Recommendation for Random Number Generation Using Deterministic Random Bit Generators

Probably not a substantial claim: may not pass S3 (load-bearing).

Each DRBG mechanism has restrictions on the security strength it can support, based on its design.

“Each DRBG mechanism has restrictions on the security strength it can support, based on its design (see Section 10).”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

This Recommendation specifies several DRBG mechanisms, all of which provided acceptable security when this Recommendation was published.

“This Recommendation specifies several DRBG mechanisms, all of which provided acceptable security when this Recommendation was published.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The DRBG mechanisms specified in this Recommendation support four security strengths: 112, 128, 192 or 256 bits.

“The DRBG mechanisms specified in this Recommendation support four security strengths: 112, 128, 192 or 256 bits.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Each DRBG mechanism includes one or more cryptographic primitives (i.e., a hash function or block cipher algorithm).

“Each DRBG mechanism includes one or more cryptographic primitives (i.e., a hash function or block cipher algorithm).”

Probably not a substantial claim: may not pass S3 (load-bearing).

The DRBG mechanisms have been specified so that input with full entropy is not required.

“Ideally, the entropy input would have full entropy; however, the DRBG mechanisms have been specified so that input with full entropy is not required.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

A nonce may be required in the construction of a seed during instantiation to provide a security cushion to block certain attacks.

“A nonce may be required in the construction of a seed during instantiation in order to provide a security cushion to block certain attacks.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The intent of a personalization string is to introduce additional input into the instantiation of a DRBG.

“The intent of a personalization string is to introduce additional input into the instantiation of a DRBG.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

A DRBG does not provide output until a seed is available, and the internal state has been initialized.

“Note that a DRBG does not provide output until a seed is available, and the internal state has been initialized (see Section 10).”

Probably not a substantial claim: may not pass S3 (load-bearing).

A DRBG does not rely on a personalization string to provide entropy.

“Note that a DRBG does not rely on a personalization string to provide entropy, even though entropy could be provided in the personalization string”

Classified as probably not a substantial claim.

The nonce provides greater assurance that the DRBG provides security_strength bits of security to the consuming application.

“The nonce provides greater assurance that the DRBG provides security_strength bits of security to the consuming application.”

Probably not a substantial claim: may not pass S4 (based).

Random number generation does not require interoperability between two entities; communicating entities may use different DRBG mechanisms without affecting their ability to communicate.

“Random number generation does not require interoperability between two entities, i.e., communicating entities may use different DRBG mechanisms without affecting their ability to communicate.”

Probably not a substantial claim: may not pass S4 (based).

In some consuming applications, a single DRBG compromise could reveal long-term secrets (e.g., a compromise of the DSA per-message secret could reveal the signing key).

“In some consuming applications, a single DRBG compromise could reveal long-term secrets (e.g., a compromise of the DSA per-message secret could reveal the signing key).”

Classified as probably not a substantial claim.

A DRBG produces pseudorandom bits, rather than random bits, because of the deterministic nature of the process.

“Because of the deterministic nature of the process, a DRBG is said to produce pseudorandom bits, rather than random bits.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based). May combine two claims.

The security provided by an RBG that uses a DRBG mechanism is a system implementation issue; both the DRBG mechanism and its randomness source must be considered when determining whether the RBG is appropriate for use by consuming applications.

“The security provided by an RBG that uses a DRBG mechanism is a system implementation issue; both the DRBG mechanism and its randomness source must be considered when determining whether the RBG is appropriate for use by consuming applications.”

Classified as probably not a substantial claim.

Reseeding is a means of restoring the secrecy of the output of the DRBG if a seed or the internal state becomes known.

“Reseeding is a means of restoring the secrecy of the output of the DRBG if a seed or the internal state becomes known.”

Classified as probably not a substantial claim.

The secrecy of the entropy input and the seed provides the basis for the security of the DRBG.

“The secrecy of this information provides the basis for the security of the DRBG.”

Probably not a substantial claim: may not pass S4 (based).

If the seed is kept secret and the algorithm is well designed, the bits output by the DRBG will be unpredictable, up to the instantiated security strength of the DRBG.

“If the seed is kept secret, and the algorithm is well designed, the bits output by the DRBG will be unpredictable, up to the instantiated security strength of the DRBG.”

