A mechanical true random number generator

Random number generation has become an indispensable part of information processing: it is essential for many numerical algorithms, security applications, and in securing fairness in everyday life. Random number generators (RNGs) find application in many devices, ranging from dice and roulette wheels, via computer algorithms, lasers to quantum systems, which inevitably capitalize on their physical dynamics at respective spatio-temporal scales. Herein, to the best of our knowledge, we propose the first mathematically proven true RNG (TRNG) based on a mechanical system, particularly the triple linkage of Thurston and Weeks. By using certain parameters, its free motion has been proven to be an Anosov flow, from which we can show that it has an exponential mixing property and structural stability. We contend that this mechanical Anosov flow can be used as a TRNG, which requires that the random number should be unpredictable, irreproducible, robust against the inevitable noise seen in physical implementations, and the resulting distribution’s controllability (an important consideration in practice). We investigate the proposed system’s properties both theoretically and numerically based on the above four perspectives. Further, we confirm that the random bits numerically generated pass the standard statistical tests for random bits.


Introduction
Random numbers with ideal properties are known as true random numbers. There is no straightforward way of defining random numbers as their definition varies between different fields and subjects. Random numbers can have finite or infinite sequences, and they can have discrete or continuous densities. A variety of approaches from mathematics [1], dynamical systems [2,3], computer science [4,5], cryptographic theory [6], information theory [7], and entropy generation [8,9] have been proposed to define and quantify randomness.
These definitions include unpredictability as an essential property of random numbers. Furthermore, irreproducibility is a requirement for cryptography applications. Unpredictability implies that random numbers cannot be predicted statistically to any significant degree, while irreproducibility implies that it is practically impossible to consistently reproduce previously generated random numbers without simply storing them. For practical applications, two additional properties are also necessary, namely, distribution controllability and robustness against any kind of perturbation. How to generate true random numbers has been a fundamental and active research topic for many years [10][11][12][13][14]. Even though quantum mechanics presents a promising candidate for generating true random numbers [15], we have investigated the possibility of creating a true random number generator (TRNG) based on deterministic dynamics. This consideration was made in light of the implementation costs and ease of use. In this regard, to the best of our knowledge, no existing random number generator (RNG) in the mechanical scale has been proven to have all four of the properties stated above.

