphers

To prove the robustness of the proposed stream ciphers against statistical attacks, we perform the following experiments: histogram, chi-square test and correlation analysis.

Histogram analysis

A key property of a secure stream cipher algorithm is that the encrypted image should have a uniform distribution. We applied the proposed CM-SC stream cipher on three different plain images (Lena, Baboon and Peppers) of size (512 × 512 × 3). The obtained results are given in Figures.4. We can visually observe that the histograms of the encrypted images are uniform and significantly different from those of the plain-images. The same visual results are obtained for the two proposed algorithms DM-SC and CS-SC.

Chi-square test analysis

In order to assert the uniformity of the encrypted images, we apply the Chi-Square test. The experimental Chi-Square test χ 2 is calculated by the following formula:

χ 2 exp = K-1 i=0 (O i -E i ) 2 E i . (4.30)
Where K is the number of levels (here 256), O i are the observed occurrence frequencies of each color level (0-255) in the histogram of the ciphered image, and E i is the expected occurrence frequency of the uniform distribution, given here by E i = (L × C × P )/256 [START_REF] Assad | A new chaos-based image encryption system[END_REF] [START_REF] Farajallah | Fast and secure chaos-based cryptosystem for images[END_REF].

We compare the experimental value with the theoretical value obtained for a threshold α=0.05 and a degree of freedom K -1 = 255. To prove the uniformity of a sequence, the experimental value of Chi-Square must be lower than the theoretical one χ 2 exp < χ 2 th (255, 0.05). The smaller the experimental value of Chi-Square is than the theoretical one, the better the uniformity of the histogram.

In Table 4.18, we reported the experimental and theoretical values of the Chi-Square test for the three ciphered images (Baboon, Peppers, and Lena) obtained by the proposed algorithms. We note that for the three images, χ 2 exp < χ 2 th (255, 0.05). In addition, images encrypted by the CM-SC algorithm have a better uniform distribution than those encrypted by the DM-SC and CS-SC algorithms. Also, the distribution of images encrypted by the CS-SC is more uniform than those of DM-SC algorithm.

Correlation analysis

The adjacent pixels in a plain image normally have strong correlation. Also, the pixels in an encrypted image, with a high security level, is expected to be randomly distributed. Therefore, a good encryption scheme should have the ability to efficiently reduce the correlation among adjacent pixels. We measured the correlation coefficient between adjacent pixels, selected randomly from three directions: horizontally, vertically and diagonally. The correlation coefficient ρ xy of adjacent pixels is calculated by the following equation:

ρ xy = M i=1 (x i -1 M M j=1 x j )(y i -1 M M j=1 y j ) [ M i=1 (x i -1 M M j=1 x j ) 2 ] 1/2 × [ M i=1 (y i -1 M M j=1 y j ) 2 ] 1/2 . ( 4.31)
where x i and y i form i th pair of horizontally/vertically/diagonally adjacent pixels, M is the total number of pairs of horizontally/ vertically/diagonally adjacent pixels.

In Table 4.19, we give the obtained correlation coefficients in horizontal, vertical and diagonal directions of 1000 pairs of adjacent pixels of the plain images mentioned above and their corresponding ciphered images.

These results show that the correlation coefficients of the plain images are close to 1 while those of encrypted images are near to 0. Then, the proposed encryption schemes generate an image with uncorrelated adjacent pixels. This indicates that the proposed algorithms are secure against statistical attacks.

In addition, such results are confirmed in Figure 4.22, which shows the correlation of two horizontally, vertically and diagonally adjacent pixels in the plain and ciphered Baboon image (512 × 512 × 3) using the CM-SC stream cipher. Similar results are obtained when using the DM-SC and CS-SC algorithms.

NIST test analysis

To evaluate the performance of the proposed algorithms, we use the NIST test. For that, we encrypted 100 different binary sequences of plain text, P 1 , P 2 and P 3 ; using the proposed stream ciphers CM-SC, DM-SC and CS-SC, respectively, each one with a different secret key and containing 10 6 bits. We present the results of NIST for the encrypted sequences C 1 , C 2 and C 3 in Table 4.20, with a level of significance of the test α = 0.01. Results show that sequences C 1 , C 2 and C 3 have successfully passed all NIST tests. Therefore, the proposed stream ciphers can resist statistical attacks.

Computing performance of the proposed stream ciphers

We have performed the computing performance of the proposed stream ciphers. In this implementation, we do not parallelize processes and operations. We evaluated the computing performance as follows: for 100 different keys, we executed our algorithm and then, we calculated the average encryption time in (Micro second), the average encryption throughput (ET) in (MByte) and the number of cycles per byte (NCpB).

ET =

Image size(M Byte) Encryption time(s) (4.32)

N CpB = CP U speed(Hz) ET (Byte/s) (4.33)
The obtained results of computing performance for the proposed stream ciphers CM-SC, DM-SC and CS-SC are given in Tables 4.21, 4.22 and 4.23, respectively. We remark that globally, the speed performance of the stream ciphers is approximately 17 % less than that of the corresponding PCNGs. In Table 4.24, we We observe that the proposed algorithms have a better speed performance than the cited chaos-based algorithms except that of [START_REF] Vidal | A fast and light stream cipher for smartphones[END_REF]. However, in [START_REF] Vidal | A fast and light stream cipher for smartphones[END_REF], the authors do not explain the measurement method used to obtain such excellent results, given that the complexity of their system is similar to ours. Compared to the AES-CTR, Rabbit, HC-128, Salsa20/12 and SOSEMANUK, the obtained performance is not as good. However, the non linearity of the proposed systems is higher than the other systems, consequently, its robustness against known attacks is higher.

Conclusion

In this chapter, we designed and developed three novel chaos-based stream ciphers, defined on finite precision N=32, for secure data transmission in real-time applications. The high efficiency obtained from these crypto-systems is due to the designed PCNGs structure. Indeed, their architectures integrate chaotic maps weakly coupled using a predefined matrix or coupled by a binary diffusion matrix. The CM-PCNG and DM-PCNG uses a chaotic multiplexing technique while the CS-PCNG includes a swap technique. The used techniques permit to decrease the degradation caused by the descretizing process and the finite precision N. For that, we do not include in the proposed architectures the perturbation technique and the recursive structure proposed in Chapter 3. Simulation tests, security analyses and computing performance were carried out to prove the efficiency in terms of robustness and speed performance of the proposed PCNGs and stream ciphers. The obtained results show that the proposed stream ciphers are robust against known attacks of the literature and can be used in practical applications including secure network communication.

Energy and Power consumption evaluation and

Real-Time Implementation of the proposed stream ciphers

Introduction

The concept of Internet of Things (IoT) is becoming an increasingly growing topic, due to huge advancements in wireless networking technology and standardization of communication protocols [START_REF] Feki | The internet of things: the next technological revolution[END_REF] [START_REF] Ericsson | More than 50 billion connected devices[END_REF]. The core idea of this concept lies in the presence of everyday physical objects known as things which are connected to the internet. Interconnection between things is made possible by technologies such as Radio Frequency IDentification (RFID), Wireless Sensor Networking (WSN), cloud servicing, machine-tomachine interfacing (M2M), etc.

Secure data transmission in the IoT is a very significant issue because confidential and proprietary information have to be transmitted, especially in healthcare applications. Unfortunately, existing cryptographic techniques developed for enterprise and desktop computing might not satisfy embedded applications with strong real-time requirements as they can be too slow, huge and very power consuming [START_REF] Koopman | Embedded system security[END_REF].

Smart devices of the IoT, including sensors, are inherently resource constrained with regard to memory, communication bandwidth, processing power and energy [START_REF] Good | A low-frequency rfid to challenge security and privacy concerns[END_REF]. The most widespread energy sources are typically batteries, renewable energy sources of the environment, or both. Most of wireless devices should be autonomous i.e. operate for several years even for decades without any human intervention. Energy consumption is consequently a central performance factor since it directly impacts lifetime of the device. Hence, a challenging topic concerns the design of efficient and lightweight (from the point of view of energy and processing time consumption) cryptographic techniques to guarantee secure data transmission in the IoT. Such techniques should fit the low energy, computation and memory capabilities of cyber-physical systems and provide an optimized security/cost/performance trade-off [START_REF] Eisenbarth | A survey of lightweight-cryptography implementations[END_REF]. This is why the new field of Light Weight Cryptography (LWC) is emerging.

The four main characteristics that differentiate one crypto-system from another are: ability to secure the protected data, speed i.e. computational complexity, energy consumption and memory required in doing so. The first objective of this chapter is to study the performance of two chaotic stream ciphers that we recently designed in terms of energy and power consumption and memory assessment, since we have presented their security and speed performance in the previous chapter. We will show that the proposed stream ciphers are lightweight crypto-systems. Compared to other crypto-systems of the literature, we demonstrate that our designed stream ciphers are suitable for practical secure applications of the IoT with constrained resources environment. In section 5.2, we present some energy and power measurements tools proposed in the literature. And we give energy and power consumption measurements for our proposed algorithm. Section 5.3 deals with the requirements of the designed stream ciphers in terms of RAM and code size requirements.

The second part of this chapter concerns the actual integration of the proposed crypto-systems with real-time features. Indeed, the development of real-time embedded systems is continuously growing. In some real-time applications such as automotive, robotic, tele-medicine and avionics, real time performance becomes critical because each component of the system must work in cooporation and coordination. "The correctness of a real-time system depends not only on the correctness of the logical result of the computation but also on the physical time when this result is produced" [START_REF] Stankovic | Real-time computing system: The next generation[END_REF] The role of an operating system in communication devices is important. Besides scheduling the real-time tasks for access to the processor, it realizes synchronization between tasks and in particular it controls access to multiple resource through specific resource management protocols.

In order to study the effective behaviour of our crypto-systems as part of a real-time application, we implemented the proposed stream ciphers using a famous RTOS (Real Time Operating System) named Xenomai . In section 5.4, we give a brief introduction to the field of real-time computing, especially to the topics which are relevant in the context of this thesis. We also define a number of basic terms including embedded systems, real-time systems, real-time operating system, etc. In addition, we report in subsection 5.4.5 the model used to implement the real-time crypto-systems using Xenomai which presents a software framework able to give real time capabilities to the operating system. Tools for execution time measure-ments and resulting results about computation performance are given in 5.4.6. Section 5.5 concludes the chapter.

Energy and Power consumption evaluation

Energy and power consumption are currently a major concern in the design and usage of high performance crypto-systems. Many researchers in the energy field are contributing to elaborate multiple tools and libraries to measure energy and power consumption of software components. In spite of their efforts, there is no current standard for energy and power measurements. Traditionally, the energy consumption of an application is measured using power meters and performance counters. In the last years, different tools have been proposed to provide access to power and energy measurements. Each tool offers its own level of precision and intrusion. The choice of a concrete tool is often a matter of availability, compatibility and precision. In the next subsection 5.2.1, we present different existing tools that have been proposed in the literature. In particular, we have selected several ones to measure the energy and power consumption of our proposed algorithms, namely the 'the Intel's RAPL technology' and 'powertop' tool. Results on our measurements are reported in subsections 5.2.2 and 5.2.3 respectively.

Energy and power measurement tools

Several software tools are being used to measure energy consumption. We classify the set of existing tools in different groups according to their interaction with hardware and software:

External devices

There are many energy measurement systems that have been used to measure energy consumption and energy efficiency outside the experimental nodes. These measurements can be done without interfering the experiment. Nonetheless, they could be unsuitable for experiments that require high precision measures. These measurement systems include:

-The power distribution units (PDUs) are devices that are used to supply energy to data center servers and at the same time have energy monitoring capabilities. They are used to facilitate, control, and optimize energy generation and transmission. PDUs are usually composed of a number of outlets where devices are connected [START_REF] Manansala | Design and implementation of a web-based smart power distribution unit[END_REF]. -The PowerMon2 presents a low-cost power monitoring device that operates inside commodity computer systems. It is used to analyse performance and power consumption trade-offs in computer applications. PowerMon2 measures voltage and current on the individual DC power rails between a system's power supply and the motherboard and peripherals [START_REF] Bedard | Powermon: Fine-grained and integrated power monitoring for commodity computer systems[END_REF]. -PowerPack presents a power/energy/performance profiling infrastructure [START_REF] Ge | Powerpack: Energy profiling and analysis of high-performance systems and applications[END_REF]. It is a combination of hardware (e.g., sensors and digital meters) and software (e.g., drivers, instrumentation APIs, benchmarks, and analysis tools) and used to evaluate energy efficiency and power-aware techniques for parallel applications. -PowerScope [START_REF] Flinn | Powerscope: A tool for profiling the energy usage of mobile applications[END_REF] is a tool for profiling energy usage by applications. It uses a digital multimeter to perform off-line analysis using statistical sampling. It provides a kernel-level interface (via system calls) to start and stop measurements; this requires modifying the operating system. PowerScope maps energy consumption to program structure, in much the same way that CPU profilers map processor cycles to specific processes and procedures. -The energy endoscope [START_REF] Stathopoulos | The energy endoscope: Real-time detailed energy accounting for wireless sensor nodes[END_REF] is an new embedded networked sensor platform architecture that combines hardware and software tools. It offers detailed, fine-grained real-time energy measurements.

126CHAPTER 5. ENERGY AND POWER CONSUMPTION EVALUATION AND REAL-TIME IMPLEMENTAT

Intra node tools

The intra-node group includes highly customized tools which have a restricted hardware platform and a costly development:

-The Linux Energy Attribution and Accounting Platform (LEA 2 P ) [START_REF] Ryffel | Lea2p-the linux energy attribution and accounting platform[END_REF] [START_REF] Ryffel | Accurate energy attribution and accounting for multi-core systems[END_REF] presents an energy attribution and accounting architecture for multi-core systems that can provide accurate, per-process energy information of individual hardware components. (LEA 2 P ) consists on a hardware-assisted direct energy measurement system that integrates seamlessly with the host platform and provides detailed energy information of multiple hardware elements at millisecond-scale time resolution. These informations are passed into the Linux kernel and made available via the /proc file system and can be read in-band. -The Seoul National University Energy Scanner (SES) [START_REF] Shin | Energy-monitoring tool for low-power embedded programs[END_REF] is an integrated energy monitoring tool, consists in a power instrumentation board that connects via PCI(E) bus, supporting various power measurement tools although it was not a generic API. SES collects power consumption information in a cycle-by-cycle resolution and associates the collected power data with C program and assembly language source code. -Bellosa [START_REF] Bellosa | The benefits of event: driven energy accounting in power-sensitive systems[END_REF] presents Joule Watcher, an approach based on information about active hardware units (e.g., integer/floating-point unit, cache/memory interface) gathered by event counters to establish a thread-specific energy measurement.

Other libraries

Other energy measurement tools have been proposed which are focused on a general API to access the information provided by the hardware counter but are restricted by the platform:

-The performance API (PAPI) [START_REF] Browne | A portable programming interface for performance evaluation on modern processors[END_REF] is a standard application programming interface (API) for accessing hardware performance counters available on most modern CPUs. It provides the ability to measure system's energy and power consumption. This is offered by using the RAPL interface (which will be later described) [START_REF] Weaver | Measuring energy and power with papi[END_REF]. -LIKWID ("Like I Knew What I am Doing") [START_REF] Treibig | Likwid: A lightweight performance-oriented tool suite for x86 multicore environments[END_REF] is a performance-oriented library that is targeted towards applications in a Linux environment and does not require any kernel patching. It has the ability to measure energy consumption by measuring performance counter metrics over the complete run time of an application or, with support from a simple API, between arbitrary points in the code. LIKWID is suitable for Intel and AMD processor architectures. It only supports x86-based processors. -The Intel ® Energy Checker Software Developer Kit (Intel ® EC SDK) provides tools to help developers design energy-efficient applications. It has a small set of simple APIs for software instrumentation to measure the energy consumption. It is restricted to Intel architectures [START_REF] Tayeb | Intel energy checker software development kit user guide[END_REF]. -The NVIDIA Management Library (NVML) is a C-based API for monitoring and managing various states of the NVIDIA GPU devices. It provides the power usage and the power limits of the supported products [START_REF] Developer | Nvidia management library (nvml)[END_REF]. -The PowerAPI is a software library to monitor the energy consumed at the process-Level. It provides an application programming interface (API) that estimates, in real-time, the energy consumed at the granularity of a system process, from formulas based on CPU, memory and disk usage metrics. PowerAPI supports only a single Power-Spy2 PDU [START_REF] Bourdon | Powerapi: A software library to monitor the energy consumed at the process-level[END_REF]. -The Energy Measurement Library (EML) [START_REF] Cabrera | Energy measurement library (eml) usage and overhead analysis[END_REF] is a software library created to facilitate the experimentation of energy consumption in distributed systems. It is based on using an API that offers multiple options to users in order to speed up the measurement and experimentation process. It provides energy information by accessing energy counter measurements through PAPI. We also report a power estimation through the PowerTop Linux tool provided by Intel, which permits to diagnose issues with power consumption and power management. This tool helps the user to point out the power inefficiencies of a program. It shows how well the different hardware power-saving features are used. It reports the software components that prevent optimal usage [15] [136]. It also returns a power estimation for each device.

To use PowerTOP, one must meet the following requirements:

• an Intel processor,

• a Linux kernel 2.6.21 or better,

• PowerTOP is mainly useful for a laptop since it can only study battery consumption. For best results, when using PowerTOP on a laptop, do so when running on battery. Power consumption measurements are given in table 5.3. Results shown in Tables 5.2 and 5.3 indicate that CS-SC algorithm has less energy and power consumption compared to CM-SC and HC-128 algorithms. Indeed, CS-SC consumes about 30% of energy consumed by the CM-SC algorithm, and 60% of that of the HC-128 algorithm. However, CS-SC consumes about two times more energy than Rabbit.