Probably not a substantial claim: may not pass S4 (based).

Generating too many outputs from a seed (and other input information) may provide sufficient information for successfully predicting future outputs.

“Generating too many outputs from a seed (and other input information) may provide sufficient information for successfully predicting future outputs (see Section 8.8).”

Probably not a substantial claim: may not pass S2 (checkable).

The presence of more entropy than is required, especially during the instantiation, will provide a higher level of assurance than the minimum required entropy.

“The presence of more entropy than is required, especially during the instantiation, will provide a higher level of assurance than the minimum required entropy.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The DRBG reseed specifications within this Recommendation are designed to produce a new seed that is determined by both the old seed and newly obtained entropy input that will support the desired security strength.

“The DRBG reseed specifications within this Recommendation are designed to produce a new seed that is determined by both the old seed and newly obtained entropy input that will support the desired security strength.”

Classified as probably not a substantial claim.

If a DRBG were instantiated many times without a nonce, a compromise could become more likely.

“If a DRBG were instantiated many times without a nonce, a compromise could become more likely.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The security of the DRBG itself does not rely on the secrecy of other inputs (nonce, personalization string, additional input).

“This information may or may not be required to be kept secret by a consuming application; however, the security of the DRBG itself does not rely on the secrecy of this information.”

Probably not a substantial claim: may not pass S2 (checkable).

In the event that new attacks are found on a particular class of DRBG mechanisms, a diversity of approved mechanisms will allow a timely transition to a different class of DRBG mechanism.

“However, in the event that new attacks are found on a particular class of DRBG mechanisms, a diversity of approved mechanisms will allow a timely transition to a different class of DRBG mechanism.”

Probably not a substantial claim: may not pass S4 (based).

If a DRBG instantiation was initially seeded with sufficient entropy, and the randomness source subsequently fails without being detected, then a new instantiation using the same (failed) source would not have sufficient entropy to operate securely.

“If a DRBG instantiation was initially seeded with sufficient entropy, and the randomness source subsequently fails without being detected, then a new instantiation using the same (failed) source would not have sufficient entropy to operate securely.”

Classified as probably not a substantial claim. May combine two claims.

Periodic reseeding will reduce security risks, reducing the likelihood of a compromise of the data that is protected by cryptographic mechanisms that use the DRBG.

“Periodic reseeding will reduce security risks, reducing the likelihood of a compromise of the data that is protected by cryptographic mechanisms that use the DRBG.”

Classified as probably not a substantial claim. May combine two claims.

Seeds have a finite seedlife (i.e., the number of outputs that are produced during a seed period); the maximum seedlife is dependent on the DRBG mechanism used.

“Seeds have a finite seedlife (i.e., the number of outputs that are produced during a seed period); the maximum seedlife is dependent on the DRBG mechanism used.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Knowledge of the personalization string by an adversary does not degrade the security strength of a DRBG instantiation, as long as the entropy input is unknown.

“knowledge of the personalization string by an adversary does not degrade the security strength of a DRBG instantiation, as long as the entropy input is unknown.”

• AssumptionRests on an assumption: The security of the DRBG depends on the secrecy of the entropy input.

Classified as probably not a substantial claim. May combine two claims.

Having more entropy than the assessed amount is acceptable; having less entropy than the assessed amount could be fatal to security.

“Having more entropy than the assessed amount is acceptable; having less entropy than the assessed amount could be fatal to security.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Validations by a NVLAP-accredited laboratory provide a higher level of assurance that the DRBG mechanism is correctly implemented.

“Such validations provide a higher level of assurance that the DRBG mechanism is correctly implemented.”

Probably not a substantial claim: may not pass S4 (based).

The simple discard method produces a random number a with no skew (no bias).

“This method produces a random number a with no skew (no bias).”

Probably not a substantial claim: may not pass S3 (load-bearing).

When the reseed function returns an error, the indicated instantiation will not have been reseeded (i.e., the internal state will not have been injected with fresh entropy).

“When the reseed function returns an error (see Section 9.2), the indicated instantiation will not have been reseeded (i.e., the internal state will not have been injected with fresh entropy).”