TRNG
We define the properties of a TRNG as follows: • Unpredictability: the autocorrelation of the random number sequence is zero. If the random numbers are used for cryptographic purposes, the following property is required.
• Irreproducibility: the system should be physically implementable. In addition, it should be impossible to generate the identical random number sequence by observing a seed, which is an initial value of the RNG, with finite precision. The properties of a TRNG for practical use are additionally defined as follows: • Distribution controllability: a random number sequence's cumulative distribution function can be obtained explicitly. • Structural stability: the system should be robust against perturbations. Even true random numbers are practically useless if there is no quantitative understanding of their distribution. Random numbers can be explicitly transformed into any other distribution by performing inverse transform sampling, provided their cumulative distribution function can be derived explicitly [24]. Furthermore, dynamical systems typically involve noise-induced phenomena, which implies that even a small amount of perturbation can change their properties [25][26][27]. For instance, it is known that for chaotic systems, noise-induced order phenomena can alter dynamics from being chaotic to periodic [27,28]. Consequently, generating true random numbers requires system robustness against perturbations to ensure unpredictability and irreproducibility. This property is formulated as structural stability in the dynamical systems' context.
RNGs can be categorised as either physical, hybrid, or pseudo RNGs, depending on how they are realized, with each type having different properties. Physical random numbers are generated by physical devices. Carefully designed devices can generate bounded and non-periodic sequences (such as chaotic dynamics). Unpredictable sequences can be generated using quantum mechanics [10,11,29]. Another reason for using physical devices is their irreproducibility; as we can only observe and/or control physical quantities with finite precision, it is impossible to precisely identify practical system states. Thus, the generated random numbers will be irreproducible, if we employ dynamics that expand the distance between the true and observed states over time for an RNG. Pseudo-random numbers are generated over finite and discrete times and spaces (e.g., using a computer). They are not unpredictable in a strict sense because a sequence's periodicity is inevitably bounded by a finite number of possible state combinations. Furthermore, they are not irreproducible because their states can be identified unambiguously if the generation algorithm is known, enabling an identical sequence of random numbers to be generated. Hybrid RNGs combine a PRNG with a physical implementation such as a physical system providing a seed (e.g., by exploiting thermal noise), which can then be used as a parameter for a PRNG algorithm. In such RNGs, quantum mechanical properties, such as radioactive decay, are often used [30]. Hybrid random numbers are considered unpredictable if the seed cannot be identified. However, a seed can be regarded as a discrete value within the finite space of the PRNG, so the numbers are reproducible in a similar way if the seed can be identified. We here review whether or not the existing standard RNGs satisfy our true random number properties. The Mersenne twister [31], a practically important PRNG, has a sufficiently long but finite period derived from the Mersenne prime number. Thus, it is not unpredictable in the aforementioned sense, nor is it irreproducible as, the random number sequence can be identified based on the seed and algorithm used. Blum-Blum-Shub [32] is a typical example of a cryptographically secure PRNG. In such RNGs, the next bit cannot be predicted in polynomial time from the previous bits. However, because it is a PRNG, its unpredictability is restricted by the resources of the computer on which the algorithm is executed. The laser chaos RNG [22] is a very fast and practically useful physical RNG. It can pass the statistical test of the randomness, which is the NIST SP 800-22. However, it has not yet been mathematically proven to be unpredictable, irreproducible, and to have controllable distribution.
Here, we consider the types of dynamical systems that can be candidates for a TRNG. A typical example is a Bernoulli shift map [33]. A shift map involves outputting the digits of a real number represented in a binary notation sequentially; hence, the binary numbers obtained by extracting an arbitrary number of digits will follow a uniform distribution and are also not temporally correlated due to the real number's normality [34]. Therefore, the shift map is unpredictable and irreproducible. Moreover, we can obtain its distribution. Accordingly, if a physically implemented dynamical system is isomorphic to a Bernoulli map, then it will be both unpredictable and irreproducible. For example, dynamical systems that can be transformed into the shift map are a baker map and an Anosov system [33]. Regarding structural stability, a system is structurally stable if it is conjugate to all other nearby systems. Necessary and sufficient conditions for a dynamical system with a compact phase space to be structurally stable have been obtained [35]. The Anosov and Morse-Smale systems are shown to be structurally stable dynamical systems. Therefore, a physically implementable Anosov system is an appropriate candidate for a TRNG. Figure 1(a) shows a triple linkage in which three pairs of disks and rigid rods are coupled and arranged symmetrically. If the disks are also regarded as rigid rods, fixed at the disks' centers, then the triple linkage can be regarded as consisting of three connected double pendulums. Hunt and MacKay [19] showed that a free motion, without friction and potential, of a triple linkage with certain parameters (Anosov parameters) is an Anosov system (Anosov parameters are defined in appendix A). For an Anosov system, we can derive certain properties analytically, such as its ergodicity and structural stability. Particularly, this system is regarded as a geodesic flow of Schwarz P-surface, which has a negative curvature at almost every point, as shown in figure 1(b) [19]. In this case, we can show that a geodesic flow possesses a mixing property, for which the autocorrelation function decays exponentially [36]. Here, the map, which discretizes a geodesic flow with a certain time interval and partition, can be shown to be isomorphic to a Bernoulli shift [37]. Additionally, because the temporal averages coincide with the spatial averages by the ergodicity, we can explicitly obtain the distribution of random numbers from the geometry of the Schwarz P-surface. Therefore, it is reasonable to expect that the triple linkage with Anosov parameters can be used as a TRNG.

Triple-linkage-based RNG
We formulated the RNG based on a continuous-time dynamical system.

Definition 4.1 (Random number (bit) generator).
Let X, f be a continuous-time dynamical system with a phase space X and a flow f. Let x 0 ∈ X denote the seed for the RNG and τ > 0 denote the sampling interval; then, we can define an observation function ϕ : X → R. Further, we can define one-sided infinite sequences {x n } ∈ X N and {y n } ∈ R N as follows: The RNG is given by X, f , x 0 , τ , ϕ , and the one-sided infinite sequence {y n } is the random number sequence it generates. Particularly, if ϕ : X → {0, 1}, then X, f , x 0 , τ , ϕ is referred to as a random bit generator (RBG).
In this study, RNG is based on the free motion of a triple linkage with Anosov parameters. The invariant measure μ appears in the following theorems and its existence is guaranteed if X is compact and f is a continuous function [16]. In this case, μ denotes the volume of X, normalized to be μ (X) = 1.
To investigate the distribution controllability, we start by discussing the RNG's temporal average. If an RNG is ergodic, then its temporal and spatial averages coincide, allowing us to replace this problem with that of discussing the phase space geometry. Because the periodic sampling process of the triple linkage has ergodicity (see appendix B), theorem 4.1 holds.