Memory assessment

Whatever the complexity of the cryptographic primitives in terms of computational overhead and memory usage, the hardware resources available must be performant enough to minimize the execution time of the secured applications. However, embedded devices often have inherent limitations in terms of memory space. Hence, it would be necessary to analyse how these primitives perform over highly-constrained devices. We calculate the requirements of the designed stream ciphers in terms of RAM consumption and code size. We use the FELICS framework which is an open source benchmarking framework [START_REF] Dinu | Felics-fair evaluation of lightweight cryptographic systems[END_REF]. We describe FELICS framework in section 5.3.1 and the main modifications to operate on the code so as to use FELICS. Also, we give the code size and RAM consumption values for our algorithms.

FELICS framework

FELICS (Fair Evaluation of Lightweight Cryptographic Systems) is a free, open source and flexible framework, which determine the performance of C and assembly software implementations of lightweight primitives on resource constrained devices commonly used in the IoT [START_REF] University | Cryptolux > felics[END_REF].

To the best of our knowledge, FELICS is the only open source and free framework that provide fair and consistent performance evaluation of software implementations of lightweight ciphers on different IoT embedded devices in the same usage conditions. FELICS is designed to work on Linux operating systems. It is able to benchmark C and assembly implementations of lightweight block and stream ciphers on three different devices: 8-bit AVR, 16-bit MSP and 32-bit ARM. The three extracted metrics are: code size, RAM consumption and execution time.

-The code size is measured in bytes. It corresponds to the amount of data that is stored in the Flash memory of the target device. To calculate the code size for each target device, FELICS uses the GNU size tool that lists the section sizes and the total size in bytes for a given binary file.

The code size extraction process is completely automated and can be done using the cipher code size.sh script for a given cipher implementation and a given evaluation scenario. -The RAM consumption is split into data consumption and stack consumption. The data requirement represents the static RAM and it is given in bytes by the size of the constants stored in target device RAM. It includes data which is specific to each scenario such as data to encrypt, master key, round keys or initialization vectors. The stack consumption permits to assess, in bytes, the RAM used to store local variables. The cipher ram.sh script is able to extract the RAM requirement for a given cipher in a given usage scenario. -The execution time is expressed in number of CPU clock cycles required to execute a set of operations. It is computed from the system timer at the finishing point of the operations minus the system timer at the starting point of the operations. The cipher execution time.sh script extracts the execution time for a given cipher implementation and scenario. FELICS framework source code, with implemented ciphers source code and performance figures are available on the web site [START_REF] University | Cryptolux > felics[END_REF]. Information on how to use the FELICS framework is also available.

In this research work, we use the FELICS virtual machine that we downloaded from its web site. We had to adapt our C implementation to the framework requirements to be able to evaluate the new stream ciphers.

A template cipher implementation is provided to integrate a new algorithm implementation into FELICS framework. The process of integration consists on filling the functions from the template cipher with the source code of the cipher according with the requirements described in the README file.

The main modifications required to integrate the new stream cipher algorithms are the followings:

• The cipher state size, key size and initialization vector size have to be defined in "constants.h" file.

• The constants used by the stream cipher must be declared in "constants.h" file and defined in "constants.c" or any other "*.c" file, except the predefined "*.c" files. • Declaration and definition of the cipher test vectors in "test_vectors.c".

• Implementation of the setup function in "setup.c" using the following function signature:

void Setup(uint8_t *state, uint8_t *key, uint8_t *iv); Note: After running the setup, the key "key" and IV "iv" should not be modified.

In our algorithmic structure, the setup function presents the two functions key-setup and IV-setup. • Implementation of the encryption function in "encrypt.c" using the following function signature: void Encrypt(uint8_t *state, uint8_t *stream, uint16_t length); • Add a description of the cipher implementation in "implementation.info" file, in the "Implementa-tionDescription" section. If there are other functions used in the cipher implementation and defined in "*.c" files, add the "*.c" name in "implementation.info" file, in the corresponding section(s) ("Se-tupCode", "EncryptCode"). FELICS parses the implementation.info file to be able to count the common source code and constants only once in the extracted metrics. The implementation of each of the required functions can be split into several files provided that the implementation information is correctly given in the implementation.info file.

Two evaluation scenarios are implemented for the stream cipher module:

• The first scenario (Scenario 0) is evaluated using the provided test vectors.

• The second scenario (Scenario 1) consists in encryption of 128 bytes of data. It covers the need for secure communication sensor networks and between IoT devices. Results are given using the second scenario (Scenario 1). To evaluate and test the cipher implementation, we do not need to compile the provided "makefile" that can build the cipher in different scenarios and test cases, either in debug or in release mode. If the cipher builds without errors or warnings and the two tests (test-cipher, test-scenario1) run as expected, the cipher implementation is correctly integrated into the FELICS framework.

In order to analyse and post process the results for the different metrics (Code Size, the RAM consumption and the execution time), the framework can export the extracted results for each scenario and target architecture in various formats, including: raw data table, CSV file, XML, MediaWiki table and LaTeX table.

Code size and RAM consumption results

The code size measures the amount of data that is stored in the Flash memory of the target device. The RAM consumption includes the stack requirements and data requirement. The former presents the maximum value of RAM used to store local variables. The later forms the static RAM, given by the size of the constants stored in target device RAM (such as data to encrypt, key, initial vectors...). Table 5.4 clarifies the code size and RAM consumption measurements of the four tested algorithms using FELICS framework. The code size and RAM consumption values, for Rabbit and HC-128 stream ciphers, are given by [START_REF] Manifavas | Lightweight cryptography for embedded systems-a comparative analysis[END_REF]. These experimental results show that RAM and ROM required by the two designed stream ciphers CM-SC and CS-SC, are less than 8 KB and 32 KB respectively. Theses values are consequently very low and compatible with limitations of most of small devices. In conclusion, we may state that stream ciphers CM-SC and CS-SC are suitable for memory-constrained devices as those encountered in the IoT.

Integration of a real-time crypto-system

Definitions

This section recalls concepts and terminology relating to real-time computing such as embedded system, real-time system and real-time operating system.

Embedded system

An embedded system can be defined as a combination of computer hardware and software, with either fixed or programmable capabilities. It is particularly dedicated towards a specific kind of application device in which the resources are constrained. Embedded systems are commonly deployed in microprocessor or microcontroller that impose severe space, weight, and power constraints. They mostly have no user interface [START_REF] Marwedel | Embedded system design: Embedded systems foundations of cyber-physical systems[END_REF] [START_REF] Stepner | Embedded application design using a real-time os[END_REF]. Today, embedded systems are the dominant form of computing due to the IoT, vastly outnumbering "traditional" computers such as PCs. They are found in transportation systems like cars, trains, or air-planes as well as telecommunication equipment like cell phones and internet routers. Production and process control systems are among the many possible hosts of an embedded system.

Real-time system

According to [START_REF] Burns | Real-time systems and programming languages: Ada 95, real-time Java, and real-time POSIX[END_REF], a real-time system is defines as "any information processing activity or system which has to respond to externally generated input stimuli within a finite and specified period". In other words, the correct behaviour of a real time system depends not only on the logical result of computation, but also on the time at which the results are produced [START_REF] Kopetz | Real-time systems: design principles for distributed embedded applications[END_REF] [START_REF] Buttazzo | Hard real-time computing systems: predictable scheduling algorithms and applications[END_REF]. If the timing constraints of the system are not respected, a system failure occurs or a sanction is incurred for the violation of the timing constraints. It is therefore essential that the timing constraints of the system are guaranteed to be met. It is also desirable for the system to achieve a high degree of utilization while satisfying the timing constraints of the system.

There are three fundamental characteristics that define the behaviour that a real time system must adopt: predictability, determinism and reliability [START_REF] Bonnet | Introduction aux systèmes temps réel[END_REF]. Indeed, activities must be planned and executed within the specified time constraints. To ensure this, the real-time system designer must always be in the worst case. Determinism is to remove any uncertainty about the behaviour of individual activities, including when they must interact. Among the sources of non-determinism, we can cite the calculation load, the input-outputs, the interruptions, etc. Concerning the reliability constraint, the hardware and software components must be reliable in a real time context. This is why, in general, real time systems are designed to be fault-tolerant.

Real-time operating system

A real-time operating system (RTOS) is the underlying software or operating system (OS) that manages hardware resources and coordinates the execution of user applications. It is adopted to fulfill the demands of a real time system and to explicitly satisfy response-time constraints. So, it supports a scheduling method that guarantees response time especially to critical tasks [START_REF] Laplante | Real-time systems design and analysis[END_REF]. Nowadays, there are many RTOSes (for example RTLinux,LynxOS, Windows CE, VxWorks, QNX,...) that offer the basic functions such as multitasking, synchronization, communication, resource access, fault tolerance and so on. However, they differ in the ease of use, performance and debugging facilities.

According to [START_REF] Liu | Real-time systems[END_REF], what makes an OS a Real-Time OS (RTOS) is the imperative presence of several specific properties:

-A RTOS has to be multi-threaded and preemptible.

-The existence of thread (or process) priority notion, -The OS has to support predictable thread synchronization mechanisms, -A system of priority inheritance has to exist to limit priority inversion, -OS behaviour should be predictable. A RTOS allows real time application software to be easily designed and expanded. Functions can be added without the requirement of major changes to the software. Using a RTOS simplifies the design process by splitting the application code into different separate software elements called process or task. A RTOS allows the designer to make better use of the resources by providing precious services like semaphores, queues, time delays, timeouts, mailboxes, etc.

Simple real time applications are often implemented without any operating system and consequently with no pseudo-parallelism. In this case, the designer should take care of hardware resources accesses and should verify that timing constraints of the software operations be guaranteed. RTOSes are now used whenever the application gets complexity and requires modularity in software for debugging. RTOSes are now widely used in the development of embedded real time systems which are deployed in high number.

Classification of real-time systems

There are three classes of real time systems depending on the consequence of violating specifications on timing constraints mostly expressed in terms of deadlines for finishing the executions of programs. The three classes are defined here below.

We call a soft real-time system [START_REF] Horn | Some simple scheduling algorithms[END_REF][102], the system in which response time is important but the consequence of missing a deadline is relatively mild. The system will still function correctly. Its performance is degraded without causing dramatic consequences on the environment under control and without calling into question the integrity of the system. Exceeding deadlines will have a certain cost for the system, which will result, for example, in lower calculation accuracy, lower data refresh rate, and so on.

In contrast, a hard real-time system [232][150][47] is a system for which all processing operations must imperatively respect all their temporal constraints in nominal operating condition. The system must be predictable [START_REF] Lawler | Recent results in the theory of machine scheduling[END_REF] in terms of its logical and temporal performances. The inability of the system to meet temporal constraints causes failures and often leads to catastrophic consequences on the controlled environment. A single time fault can then have an intolerable cost in terms of human lives, material damage or economic losses. Hard real-time systems are mainly present in the fields of aeronautics, aerospace, robotics, supervision of chemical or nuclear power plants, etc.

On the boundary between the two previous constraints levels, we find the Firm real-time system in which the real-time processing is based on strict constraints, but a low probability of missing the temporal limits can be tolerated [START_REF] Bernat | Weakly hard real-time systems[END_REF]. The measure of the respect of temporal constraints can then take the form of a probabilistic data: the Quality of Service (QoS). This is directly related to a service offered by the system and/or to the behaviour of the system as a whole. Deadline misses may degrade the system's quality of service. These new types of applications displaying firm real-time systems are for the most part emerging applications in the fields of multimedia, automatic control, and surveillance.

Real-time task characterization and modelling

The functionality of a real-time system is yielded by the software controlling the system's hardware and peripherals. Generally, several jobs are handled by a single embedded system, e.g. a personal monitoring device that allows one to measure one's heart rate in real-time and send the heart rate for later study. In order to ensure the different jobs and improve reuseability and maintainability, the jobs are modularized and each module is called a task. In next sections, we define a real-time task and its different properties .

Definition of a real-time task

Nissanke defines a task as "a software entity or program intended to process some specific input or to respond in a specific manner to events conveyed to it" [START_REF] Nissanke | Realtime systems[END_REF].

A task is a software entity that performs a particular function within a software application. It corresponds to the execution of a sequence of operations given on the processor. This sequence of operations relating to the service provided by the task can be repeated several times, periodically for example. Each of the executions is then considered individually in the form of instances (or works).

In a multi-tasking environment, tasks can be in one of four states: executing, ready, suspended and dormant. The first three states are considered active states (The tasks exist and provide a special service for the application), the last being an inactive state (the tasks do not exist from the point of view of the application). The transition from one state to another is made by the decision of the scheduler. In practice, a change of state will often result in a change of context. Figure 5.1 illustrates the active states and transitions from one state to another.

A task in the executing state has the control of the processor and executes its code. The task at execution is the one that at any given time is considered to have the highest priority among candidates for CPU allocation. A suspended task is not a candidate for CPU assignment. Its execution is temporarily suspended until it gets the resource that it lacks to run (in addition to the processor). A ready task is waiting to be selected to be able to execute. A task in dormant state is either not yet created or is definitively terminated.

In addition to the time constraints, other constraints can be associated with the execution of real-time tasks. Among these, we can cite [START_REF] Silly-Chetto | Sur la problématique de l'ordonnancement dans les systèmes informatiques temps réel[END_REF]:

-Resource constraints: The resources required by a task at its activation are not always assumed to be available whenever this task requires execution, and their access must be protected to ensure consistency (eg.shared variables in memory). -The synchronization constraints which can be described by a set of precedence relations that determine the order in which the tasks must execute. When there is no precedence relationship between tasks, then we are talking about independent tasks. -The execution constraints are based on two modes of execution of the tasks, respectively qualified as preemptive and non-preemptive. A preemptible task means that its execution can be interrupted at any time and can be retrieved later. Unlike the non-preemptive case in which the task reserves access to the processor from the beginning to the end of its execution. -The placement constraints that relate to the identity of the processor(s) of a multicore system on which a task is allowed to execute. Based on the way real-time tasks recur over a period of time, a real-time task is generally placed into two main categories: the periodic tasks and the aperiodic tasks.The model of each of these tasks is written below.

In the following, we consider a task τ i belonging to the system of tasks τ to which is associated the set of jobs J i executing on the set of processors M .

Model of a periodic real-time task

A periodic task is one that repeats regularly, after a certain fixed time interval which is the period of the task τ i . A common use of periodic task is to process sensor data and update the current state of the real-time system on a regular basis. Periodic tasks, typically used in control and signal-processing applications have hard deadlines.

From a temporal point of view, a periodic task τ i is characterized by (r i , C i , D i , P i ) where: -The release time r i : It represents the wake-up date of the task, that is, the time at which this task is ready for processing. -The worst-case execution time C i : It denotes the maximum uninterrupted/undisturbed execution time taken to complete the task. -The deadline D i : It is the critical time-delay by which execution of the task should be completed, after the task is released. -The period P i : It corresponds to the period of activation, that is to say to the duration which separates two successive arrivals of work for τ i . Figure 5.2 shows the model of a periodic real-time task. The time is plotted on the horizontal axis, while the vertical axis is used to indicate whether the task is active (high state) or inactive (low state). The periodic task τ i defines an infinite number of jobs all having the same execution time. Every job j n ∈ J that wakes up at time r i + (n -1) × P i , must end before its deadline

d i = r i + (n -1) × P i + D i ; ∀n ∈ N * .
In the case where P i = D i then τ i is said task with deadlines on requests. Furthermore, if all the periodic tasks of τ have the same initial release time (∀i, j ∈ N, r i = r j ), then this task configuration is said to be synchronous, otherwise it is said asynchronous.

Model of an aperiodic real-time task

An aperiodic task requires execution only once. The activation of such a task takes place when an event occurs, which can be either external when it is emitted by the environment or when it comes from another task.

An aperiodic task τ i is characterized by (r i , C i , D i ) where:

r i : it represents the moment of the first job of τ i -C i : It denotes the worst-case execution time.

-D i : It is the critical time-delay or deadline by which execution of the task should be completed. Figure 5.3 illustrates the model of an aperiodic task. The date of arrival a i in the system of an aperiodic task is not known a priori. Once taken into account by the system, the aperiodic task begins its execution on a date r i where r i ≥ a i and must have completed its execution before d i = r i + D i .

Processor utilization factor

An important property which characterize each task is the Processor utilization factor U i , which is the ratio of the worst-case execution time (WCET) and the period ( U i = C i /P i ). The utilisation provides a very simple scheduling check for any processor. Processor utilisation U refers to the sum of the task utilisations U i of all tasks scheduled on that processor (U = U i ). If the processor utilisation is greater than 1, the tasks cannot all be scheduled successfully on that processor by any scheduler.

Real-time operating system

RTLinux, RTAI and Xenomai are common real-time Linux operating systems developed by open-source projects. We specifically focus on these operating systems because they are free. Our objective is to select one of them for the integration phase of our work. These RTOSes have several benefits. They can be built at a lower cost and provide as good performance as proprietary RTOSes. They are developed using different approaches and techniques. In the next sections, we present a detailed description of these RTOSes.

RTLinux

RTLinux [START_REF] Yodaiken | Rtlinux/rtcore dual kernel real-time operating system[END_REF] uses a dual-kernel approach which has a transparent, modular and extensible architecture (see figure 5.4). One of them is the Linux kernel, which provides all the features of a general purpose OS, whereas the other one is the RTLinux kernel. RTLinux provides hard real-time capabilities. It has a hybrid kernel architecture with a small real-time kernel that coexists with the Linux kernel which runs at the lowest priority level. This combination allows RTLinux to provide highly optimized, time-shared services in parallel with the real-time, predictable, and low-latency execution [START_REF] Yodaiken | The rtlinux manifesto[END_REF] Figure 5.4 -RTLinux architecture The RTLinux scheduler is pure priority driven. The priority can be fixed by Rate Monotonic algorithm. Nonetheless, a dynamic priority scheduler called Earliest Deadline First can be used. The priority of every job is computed from the current deadline of the job. Higher is the urgency of the job, higher is its priority.