Probably not a substantial claim: may not pass S3 (load-bearing).

Since SHA-224 is based on SHA-256, there is no efficiency benefit when using SHA-224 rather than SHA-256.

“Note that since SHA-224 is based on SHA-256, there is no efficiency benefit when using SHA-224, rather than SHA-256.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The complex discard method may have better overall performance than the simple discard method if many random numbers are needed.

“The complex discard method may have better overall performance than the simple discard method if many random numbers are needed.”

Classified as probably not a substantial claim.

An amount of entropy that is sufficient to support the security strength of the DRBG being reseeded (i.e., an amount that is at least equal to the security strength) must be provided to the DRBG in a way that ensures that knowledge of the current DRBG internal state does not allow an adversary any useful knowledge about future DRBG internal states or outputs.

“That is, an amount of entropy that is sufficient to support the security strength of the DRBG being reseeded (i.e., an amount that is at least equal to the security strength) must be provided to the DRBG in a way that ensures that knowledge of the current DRBG internal state does not allow an adversary any useful knowledge about future DRBG internal states or outputs.”

• AssumptionThe authors state this as an assumption: The adversary is incapable of performing work that matches the claimed security strength of the RBG.

Probably not a substantial claim: may not pass S3 (load-bearing).

Since SHA-384, SHA-512/224 and SHA-512/256 are based on SHA-512, there is no efficiency benefit for using these three SHA mechanisms rather than using SHA-512.

“Also note that since SHA-384, SHA-512/224 and SHA-512/256 are based on SHA-512, there is no efficiency benefit for using these three SHA mechanisms, rather than using SHA-512.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The complex discard method coincides with the simple discard method when t = 1.

“The complex discard method coincides with the simple discard method when t = 1.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

If the additional input is kept secret and has sufficient entropy, the input can provide more assurance when recovering from the compromise of the entropy input, the seed or one or more DRBG internal states.

“If the additional input is kept secret and has sufficient entropy, the input can provide more assurance when recovering from the compromise of the entropy input, the seed or one or more DRBG internal states.”

Probably not a substantial claim: may not pass S3 (load-bearing).

A possible disadvantage of the simple discard method, in general, is that the time needed to generate such a random a is not a fixed length of time because of the conditional loop.

“A possible disadvantage of this method, in general, is that the time needed to generate such a random a is not a fixed length of time because of the conditional loop.”

Classified as probably not a substantial claim. May combine two claims.

The hash-based DRBG mechanisms specified in this Recommendation have been designed to use any approved hash function and may be used by consuming applications requiring various security strengths, providing that the appropriate hash function is used and sufficient entropy is obtained for the seed.

“The hash-based DRBG mechanisms specified in this Recommendation have been designed to use any approved hash function and may be used by consuming applications requiring various security strengths, providing that the appropriate hash function is used and sufficient entropy is obtained for the seed.”

Probably not a substantial claim: may not pass S3 (load-bearing).

In accordance with Table 2 in Section 10.1, security strengths of 112, 128, 192 and 256 bits may be instantiated.

“In accordance with Table 2 in Section 10.1, security strengths of 112, 128, 192 and 256 bits may be instantiated.”

• cites Table 2 in Section 10.1Not checked yet

  Not checked in the free run.

Classified as probably not a substantial claim.

Entropy input used for testing shall not be used for normal operational use.

“Therefore, entropy input used for testing shall not be used for normal operational use.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Any entropy input used for testing (either for validation testing or health testing) may be publicly known.

“Note that any entropy input used for testing (either for validation testing or health testing) may be publicly known.”

Probably not a substantial claim: may not pass S4 (based).

Reseeding will insert additional entropy into the generation of pseudorandom bits.

“Reseeding will insert additional entropy into the generation of pseudorandom bits.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

The Get_entropy_input call could return a status of ERROR_FLAG to indicate that entropy is currently unavailable, and could return CATASTROPHIC_ERROR_FLAG to indicate that an entropy source failed.

“The Get_entropy_input call could return a status of ERROR_FLAG to indicate that entropy is currently unavailable, and could return CATASTROPHIC_ERROR_FLAG to indicate that an entropy source failed.”

Probably not a substantial claim: may not pass S3 (load-bearing).