Theorem 4.1 (Temporal average).
Let (X, f) be the free motion of a triple linkage with Anosov parameters, and μ be an invariant measure under f. For all τ > 0 and ϕ ∈ L 1 (μ), the following equation concerning the random number series {y n } generated by the RNG (X, f, x 0 , τ , ϕ) holds The proof of this theorem is given in appendix B. Based on this theorem, we can investigate the RNG's cumulative frequency distribution, if it is possible to derive the phase space's spatial average analytically. In the phase space of a triple linkage with Anosov parameters, the displacement component is a Schwarz P-surface while the velocity component is a sphere with a radius that depends on the energy. Thus, we can completely understand the phase space's volume. Considering the RBG, if we assume that ϕ = 1 A (the indicator function of A) when A ⊂ X, then we have which is the spatial average of the volume of A. Figure 2 shows the results of the numerical calculations performed for a concrete example, illustrating the relative and cumulative frequency distributions of the triple-linkage RNG X, f , x 0 , 1, θ 1 (detailed conditions of numerical calculations are given in appendix C). The observation function is ϕ = θ 1 in figure 1 (one of the disk angles), and the other state variables are not used. The relative frequency distribution in figure 2 is the Schwarz P-surface's area surface density in the θ 1 direction. The cumulative frequency distribution is given by μ(A(a)) μ(X) , where A can be defined as A(a) = (θ 1 , θ 2 , θ 3 ,θ 1 ,θ 2 ,θ 3 ) ∈ X|θ 1 < a (−π < a < π). Thus, it is obvious that the RNG's cumulative frequency distribution can be expressed in an explicit form, and it is controllable. Particularly, if a = −π/2, 0, π/2, then we can solve this analytically to obtain μ(A(a)) μ(S) = 1/4, 1/2, 3/4 based on the Schwarz P-surface's symmetry.
Having proven controllability, we shall now discuss the RNG's unpredictability.

Theorem 4.2 (Unpredictability of numbers [36]).
Let (X, f) denote a free motion of a triple linkage with Anosov parameters and μ denote a mixing-invariant measure. Then, for the random number series {y n } generated by an RNG X, f , x 0 , τ , ϕ , there exists C 1 , C 2 > 0, such that for all τ > 0 the following equation holds

Theorem 4.3 (Unpredictability of bits
When generating random numbers, theorem 4.2 claims that the absolute value of the autocorrelation function decays exponentially with increasing τ . When generating random bits, theorem 4.3 claims that the random bits can be completely independent, which is the ideal unpredictability for any τ . This is because a geodesic flow on surface of negative curvature is isomorphic to the Bernoulli shift [37] (the proof is given in appendix B). Figure 3(a) shows the numerical results for the autocorrelations of the random numbers generated using ϕ = θ 2 and random bits generated using ϕ = 1 A . Herein, A = {(θ 1 , θ 2 , θ 3 ,θ 1 ,θ 2 ,θ 3 ) ∈ X|θ 2 > 0}, and we used the same conditions as in figure 2. It can be seen that the autocorrelation decays in an oscillatory manner as τ increases, which we suspect is a result of the phase space orbits crossing the A and A c regions at roughly constant intervals. Detail conditions of numerical analysis are given in the appendix C.
Now we turn to irreproducibility by returning to observing or controlling values with finite precision in an RNG. States in a dynamical system are represented by points in the phase space, and if the system is physical in nature, they can be represented by continuous values. Observing a value with finite precision means that we split the phase space and assign a representative value to each split region. Hence, if we can show irreproducibility, the random numbers for any partition must be uniformly distributed, as the following theorem suggests:

Theorem 4.4 (Irreproducibility).
Let (X, f) denote the free motion of a triple linkage with Anosov parameters. Then for any ϕ : X → R and B ⊂ X that satisfies μ(B) > 0, the following equation holds: In theorem 4.4, B denotes a region that has the same state after performing a phase space coarse-graining procedure, and the spatial average of the random numbers in B asymptotically approaches the spatial average in the entire phase space with increasing τ . This means that y n+1 cannot be predicted from y n , since it is observed with finite precision, and hence, the sequence cannot be reproduced.
A quantitative way to evaluate the random numbers' irreproducibility is to measure the uncertainty exponent α [38]. This focuses on the dimensionality of the basin boundary and is defined as follows: where N denotes the phase space's dimensionality and D 0 denotes the fractal dimension of the basin boundary. The uncertainty exponent is a measure of the final state's exponential sensitivity to the initial state. If α = 1, the boundary is said to be smooth and it is clear to which basin every point belongs to. If 0 < α < 1, the boundary is said to be fractal, and if α is sufficiently close to 0, its basins cannot be distinguished from white noise, requiring an infinitely precise initial state to determine the basin to which it belongs. Figure 3(b) shows the numerically calculated uncertainty exponent of the RBG by considering the next random bit, such as the final state in the initial value space. Figure 3(c) illustrates how the partitions of the initial state space change with the sampling interval. These regions are the spaces obtained by projecting the θ 3 > 0 region onto the θ 1 × θ 2 plane. The red and black points represent y 1 = 1 and y 1 = 0, respectively. In (i) τ = 0 and the initial values are directly used, so the upper half is red and the lower half is black. There is no mixing, and the uncertainty exponent is just 1. In (ii), τ = 5 and although mixing is starting to occur, there are still clearly identifiable red and black regions. We can show that initial points close to the configuration space become the same random bits. Even though the unpredictability is high, as the autocorrelation is close to 0 ( figure 3(a)). The sequence is still too easily reproducible because the uncertainty exponent is about 0.8 ( figure 3(b)). In (iii), τ = 10 and the region is divided into several streaks in the θ 2 direction (the direction in which the geodesic flow travels). However, the partition directions are still nonuniform, and the uncertainty exponent is still in the process of decaying and not close to 0. Finally, in (iv), τ = 15 and the uncertainty exponent is asymptotically close to 0, where the results are indistinguishable from white noise. Thus, we can visually confirm that there is no bias in the distribution for any state coarse-graining procedure.
Having established all of the other criteria for a TRNG, we now discuss structural stability. Herein, d(·, ·) denotes the distance between flows. Structural stability guarantees that the perturbed system f is a topological conjugate of the original system g. Therefore, g includes not only a disturbed system but also a system with parameters close to the Anosov parameters. We note that the observation function φ that guarantees the unpredictability of a perturbed system (X, g) is different from the observation function of the original system (X, f ). If we know the conjugation function between f and g, the composite function of f 's observation function and the conjugation function is the observation function that guarantees the unpredictability of a perturbed system (X, g).
Regarding structural stability, we do not consider perturbations that cause states to deviate from the original system's phase space X. For instance, we do not consider a finite-duration frictional force that changes the energy (conserved quantity). However, Anosov properties are preserved by suitable feedback controls against external perturbations, such as friction or potential, and a concrete feedback control formula has been proposed [19,39]. In addition, by controlling the energy level, it is possible to accept these perturbations at an ideally unlimited magnitude of perturbation [19].
Finally, we can further confirm numerically that a simple configuration, such as the RBG shown in figure 3, can pass all NIST SP 800-22 [10] tests (table 1) [21] (detailed conditions of statistical tests are given in appendix D).

