29 Numerics library [numerics]

A philox_engine random number engine produces unsigned integer random numbers in the closed interval [0, m], where $m=2^w-1$ and the template parameter w defines the range of the produced numbers.

The state of a philox_engine object consists of a sequence X of n unsigned integer values of width w, a sequence K of $n/2$ values of result_type, a sequence Y of n values of result_type, and a scalar i, where

• (1.1)
  X is the interpretation of the unsigned integer counter value $Z:={\sum }_{j=0}^{n-1}{X}_j\cdot 2^{wj}$ of $n\cdot w$ bits,
• (1.2)
  K are keys, which are generated once from the seed (see constructors below) and remain constant unless the seed function ([rand.req.eng]) is invoked,
• (1.3)
  Y stores a batch of output values, and
• (1.4)
  i is an index for an element of the sequence Y.

The generation algorithm returns $Y_i$, the value stored in the $i^{th}$ element of Y after applying the transition algorithm.

The state transition is performed as if by the following algorithm: i = i + 1 if (i == n) { Y = Philox(K, X) // see below Z = Z + 1 i = 0 }

The Philox function maps the length-$n/2$ sequence K and the length-n sequence X into a length-n output sequence Y.

Philox applies an r-round substitution-permutation network to the values in X.

A single round of the generation algorithm performs the following steps:

• (4.1)
  The output sequence $X^{\prime }$ of the previous round (X in case of the first round) is permuted to obtain the intermediate state V: $V_j=X_{f_n\left(j\right)}^{\prime }$ where $j=0,\dots ,n-1$ and $f_n\left(j\right)$ is defined in Table 124.
  Table 124: Values for the word permutation ${\text{f}}_{\text{n}}\text{(j)}$ [tab:rand.eng.philox.f]
  

  🔗	${\text{f}}_{\text{n}}\text{(j)}$		j
  🔗			0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15
  🔗	n	2	0	1
  🔗		4	0	3	2	1
  🔗		8	2	1	4	7	6	5	0	3
  🔗		16	0	9	2	13	6	11	4	15	10	7	12	3	14	5	8	1
  🔗

  [Note 1: 

  For $n=2$ the sequence is not permuted.

  — end note]
• (4.2)
  The following computations are applied to the elements of the V sequence: $X_{2k+0}=\mathrm{mullo}(V_{2k+1},M_k,w)$ $X_{2k+1}=\mathrm{mulhi}(V_{2k+1},M_k,w)xor{key}_k^{q}xor{V}_{2k}$ where:
  • (4.2.1)
    mullo(a, b, w) is the low half of the modular multiplication of a and b: $(\text{a}\cdot \text{b})\mathrm{mod}{2}^w$,
  • (4.2.2)
    mulhi(a, b, w) is the high half of the modular multiplication of a and b: $\left(\lfloor (\text{a}\cdot \text{b})/2^w\rfloor \right)$,
  • (4.2.3)
    $k=0,\dots ,n/2-1$ is the index in the sequences,
  • (4.2.4)
    $q=0,\dots ,r-1$ is the index of the round,
  • (4.2.5)
    ${key}_k^q$ is the $k^{\text{th}}$ round key for round q, ${key}_k^q:=(K_k+q\cdot C_k)\mathrm{mod}{2}^w$,
  • (4.2.6)
    $K_k$ are the elements of the key sequence K,
  • (4.2.7)
    $M_k$ is multipliers[k], and
  • (4.2.8)
    $C_k$ is round_consts[k].

After r applications of the single-round function, Philox returns the sequence $Y=X^{\prime }$.

Mandates:

• (6.1)
  sizeof...(consts) == n is true, and
• (6.2)
  n == 2 || n == 4 || n == 8 || n == 16 is true, and
• (6.3)
  0 < r is true, and
• (6.4)
  0 < w && w <= numeric_limits<UIntType>​::​digits is true.

The template parameter pack consts represents the $M_k$ and $C_k$ constants which are grouped as follows: $[M_0,C_0,M_1,C_1,M_2,C_2,\dots ,M_{n/2-1},C_{n/2-1}]$.

The textual representation consists of the values of $K_0,\dots ,K_{n/2-1},X_0,\dots ,X_{n-1},i$, in that order.