In accordance with Table 2 in Section 10.1, the 112-and 128-bit security strengths may be instantiated.

“In accordance with Table 2 in Section 10.1, the 112-and 128-bit security strengths may be instantiated.”

• cites Table 2 in Section 10.1Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

A DRBG implementation shall perform self-tests to obtain assurance that the DRBG continues to operate as designed and implemented (health testing).

“A DRBG implementation shall perform self-tests to obtain assurance that the DRBG continues to operate as designed and implemented (health testing).”

Classified as probably not a substantial claim.

If r/2^m is close to 1, then the simple discard method is simple and efficient.

“If r/2 m is close to 1, then the above method is simple and efficient.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

The error codes may provide information about the reason for the error; for example, when ERROR_FLAG is returned because of an incorrect input parameter, the ERROR_FLAG may indicate the problem.

“The error codes may, in fact, provide information about the reason for the error; for example, when ERROR_FLAG is returned because of an incorrect input parameter, the ERROR_FLAG may indicate the problem.”

Probably not a substantial claim: may not pass S4 (based).

The complex discard method produces random numbers (a0, a1, ..., at-1) with no skew.

“This method produces random numbers (a 0 , a 1 , … , a t-1 ) with no skew.”

Probably not a substantial claim: may not pass S3 (load-bearing).

A possible disadvantage of the complex discard method, in general, is that the time needed to generate these numbers is not a fixed length of time because of the conditional loop.

“A possible disadvantage of this method, in general, is that the time needed to generate these numbers is not a fixed length of time because of the conditional loop.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The simple modular method can be coded to take constant time.

“The simple modular method can be coded to take constant time.”

Probably not a substantial claim: may not pass S3 (load-bearing).

A DRBG does not rely on additional input to provide entropy.

“Note that a DRBG does not rely on additional input to provide entropy, even though entropy could be provided in the additional input”

Probably not a substantial claim: may not pass S3 (load-bearing).

The use of additional input may be a means of providing more entropy for the DRBG internal state that will increase assurance that the entropy requirements are met.

“The use of additional input may be a means of providing more entropy for the DRBG internal state that will increase assurance that the entropy requirements are met.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

The ratio r/2^m is a measure of the efficiency of the simple discard technique, and this ratio will always satisfy 0.5 < r/2^m ≤ 1.

“The ratio r/2 m is a measure of the efficiency of the technique, and this ratio will always satisfy 0.5 < r/2 m ≤ 1.”

Classified as probably not a substantial claim.

Prediction resistance can be provided when the randomness source is or has direct or indirect access to an entropy source or an NRBG.

“Prediction resistance can be provided when the randomness source is or has direct or indirect access to an entropy source or an NRBG (see Section 8.6.5).”

• AssumptionThe authors state this as an assumption: The adversary is incapable of performing work that matches the claimed security strength of the RBG.

May combine two claims.

The ratio r^t/2^m is a measure of the efficiency of the complex discard technique, and this ratio will always satisfy 0.5 < r^t/2^m ≤ 1.

“The ratio r t /2 m is a measure of the efficiency of the technique, and this ratio will always satisfy 0.5 < r t /2 m ≤ 1.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

A personalization string might contain values unknown to an attacker, or values that tend to differentiate this DRBG instantiation from all others.

“This personalization string might contain values unknown to an attacker, or values that tend to differentiate this DRBG instantiation from all others.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Without the explicit prediction resistance request, the entropy input could be provided from either a DRBG with no access to an entropy source (i.e., fresh entropy would not be provided), or the entropy input could be provided by an entropy source or by an RBG with access to an entropy source (i.e., fresh entropy would be provided in these cases).

“Without the explicit prediction resistance request, the entropy input could be provided from either a DRBG with no access to an entropy source (i.e., fresh entropy would not be provided), or the entropy input could be provided by an entropy source or by an RBG with access to an entropy source (i.e., fresh entropy would be provided in these cases).”

Probably not a substantial claim: may not pass S4 (based).

Backtracking resistance can be provided by ensuring that the DRBG generation algorithm is a one-way function.

“Backtracking resistance can be provided by ensuring that the DRBG generation algorithm is a one-way function.”