Discussion
In this study, we presented the first concrete example of the mathematically proven TRNG based on the mechanical system. It is important to note that our system has some unsuitable points for practical applications. For example, when compared to practical RNGs such as photonic RNGs, the speed of the random number generation is slow, and the size of the device is large. However, we believe that our proposed example has values for studies of physical RNGs because it serves as a prototype that provides fundamental insights into the construction methods and theory of RNGs for various physical devices.
The theory of triple linkages requires further investigation to identify suitable sampling intervals and practical observation functions for generating true random bit sequences. We proved that systems with perturbations are topologically conjugate to the original systems, but the general procedure for obtaining the detailed conjugation function and the observation function requires further study. In particular, if the sampling interval τ is too small, it is expected that the observation function φ that guarantees unpredictability is too complex to implement physically. However, we can obtain the concrete method by introducing a partition of the state space (observation function) such that the induced dynamics on the symbol sequences is a Gibbsian process [40,41]. Note, however, that the exact Bernoulli property is not easy to obtain in the Gibbsian process.
This paper focuses on the physical Anosov system, because we consider unpredictability, irreproducibility, distribution controllability, and structural stability as essential properties of a TRNG. If we only considered unpredictability and irreproducibility, the systems that are isomorphic to a Bernoulli shift would also be candidates of a TRNG. Such systems can be understood by Ornstein's isomorphism theorem [42]. They include Sinai's billiard, ergodic automorphisms of the n-torus, and Anosov flows. In particular, such a class of one dimensional interval maps is called formal chaos [43], and necessary and sufficient conditions are known.
There exist mechanical systems whose randomness has been discussed theoretically. The tossing dice is the most familiar mechanical RNG. In addition, the Galton Board, which is based on a mechanical system, can be also studied as an RNG [44]. Such unpredictability is theoretically explained by the fractal basin boundary and final state sensitivity [38] of the dynamics [44][45][46]. However, its correlation decreasing property, distribution, and structural stability have not yet been discussed theoretically. The Sinai's billiard, which is mentioned above, is also a mechanical system, and its correlation can be theoretically proven to be zero. We note that more research is needed on the relationship between an Anosov based-RNG and other mechanical system based-RNGs in future.

Data availability statement
The data that support the findings of this study are available upon reasonable request from the authors.

Appendix A. Proof that free motion of the triple linkage is Anosov
In this section, we present an outline of Hunt and MacKay [19] proof, which suggests that a triple linkage's free motion forms an Anosov system, to understand its dynamics. We aim to confirm the key theorem presented in [19]. If we define the disks to have radii of l 1 and masses of M, while the rigid rods to have lengths of l 2 and masses m, the triple linkage is an Anosov system. We also assume the masses to be uniformly distributed over the objects' entire structures. This proof focuses on the geometry of the triple linkage's configuration space (displacement space), replacing the dynamics with a geodesic flow in the configuration space without explicitly describing its governing equation. We can derive its phase space dimensionality from the number of constraints existing among its vertices. The dynamics can be described in terms of the orbits of four vertices on R 2 . Each vertex has 2 × 2 degrees of freedom based on displacement and velocity in R 2 . As a result, the phase space can be expressed by a total of 2 × 2 × 4 state variables. As the three constraints existing between the disks and rods restrict their displacements and velocities, for a total of six constraints, the phase space can be described using a Riemannian manifold with 2 × (2 × 4-6) = 4 dimensions, embedded in a Euclidean space having 2 × 2 × 4 dimensions. Therefore, we considered the configuration space of a triple linkage with Anosov length parameters l 1 and l 2 in the theorem A.1. Since the phase space is a four-dimensional space defined by displacements and velocities, we observed that the configuration space is two-dimensional. We denoted the coordinates of the disks' centers as A 1 , A 2 , and A 3 , and the center of the equilateral triangle formed by these three points as O. In addition, we defined the points where the rigid rods were attached to the disks as P 1 , P 2 and, P 3 , and their rotation angles as θ i = ∠OA i P i (i = 1, 2, 3). Additionally, we assumed that l 1 , b 1, which implies that the quantities that are second-order or above can be ignored as being negligible, and defined the triple linkage's configuration as θ i . Its configuration space, extended to include the constraints the disks and rigid rods, can be expressed as cos θ 1 + cos θ 2 + cos θ 3 = b (0 < b 1). (A.1) When b = 0, this is a Schwarz P-surface with genus 3, as shown in figure 1(b). If we assume that m = 0, then the energy metric is proportional to the metric in the Euclidean space θ 1 × θ 2 × θ 3 . Therefore, the triple linkage's free motion can be regarded as flow along a geodesic in the configuration space embedded in the Euclidean space, i.e. a geodesic flow. A sufficient condition for a geodesic flow to be an Anosov flow is that the curvature should be negative over the whole configuration space except at a finite number of points. The Schwarz P-surface has negative curvature everywhere except at six points, which implies that the free motion with these Anosov parameters is an Anosov flow. Further, the Anosov system is structurally stable, indicating that there are other Anosov flows in the neighborhood of this structure. Hunt and MacKay [19] confirmed through numerical analysis that the Gaussian curvature of a configuration space with particular parameters is negative everywhere. This result has been generalised by Pollicott and Magalhães [47], who proved that Anosov systems exist that represent not just a 'triple' linkage, but also an 'nth' linkage. Additionally, Kuznetsov [39] confirmed through numerical analysis that it remains uniformly hyperbolic under a self-rotation control condition.