RTAI

RTAI abbreviated from Real Time Application Interface, is a real-time extension for the Linux kernel, bringing it hard real-time features. RTAI was developed by The "Dipartimento di Ingegneria Aerispaziale del Politecnico di Milano" (DIAPM) in 1997. It is originally developed as a variant of RTLinux, at a time when neither floating point support nor periodic mode scheduling were supported by RTLinux. RTAI has now added many new features without compromising performance. One of which is RTHAL [START_REF] Mantegazza | Rtai: Real time application interface[END_REF]. Unfortunately, a patent on the design concept of RTLinux brings the open source RTAI project some potential problems [START_REF] Moglen | Rtai and the rt-linux patent[END_REF]. Thus, the RTAI project has been working to replace RTHAL with ADEOS (Adaptive Domain Environment for Operating Systems) which is a resource virtualization layer available as a Linux kernel patch, to be free of the RTLinux patent. -Xenomai has a strong focus on embedded systems, although it runs over mainline desktop and server architectures as well. -It has proven its high performance level of compliance with hard real-time constraints.

-Good documentation is available on the website of the project.

-The mailing list of Xenomai project provides good support for developers with prompt and active responses.

Integration of crypto-systems in Xenomai framework

This section deals with the real-time implementation of two proposed stream ciphers using the Xenomai framework. We started by installing Xenomai 2.6 with linux kernel 3.16.0 on our personal computer. An installing documentation was provided by the Xenomai project in [14].

Once the real-time framework was set up and functional, the next step had two main objectives:

• firstly, design of a cryptosystem around real time tasks, and integration with the Xenomai RTOS.

• secondly, performance evaluation of the cryptosystems under the Xenomai RTOS in comparison with the Linux OS.

Real-time cryptosystem design

A stream cipher is a symmetric cryptographical system. It means that the emitter (Alice) and the receiver (Bob) must share the same secret key in order to encrypt/decrypt the message which is transmitted through the communication channel. With this secret key, both emitter and receiver generate the same keystream using a keystream generator, having as input a secret Key "K" and an Initial Vector "IV". XORing this keystream with the plaintext/ciphertext enables us to obtain the ciphertext/plaintext as it is shown in Figure 5. [START_REF]LeakTracer -trace and analyze memory leaks in C++ programs)[END_REF] In this thesis, we focus on the design of the cryptosystem from the point of view of the emitter. We implement the proposed stream ciphers in order to encrypt the plaintext and transmit the cipher text to the receiver.

First, we have divided our application software into four main tasks:

• τ K : this task ensures the function of reading the secret Key and the Initial vector IV.

• τ P : The plain text can be a text file or an image. In this research work, we use images as plaint-text. This task reads the plain-text which is an image. We use for that the opencv library. • τ E : the encryption function is ensured by Xoring the generated keystream and the plain text. This task ensures generation of keystream by the PCNG and the Xor function between the plain text and the keystream to create the cipher text. • τ T : once the encryption bas been performed, the cipher text can be transmitted to the receiver.

} Listing 5.1 -Description of Tasks creation code

Description of tasks dependencies

The four tasks τ K , τ P , τ E and τ T have execution dependency on each other. τ E should begin execution only after the two tasks τ K and τ P terminate. Once encryption is complete, τ T may start to transfer the encrypted plaintext or the ciphertext to the receiver.

We use three binary semaphores namely Sem key , Sem P and Sem E . The initial values of the binary semaphores are 0.

Task τ E has to wait for task τ K to start execution, at which time, task τ K signals to task τ E its completion by unlocking the semaphore and changing the value of the binary semaphore Sem key to 1. In the same way, Task τ E must also wait for task τ IV to start execution. At the end of its execution, task τ P unlocks i.e. changes the value of Sem P to 1 and signals to task τ E its completion. Once the two semaphores Sem P and Sem key are equal to 1 (both are unlocked), Task τ E start execution. Task τ T cannot begin execution before completion of τ E . τ E signals to τ T the end of its execution by changing the value of Sem E to 1. Figure 5.8 describes the dependency and the synchronisation of the four tasks τ K , τ P , τ E and τ T .

Mechanisms of Xenomai

Xenomai offers a complete set of classic synchronization mechanisms e.g. semaphores, mutex, variable conditions, event waiting. The description of the Xenomai API is available online or in the Xenomai installation directory.

To manage the dependency of tasks and synchronise their activities, we use binary binary semaphores. Binary semaphore can be used for tasks synchronisation. It is initially set equal to 0 (empty), because it acts as en event other tasks are waiting for. Other tasks that need to run in a particular sequence then wait (block) for the binary semaphore to be equal to 1 (until the event occurs) to take the semaphore from the original task and set it back to 0. The semaphores in Xenomai provide fast intertask communication. Semaphores are the primary means for addressing the requirements of task synchronization. In general we can say:

• Availability: there are some type of systems that are not using an OS with suitable timing facilities support. • Cost: Special purpose hardware solutions, such as an emulator, are more often costly than general purpose ones, such as an oscilloscope. • Difficulty: subjectively defines the effort to obtain measurements. A technique that requires usage of hardware equipment such as a logic analyzer or filtering of data to obtain the answers is considered hard. A technique that requires a simple execution of the code and produces an instant measurement is considered easy. Typically, software techniques are easier, but yield only coarse-grain results.

Hardware-assisted techniques are hard, but they can provide fine-grain results with high accuracy. In this thesis, we used two different software techniques to calculate the execution time of the tasks. The first one consists on using the gettimeofday system-call which is present in the Linux environment. gettimeofday gives answers in micro-second resolution. The second method is using a predefined function present in the Xenomai API, called int rt_task_inquire and produces information about current task such us execution time nanoseconds. In next sections, we give a description of these two techniques.

First Method: gettimeofday system-call

The POSIX standard C-library available in Linux, provides the system-call gettimeofday to access the timing resource and determine the current time.

The gettimeofday system call gets the system's wall-clock time. It takes a pointer to a struct timeval variable (as specified in <sys/time.h>): int gettimeof day (struct timeval * tv, struct timezone * tz); struct timeval { time_t tv_sec; /* seconds */ suseconds_t tv_usec; /* microseconds */ };

This structure represents a time, in seconds, split into two fields. The tv_sec field contains the integral number of seconds, and the tv_usec field contains an additional number of microseconds. This struct timeval value represents the number of seconds elapsed since the start of the UNIX epoch, on midnight UTC on January 1, 1970. The gettimeofday call also takes a second argument, which should be NULL.

To use the gettimeofday approach, the program must be instrumented such that the clock is read at the beginning (start)and the end (end)of the code segment(s) being measured.

The time spent to execute this code segment(s) is equal to the difference between the end and start clock time. Instrumenting the code means adding lines of code explicitly to perform the timing measurements. Such lines of code are temporary, and are removed once the desired data has been collected.

Here is an example of a code that uses gettimeofday to measure the execution time of the encryption task. Listing 5.5 -Execution time measurement using gettimeofday method.

Second method: rt_task_inquire function Xenomai offers a function that returns various information about the status of a given task such us task name, task status (blocked, ready, delayed, etc.), initial priority, execution time in nanoseconds, time of the next activation, etc. This function is called rt_task_inquire (RT_TASK * task, RT_TASK_INFO * info) having as parameters:

task: The descriptor address of the inquired task.

info: The address of a structure the task information will be written to.

In the following example 5.6, we give part of C code in which we use rt_task_inquire to calculate the execution time in nanoseconds of a given task. Specifically, we mention that the resulting values of execution time with the first and second methods, present estimations of how long the task takes to execute. It is the difference between the time instant when the task finishes execution and the time instant when the task starts execution. It does not take into consideration preemptions and interrupts. That means that the execution time C i a task τ i is calculated as t end -t start -t preempt ; where t start is the time that gettimeof day(&start, N U LL) returned, t end is the time given by gettimeof day(&end, N U LL) / (t end -t start ) is the time returned by rt_task_inquire and t preempt is computed as the amount of time that another task executed during that time period.

As the rt_task_inquire function gives better resolution (nanosecond) than to gettimeofday system-call method, we use the rt_task_inquire function to calculate the execution time of the encryption task. In the next section, we describe our results for execution time measurements using the second method (rt_task_inquire function).

Measurements for execution times

In the design of any cryptosystem, the computational efficiency of the encryption algorithm is an important factor to exhibit its performance. We calculate the average encryption time in micro second (µs), the encryption throughput in Mega bit par second BR(Mbit/s), and the number of cycles needed to encrypt one byte (NCpB), given as follow: Obtaining information about the execution time of a program is by executing the program 100 times with different secret keys and IVs, and then measuring the execution time for each test run. We report in table 5.5 the computation performance measurements of our proposed stream ciphers CM-SC and CS-SC proposed respectively in [START_REF] Jallouli | Design and analysis of two stream ciphers based on chaotic coupling and multiplexing techniques[END_REF] and [START_REF] Jallouli | Robust chaos-based stream-cipher for secure public communication channels[END_REF], implemented in Xenomai RTOS. Also, we restore the computation performance of the algorithms when they are running on ubuntu in table 5.6. Results from tables 5.5 and 5.6 show that CS-SC algorithm has better computing performance than CM-SC algorithm as mentioned earlier. In addition, for all the algorithms, the encryption time is greater when the program runs on xenomai. This is due to preemption and interrupts time taken into consideration. Therefore, to better evaluate the time required to perform encryption/decryption, it is necessary to consider non real time OS in which there will be no preemption interferences and interruption issues.

Conclusion

Standard cryptographic algorithms can be huge, slow or very energy-consuming and consequently not adapted to small electronic devices with severe limitations. Lightweight cryptography concerns the design of new cryptographic algorithms tailored for implementation in constrained environments including RFID tags, sensors, smart cards, health-care devices and also applications of the IoT field. In software implementation, the code and RAM sizes are the important features to evaluate the lightweight properties.

In the first part of this chapter, we have provided a quantitative evaluation of energy, power consumption and memory size requirement of lightweight stream cipher algorithms including CM-SC and CS-SC that were proposed in [START_REF] Jallouli | Design and analysis of two stream ciphers based on chaotic coupling and multiplexing techniques[END_REF] and [START_REF] Jallouli | Robust chaos-based stream-cipher for secure public communication channels[END_REF]. We presented the tools which are well known to measure energy and power consumption such as RAPL and powertop that we used for our experiments. We have choosen these tools among the others since they are open source and free, and do not require external hardware materials.

CHAPTER 6. CONCLUSIONS AND PERSPECTIVES

Progress in mobile and wireless technologies, coupled with embedded devices, has led to giving rise to the notion of ubiquitous computing. The vision of Mark Weiser in his article "The Computer of the 21 st Century", according to which "the most profound technologies are those that disappear; they weave themselves into the fabric of everyday life until they are indistinguishable from it," is today a reality [START_REF] Weiser | The computer for the 21st century[END_REF]. We can observe that from automobiles to smart phones, environmental sensors to medical devices and personal communication -embedded computing increasingly pervade our lives. Therefore, computing is becoming revolved around the huge amount of information gotten from a large number of embedded devices that form the Internet of Things (IoT). The core idea of this concept lies in the presence of uniquely identifiable physical objects known as things which can interact with other objects through the Internet. The vast majority of devices that will integrate the IoT are expected to work under severe constrained resource in terms of computing capabilities, memory capacitance, and limited battery and computing power. The communication technique among a large number of constrained devices that generate huge amount of data has an impact on the security and privacy of the applications. These requirements lead to the need of specific security primitives for pervasive devices. Hence, there is an increasing demand for lightweight cryptography, capable of guaranteeing secure data transmission and providing an optimized security/cost/performance trade-off.

In Chapter 2, we presented the fundamental concepts of cryptography primitives. We started by discussing principles of foundation and basic concepts of cryptography and the two major categories of modern cryptographic primitives, namely symmetric and asymmetric algorithms. We described in details block ciphers and stream ciphers. The next step was to introduce chaos theory and briefly present some chaotic maps including Gauss map, Tent map, Hénon map, Lozi map, Lorenz attractor and Rössler attractor. Then, we provided the state of the art of block ciphers, pseudo-random number generators and stream ciphers based on chaotic maps.

In Chapter 3, we studied the security and computing performance of some discrete chaotic maps including: Logistic, Skew Tent and PWLCM maps, as base of proposed chaos-based stream ciphers during this thesis. First, we presented a collection of common and standard security tools useful to define that assessment. Second, we discretized the chaotic maps making them running over a finite precision (N=32), and we analyzed their cryptographic properties and speed. Then, we introduced a perturbation technique which permits to decrease the degradation caused by the discretizing process. We performed some security analysis of chaotic maps using this perturbation technique. In order to improve the cryptographic performance of chaotic maps, we have proposed a recursive structure. Afterwards, we gave the security and speed performance of chaotic maps using the perturbation technique and the recursive structure.

In Chapter 4, we presented our first contribution. It consists of designing and implementing in an efficient and secure manner the three proposed stream ciphers, based on three robust Pseudo-Chaotic Numbers Generators (PCNGs). We described in details the general structure of the three proposed PCNGs. The first proposed PCNG, called CM-PCNG, uses three weakly coupled chaotic maps: PWLCM, Skew Tent and Logistic and includes a multiplexing chaotic technique. In comparison with the architecture of CM-PCNG, the second PCNG -DM-PCNG -uses a binary diffusion matrix on the chaotic coupling technique. The architecture of the third proposed PCNG, named CS-PCNG, is based on using two chaotic maps, namely PWLCM and SkewTent, and includes coupling and swap chaotic techniques. We gave the security and statistical analysis, and the computing performance measures of the proposed PCNGs and stream ciphers. The proposed crypto-systems are very secure, due to the use of chaotic coupling, swap and multiplexing techniques, while having a high speed performance.

In Chapter 5, we focused first on studying the performance of two proposed chaotic stream ciphers CM-SC & CS-SC in terms of energy and power consumption and memory assessment. We showed that the proposed stream ciphers are lightweight crypto-systems. Compared to other crypto-systems presented in the literature, we demonstrated that our designed stream ciphers are suitable for practical secure applications of the IoT with constrained resources environment. The second part of this chapter concerned the implementation of the proposed crypto-systems as real-time crypto-systems, using a real time operating systems named Xenomai which presents a software framework able to give real time capabilities to the operating system. We reported the used model to implement the real-time crypto-systems and we gave the execution time measurements tools and obtained results of computation performance for the two proposed crypto-systems.

In future work, we plan on continuing the real time performance analysis study. During this thesis, we measured the execution time of individual tasks of the proposed crypto-systems, which presents a necessary step toward fully understanding the timing of a real-time system, but it is not sufficient to analyze its realtime performance. Among the basis measures to be quantified, we quote the worst-case utilization of each task. The worst-case utilization U i of a task τ i is computed as the ratio between the task's worst-case execution time (C i ) and its period (P i ). An important piece of information that also must be considered in the computing performance evaluation of any real-time system is the presence of timing errors, notably the missed deadline and improper scheduling rates.

In addition, we will propose the realization of a library of crypto-systems based on the proposed algorithms, available to the users in order to implement their real time applications. The users can choose the appropriate crypto-systems according to the requirements of the application in terms of security performance level, and the available resources (energy and available memory) in the device. Also, we plan to prepare a user guide to help developers to implement their real-time crypto-systems under Xenomai RTOS. De nos jours, les périphériques mobiles et embarqués sont devenus omniprésents dans notre vie quotidienne. Cela s'explique par la croissance rapide des technologies de pointe récentes d'informatique et de communication. Ces systèmes embarqués sont utilisés dans nombreuses applications dans divers domaines tels que l'électronique numérique, les télécommunications, les réseaux informatiques, les systèmes satellites, les équipements du système de défense militaire, les équipements du système de recherche, etc. Ces systèmes sont connectés entre eux soit localement, soit via Internet. Ce phénomène est appelé Internet des objets (Internet of Things IoT). L'idée centrale de ce concept réside dans la présence d'objets physiques quotidiens liés à Internet. L'interconnexion entre eux est assurée par des technologies telles que l'identification par radiofréquence (RFID), Wireless Sensor Networking (WSN), etc. L'IoT est actuellement en train d'émerger: 50 milliards de périphériques sont estimés être connectés sans fil à Internet d'ici 2020. Le déploiement massif de dispositifs de l'IoT a soulevé la problématique cruciale de la sécurité des données, transmises via des canaux publiques non protégés et utilisées dans nombreuses applications très sensibles à la sécurité (par exemple, défense, militaire, financier, automobiles ou aéronautiques...). De tels dispositifs doivent être invulnérables aux tentatives malveillantes de sabotage de la communication ou qui peuvent limiter leurs fonctionnalités. Ainsi, ces dispositifs doivent inclure des stratégies de protection contre les attaques cryptographiques. Par conséquent, il est nécessaire d'augmenter la sécurité des données transmises afin d'éviter le piratage d'informations et de fraudes, tout en conservant les avantages de l'IoT.

L'utilisation des techniques cryptographiques est appropriée pour fournir de nombreux services de sécurité, tel que la protection de la transmission des données contre les attaques cryptographiques passives et actives. Un nombre croissant de techniques cryptographiques efficaces pour sécuriser l'information transmise ont été développées dans la littérature. Ces techniques cryptographiques existantes développées pour l'informatique d'entreprise pourraient ne pas satisfaire les exigences des applications des systèmes embarqués car elles peuvent être lentes et très consommatrices d'énergie. En effet, les dispositifs de l'IoT sont intrinsèquement contraints aux ressources en matière de mémoire et d'énergie. Par conséquent, il est nécessaire de conçevoir des crypto-systèmes "légères" et efficaces pour garantir une transmission de données sécurisée dans l'IoT.