• AssumptionThe authors state this as an assumption: The adversary is incapable of performing the work required to negate the claimed security strength of the DRBG.

Classified as probably not a substantial claim.

Prediction resistance can be provided only by ensuring that a DRBG is effectively reseeded with fresh entropy between producing output for consecutive DRBG requests.

“Prediction resistance can be provided only by ensuring that a DRBG is effectively reseeded with fresh entropy between producing output for consecutive DRBG requests.”

• AssumptionThe authors state this as an assumption: The adversary is incapable of performing work that matches the claimed security strength of the RBG.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

All DRBG mechanisms in this Recommendation have been designed to provide backtracking resistance.

“All DRBG mechanisms in this Recommendation have been designed to provide backtracking resistance.”

• AssumptionThe authors state this as an assumption: The adversary is incapable of performing the work required to negate the claimed security strength of the DRBG.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Health tests on the DRBG mechanism shall be implemented within a DRBG mechanism boundary or sub-boundary in order to determine that the process continues to operate as designed and implemented.

“Health tests on the DRBG mechanism shall be implemented within a DRBG mechanism boundary or sub-boundary in order to determine that the process continues to operate as designed and implemented.”

Classified as probably not a substantial claim.

If r/2^m is close to 0.5, then the simple discard method is less efficient.

“However, if r/2 m is close to 0.5, then the simple discard method is less efficient”

Probably not a substantial claim: may not pass S3 (load-bearing).

Each HMAC_DRBG generate request involves additional overhead equivalent to processing 2048 extra bits with SHA-256.

“Each generate request also involves additional overhead equivalent to processing 2048 extra bits with SHA-256.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

A general-purpose hash function implementation can always be used to implement HMAC.

“However, a general-purpose hash function implementation can always be used to implement HMAC.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

When instantiation is performed using this method, a nonce is required, whereas using the method in Section 10.2.1.3.1 does not require a nonce, since full entropy is provided when using that method.

“When instantiation is performed using this method, a nonce is required, whereas using the method in Section 10.2.1.3.1 does not require a nonce, since full entropy is provided when using that method.”

May combine two claims.

For an attacker who sees 2^64 bits of output from TDEA CTR_DRBG across at least one reseed, the TDEA CTR_DRBG received 2^45 generate requests; an ideal random sequence has a probability of about 2^-6 of having a duplicate block in one of the generate outputs, while CTR_DRBG outputs will never have one.

“In this case, the TDEA CTR_DRBG received 2 45 generate requests.An ideal random sequence has a probability of about 2 -6 of having a duplicate block in one of the generate outputs; the CTR_DRBG outputs will never have one.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

If the hash function is replaced by a random oracle, Hash_DRBG is secure.

“If the hash function is replaced by a random oracle, Hash_DRBG is secure.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

CTR_DRBG is parallelizable.

“Furthermore, CTR_DRBG is parallelizable.”

May combine two claims.

For AES CTR_DRBG, each generate request may produce no more than 2^19 bits, which means 2^12 128-bit blocks; in an ideal random sequence of 2^12 128-bit blocks, the probability that any two blocks will be the same is approximately 2^-105; AES CTR_DRBG will never provide a generate output with duplicate blocks.

“The case for AES CTR_DRBG is similar: each generate request may produce no more than 2 19 bits, which means 2 12 128-bit blocks.In an ideal random sequence of 2 12 128-bit blocks, the probability that any two blocks will be the same is approximately 2 -105 ; AES CTR_DRBG will never provide a generate output with duplicate blocks.”

May combine two claims.

TDEA CTR_DRBG permits the use of up to 2^32 generate requests; an ideal random source providing 2^32 sequences of 128 64-bit blocks would have a probability of about 2^-19 of having a duplicate block in one of those sequences, while CTR_DRBG will never have such a duplicate block.

“TDEA CTR_DRBG permits the use of up to 2 32 generate requests.An ideal random source, providing 2 32 sequences of 128 64-bit blocks, would have a probability of about 2 -19 of having a duplicate block in one of those sequences of 128 64-bit blocks; the CTR_DRBG will never have such a duplicate block.”

Probably not a substantial claim: may not pass S4 (based).