Appendix B. Proofs of theorems
In this section, we define an RNG based on a dynamical system (not limited to the triple linkage) and discuss its properties to extend our argument to more general dynamical systems. We begin by introducing and proving a theorem about temporal average of random numbers. Proof. Here, we can show that an invariant measure exists by using the Kryrov-Bogolyubov theorem, if X is compact and f is a continuous function [16]. This theorem can then be proven by considering the fact that a discrete-time dynamical system, sampled periodically from a mixing continuous-time dynamical system, is also mixing.
Lemma B.1. Let a continuous-time dynamical system X, f have a mixing invariant measure μ. Then, for any τ with T τ (·) = f τ (·), μ is a mixing invariant measure of the discrete-time dynamical system (X, T τ ).
Here, μ is an invariant measure of (X, T τ ), so we need to prove that μ is a mixing-invariant measure of (X, T τ ).

Proof. We need to prove that lim
where B is a Borel set of X. By the definition of the mixing property of (X, f), the following equation is satisfied for any ϕ, ψ ∈ L 1 (μ): If we denote the indicator function of set A by 1 A , then we can obtain This completes the proof of lemma B.1.
Since having mixing properties is a sufficient condition for ergodicity, the limit on the left-hand side of equation (B.1) exists and coincides with the right-hand side by the individual ergodic theorem [48].
To prove theorem 4.3, which is about the unpredictability of bits, we provide some definitions and theorem. A (finite) partition of X, which is a set, is denoted by α = {A 1 , A 2 , . . . , A a }. Based on this partition α, a i=1 A i = X and A i ∩ A j = δA i ∩ δA j hold, where δA is a boundary of A. A triplet (X, B, μ) expresses a measure space, where μ(X) = 1, and φ : X → X is an invertible measure-preserving function. The partition α is called a generator of φ, if ∞ −∞ φ n α = B, where φ n α = {φ n A 1 , . . . , φ n A a } and α i is the smallest σ-algebra given that all the α i are measurable. The partition α is called to be independent for φ, if for all choices of i j , −n j n, all n

Definition B.1 (Bernoulli shift).
If φ has an independent generator, then φ is called a Bernoulli shift.
Here, (X, B, μ, f ) is a continuous-time dynamical system, so f : R × X → X is a measure preserving flow. Furthermore, to prove theorem 4.3, we give following lemma.

Lemma B.2. If a partition α is independent for φ, then
Proof. Here, we prove the case of n = 1 in equation (B.4), because the case of n = 1 is necessary to prove theorem.4.3. We can prove the case of any n as well as the case of n = 1. For all k = 1, . . . , a, We take the sum of equation (B.5) for k = 1, . . . , a, We prove theorem 4.3 by using the above results.
Proof. The Schwarz P-surface is a torus with genus 3, which is represented by equation We use theorem B.1 to transform (B.6) and lemma B.2 to transform (B.7).
To complete our proofs, we derive the irreproducibility of mixing dynamical systems by setting ψ = 1 B in the mixing definition equation (B.2).