Au cours des dernières années, la cryptographie basée chaos a reçu beaucoup d'attention suite à son efficacité dans la protection des données. En effet, les propriétés des systèmes chaotiques et déterministes telles que: ergodicité, sensibilité aux conditions initiales et paramètres de contrôle, nombre important de trajectoires très longues (apériodiques), etc., sont très recherchées pour tout système cryptographique dédié à la sécurité des données.

Dans ce contexte, nous avons étudié, dans cette thèse, la problématique de la sécurité de l'information basée chaos sous contraintes temps réel et d'énergie. A ce sujet d'abord, nous avons étudié les performances de trois cartes chaotiques (Logistique, SkewTent et PWLCM) seules et intégrées dans des cellules récursives de 1 à 3 retards. Basé sur les cartes précédentes, nous avons conçu, implémenté de façon efficace et analysé trois générateurs de nombres pseudo-chaotiques (PCNGs). Ces générateurs utilisent une matrice de couplage faible ou une matrice de couplage binaire à forte diffusion entre les cartes chaotiques de base, et une technique de multiplexage chaotique. Puis, nous avons réalisé de façon sécurisée trois systèmes de chiffrement/déchiffrement par flux basés sur les PCNGs proposés. L'analyse cryptographique des systèmes chaotiques réalisés montrent leur robustesse contre des attaques connues. Ce résultat est dû aux structures proposées qui intègrent une forte non-linéarité, une technique de couplage faible, ou de couplage binaire à fort diffusion, un multiplexage chaotique et une technique de permutation pour le troisième système. La performance obtenue en complexité de calcul indique leurs utilisations dans des applications temps réel.

Ensuite, nous avons intégré ces systèmes de chiffrement/déchiffrement chaotiques au sein d'un système d'exploitation temps réel appelé Xenomai. Enfin, nous avons mesuré la consommation d'énergie et de puissance des trois systèmes chaotiques réalisés, et nous avons montré comment adapter le degré de sécurité de ces systèmes en fonction de la disponibilité énergétique temporelle.

A.2 Contributions:

2. 1

 1 Key lengths and number of rounds for AES. . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Parameters of the A5/1 Registers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3 The finalist stream ciphers for the eStream project. . . . . . . . . . . . . . . . . . . . . . 2.4 Symbols and their meaning used in HC-128 stream cipher. . . . . . . . . . . . . . . . . . 2.5 Functions used in HC-128 stream cipher and their description. . . . . . . . . . . . . . . . 3.1 P-values and Proportion results of NIST test for the Logistic map. . . . . . . . . . . . . . 3.2 Computing performance of the Logistic map. . . . . . . . . . . . . . . . . . . . . . . . . 3.3 P-values and Proportion results of NIST test for the Skew Tent map. . . . . . . . . . . . . 3.4 Computing performance of the Skew Tent map. . . . . . . . . . . . . . . . . . . . . . . . 3.5 P-values and Proportion results of NIST test for the PWLCM map. . . . . . . . . . . . . . 3.6 Computing performance of the PWLCM map. . . . . . . . . . . . . . . . . . . . . . . . . 3.7 P-values and Proportion results of NIST test for the disturbed Logistic map. . . . . . . . . 3.8 Computing performance of the disturbed Logistic map. . . . . . . . . . . . . . . . . . . . 3.9 P-values and Proportion results of NIST test for the disturbed Skew Tent map. . . . . . . . 3.10 Computing performance of the disturbed Skew Tent map. . . . . . . . . . . . . . . . . . . 3.11 P-values and Proportion results of NIST test for the disturbed PWLCM map. . . . . . . . . 3.12 Computing performance of the disturbed PWLCM map. . . . . . . . . . . . . . . . . . . 3.13 Correlation coefficient values for sequences generated by the structure of Figure 3.5.2 using the disturbed Logistic map with delays equal to 1, 2 and 3. . . . . . . . . . . . . . . . . . 3.14 Theoretical and experimental values of Chi-square test for sequences generated by the structure of Fig. 3.5.2 with delay equal to 1 and using the disturbed Logistic map. . . . . . . . . 3.15 P-values and Proportion results of NIST test for the disturbed Logistic map in a recursive structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.16 Computing performance of the structure of Fig. 3.5.2 with delays equal to 1, 2 and 3 and using the disturbed Logistic map. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.17 Correlation coefficient values for sequences generated by the structure of Fig. 3.5.2 using the disturbed Skew Tent map with delays equal to 1, 2 and 3. . . . . . . . . . . . . . . . . 3.18 Theoretical and experimental values of Chi-square test for sequences generated by the structure of Fig. 3.5.2 with delay equal to 1 and using the disturbed Skew Tent map. . . . . . . 3.19 P-values and Proportion results of NIST test for the disturbed Skew Tent map in a recursive structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.20 Computing performance of the structure of Fig. 3.5.2 with delays equal to 1, 2 and 3 and using the disturbed Skew Tent map. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.21 Correlation coefficient values for sequences generated by the structure of Fig. 3.5.2 using the disturbed PWLCM map with delays equal to 1, 2 and 3. . . . . . . . . . . . . . . . . . 3.22 Theoretical and experimental values of Chi-square test for sequences generated by the structure of Fig. 3.5.2 with delay equal to 1 and using the disturbed PWLCM map. . . . . . . . 3.23 P-values and Proportion results of NIST test for the disturbed PWLCM map in a recursive structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .List of Figures2.11 Mapping and bifurcation digram of the Tent map [12]. . . . . . . . . . . . . . . . . . . . 3.2 Bifurcation Diagram and Lyapunov Exponent of the Logistic map. . . . . . . . . . . . . . 3.3 Phase space trajectory, attractor and discrete variation of sequence X L (n) generated by the discrete Logistic map. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5 Auto-correlation of sequence X L generated by Logistic map. . . . . . . . . . . . . . . . . 3.6 Cross-correlation functions of sequences X L and X L generated by the Logistic map . . . 3.8 Phase space trajectory, attractor and discrete variation of sequence X S (n) generated by the discrete Skew Tent map. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.10 Auto-correlation of sequence X S generated by a Skew Tent map. . . . . . . . . . . . . . . 3.11 Cross-correlation functions of sequences X S and X S generated by the Skew tent map. . . 3.13 Phase space trajectory, attractor and discrete variation of sequence X P(n) generated by the discrete PWLCM map. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.15 Auto-correlation of sequence X P generated by the PWLCM map. . . . . . . . . . . . . . 3.16 Cross-correlation functions of sequences X P and X P generated by the PWLCM map. . . 3.26 Cross-correlation functions of sequences X L and X L generated by the structure of Figure 3.5.2 with delay equal to 1 and using the disturbed Logistic map. . . . . . . . . . . . . . . 3.27 Histograms of sequences X L generated by a disturbed Logistic map in a recursive structure with delays equal to 1, 2 and 3 respectively. . . . . . . . . . . . . . . . . . . . . . . . . . 3.28 NIST test results for sequences generated by the structure of Fig. 3.5.2 with delays equal to 1, 2 and 3 and using the disturbed Logistic map. . . . . . . . . . . . . . . . . . . . . . . . 3.30 Cross-correlation functions of sequences X S and X S generated by the structure of Fig. 3.5.2 with delay equal to 1 and using the disturbed Skew Tent map. . . . . . . . . . . . . . . . . 3.31 Histograms of sequences X S generated by a disturbed Skew Tent map in a recursive structure with delays equal to 1, 2 and 3 respectively. . . . . . . . . . . . . . . . . . . . . . . 3.32 NIST test results for sequences generated by the structure of Fig. 3.5.2 with delays equal to 1, 2 and 3 and using the disturbed Skew Tent map. . . . . . . . . . . . . . . . . . . . . . . 3.34 Cross-correlation functions of sequences X P and X P generated by the structure of Fig. 3.5.2 with delay equal to 1 and using the disturbed PWLCM map. . . . . . . . . . . . . . . . . 3.35 Histograms of sequences X P generated by a disturbed PWLCM map in a recursive structure with delays equal to 1, 2 and 3 respectively. . . . . . . . . . . . . . . . . . . . . . . . . . 3.36 NIST test results for sequences generated by the structure of Figure 3.5.2 with delays equal to 1, 2 and 3 and using the disturbed PWLCM map. . . . . . . . . . . . . . . . . . . . . . 4.1 General structure of the proposed PCNGs. . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2 Architecture of the proposed CM-PCNG. . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3 Architecture of the proposed DM-PCNG. . . . . . . . . . . . . . . . . . . . . . . . . . . 4.4 Architecture of the proposed CS-PCNG. . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.5 General structure of a generated sequence X(n). . . . . . . . . . . . . . . . . . . . . . . 4.6 General structure of a generated sequence using a parallel programming. . . . . . . . . . .

Figure 2 . 1 -

 21 Figure 2.1 -Symmetric encryption primitive.

Figure 2 . 2 -

 22 Figure 2.2 -Asymmetric encryption primitive.

Figure 2 . 3 -

 23 Figure 2.3 -AES input/output parameters.

Figure 2 . 4 -

 24 Figure 2.4 -Encryption process of a synchronous stream cipher.

Figure 2 . 5 -

 25 Figure 2.5 -Encryption process of an asynchronous stream cipher.

Figure 2 . 6 -

 26 Figure 2.6 -Encryption process of OTP stream cipher.

Figure 2 . 7 -

 27 Figure 2.7 -The encryption process of the AES-CTR stream cipher.

Figure 2 .

 2 8 presents the general structure of the A5/1 stream cipher. The three LFSRs are updated according to their primitive feedback polynomials which are summarized in Table2.2. The output of each LFSR is the last bit. The clocking function is based on stop/go technique using a majority rule. The three bits are being examined and their majority is calculated. The register is clocked if the clocking bit agrees with the majority bit. Hence, note that at each step at least two or three LFSRs are clocked and the probability for each LFSR being clocked is equal to 3/4. Initially, all the LFSRs are set to zero. Then for 64 cycles, the 64-bits key are consecutively combined in parallel to the least significant bit of each LFSR using XOR operation: R[0] = R[0] K[i].Each LFSR is then clocked. Similarly, the three LFSRs are clocked 22 times and the entire system is clocked for 100 additional clock cycles using the irregular clocking mechanism, but the output discarded. Then, finally, the three LFSRs are clocked for 228 clock cycles, producing two 114 bit sequences of output keystream, first 114 for downlink, last 114 for uplink.

Figure 2 .

 2 Figure 2.8 -The A5/1 stream cipher structure.

Figure 2 . 9 -

 29 Figure 2.9 -The next-state function of the Rabbit stream cipher.

Figure 2 . 10 -

 210 Figure 2.10 -Bifurcation diagram of the Gauss map with α= 4.90 and β in the range -1 to +1.

Figure 2 . 11 -

 211 Figure 2.11 -Mapping and bifurcation digram of the Tent map [12].

Figure 2 . 12 -

 212 Figure 2.12 -Attractor of the Hénon map for α = 1.4 and β = 0.3. [272]

Figure 2 . 13 -

 213 Figure 2.13 -Attractor of the Lozi map for α=1.4, β=0.3 [273].

Figure 2 .

 2 Figure 2.14 -Attractor of the Lorenz system for σ = 10, β = 8/3, ρ = 28.

Figure 2 .

 2 Figure 2.15 -Attractor of the Rössler system [11].

Figure 2 . 16 -

 216 Figure 2.16 -General structure of chaos-based block cipher.

Figure 2 . 17 -

 217 Figure2.17 -Image encryption scheme of Fridrich[START_REF] Lian | Security analysis of a chaos-based image encryption algorithm[END_REF].

Figure 2 . 20 -

 220 Figure 2.20 -Encryption structure of the proposed crypto-system by Farajallah et al., [85].

Figure 2 . 21 -

 221 Figure 2.21 -Structure of the digital CCS-PRBG proposed in [240].

Figure 2 . 22 -

 222 Figure 2.22 -Structure of the chaos-based stream cipher proposed by [200].

Figure 2 .

 2 Figure 2.23 -Architecture of NDF-PRBG [266].

  [D]. The structure of the two PCNGs are shown in Figures 2.24 and 2.25 respectively.

Figure 2 . 24 -

 224 Figure 2.24 -Structure of the first proposed PCNG proposed in [112].

Figure 2 . 25 -

 225 Figure 2.25 -Structure of the second proposed PCNG proposed in [112].

Figure 3 . 1 -

 31 Figure 3.1 -Scheme for generating a pseudo-random sequence by a chaotic map.

Figure 3 . 2 -

 32 Figure 3.2 -Bifurcation Diagram and Lyapunov Exponent of the Logistic map.

Figure 3 . 3 -

 33 Figure 3.3 -Phase space trajectory, attractor and discrete variation of sequence X L (n) generated by the discrete Logistic map.

Figure 3 . 4 -

 34 Figure 3.4 -Histogram of sequence X L generated by the discrete Logistic map.

Figure 3 . 5 -

 35 Figure 3.5 -Auto-correlation of sequence X L generated by Logistic map.

Figure 3 . 6 -

 36 Figure 3.6 -Cross-correlation functions of sequences X L and X L generated by the Logistic map

  Figure 3.8 -Phase space trajectory, attractor and discrete variation of sequence X S (n) generated by the discrete Skew Tent map.

56CHAPTER 3 .

 3 Figure 3.9 -Histogram of sequence X S generated by the discrete Skew Tent map.

  Figure 3.11 -Cross-correlation functions of sequences X S and X S generated by the Skew tent map.

Figure 3 .

 3 Figure 3.12 -NIST test results of the Skew Tent map.

60CHAPTER 3 .

 3 Figure 3.13 -Phase space trajectory, attractor and discrete variation of sequence X P (n) generated by the discrete PWLCM map.

Figure 3 .

 3 Figure 3.14 -Histogram of sequence X P generated by the discrete PWLCM map.

  Figure 3.15 -Auto-correlation of sequence X P generated by the PWLCM map.

  Figure 3.16 -Cross-correlation functions of sequences X P and X P generated by the PWLCM map.

Figure 3 .

 3 Figure 3.17 -NIST test results of the PWLCM map.

Figure 3 . 20 -

 320 Figure 3.20 -Mapping, histogram, correlation and NIST test results of sequence generated by the disturbed Logistic map.

3. 4 . 3 Figure 3 . 21 -

 43321 Figure 3.21 -Mapping, histogram, correlation and NIST test results of a sequence generated by the disturbed Skew Tent map.

Figure 3 . 22 -

 322 Figure 3.22 -Mapping, histogram, correlation and NIST test results of a sequence generated by the disturbed PWLCM map.

Figure 3 . 23 -

 323 Figure 3.23 -Non linear recursive structure.

Figure 3 . 24 -

 324 Figure 3.24 -Non linear recursive structure based on disturbed chaotic map.

3. 5 . 2

 52 Performance evaluation of the non linear recursive structure using the disturbed Logistic map Security Performance Evaluation We draw in Fig.3.25 the mapping and a zoom on the mapping of a generated sequence X L (n) by the structure of Fig.3.24 with delay equal to 1 and using the disturbed Logistic map. The resulted mapping is random. Similar results of mapping are obtained for sequences generated with delays equal to 2 and 3. This shows that with the recursive structure, the mapping loses the signature of the chaotic map. Consequently, it is impossible to recognize the used map through the tracing of the phase space or mapping.

Figure 3 . 25 -

 325 Figure 3.25 -Mapping and zoom on the mapping of a sequence X L (n) generated by the recursive structure with delay equal to 1, using the disturbed Logistic map.

Fig. 3 .Figure 3 . 26 -

 3326 Fig.3.26 presents the autocorrelation and cross-correlation of two sequences X L and X L generated by the same structure with slightly different secret keys. Table3.13 gives the correlation coefficients between

Figure 3 . 27 -

 327 Figure 3.27 -Histograms of sequences X L generated by a disturbed Logistic map in a recursive structure with delays equal to 1, 2 and 3 respectively.

Fig. 3 . 3 Figure 3 . 28 -

 33328 Fig. 3.28 and Table3.15 presents the results of the NIST for sequences generated by the disturbed Logistic map using a perturbation technique in a recursive structure, with delay equal to 1, 2 and 3 respectively. Obtained results show that the perturbation technique and the recursion structure have improved cryptographic properties of the Logistic map.

3. 5 .

 5 Figure 3.29 -Mapping and zoom on the mapping of a sequence X S (n) generated by the disturbed Skew Tent map used in a recursive structure with a delay equal to 1.

2 th 18 -

 218 -square value delay = 1 delay = 2 delay = 3 χ Theoretical and experimental values of Chi-square test for sequences generated by the structure of Fig.3.5.2 with delay equal to 1 and using the disturbed Skew Tent map.

76CHAPTER 3 .Figure 3 . 30 -

 3330 Figure 3.30 -Cross-correlation functions of sequences X S and X S generated by the structure of Fig. 3.5.2 with delay equal to 1 and using the disturbed Skew Tent map.

Figure 3 . 31 -

 331 Figure 3.31 -Histograms of sequences X S generated by a disturbed Skew Tent map in a recursive structure with delays equal to 1, 2 and 3 respectively.

78CHAPTER 3 . 3 Figure 3 . 32 -

 33332 Figure 3.32 -NIST test results for sequences generated by the structure of Fig. 3.5.2 with delays equal to 1, 2 and 3 and using the disturbed Skew Tent map.

  Figure 3.33 -Mapping and zoom on the mapping of a sequence X P (n) generated by the disturbed PWLCM map used in a recursive structure with a delay equal to 1.

Figure 3 . 34 - 2 (c) delay = 3 Figure 3 . 35 -

 33423335 Figure 3.34 -Cross-correlation functions of sequences X P and X P generated by the structure of Fig. 3.5.2 with delay equal to 1 and using the disturbed PWLCM map.

3 Figure 3 . 36 -

 3336 Figure 3.36 -NIST test results for sequences generated by the structure of Figure 3.5.2 with delays equal to 1, 2 and 3 and using the disturbed PWLCM map.

Figure 4 . 1 -

 41 Figure 4.1 -General structure of the proposed PCNGs.

Figure 4 . 2 -

 42 Figure 4.2 -Architecture of the proposed CM-PCNG.

88CHAPTER 4 .

 4 DESIGN, IMPLEMENTATION AND ANALYSIS OF PSEUDO-CHAOTIC NUMBER GENERAT

Figure 4 . 3 -

 43 Figure 4.3 -Architecture of the proposed DM-PCNG.

90CHAPTER 4 .Figure 4 . 4 -

 444 Figure 4.4 -Architecture of the proposed CS-PCNG.

Figure 4 . 5 -

 45 Figure 4.5 -General structure of a generated sequence X(n).

Algorithm 5

 5 Number of samples generated by each thread. int remainder = MOD(Ns / 4) int min = 0, max = 0 for int k = 1, k++, while k ≤ 4 do min = (k-1) × (Ns / 4) if (k != 4) then max = k × (Ns/4)+ remainder else max = k × (Ns/4) end if {Nbth[k]is the number of samples to be generated by the thread T h k } Nbth[k] = max -min end forTable 4.1 -Number of samples generated by each thread.

Figure 4 . 6 -

 46 Figure 4.6 -General structure of a generated sequence using a parallel programming.

  static void * ( * const volatile memset_ptr)(void * , int, size_t) = memset; static void secure\_memzero(void * p, size_t len){ (memset_ptr)(p, 0, len)sensitive information. * / secure_memzero(key, sizeof(key)); } Listing 4.1 -Description of secure_memzero function

. 13 )

 13 |K2| = (|Xp| + |Xs| + |Xl|) + (|P p| + |P s|) = 159 bits. (4.14) |K3| = (|Xp| + |Xs|) + (|P p| + |P s|) + 4 × |ε ij | = 147 bits. (4.15) where |Xp| = |Xs| = |Xl| = |P s| = 32 bits; |P p| = 31 bits and |ε ij | is equal to 5 bits. The proposed algorithms have 2 189 , 2

  , 4.7c and 4.7e the mapping of sequences X1, X2 and X3, each containing Ns = 31250 samples, generated by CM-PCNG, DM-PCNG and CS-PCNG respectively and a zoom of these mappings are given in Figures 4.7b

Figure 4 . 7 -

 47 Figure 4.7 -Mapping of sequences X1, X2 and X3, generated by CM-PCNG, DM-PCNG and CS-PCNG respectively, and a zoom of these mappings.

  , 4.8c and 4.8e the mapping of sequences Xp generated by CM-PCNG, DM-PCNG and CS-PCNG respectively and we give a zoom of these mappings in Figures 4.8b

  , 4.8d and 4.8f. Similar results are obtained for mappings of the sequences Xs and Xl.

  (a) Mapping of sequence Xp generated by CM-PCNG. (b) Zoom on the mapping (c) Mapping of sequence Xp generated by DM-SC. (d) Zoom on the mapping (e) Mapping of sequence Xp generated by CS-SC. (f) Zoom on the mapping

Figure 4 .

 4 Figure 4.8 -Mapping of sequences Xp generated by CM-PCNG, DM-PCNG and CS-PCNG respectively.

  j+1 [, i, j = 0, ..., M -1. (4.20) In Figures4.9a, 4.9b and 4.9c, we show the r 6,6 box, after zooming the mapping of sequences X1, X2 and X3 .

  (a) Zoom on the phase space of X1 (b) Zoom on the phase space of X2 (c) Zoom on the phase space of X3

Figure 4 . 9 -

 49 Figure 4.9 -Zoom on the phase space of sequences X1, X2 and X3 generated by CM-PCNG, DM-PCNG and CS-PCNG respectively.

. 22 )

 22 In table 4.9, we report the obtained values of CRE for sequences X1, X2 and X3. For this experiment, we took three different values for N s: N s = 31250, N s = 31250 × 10, and N s = 31250 × 100. And for each N s, we consider two values of M : M = 5 and M = 10.

102CHAPTER 4 .

 4 DESIGN, IMPLEMENTATION AND ANALYSIS OF PSEUDO-CHAOTIC NUMBER GENERA

Figure 4 .

 4 10a, Figure 4.10b and Figure 4.10c the histograms of generated sequences X1, X2 and X3, each formed by 10 7 samples, generated by CM-PCNG, DM-PCNG

  and 4.13 ) 104CHAPTER 4. DESIGN, IMPLEMENTATION AND ANALYSIS OF PSEUDO-CHAOTIC NUMBER GENERA (a) The histogram of generated sequence X1. (b) The histogram of generated sequence X2. (c) The histogram of generated sequence X3.

Figure 4 . 10 -

 410 Figure 4.10 -The histograms of sequences X1, X2 and X3 generated by CM-PCNG, DM-PCNG and CS-PCNG respectively.

Figure 4 . 11 -

 411 Figure 4.11 -Auto and cross-correlation functions of sequences X and Y generated by CM-PCNG.

106CHAPTER 4 .Figure 4 . 12 -

 4412 Figure 4.12 -Auto and cross-correlation functions of sequences X and Y generated by DM-PCNG.

Figure 4 . 13 -

 413 Figure 4.13 -Auto and cross-correlation functions of sequences X and Y generated by CS-PCNG.

108CHAPTER 4 .

 4 DESIGN, IMPLEMENTATION AND ANALYSIS OF PSEUDO-CHAOTIC NUMBER GENERA

  (a) NIST tests results of the proposed CM-SC. (b) NIST tests results of the proposed DM-SC. (c) NIST tests results of the proposed CS-SC.

Figure 4 .

 4 Figure 4.14 -NIST test results of the proposed PCNGs.

110CHAPTER 4 .

 4 DESIGN, IMPLEMENTATION AND ANALYSIS OF PSEUDO-CHAOTIC NUMBER GENERA

  (a) Generation Time of the proposed CM-PCNG. (b) Generation Time of the proposed DM-PCNG. (c) Generation Time of the proposed CS-PCNG.

Figure 4 .

 4 Figure 4.15 -Generation Time of the proposed PCNGs.

112CHAPTER 4 .

 4 DESIGN, IMPLEMENTATION AND ANALYSIS OF PSEUDO-CHAOTIC NUMBER GENERA (a) Bit Rate of the proposed CM-PCNG. (b) Bit Rate of the proposed DM-PCNG. (c) Bit Rate of the proposed CS-PCNG.

Figure 4 . 16 -

 416 Figure 4.16 -Bit Rate of the proposed PCNGs.

  NCpB of the proposed DM-PCNG. (c) NCpB of the proposed CS-PCNG.

Figure 4 . 17 -

 417 Figure 4.17 -NCpB of the proposed PCNGs.

114CHAPTER 4 .Figure 4 . 18 -

 4418 Figure 4.18 -General scheme of a stream cipher.

  19, 4.20 and 4.21. On each one, we show (a) the plain image, (b) the corresponding cipher image, (c) the histogram of the plain image and (d) the histogram of the ciphered image.

Figure 4 .

 4 Figure 4.19 -(a) Lena image, (b) Lena cipher image, (c) the histogram of Lena image and (d) the histogram of the ciphered Lena image.

116CHAPTER 4 .Figure 4 .

 44 Figure 4.20 -(a)Baboon image, (b) Baboon cipher image, (c) the histogram of Baboon image and (d) the histogram of the ciphered Baboon image.

Figure 4 .

 4 Figure 4.21 -(a) Peppers image, (b) Peppers cipher image, (c) the histogram of Peppers image and (d) the histogram of the ciphered Peppers image.

  (a) Distributions of two horizontally adjacent pixels in the plain 'Lena' image (b) Distributions of two horizontally adjacent pixels in the encrypted 'Lena' image (c) Distributions of two vertically adjacent pixels in the plain 'Lena' image (d) Distributions of two vertically adjacent pixels in the encrypted 'Lena' image (e) Distributions of two diagonally adjacent pixels in the plain 'Lena' image (f) Distributions of two diagonally adjacent pixels in the encrypted 'Lena' image

Figure 4 . 22 -

 422 Figure 4.22 -Distributions of two horizontally/ vertically/ diagonally adjacent pixels in the plain and encrypted 'Lena' images.

120CHAPTER 4 .

 4 DESIGN, IMPLEMENTATION AND ANALYSIS OF PSEUDO-CHAOTIC NUMBER GENERA give a comparison of NCpB for the proposed algorithms (for Lena 512 × 512 × 3) with other chaos-based algorithms and the most known stream ciphers [52][28].

Figure 5 . 1 -

 51 Figure 5.1 -Task active state Diagram.

Figure 5 . 2 -

 52 Figure 5.2 -Model of a periodic real-time task

Figure 5 . 3 -

 53 Figure 5.3 -Model of an aperiodic real-time task

Figure 5 . 6 -

 56 Figure 5.6 -General architecture of Xenomai.

Figure 5 .

 5 Figure 5.8 -Tasks Dependency Graph.

#

  include <sys/time.h> #include <time.h> struct timeval start, end; / * absolute times (start/end times) * / double elapsed; void encryption(void * arg){ gettimeofday(&start, NULL); / *** encryption process code *** / gettimeofday(&end, NULL); // the end of time measurement } / * measurement of encryption time in microsecond * / elapsed=((end.tv_sec -start.tv_sec) * 1000000.0)+(end.tv_usec -start.tv_usec) ; rt_printf("Encryption time = %.9lf Microsecond",elapsed);

# 6 -

 6 include <native/task.h> #include <native/timer.h> / * execution time measurements * / double execTime (RT\_TASK * curtask)Execution time measurement using rt_task_inquire method.

A

  Synthèse des travaux réalisés: Sécurité basée Chaos sous contraintes temps réel et d'énergie pour l'Internet des Objets A.1 Contexte et Objectives

A. 2 . 1 1

 21 ère contribution: Conception, mise en oeuvre et analyse de générateurs de nombres pseudo-chaotiques et systèmes de chiffrement par flux La structure générale des PCNG proposés est présentée dans la Fig. A.1. Elle prend comme entrée, les paramètres du système (N et le nombre d'échantillons N s), une clé secrète "K" et un vecteur initial "IV" de taille 32 bits, et comme sortie, elle génère une séquence d'échantillons pseudo-chaotiques X(n), n = 1, 2, ..., chacun quantifié sur N = 32 bits. Les PCNG proposés se composent de quatre fonctions principales: -IV-Setup: bloc de configuration IV; -Key-setup: bloc de configuration de clés secrétes; -Internal function: bloc de fonction interne; -Output function: configuration de sortie. Tous les PCNG proposés ont la même structure générale mais diffèrent dans leur état interne (Internal function) et légèrement leur fonction de configuration de clé, de configuration IV et de sortie (Key-setup, IV-setup and Output function). Chaque bloc fonctionnel sera détaillé dans la description architecturale des PCNG proposés. Dans ce qui suit, nous décrivons en détail la structure générale des PCNG proposés et leurs architectures. Ensuite, nous étudions la sécurité et la performance en termes de vitesse de ces PCNGs. Architecture du CM-PCNG proposé L'architecture du premier générateur chaotique proposé CM-PCNG est donnée dans la Fig. A.2. Il utilise trois cartes chaotiques faiblement couplées: PWLCM, Skew Tent et Logistique; et comprend une technique de multiplexage chaotique. La fonction Key-setup se compose de deux parties principales. Elle prend la clé secrète K et le vecteur initial IV comme entrée et calcule les valeurs initiales Xp(0), Xs(0) et Xl(0) des trois cartes chaotiques: PWLCM, Skewtent et Logistique respectivement. Nous avons réalisé et analysé trois systèmes de chiffrement/déchiffrement par flux nommé CM-SC, DM-SC et CS-SC basés sur les générateurs proposés CM-PCNG, DM-PCNG et CS-PCNG respectivement( voir Fig. A.5). En effet, la sécurité de tout système de chiffrement par flux dépend du caractère aléatoire de la clé (keystream) générée par le PCNG, donc de la robustesse du PCNG utilisé qui est l'élément principal de tout système de chiffrement par flux.

Figure A. 5 -

 5 Figure A.5 -Système de chiffrement/déchiffrement par flux.

Figure A. 6 -

 6 Figure A.6 -(a) Lena Image, (b) Image chiffrée de Lena , (c) tHistogramme de Lena Image et (d) histogramme de l'image chiffrée de Lena.

Figure A. 7 -

 7 Figure A.7 -Résultat du test NIST du système CM-SC.

Table 2 .

 2 1.

	Key lengths Number of rounds Nr
	128 bits	10
	192 bits	12
	256 bits	14

Table 2 .

 2 1 -Key lengths and number of rounds for AES.

Table 2 .

 2

2 -Parameters of the A5/1 Registers.

  [START_REF] Mukherjee | An overview of estream ciphers[END_REF].

	Algorithm 2 KEYSTREAM-GENERATION
	Assume N bits are required...
	for i =0 → N do
	j = imod512
	if (i mod 1024) ≤ 512 then
	P [j] ← P [j] + g 1 (P [j 3], P [j 10], P [j 511])

Table 3 .

 3 3 -P-values and Proportion results of NIST test for the Skew Tent map.

	Test	P-value Proportion
	Frequency test	0.262	93.000
	Block-frequency test	0.000	59.000
	Cumulative-sums test	0.198	91.000
	Runs test	0.081	93.000
	Longest-run test	0.575	99.000
	Rank test	0.000	79.000
	FFT test	0.000	55.000
	Non-periodic-templates	0.531	98.108
	Overlapping-templates	0.760	98.000
	Universal	0.000	88.000
	Approximty entropie	0.575	97.000
	Random-excursions:	0.468	97.645
	Random-excursions-variant 0.369	98.631
	Serial test	0.402	100.000
	Linear-complexity	0.103	98.000
	Generation Time (µs) 422.20
	Bit Rate (Mbits/s)	2368.54
	NCpB	8

Table 3 .

 3 4 -Computing performance of the Skew Tent map.

Table 3 .

 3 5 -P-values and Proportion results of NIST test for the PWLCM map.

	Test	P-value Proportion
	Frequency test	0.994	98.000
	Block-frequency test	0.456	100.000
	Cumulative-sums test	0.856	97.000
	Runs test	0.924	100.000
	Longest-run test	0.720	98.000
	Rank test	0.616	97.000
	FFT test	0.040	93.000
	Non-periodic-templates	0.482	98.838
	Overlapping-templates	0.964	98.000
	Universal	0.868	100.000
	Approximty entropie	0.868	93.000
	Random-excursions:	0.266	97.955
	Random-excursions-variant 0.308	99.495
	Serial test	0.269	93.500
	Linear-complexity	0.046	99.000
	Generation Time (µs) 514.98
	Bit Rate (Mbits/s)	1941.82
	NCpB	10

Table 3 .

 3 6 -Computing performance of the PWLCM map.

Table 3 .

 3 7 -P-values and Proportion results of NIST test for the disturbed Logistic map.

Table 3 .

 3 8 -Computing performance of the disturbed Logistic map. 66CHAPTER 3. PERFORMANCE EVALUATION OF SOME CHAOTIC MAPS AS BASE OF PROPOSED CHAO

	Generation Time (µs) 319.66
	Bit Rate (Mbits/s)	3128.32
	NCpB	7

Table 3 .

 3 9 -P-values and Proportion results of NIST test for the disturbed Skew Tent map.Computing Performance Evaluation Table3.10 shows the computing performance of the disturbed Skew Tent map. We note that the bit rate of a disturbed Skew Tent map is a little less than the bit rate of the Skew Tent map used alone.

	Test	P-value Proportion
	Frequency test	0.616	95.000
	Block-frequency test	0.000	60.000
	Cumulative-sums test	0.252	94.000
	Runs test	0.154	94.000
	Longest-run test	0.456	98.000
	Rank test	0.000	85.000
	FFT test	0.000	54.000
	Non-periodic-templates	0.484	98.108
	Overlapping-templates	0.506	96.000
	Universal	0.000	83.000
	Approximty entropie	0.883	97.000
	Random-excursions:	0.196	98.707
	Random-excursions-variant 0.286	99.713
	Serial test	0.380	99.000
	Linear-complexity	0.554	100.000
	chaotic sequences.
	Generation Time (µs) 448.94
	Bit Rate (Mbits/s)	2227.46
	NCpB	10

Table 3 .

 3 10 -Computing performance of the disturbed Skew Tent map.

Table 3 .

 3 3.5. PERFORMANCE EVALUATION OF SOME DISTURBED CHAOTIC MAPS INCLUDING RECURSIVE TE 11 -P-values and Proportion results of NIST test for the disturbed PWLCM map.

	Test	P-value Proportion
	Frequency test	0.182	100.000
	Block-frequency test	0.163	99.000
	Cumulative-sums test	0.378	100.000
	Runs test	0.154	98.000
	Longest-run test	0.276	98.000
	Rank test	0.225	100.000
	FFT test	0.494	96.000
	Non-periodic-templates	0.504	98.682
	Overlapping-templates	0.401	99.000
	Universal	0.122	99.000
	Approximty entropie	0.033	94.000
	Random-excursions:	0.359	97.461
	Random-excursions-variant 0.422	99.132
	Serial test	0.387	93.000
	Linear-complexity	0.834	98.000
	Generation Time (µs) 523.030
	Bit Rate (Mbits/s)	1960.66
	NCpB	11

Table 3 .

 3 [START_REF]The tent map -wikipedia[END_REF] -Computing performance of the disturbed PWLCM map.

Table 3

 3

	0.000	0.000	0.000	0.000

.

[START_REF] Addabbo | Long period pseudo random bit generators derived from a discretized chaotic map[END_REF]

). The bit rate decreases as the delay increases. This is expected since the number of operations increases as the delay increases.