Appendix C. Numerical analysis
We hereby present a detailed discussion of the numerical analysis conducted. The parameters of our triple linkage are Anosov parameters. This means that l 1 → 0, l 2 → 1, and m → 0, where l 1 denotes the radius of disks, l 2 denotes the length of the rigid rods, and m denotes the mass of the rigid rods. For these parameters, the configuration space of the triple linkage is This is a Schwarz P-surface. In addition, free motion of the triple linkage can be regarded as a geodesic flow on the configuration space. Therefore, a governing equation of our triple linkage is where Γ is derived from the second derivative of F. We chose the fourth-order Runge-Kutta method as the numerical integration method for solving equation (C.2). The differential equation of equation (C.2) has two conserved quantities those are F (θ 1 , θ 2 , θ 3 ) and K(θ 1 ,θ 2 ,θ 3 ) = 1 2 (θ 2 1 +θ 2 2 +θ 2 3 ). We chose a sufficiently small time step so that the conserved quantities experienced almost no change.
The calculation of figure 2 can now be explained. If a number of random numbers N is sufficiently large, using the first to Nth random numbers {y 1 , . . . , y N } generated from one seed x 0 is equivalent to using N random numbers generated from N different seeds, because X, f is ergodic. The bin width of the histogram is π/50 and the bin height normalized by the number of random numbers N is represented as a relative frequency. The histogram in figure 2 is made using one million random numbers {y 1 , . . . , y 1000 000 } generated from the RNG X, f , x 0 , 1, θ 1 , where X, f is the free motion of a triple linkage with Anosov parameters, the seed x 0 is chosen randomly from points on energy level 1, sampling interval τ is 1, and θ 1 is one of the disk's angles of the triple linkage. Therefore, the area of histogram equals one and the cumulative relative frequency shows a value of the ratio below the horizontal axis value in N = 1000 000.
To complete this section, we shall explain the calculation of figure 3. The observation functions of our RNG and RBG are θ 2 and ϕ = 1 A , respectively, where, A = (θ 1 , θ 2 , θ 3 ,θ 1 ,θ 2 ,θ 3 ) ∈ X|θ 2 > 0 . The following autocorrelations are calculated from one million random numbers and bits {y 1 , . . . , y 1000 000 } with a seed and a sampling interval τ = 0. (C. 3) The calculation of the uncertainty exponent in figure 3(b) can be explained by defining the uncertainty exponent α = N − D 0 , where N denotes the dimensionality of the space where the basins are projected and D 0 denotes a fractal dimension of the basin boundaries. We consider θ 1 × θ 2 as space, so N = 2. We use the box-counting dimension as D 0 and defined the dimension as follows: where ε denotes length of boxes and N(ε) is a number of boxes included within the basin boundary. From the numerical calculations performed, we cannot get ε that is close to 0, so instead, we calculated slopes of the log-log plot of ε versus N(ε). In figure 3(b), uncertainty exponents can be calculated from ten different box sizes ε = π/200, π/180, . . . , π/20 and N(ε) can be calculated from 100 grid points in each box. In figure 3(c), random bits are plotted on the grid points with intervals 0.005 in θ 1 × θ 2 space.

Appendix D. Statistical tests
This section explains the settings and results of conducting statistical tests for random numbers on our triple-linkage-based RNG. In this paper, we presented the existence of a structure with ideal properties while showing that it can produce random bits with particular properties in certain cases. To investigate its properties in practice, we also carried out the tests specified in the NIST SP800-22 [21]. NIST SP800-22 tests the suitability of RBGs, and its 15 tests have been used to evaluate a variety of RBGs and pseudo-RBGs [22,23]. Statistics were calculated based on multiple sequences of random bits generated by the same RBG, and this involved calculating the p-value, or probability that the statistics generated by the random bit sequences were biased. Each test was either passed or failed depending on the uniformity of the p-values and the proportion of sequences with p-values greater than 0.01. Thus, the NIST SP800-22 tests not only showed that the random bit sequences have suitable statistical properties, but also whether the RBG can generate extremely biased sequences.
The construction of the RBG was the same as shown the one in figure 3 and its sampling interval was τ = 30. We generated a thousand 1000 000 bits random bit sequences from different seeds. When numerical calculations run for extended periods, numerical errors may cause quantities that should be conserved to not be preserved. To deal with this issue, we employed the projection method within the Runge-Kutta methods [49]. The projection method is a numerical calculation algorithm for ordinary differential equations that projects the state onto a manifold when the distances between it, the energy set, and the configuration space (conserved quantities) exceed given thresholds. Table 1 shows the results of the tests. For tests involving multiple conditions, the lowest p-value is shown. Passing each test required that p − value > 0.0001 and that the proportion of random bit sequences for which the p-value was 0.01 or more (0.01 significance level) was within the range 0.99 ± 0.009 4392. In this manner, our RBG passed all the tests, indicating that this approach could be applied in practice.