Table 3 .

 3 15 -P-values and Proportion results of NIST test for the disturbed Logistic map in a recursive structure.

		delay = 1	delay = 2	delay = 3
	Generation Time (µs) 418.830	420.30	421.93
	Bit Rate (Mbits/s)	2387.6036 2379.2529 2370.0614
	NCpB	7.71	7.73	7.76

Table 3 .

 3 [START_REF] Addabbo | Long period pseudo random bit generators derived from a discretized chaotic map[END_REF] -Computing performance of the structure of Fig.3.5.2 with delays equal to 1, 2 and 3 and using the disturbed Logistic map.

Table 3 .

 3 19 -P-values and Proportion results of NIST test for the disturbed Skew Tent map in a recursive structure.

		delay = 1		delay = 2		delay = 3
	Test	P-value Proportion P-value Proportion P-value Proportion
	Frequency test	0.616	93.000	0.494	99.000	0.616	98.000
	Block-frequency test	0.946	96.000	0.262	100.000	0.249	100.000
	Cumulative-sums test	0.617	94.000	0.351	99.000	0.689	98.000
	Runs test	0.172	95.000	0.122	100.000	0.350	98.000
	Longest-run test	0.290	94.000	0.658	98.000	0.596	100.000
	Rank test	0.637	99.000	0.851	99.000	0.596	100.000
	FFT test	0.000	79.000	0.740	100.000	0.401	99.000
	Non-periodic-templates	0.459	97.581	0.530	98.966	0.474	98.831
	Overlapping-templates	0.384	90.000	0.456	99.000	0.898	100.000
	Universal	0.213	96.000	0.071	98.000	0.437	99.000
	Approximty entropie	0.000	81.000	0.145	99.000	0.419	97.000
	Random-excursions:	0.458	99.091	0.454	99.254	0.619	99.180
	Random-excursions-variant 0.437	99.495	0.257	98.259	0.512	99.180
	Serial test	0.000	78.000	0.464	99.500	0.461	97.500
	Linear-complexity	0.437	96.000	0.637	100.000	0.456	98.000
			delay = 1 delay = 2 delay = 3
	Generation Time (µs) 507.23	508.94	529.34
	Bit Rate (Mbits/s)	1971.49 1964.86 1889.14
	NCpB		10.55	10.59	11.01

Table 3 .

 3 [START_REF] Alippi | Lightweight cryptography for constrained devices[END_REF] -Computing performance of the structure of Fig.3.5.2 with delays equal to 1, 2 and 3 and using the disturbed Skew Tent map.

	Correlation coefficient delay = 1 delay = 2 delay = 3
	ρ X S ,X S	0.0013	-0.001	0.0009

Table 3 .

 3 [START_REF] Alligood | Chaos: an introduction to dynamical systems[END_REF] -Correlation coefficient values for sequences generated by the structure of Fig.3.5.2 using the disturbed PWLCM map with delays equal to 1, 2 and 3.

	Chi-square value delay = 1 delay = 2 delay = 3
	χ 2 th	1073.64 1073.64 1073.64
	χ 2 exp	4313.57 947.47	925.11

Table 3 .

 3 [START_REF] Alvarez | New approach to chaotic encryption[END_REF] -Theoretical and experimental values of Chi-square test for sequences generated by the structure of Fig.3.5.2 with delay equal to 1 and using the disturbed PWLCM map.

Table 3 .

 3

	Frequency test	0.182	98.000	0.779	99.000	0.996	98.000
	Block-frequency test	0.419	99.000	0.554	99.000	0.081	97.000
	Cumulative-sums test	0.378	100.000	0.593	99.000	0.720	97.500
	Runs test	0.367	94.000	0.163	99.000	0.213	99.000
	Longest-run test	0.494	92.000	0.012	100.000	0.616	100.000
	Rank test	0.898	99.000	0.637	99.000	0.419	100.000
	FFT test	0.000	78.000	0.779	99.000	0.163	100.000
	Non-periodic-templates	0.457	97.824	0.487	99.027	0.500	98.865
	Overlapping-templates	0.817	94.000	0.834	97.000	0.456	99.000
	Universal	0.868	99.000	0.798	99.000	0.163	98.000
	Approximty entropie	0.000	80.000	0.554	100.000	0.475	99.000
	Random-excursions:	0.579	98.750	0.433	98.694	0.338	98.387
	Random-excursions-variant 0.467	98.778	0.438	98.093	0.355	98.925
	Serial test	0.000	78.000	0.748	98.000	0.647	100.000
	Linear-complexity	0.983	100.000	0.276	100.000	0.679	98.000
	Table 3.23 -P-values and Proportion results of NIST test for the disturbed PWLCM map in a recursive
	structure.
			delay = 1 delay = 2 delay = 3
	Generation Time (µs) 627.55	654.69	694
	Bit Rate (Mbits/s)	1593.49 1527.44 1440.92
	NCpB		13.05	13.62	14.44

[START_REF] Alvarez | Cryptanalysis of an ergodic chaotic cipher[END_REF]

-Computing performance of the structure of Fig.

3

.5.2 with delays equal to 1, 2 and 3 and using the disturbed PWLCM map.

  It is memory-leak analyzer, similar to the LeakTracer tool. It uses the gdb debugger to analysis the code and show the memory leaks. -Valgrind: A free and open-source framework for building dynamic analysis tools, available under the GNU General Public License [13][182]. It is goal is to automatically detect many memory management and threading bugs, and profile programs in detail. Valgrind includes many debugging and profiling tools. An interesting example of these tools is Memcheck [233]. Memcheck detects a wide range of memory problems and is designed primarily to C and C++ programs. It checks all reads and writes of memory and intercept calls to malloc/new/free/delete functions. -Callgrind: A part of Valgrind framework and extension to Cachegrind tool. It is a cache profiler.

. LeakTracer is open-source and available in the Ubuntu software Center. It uses gdb to print out the lines of code that have memory leaks, together with leak count and size. It does not trace malloc etc., but only operator new/delete. -Leak-analyzer:

Table 4 .

 4 2 -Values of D H for the proposed CM-PCNG, DM-PCNG and CS-PCNG.

	PCNG D H
	CM-SC 0.499988
	DM-SC 0.500025
	CS-SC 0.500041

Phase space trajectory or mapping analysis

Table 4

 4 100CHAPTER 4. DESIGN, IMPLEMENTATION AND ANALYSIS OF PSEUDO-CHAOTIC NUMBER GENERA value is 1.107. Also, for sequence X3, the smallest value of P d N (si, tj) is 0.832 and we only have 4 values smaller than 0.88. Likewise, the biggest P d N (si, tj) value is 1.142 and only we have 5 values bigger than 1.10. For sequence X2, we observe that: the smallest value of P d N (si, tj) is 0.246 and there are 34 values smaller than 0.88. Additionally, the highest P d N (si, tj) value is 1.658 and there are 40 values higher than 1.10.

.3 are closer to uniform distribution. Indeed, for sequence X1, the smallest value of P d N (si, tj) is 0.883 and the biggest P d N (si, tj)

Table 4 .

 4 3 -Values of #r i,j and P d N (si, tj) for sequence X1 with N s = 31250 samples.

	#r i,j
	P d N (si, tj)
	325	319	311	314	336	296	314	309	294	296
	1.04	1.020 0.995	1.005	1.075 0.947 1.005 0.989 0.941 0.947
	320	320	325	311	301	295	308	327	301	297
	1.0240 1.024 1.040	0.995	0.963 0.944 0.986 1.046 0.963 0.950
	333	334	341	321	306	316	305	287	333	344
	1.066	1.069 1.0919 1.027	0.979 1.011 0.976 0.918 1.065 1.1
	317	326	315	344	337	346	310	319	334	313
	1.0144 1.043 1.008	1.1008 1.078 1.107 0.992 1.02	1.068 1.001
	325	292	304	331	303	309	297	321	297	303
	1.04	0.934 0.972	1.059	0.969 0.988 0.950 1.027 0.950 0.969
	310	300	324	338	297	301	301	304	295	319
	0.992	0.96	1.036	1.081	0.950 0.963 0.963 0.972 0.944 1.020
	309	333	317	307	293	310	318	327	293	285
	0.988	1.065 1.014	0.982	0.937 0.992 1.017 1.046 0.937 0.912
	298	276	304	328	319	314	310	329	342	286
	0.953	0.883 0.972	1.049	1.02	1.004 0.992 1.052 1.094 0.915
	311	308	341	338	284	298	330	293	331	296
	0.995	0.985 1.091	1.081	0.908 0.953 1.056 0.937 1.059 0.947
	266	299	338	329	306	304	299	289	309	309
	0.851	0.956 1.081	1.052	0.979 0.972 0.956 0.924 0.988 0.988

Table 4 . 4

 44

	#r i,j
	P d N (si, tj)
	291	307	284	293	287	313	332	349	328	353
	0.931 0.982 0.909 0.938	0.918 1.002 1.062 1.117 1.05	1.13
	474	399	415	352	422	205	211	214	184	196
	1.517 1.277 1.328 1.126	1.35	0.656 0.675 0.685 0.589 0.627
	381	344	359	331	361	292	233	224	250	328
	1.219 1.101 1.149 1.059	1.155 0.934 0.746 0.717 0.8	1.05
	328	332	339	452	377	277	292	288	236	210
	1.050 1.062 1.085 1.446	1.206 0.886 0.934 0.922 0.755 0.672
	518	420	421	425	394	169	199	190	214	247
	1.658 1.344 1.347 1.36 0 1.261 0.541 0.637 0.608 0.685 0.790
	77	141	184	211	208	442	428	477	456	438
	0.246 0.451 0.589 0.675	0.666 1.414 1.37	1.526 1.459 1.402
	315	226	210	214	257	350	344	351	368	405
	1.008 0.723 0.672 0.685	0.822 1.12	1.101 1.123 1.178 1.296
	197	298	283	285	276	342	371	387	378	328
	0.63	0.954 0.906 0.912	0.883 1.094 1.187 1.238 1.21	1.05
	216	253	230	200	232	389	365	402	437	411
	0.691 0.81	0.736 0.64	0.742 1.245 1.168 1.286 1.398 1.315
	340	352	378	368	383	283	265	263	284	311
	1.088 1.126 1.21	1.178	1.226 0.906 0.848 0.842 0.909 0.995

-Values of #r i,j and P d N (si, tj) for sequence X2 with N s = 31250 samples.

Besides, compared to results in Table

4

.3, the obtained values of P d N (si, tj) in Table

Table 4 .

 4 5 -Values of #r i,j and P d N (si, tj) for sequence X3 with N s = 31250 samples.

	#r i,j
	P d N (si, tj)
	312	338	291	322	330	289	348	296	323	301
	0.998 1.082 0.931 1.03	1.056 0.925 1.114 0.947 1.034 0.963
	343	343	311	284	306	314	305	337	316	338
	1.098 1.098 0.995 0.909 0.979 1.005 0.976 1.078 1.011 1.082
	295	313	293	297	295	312	312	316	321	286
	0.944 1.002 0.938 0.95	0.944 0.998 0.998 1.011 1.027 0.915
	313	314	318	315	317	307	301	314	287	324
	1.002 1.005 1.018 1.008 1.014 0.982 0.963 1.005 0.918 1.037
	319	292	314	306	337	285	315	357	319	333
	1.021 0.934 1.005 0.979 1.078 0.912 1.008 1.142 1.021 1.066
	299	304	301	343	326	313	314	278	320	298
	0.957 0.973 0.963 1.098 1.043 1.002 1.005 0.89	1.024 0.954
	339	303	313	289	304	310	349	294	318	321
	1.085 0.97	1.002 0.925 0.973 0.992 1.117 0.941 1.018 1.027
	290	319	313	307	312	328	320	290	324	310
	0.928 1.021 1.002 0.982 0.998 1.05	1.024 0.928 1.037 0.992
	319	337	273	298	319	346	298	320	260	315
	1.021 1.078 0.874 0.954 1.021 1.107 0.954 1.024 0.832 1.008
	321	333	313	348	331	292	278	312	297	314
	1.027 1.066 1.002 1.114 1.059 0.934 0.89	0.998 0.95	1.005

Table 4 . 6

 46

	31300 31602 31335 31421 31404 31468 31206 31201 31286 31462
	1.002	1.011	1.003	1.005	1.005	1.007	0.999	0.998	1.001	1.007
	31568 31215 30925 31044 31711 31264 31150 31098 31072 31293
	1.01	0.999	0.99	0.993	1.015	1	0.997	0.995	0.994	1.001
	31425 31076 31270 31229 31304 31279 31287 31068 31073 31020
	1.006	0.994	1.001	0.999	1.002	1.001	1.001	0.994	0.994	0.993
	31375 30950 31126 30988 31286 31380 31203 30913 31221 31396
	1.004	0.99	0.996	0.992	1.001	1.004	0.998	0.989	0.999	1.005
	31475 30911 31154 31304 31411 31362 31286 31506 31358 31427
	1.007	0.989	0.997	1.002	1.005	1.004	1.001	1.008	1.003	1.006
	31395 31360 31380 31601 31251 31458 31173 31380 31096 31440
	1.005	1.004	1.004	1.011	1	1.007	0.998	1.004	0.995	1.006
	31269 31478 31470 31108 31358 31499 31384 31250 31060 30705
	1.001	1.007	1.007	0.995	1.003	1.008	1.004	1	0.994	0.983
	31233 31368 31183 31053 31198 31122 31271 31180 30889 31361
	0.999	1.004	0.998	0.994	0.998	0.996	1.001	0.998	0.988	1.004
	31218 31022 31083 31013 31154 31265 31233 30911 31027 31351
	0.999	0.993	0.995	0.992	0.997	1	0.999	0.989	0.993	1.003
	31427 31357 31105 31077 31117 31438 31388 31351 31195 31206
	1.006	1.003	0.995	0.994	0.996	1.006	1.004	1.003	0.998	0.999

-Values of #r i,j and P d N (si, tj) for sequence X1 with N s = 31250 × 100 samples. #r i,j P d N (si, tj)

Table 4 .

 4 7 -Values of #r i,j and P d N (si, tj) for sequence X2 with N s = 31250 × 100 samples.

	#r i,j
	P d N (si, tj)
	29390	28231 27973	28024 26081 34062	33679 33191 33276	34079
	0.94	0.903	0.895	0.897	0.835	1.089	1.077	1.062	1.065	1.09
	45311	41954 38137	38005 38769 22302	23238 22161 20312	20596
	1.45	1.342	1.22	1.216	1.24	0.714	0.743	0.709	0.65	0.659
	38874	32922 36507	37833 35911 27787	26633 23892 25664	29221
	1.244	1.053	1.168	1.211	1.149	0.889	0.852	0.764	0.821	0.935
	3233 2 33458 38293	43204 40442 29067	28551 29473 23292	20085
	1.035	1.07	1.225	1.382	1.294	0.93	0.914	0.943	0.745	0.643
	4950 3 43437 41164	40803 39851 15716	18061 20104 2286 5 23238
	1.584	1.39	1.317	1.306	1.275	0.503	0.578	0.643	0.732	0.743
	9008	14252 18517	20938 20945 4643 7 46812 47074 45721	43910
	0.288	0.456	0.592	0.67	0.67	1.486	1.498	1.506	1.463	1.405
	2771 1 26873 2516 2 22977 24330 35524	33475 35438 37720	40422
	0.887	0.86	0.805	0.735	0.779	1.137	1.071	1.134	1.207	1.293
	2261 2 28674 29421	27095 27703 35328	35300 37512 35492	34186
	0.724	0.917	0.941	0.867	0.886	1.13	1.13	1.2	1.136	1.094
	20412	25354 24276	21672 23290 40373	37131 38233 39201	39745
	0.653	0.811	0.777	0.693	0.745	1.292	1.188	1.223	1.254	1.272
	32781	35632 35804	37640 37403 27062	26757 26242 2614 5 26693
	1.049	1.14	1.146	1.204	1.197	0.866	0.856	0.84	0.836	0.854

Table 4 .

 4

	31146 31521 31105 31266	31271	31197	31087 31295 31126 31314
	0.996	1.008	0.995	1.0005 1.0006 0.998	0.994	1.001	0.996	1.002
	30845 31019 31233 31041	31203	31163	31504 31388 31448 31321
	0.987	0.992	0.999	0.993	0.998	0.997	1.008	1.004	1.006	1.002
	31486 31101 31323 31267	31331	31405	31134 31124 31362 30858
	1.007	0.995	1.002	1	1.002	1.004	0.996	0.995	1.003	0.987
	31185 31555 31419 31249	31282	31210	31054 31094 31282 31582
	0.997	1.009	1.005	0.999	1.001	0.998	0.993	0.995	1.001	1.010
	31199 31192 31177 31231	31041	31093	31487 31350 31322 31209
	0.998	0.998	0.997	0.999	0.993	0.994	1.007	1.003	1.002	0.998
	31552 30868 31065 31629	31477	31255	31483 31083 31176 31222
	1.009	0.987	0.994	1.012	1.007	1.0001 1.007	0.994	0.997	0.999
	31351 31091 31462 31265	31145	31364	31353 31412 31194 31236
	1.003	0.994	1.006	1.0004 0.996	1.003	1.003	1.005	0.998	0.999
	31151 31154 31302 31529	31112	31528	30971 31345 31340 30790
	0.996	0.996	1.001	1.008	0.995	1.008	0.991	1.003	1.002	0.985
	31177 31043 31094 31358	31277	31226	31745 31194 31236 31390
	0.997	0.993	0.995	1.003	1.003	0.999	1.015	0.998	0.999	1.004
	31236 31621 31211 31076	31162	31370	31055 30937 31254 31335
	0.999	1.011	0.998	0.994	0.997	1.003	0.993	0.989	1.000	1.002

8 -Values of #r i,j and P d N (si, tj) for sequence X3 with N s = 31250 × 100 samples. #r i,j P d N (si, tj)

Table 4 .

 4 9 -Values of the Cumulative Relative Error.

			Ns
	M PCNG	31250	31250 × 10 31250 × 100
	5	CM-PCNG 0.5432 0.1982 DM-PCNG 2.5512 2.3857	0.0651 2.3657
		CS-PCNG 0.7959 0.1812	0.0480
	10	CM-PCNG 4.4869 1.5268 DM-PCNG 23.0597 22.8217	0.4722 22.6401
		CS-PCNG 4.4255 1.6144	0.4498
	and CS-PCNG respectively.

Table 4 .

 4 10 -Theoretical and experimental values of the Chi-Square test for the proposed PCNGs.

	Chi-square test value CM-PCNG DM-PCNG CS-PCNG
	χ 2 th	1073.642	1073.642	1073.642
	χ 2 exp	904.652	960.689	918.988

Table 4 .

 4 11 -Correlation coefficients of the proposed PCNGs.

	Correlation coefficient CM-PCNG DM-PCNG CS-PCNG
	ρ X,Y	0.0025	0.0104	0.0080
	ρ X,Xp	0.0015	0.0078	-0.0034
	ρ X,Xs	-0.0047	0.0150	0.0063
	ρ X,X l	0.0020	-0.0010	/

Table 4 .

 4 [START_REF]The tent map -wikipedia[END_REF] -P-values and Proportion results of NIST for the proposed stream ciphers.

		CM-PCNG	DM-PCNG	CS-SC
	Test	P-value Proportion P-value Proportion P-value Proportion
	Frequency test	0.946	100	0.740	100	0.249	98
	Block-frequency test	0.883	99	0.091	100	0.063	99
	Cumulative-sums test	0.376	100	0.646	100	0.862	98
	Runs test:	0.616	98	0.658	100	0.456	100
	Longest-run test	0.898	100	0.596	99	0.720	100
	Rank test	0.290	99	0.534	98	0.924	100
	FFT test	0.534	100	0.554	100	0.596	98
	Non-periodic-templates	0.483	99.061	0.494	99.088	0.540	98.784
	Overlapping-templates	0.063	100	0.798	100	0.817	98
	Universal	0.172	99	0.040	99	0.720	98
	Approximty entropie	0.419	99	0.097	98	0.972	98
	Random-excursions:	0.335	99.123	0.545	97.656	0.325	98.674
	Random-excursions-variant 0.436	99.318	0.576	99.566	0.273	98.401
	Serial test	0.478	100	0.627	99.5	0.720	99.5
	Linear-complexity	0.249	98	0.262	98	0.475	100

Table 4 .

 4 [START_REF][END_REF] -Speed Performance of CM-PCNG using sequential and parallel implementations.

	Data Size (Byte) Generation Time (µs) Bit Rate (Mbits/s)	NCpB
		Sequential Parallel	Sequential Parallel Sequential Parallel
		Impl.	Impl.	Impl.	Impl.	Impl.	Impl.
	64	4.02	79.56	127.36	6.43	163.31	3082.39
	128	5.69	98.13	179.96	10.43	115.58	1900.93
	256	8.9	95.29	230.11	21.49	90.39	922.96
	512	14.89	96.90	275.08	42.27	75.61	492.07
	1024	27.36	93.51	299.41	87.60	69.47	237.43
	2048	49.63	89.95	330.12	182.14 63.01	108.9
	4096	89.33	99.75	366.81	328.50 56.7	60.38
	8192	144.19	141,03	454.51	464.67 45.76	44.76
	16384	262.31	271,64	499.68	482.52 41.63	43.11
	32768	521.49	359.05	502.68	724.48 41.38	27.38
	65536	782.22	616.22	670.25	850.81 31.03	23.31
	125000	1269.86	1140.89 787.48	876.50 25.19	22.63
	196608	1970.40	1548.23 798.24	1015.91 24.85	19.53
	393216	3930.71	2838.58 800.29	1108.2 24.79	17.9
	786432	7826.19	4279.44 803.89	1470.15 24.68	13.49
	3145728	31229.65 16936.79 805.83	1485.86 24.63	13.35

Table 4 .

 4 14 -Speed Performance of DM-PCNG using sequential and parallel implementations.

	Data Size (Byte) Generation Time (µs) Bit Rate (Mbits/s)	NCpB
	Sequential Parallel Sequential Parallel Sequential Parallel
	Impl.	Impl.	Impl.	Impl.	Impl.	Impl.
	1.92	52.79	266.66	9.69	74.39	2144.59
	2.58	65.16	369.89	15.71	49.98	1323.56
	3.59	98.96	570.47	35.59	34.77	584.39
	6.16	79.45	664.93	51.55	29.83	384.77
	12.03	76.29	680.96	107.37 29.13	184.73
	21.55	84.26	760.27	194.44 26.09	106.97
	42.52	77.00	770.51	425.55 25.74	48.88
	84.72	127.67	773.52	513.32 25.64	38.64
	169.33	222.98	774.03	587.81 25.63	33.75
	337.30	293.37	777.17	893.56 25.52	23.28
	671.59	491.9	780.65	1065.84 25.41	19.52
	1194.58	718.93	837.11	1458.52 24.85	14.26
	1867.03	1293.01 842.44	1621.91 24.69	12.82
	3465.25	2235.05 907.79	1789.66 22.91	11.62
	6413.96	3417.52 980.90	1840.94 21.2	11.3
	25664.74 14827.4 980.56	1697.25 21.08	12.26

Table 4 .

 4 15 -Speed Performance of CS-PCNG using sequential and parallel implementation.

	Data Size (Byte) Generation Time (µs) Bit Rate (Mbits/s)	NCpB
	Sequential Parallel	Sequential Parallel Sequential Parallel
	Impl.	Impl.	Impl.	Impl.	Impl.	Impl.
	1.19	17.47	429.83	29.30	46.15	676.93
	1.92	18.07	531.81	56.67	37.30	350.4
	2.70	16.57	756.84	123.55 26.21	160.56
	4.65	19.43	880.46	210.76 22.5 3	94.12
	8.61	23.41	950.95	349.85 20.86	56.70
	16.56	37.32	989.36	439.65 20.05	45.12
	31.73	62.07	1032.63	527.85 19.2 1	37.58
	62.50	103.73	1048.45	631.74 18.92	31.40
	122.50	170.67	1069.94	767.97 18.54	25.83
	238.26	232.84	1100.21	1125.81 18.03	17.62
	473.36	447.72	1107.58	1171	17.9 1	16.94
	884.22	656.86	1130.94	1522.39 17.54	13.03
	1339.21	994.30	1174.47	1581.88 16.89	12.54
	2492.65	1712.66 1262.69	1836.74 15.71	10.8
	4836.71	3124.03 1300.77	2013.89 15.25	9.85
	18217.75 10656.62 1381.39	2361.52 14.36	8.4

cipher algorithms are adjusted also to encrypt 128 by 128 bits of the plain text. For this, the keystream generator produces 128 bits of keystream to be combined with 128 bits of plain text by an XOR operation. Recall that for each new encryption, a new IV is produced.

From the speed performance of the PCNGs given in Tables 4.13, 4.14 and 4.15, the PCNGs are faster

Table 4 .

 4 [START_REF] Addabbo | Long period pseudo random bit generators derived from a discretized chaotic map[END_REF] -Computing performance of some known pseudo random number generators.

	Pseudo random generator NCpB
	Wang et al., [267]	160
	Akhshani et al., [19]	45
	Abu Taha et al., [112]	17.3
	CM-PCNG	24.68
	DM-PCNG	21.2
	CS-PCNG	12

Table 4 .

 4 17 -D H , NPCR and UACI performance. CR 99.60918 99.60866 99.61024 U ACI 33.46386 33.46330 33.465842 DM-SC D H 0.500017 0.500018 0.500018 N P CR 99.60954 99.60987 99.60899 U ACI 33.469 33.46388 33.47010 CS-SC D H 0.499995 0.499985 0.499995 N P CR 99.60415 99.60412 99.61072 U ACI 33.46402 33.46258 33.46153

		Baboon	Peppers	Lena
	CM-SC D H	0.500022 0.500009 0.500015
	N P

Table 4 .

 4 [START_REF] Akhavan | A symmetric image encryption scheme based on combination of nonlinear chaotic maps[END_REF] -Theoretical and experimental values of the Chi-Square test for the proposed stream ciphers.

		Baboon Peppers Lena
	χ 2 th	293.247 293.247 293.247
	χ 2 exp of CM-SC 211.966 239.10 252.703
	χ 2 exp of DM-SC 267.293 265.37 262.31
	χ 2 exp of CS-SC 253.5	259.1	253.2

Table 4 .

 4 [START_REF] Akhshani | Pseudo random number generator based on quantum chaotic map[END_REF] -Correlation coefficients between pairs of plain and encrypted images.

	Image Direction	Plain Image Ciphered Image Ciphered Image Ciphered Image
				by CM-SC	by DM-SC	by CS-SC
	Lena	Horizontal 0.993176	0.008713	0.00131	-0.00578
		Vertical	0.997055	0.008154	0.00121	-0.00467
		Diagonal	0.988176	0.008324	0.00117	-0.00509
	Baboon Horizontal 0.99233	0.00157	0.00317	0.00278
		Vertical	0.99649	-0.00151	-0.00326	0.00261
		Diagonal	0.98712	-0.00158	-0.00309	0.00273
	Peppers Horizontal 0.96775	0.00320	0.01183	0.00508
		Vertical	0.95753	-0.00309	0.00016	0.00541
		Diagonal	0.93002	-0.00306	0.01480	0.00527

Table 4 .

 4 [START_REF] Alippi | Lightweight cryptography for constrained devices[END_REF] -P-values and Proportion results of NIST for the proposed stream ciphers.

		CM-SC		DM-SC		CS-SC
	Test	P-value Proportion P-value Proportion P-value Proportion
	Frequency test	0.225	100	0.760	98	0.319	98
	Block-frequency test	0.798	99	0.051	93	0.067	100
	Cumulative-sums test	0.696	100	0.527	100	0.657	98
	Runs test:	0.575	100	0.898	100	0.514	99
	Longest-run test	0.137	98	0.596	100	0.760	99
	Rank test	0.798	99	0.367	100	0.067	99
	FFT test	0.554	99	0.154	100	0.249	100
	Non-periodic-templates	0.483	98.966	0.522	99	0.506	99.223
	Overlapping-templates	0.720	100	0.063	98	0.851	99
	Universal	0.834	100	0.276	99	0.130	100
	Approximty entropie	0.740	99.000	0.834	99	0.475	99
	Random-excursions:	0.483	98.321	0.576	99.414	0.364	98.843
	Random-excursions-variant 0.312	98.425	0.615	98.351	0.475	99.383
	Serial test	0.257	99.500	0.519	98.500	0.480	98
	Linear-complexity	0.868	100	0.182	98	0.016	99

Table 4 .

 4 [START_REF] Alligood | Chaos: an introduction to dynamical systems[END_REF] -Speed Performance of the proposed CM-SC stream cipher.

	Data Size (Byte) Encryption Time (µs) Encryption throughput (Mbits/s) NCpB
	512	21.26	183.73	107.96
	1024	37.05	210.86	94.07
	2048	44.28	352.86	56.21
	4096	73.58	424.70	46.71
	256×256×3	2403.04	624.20	31.78
	512×512×3	8511.00	704.97	28.14
	1024×1024×3	32710.50	733.70	27.04

Table 4 .

 4 [START_REF] Alvarez | New approach to chaotic encryption[END_REF] -Speed Performance of the proposed DM-SC stream cipher.

	Data Size (Byte) Encryption Time (µs) Encryption throughput (Mbits/s) NCpB
	512	12.50	312.50	63.48
	1024	23.35	334.58	59.29
	2048	34.70	450.28	44.05
	4096	49.05	637.10	31.14
	256×256×3	2168.31	691.783	28.71
	512×512×3	7267.27	825.6195	24.03
	1024×1024×3	28808.11	833.0987	23.81

Table 4 .

 4 [START_REF] Alvarez | Some basic cryptographic requirements for chaos-based cryptosystems[END_REF] -Speed Performance of the proposed CS-SC stream cipher.

	Data Size (Byte) Encryption Time (µs) Encryption throughput (Mbits/s) NCpB
	512	10.66	384.13	51.64
	1024	18.70	437.89	45.3
	2048	24.54	667.45	29.72
	4096	28.21	1161.40	17.08
	256×256×3	1059.5	1415.76	14
	512×512×3	3964.52	1586.94	12.5
	1024×1024×3	1834964.6	1755.47	11.3

Table 4 .

 4 24 -Comparison of NCpB performance between different algorithms.

	Algorithms	NCpB
	Ref.[17]	321
	Ref.[151]	226
	Ref.[265]	1.77
	CM-SC	28.14
	DM-SC	24.03
	CS-SC	12.5
	AES-CTR	21.2
	Rabbit	9.5
	HC-128	14.4
	Salsa20/12	9.9
	SOSEMANUK 10.5

Table 5 .

 5 2 -Energy consumption (J).

	Stream cipher CM-SC	CS-SC	Rabbit	HC-128
	PKG energy(J) 0.078613 0.022672 0.013855 0.038768
	PP0 (J)	0.036316 0.010297 0.006104 0.020316
	PP1 (J)	0.007568 0.000112 0.000150 0.000030
	DRAM (J)	0.012939 0.002669 0.001648 0.003806
	5.2.3 Measurement of power consumption with PowerTOP tool

Table 5 .

 5 3 -Power consumption in milliwatt (mW).

	Stream cipher	CM-SC CS-SC Rabbit HC-128
	Power Estimation (mW) 3.4	2.9	2.7	3.18

Table 5 .

 5 4 -Code size and RAM consumption (bytes).

	Stream cipher Code size (bytes) RAM consumption (bytes)
	CM-SC	7240	660
	CS-SC	6562	564
	Trivium	5764	1516
	Snow	12861	1741
	Rabbit	1714	216
	HC-128	23100	4556

Table 5 .

 5 5 -Computation performance measurements of stream ciphers implemented in Xenomai RTOS.

	Stream cipher Average encryption time ET (Mbits/s) NCpB
		(µs)
	CM-SC	4695,72	319,44	62.10
	CS-SC	3214,42	466,64	42.51
	Rabbit	1966	762,96	26
	HC-128	3327,06	450,842	44

Table 5 .

 5 6 -Computation performance measurements of stream ciphers implemented in Ubuntu.

	Stream cipher Average encryption time ET (Mbits/s) NCpB
		(µs)
	CM-SC	2403.04	624.2	31.78
	CS-SC	1059.5	1415.76	14
	Rabbit	855.45	1753.46	11.31
	HC-128	1330	1127.81	17.59
	AES-CTR	-	-	21.2

Table A .

 A 1 -Perfermance en termes de vitesse de chiffrement des systèmes proposés. A.2.2 2 ème contribution: Évaluation de la consommation d'énergie et mise en oeuvre en temps réel des systèmes de chiffrement par flux proposés Nous avons étudié la consommation d'énergie et les exigences en termes de mémoire RAM et la taille de code des deux systèmes de chiffrement proposés CM-SC et CS-SC. Pour effectuer ces mesures, nous avons

	Système de chiffrement par flux NCpB
	CM-SC	31.78
	DM-SC	24.03
	CS-SC	14
	Rabbit	11.31
	Hc-128	17.59
	AES-CTR	21.2

Acknowledgements 2 State of the art

Phase space trajectory analysis We draw in Fig. 3.8 the phase space trajectory, the attractor and the discrete variation of a sequence X S (n) generated by the Skew Tent map. This figure shows the signature for the Skew Tent map. In this thesis, we use another software tool which is named "Running Average Power Limit" (RAPL) interface, to measure energy consumption of our proposed algorithms.

Recently, the Intel Company has equipped its systems with a new tool for obtaining fine-grain energy models: on board energy sensors for measuring the energy consumed by on-core hardware components and the energy consumed by the code that runs on these components. Intel introduced these sensors called "Running Average Power Limit" (RAPL) with their Sandy Bridge micro-architecture [START_REF] Corportation | Ia-32 intel architecture software developer's manual[END_REF]. RAPL provides a set of counters which reports energy and power consumption information. RAPL is available in newer versions of the Xeon server-level CPUs. RAPL is not an analog power meter, but rather it uses a software power model. This one estimates energy usage of the CPU-level components, listed in Table 5.1, through hardware performance counters and I/O models [START_REF] Rotem | Power-management architecture of the intel microarchitecture code-named sandy bridge[END_REF]. A specific device in the uncore RAPL_DRAM Memory controller RAPL reports various energy readings measurements that include: the energy consumption of the total processor package (PKG), the total combined energy used by all cores (Power-Plane 0 (PP0) which includes all processor caches) and the energy readings for the DRAM interface (DRAM). Also, some versions of SandyBridge chips report power usage due to the on-board GPU (PP1).

Experiment methodology

The results of RAPL model are available to the user via a model specific register (MSR), with an update frequency on the order of milliseconds [START_REF] Rotem | Power-management architecture of the intel microarchitecture code-named sandy bridge[END_REF]. To access MSRs, we require a ring-0 access to the hardware. Typically, only the OS kernel can do this. This means that accessing the RAPL values needs a kernel driver. Currently, Linux does not provide such a driver. To overcome this problem, we use the "MSR driver" that exports MSR access to user space via a special device driver. When the MSR driver is enabled and given proper read-only permission, the PAPI can access these registers without needing kernel support.

On Linux, the "MSR driver" is not auto-loaded. On modular kernels we might need to use the following command to load it explicitly before use: sudo modprobe msr.

We use the RAPL interface and the MSR driver to measure the energy consumption of the encryption task. Energy consumption presents the difference of the energy amount energy available in the CPU level components before starting and after completing the encryption function.

Experimental results on energy consumption

We have conducted our energy measurement experiment for the two stream-cipher algorithms CM-SC and CS-SC proposed respectively in [START_REF] Jallouli | Design and analysis of two stream ciphers based on chaotic coupling and multiplexing techniques[END_REF] and [START_REF] Jallouli | Robust chaos-based stream-cipher for secure public communication channels[END_REF]. Table 5.2 gives the different average values for energy consumption of the two stream ciphers CM-SC and CS-SC which are compared to that of Rabbit and HC-128.

The different average values of energy consumption are calculated after running 100 times the stream ciphers using 100 different secret keys and the Lena image (256 × 256 × 3). RTAI takes a unique approach of running Linux as a task (lowest priority) that competes with other real-time tasks for the CPU [START_REF] Cloutier | Diapmrtai position paper[END_REF]. RTAI provides deterministic response to POSIX, interrupt, native RTAI real-time task. RTAI consists mainly of two parts:

-The Linux kernel (patch with Adeos-based) which introduces a hardware abstraction layer.

-A broad variety of services which make real-time programmer's lives easier.

The general architecture of RTAI framework is presented in Figure 5.5.

Xenomai

The increased requirements of hard real-time capability lead to develop all kinds of real-time operating systems. All these real-time systems are characterized by their own APIs, which makes developers spending more and more time to learn how to use and familiar with the APIs. Also, developers have to rewrite their code when they run their applications in different RTOSes.

The Xenomai project [START_REF] Gerum | Xenomai-implementing a rtos emulation framework on gnu/linux[END_REF] has been launched in August 2001. It has merged in 2003 with the RTAI project, to produce an industrial-grade real-time Free Software platform for GNU/Linux called RTAI/fusion, on top of Xenomai's abstract RTOS core. Eventually, the RTAI/fusion effort became independent from RTAI in 2005 as the Xenomai project. Xenomai aims to design a new framework that supports traditional real-time operating system APIs. This makes that existing industrial applications from different RTOSes can easily run with stringent response time requirements, on embedded Linux platforms. Xenomai offers hard real-time capabilities to the mainline Linux kernel [14].

Xenomai implements an abstract real-time nucleus to support the traditional real-time APIs. It implement the pseudo APIs in different modules, called skins including VxWorks ® , pSOS ® , VRTX, ulTRON, RTAI and three other skins: POSIX 1003.1b, RTDM and Native skin.

As RTAI, Xenomai uses Adeos as its micro kernel, in order to handle interrupts from the hardware. Adeos is a resource virtualization layer which is available as a Linux kernel patch. In particular, hardware interrupts are intercepted by ADEOS and logically propagated through the pipe structure. This organization is fully achieved in Xenomai as illustrated in Figure 5.6. RTAI has a somewhat different organization, at the point of using ADEOS , as shown in Figure 5.5. Instead of letting ADEOS handle all the interrupt sources, it intercepts them, using ADEOS to propagate those interrupt notifications to Linux in which RTAI is not interested in (i.e., the interrupt does not affect real-time scheduling). In contrast, Xenomai handles all interrupts using ADEOS.

Xenomai can runs on X86, x86-64, PowerPC, ARM, PowerPC64, Blackfin platform Architecture.

In this thesis, we will be interested in Xenomai RTOS for the real-time integration phase of the cryptosystem. Our option for Xenomai is motivated by the following reasons: task is a pointer to an RT_TASK type structure which necessarily has been declared and its structure is filled. -name is an ASCII string for the symbolic name of the task.

-stack_size is the size of the stack to be used by the new task.

priority is the priority to be assigned to the task. The highest priority is 99, while the lowest one is 1. -mode is a set of flags which affect the task. Creation of a Real-time task is described by the following code: -The interface of a semaphore consists of two atomic operations, V and P, which affect an internal counter associated with the semaphore. -The 'V' ("Verhogen" from Dutch, signal, release, increment) operation increments the counter and returns immediately. This is ensured by the function int rt_sem_v (RT _SEM * sem). -The 'P' operation ("Proberen", wait, acquire, take) decrements the counter and returns immediately, unless the counter is already zero and the operation blocks until another process releases the semaphore. This is done by the function int rt_sem_p(RT _SEM * sem, RTIME timeout). The creation and use of semaphores are described in 5. task is a pointer to an RT_TASK type structure which must be already initialized by a call to rt_task_create(). -task_function is the task function to be executed by this real-time task.

arg is the void pointer argument given to the task function.

Measurements under the RTOS Xenomai

The objective of this section is to measure the time required for the execution of the encryption task under Xenomai. We will present two techniques.

Over the years, many different software-and hardware-based timing measurement methods have been developed [START_REF] Stewart | Measuring execution time and real-time performance[END_REF][254], but there is no single best technique. Rather, each technique is a compromise between multiple attributes including [START_REF] Eriksson | Evaluation of static time analysis for cc systems[END_REF]:

• Resolution: it is a representation of the limitations of the timing hardware.

• Accuracy: it represents the closeness of the measured value using a given method of measuring, as compared to the actual time if a perfect measurement was obtained. • Retargetability: a solution suitable for a particular processor and hardware platform might not be directly applicable on another one.

Also we calculated the requirements of the designed stream ciphers in terms of RAM consumption and code size. Our experiment demonstrates that our chaos-based stream ciphers can be efficiently implemented on energy and time constrained resources devices of the IoT where security is a big concern.

The second part of this chapter concerned the integration of the cryto-systems under the real-time Xenomai software framework. Xenomai has many advantages over other real time operating systems. First, it was developed for use in the Linux kernel as a microkernel and it was primarily considered as a migration tool. Second, its principal characteristic is the presence of skins to adapt the source code from another RTOS to the Linux environment extended with Xenomai. Third, it offers an interesting particularity that is the development of real-time applications in user space and not only as modules in kernel space. For Xenomai, the development in kernel space is reserved for real-time RTDM drivers (Real Time Driver Model). We recommend Xenomai in the design, development and running of real-time application on Linux.

We studied the performance of the crypto-systems by calculating the execution time of the encryption task. Table 5.7 exhibits a comparison between the different measurements of the average encryption time, energy consumption, code size and RAM consumption, obtained by the proposed stream ciphers CM-SC and CS-SC and some algorithms of the literature notably Rabbit and HC-128. Results show that CS-SC algorithm has better computing performance than CM-SC algorithm. It consumes less energy and has less memory requirements. Also, these performances are comparable or better than some lightweight stream ciphers of the literature.

Conclusions and Perspectives

Avec ⊕ désigne l'opérateur XOR, lsb(IV ) sont les 32 bits les moins significatifs de IV et L cir [S, q] effectue un déplacement circulaire gauche des q-bits sur la séquence binaire S. Le système est gouverné par l'équation suivante:

Où A présente la matrice de couplage faible:

Où D est la matrice de diffusion binaire:

Et est l'opérateur défini comme suit:

Le choix des échantillons X(n) est contrôlé, comme dans l'équation Eq.(A.5) par un seuil T et l'échantillon chaotique Xth, avec Xth(n) = Xp(n) ⊕ Xs(n). La technique de couplage est basée sur l'utilisation de la matrice A lors du calcul des échantillons Xp(n) et Xs(n). La technique de permutation consiste à utiliser Xp(n -1) comme une entrée de la fonction discrète de la carte SkewTent F s et Xs(n -1) comme entrée de la fonction discrète de la carte PWLCM F p.

Architecture du CS-PCNG proposé

L'équation du systeme est donnée par:

Les échantillons de sortie X(n) sont calculés à partir des échantillons Xp(n) et Xs(n) comme suit:

Réalisation de système de chiffrement par flux basé sur les générateurs proposés et étude de leurs performances cryptographiques

List of perturbation polynomials

List of perturbation polynomials for the Logistic map P -PW -G1 : g1(x) =x 16 + x 12 + x 3 + x + 1, or [16, 12, 3, 1, 0]) P -PW -G3 : g3(x) =x 16 + x 12 + x 7 + x 2 + 1 P -PW -G5 : g5(x) =x 16 + x 9 + x 5 + x 2 + 1 P -PW -G7 : g7(x) = x 16 + x 15 + x 9 + x 4 + 1 P -PW -G9 : g9(x) =x 16 + x 12 + x 9 + x 6 + 1 P -PW -G11 : g11(x) =x 16 + x 10 + x 7 + x 6 + 1 P -PW -G13 : g13(x) =x 16 + x 9 + x 4 + x 3 + 1 P -PW -G2 : g2(x) = x 17 + x 3 + 1 P -PW -G4 : g4(x) =x 17 + x 16 + x 3 + x + 1 P -PW -G6 : g6(x) =x 17 + x 8 + x 7 + x 6 + x 4 + x 3 + 1 P -PW -G8 : g8(x) =x 17 + x 9 + x 8 + x 6 + x 4 + x + 1 P -PW -G10 : g10(x) = x 17 + x 7 + x 4 + x 3 + 1 P -PW -G12 : g12(x) = x 17 + x 12 + x 6 + x 3 + x 2 + x + 1 P -PW -G14 : g14(x) = x 17 + x 11 + x 8 + x 6 + x 4 + x 2 + 1 P -PW -G15 : g15(x) = x 19 + x 5 + x 2 + x + 1 P -PW -G17 : g17(x) =x 19 + x 12 + x 10 + x 9 + x 7 + x 3 + 1 P -PW -G19 : g19(x) =x 19 + x 13 + x 8 + x 5 + x 4 + x 3 + 1 P -PW -G21 : g21(x) = x 19 + x 18 + x 17 + x 16 + x 12 + x 7 + x 6 + x 5 + x 3 + x + 1 P -PW -G23 : g23(x) = x 19 + x 9 + x 8 + x 7 + x 6 + x 3 + 1 P -PW -G25 : g25(x) =x 19 + x 16 + x 15 + x 13 + x 12 + x 9 + x 5 + x 4 + x 2 + x + 1 P -PW -G27 : g27(x) =x 19 + x 18 + x 15 + x 14 + x 11 + x 10 + x 8 + x 5 + x 3 + x 2 + 1 P -PW -G16 : g16(x) =x 23 + x 5 + 1 P -PW -G18 : g18(x) =x 23 + x 12 + x 5 + x 4 + 1 P -PW -G20 : g20(x) =x 23 + x 11 + x 10 + x 7 + x 6 + x 5 + 1 P -PW -G22 : g22(x) =x 23 + x 17 + x 11 + x 5 + 1 P -PW -G24 : g24(x) =x 23 + x 21 + x 7 + x 5 + 1 P -PW -G26 : g26(x) =x 23 + x 5 + x 4 + x + 1 P -PW -G28 : g28(x) = x 23 + x 16 + x 13 + x 6 + x 5 + x 3 + 1

List of perturbation polynomials for the Skew Tent map P -SK -G1 : g1(x) = x 15 + x 13 + x 10 + x + 1, or [15, 13, 10, 1, 0]) P -SK -G3 : g3(x) = x 19 + x 5 + x 2 + x + 1 P -SK -G5 : g5(x) = x 21 + x 2 + 1 P -SK -G7 : g7(x) =x 15 + x 9 + x 4 + x + 1 P -SK -G9 : g9(x) = x 21 + x 14 + x 7 + x 2 + 1 P -SK -G11 : g11(x) = x 17 + x 16 + x 3 + x + 1 P -SK -G13 : g13(x) =x 15 + x 14 + x 12 + x 2 + 1 P -SK -G2 : g2(x) = x 17 + x 3 + x 2 + x + 1 P -SK -G4 : g4(x) = x 23 + x 12 + x 5 + x 4 + 1 P -SK -G6 : g6(x) = x 17 + x 7 + x 4 + x 3 + 1 P -SK -G8 : g8(x) =x 19 + x 9 + x 8 + x 7 + x 6 + x 3 + 1 P -SK -G10 : g10(x) =x 15 + x 7 + x 4 + x + 1 P -SK -G12 : g12(x) = x 21 + x 13 + x 5 + x 2 + 1 P -SK -G14 : g14(x) =x 15 + x 13 + x 10 + x 9 + 1 P -SK -G15 : g15(x) =x 23 + x 5 + x 4 + x + 1 P -SK -G17 : g17(x) =x 15 + x 13 + x 9 + x 6 + 1 P -SK -G19 : g19(x) =x 21 + x 10 + x 6 + x 4 + x 3 + x 2 + 1 P -SK -G21 : g21(x) =x 15 + x 14 + x 9 + x 2 + 1 P -SK -G23 : g23(x) =x 15 + x 13 + x 12 + x 10 + 1 P -SK -G25 : g25(x) = x 15 + x 12 + x 3 + x + 1 P -SK -G27 : g27(x) =x 19 + x 13 + x 8 + x 5 + x 4 + x 3 + 1 P -SK -G16 : g16(x) = x 17 + x 12 + x 6 + x 3 + x 2 + x + 1 P -SK -G18 : g18(x) = x 21 + x 14 + x 7 + x 6 + x 3 + x 2 + 1 P -SK -G20 : g20(x) =x 23 + x 17 + x 11 + x 5 + 1 P -SK -G22 : g22(x) =x 17 + x 9 + x 8 + x 6 + x 4 + x + 1 P -SK -G24 : g24(x) =x 21 + x 8 + x 7 + x 4 + x 3 + x 2 + 1 P -SK -G26 : g26(x) =x 17 + x 8 + x 7 + x 6 + x 4 + x 3 + 1 P -SK -G28 : g28(x) =x 15 + x 13 + x 7 + x 4 + 1

List of perturbation polynomials for the PWLCM map P -PW -G1 : g1(x) =x 16 + x 12 + x 3 + x + 1, or [16, 12, 3, 1, 0]) P -PW -G3 : g3(x) =x 16 + x 12 + x 7 + x 2 + 1 P -PW -G5 : g5(x) =x 16 + x 9 + x 5 + x 2 + 1 P -PW -G7 : g7(x) = x 16 + x 15 + x 9 + x 4 + 1 P -PW -G9 : g9(x) =x 16 + x 12 + x 9 + x 6 + 1 P -PW -G11 : g11(x) =x 16 + x 10 + x 7 + x 6 + 1 P -PW -G13 : g13(x) =x 16 + x 9 + x 4 + x 3 + 1 P -PW -G2 : g2(x) = x 17 + x 3 + 1 P -PW -G4 : g4(x) =x 17 + x 16 + x 3 + x + 1 P -PW -G6 : g6(x) =x 17 + x 8 + x 7 + x 6 + x 4 + x 3 + 1 P -PW -G8 : g8(x) =x 17 + x 9 + x 8 + x 6 + x 4 + x + 1 P -PW -G10 : g10(x) = x 17 + x 7 + x 4 + x 3 + 1 P -PW -G12 : g12(x) = x 17 + x 12 + x 6 + x 3 + x 2 + x + 1 P -PW -G14 : g14(x) = x 17 + x 11 + x 8 + x 6 + x 4 + x 2 + 1 P -PW -G15 : g15(x) = x 19 + x 5 + x 2 + x + 1 P -PW -G17 : g17(x) =x 19 + x 12 + x 10 + x 9 + x 7 + x 3 + 1

Thèse de Doctorat

Ons JALLOULI

Sécurité basée Chaos sous contraintes temps réel et d'énergie pour l'Internet des Objets

Chaos-based security under real-time and energy constraints for the Internet of Things Résumé

De nos jours, la croissance rapide des technologies de l'Internet des Objets (IoT) rend la protection des données transmises un enjeu important. Les dispositifs de l'IoT sont intrinsèquement contraints à la mémoire, à la puissance de traitement et à l'énergie disponible. Ceci implique que la conception de techniques cryptographiques sécurisées, efficaces et légères est cruciale. Dans cette thèse, nous avons étudié la problématique de la sécurité de l'information basée chaos sous contraintes temps réel et d'énergie. À ce sujet, nous avons conçu et implémenté dans un premier temps, trois générateurs de nombres pseudo-chaotiques (PCNGs). Ces PCNGs utilisent une matrice de couplage faible ou une matrice de couplage binaire à forte diffusion entre des cartes chaotiques, et une technique de multiplexage chaotique. Puis, nous avons réalisé trois systèmes de chiffrement/déchiffrement par flux basés sur les PCNGs proposés. L'analyse cryptographique des systèmes chaotiques réalisés a montré leur robustesse contre des attaques connues. La performance obtenue en complexité de calcul met bien en évidence leur utilisation dans des applications temps réel. Dans un second temps, nous avons intégré ces systèmes de chiffrement/déchiffrement chaotiques au sein du système d'exploitation temps réel Xenomai. Enfin, nous avons mesuré la consommation d'énergie et de puissance des trois systèmes chaotiques réalisés ainsi que le temps moyen de chiffrement/déchiffrement.

Abstract

Nowadays, due to the rapid growth of Internet of Things (IoT) towards technologies, the protection of transmitted data becomes an important challenge. The devices of the IoT are very constrained resource in terms of computing capabilities, energy and memory capacities. Thus, the design of secure, efficient and lightweight crypto-systems becomes more and more crucial. In this thesis, we have studied the problem of chaos based data security under real-time and energy constraints. First, we have designed and implemented three pseudo-chaotic number generators (PCNGs). These PCNGs use a weak coupling matrix or a high diffusion binary coupling matrix between chaotic maps and a chaotic multiplexing technique. Then, we have realized three stream ciphers based on the proposed PCNGs. Security performance of the proposed stream ciphers were analysed and several cryptanalytic and statistical tests were applied. Experimental results highlight robustness as well as efficiency in terms of computation time. The performance obtained in computational complexity indicates their use in real-time applications. Then, we integrated these chaotic stream ciphers within the real-time operating system Xenomai. Finally, we have measured the energy and power consumption of the three proposed chaotic systems, and the average computing performance. The obtained results show that the proposed stream ciphers can be used in practical IoT applications.