The security of CTR_DRBG is directly based on the security of the underlying block cipher algorithm, in the sense that, as long as some limits on the total number of outputs are observed, any attack on CTR_DRBG represents an attack on the underlying block cipher algorithm.

“The security of CTR_DRBG is directly based on the security of the underlying block cipher algorithm, in the sense that, as long as some limits on the total number of outputs are observed, any attack on CTR_DRBG represents an attack on the underlying block cipher algorithm.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

When a derivation function is used, CTR_DRBG can process the personalization string and any additional input in the same way as any other DRBG mechanism, but at a cost in performance because of the use of the derivation function.

“When a derivation function is used, CTR_DRBG can process the personalization string and any additional input in the same way as any other DRBG mechanism, but at a cost in performance because of the use of the derivation function (as opposed to not using the derivation function; see below).”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The block cipher DRBG mechanism specified in this Recommendation has been designed to use any approved block cipher algorithm and may be used by consuming applications requiring various security strengths, providing that the appropriate block cipher algorithm and key length are used, and sufficient entropy is obtained for the seed.

“The block cipher DRBG mechanism specified in this Recommendation has been designed to use any approved block cipher algorithm and may be used by consuming applications requiring various security strengths, providing that the appropriate block cipher algorithm and key length are used, and sufficient entropy is obtained for the seed.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Within a Hash_DRBG generate request, each outlen-bit block of output requires one hash function computation and several addition operations, and an additional hash function computation is required to provide backtracking resistance.

“Within a generate request, each outlen-bit block of output requires one hash function computation and several addition operations; an additional hash function computation is required to provide the backtracking resistance.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Hash_DRBG updates the secret value V at the end of each generate request before returning the pseudorandom output to the consuming application in order to prevent backtracking.

“At the end of the generate request, and before the pseudorandom output is returned to the consuming application, the secret value V is updated in order to prevent backtracking.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Hash_DRBG produces pseudorandom output bits in about half the time required by HMAC_DRBG.

“Hash_DRBG produces pseudorandom output bits in about half the time required by HMAC_DRBG.”

May combine two claims.

An ideal random source would have a very small probability (about 2^-51) of producing a pair of identical 64-bit blocks within that generate request output; each generate request from CTR_DRBG is generated by running the block cipher in counter mode, so there can never be a duplicate block produced within a generate request output.

“An ideal random source would have a very small probability (about 2 -51 ) of producing a pair of identical 64-bit blocks within that generate request output; each generate request from the CTR_DRBG is generated by running the block cipher in counter mode, so there can never be a duplicate block produced within a generate request output.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

For large generate requests, CTR_DRBG produces outputs at the same speed as the underlying block cipher algorithm encrypts data.

“For large generate requests, CTR_DRBG produces outputs at the same speed as the underlying block cipher algorithm encrypts data.”

May combine two claims.

An attacker looking at the sequence will not be able to determine that it came from CTR_DRBG, though he would have a pretty large advantage in a distinguishing game.

“An attacker looking at the sequence will not be able to determine that it came from the CTR_DRBG, though he would have a pretty large advantage in a distinguishing game.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

It is difficult to relate the properties of the hash function required by Hash_DRBG with common properties such as collision resistance, pre-image resistance, or pseudorandomness.

“It is difficult to relate the properties of the hash function required by Hash_DRBG with common properties, such as collision resistance, pre-image resistance, or pseudorandomness.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

In general, even relatively weak hash functions seem to be quite strong when used in the HMAC construction.

“In general, even relatively weak hash functions seem to be quite strong when used in the HMAC construction.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

When instantiation is performed using this method, the entropy input may or may not have full entropy; in either case, a nonce is required.

“When instantiation is performed using this method, the entropy input may or may not have full entropy; in either case, a nonce is required.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

Few if any consuming applications are expected to need output bits faster than HMAC_DRBG can provide them.

“Note, however, that hash functions are typically quite fast; few if any consuming applications are expected to need output bits faster than HMAC_DRBG can provide them.”

Probably not a substantial claim: may not pass S3 (load-bearing).

At the end of a generation request, HMAC_DRBG generates a new Key and V, each requiring one HMAC computation.

“At the end of a generation request, the HMAC_DRBG generates a new Key and V, each requiring one HMAC computation.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Such an implementation may be seeded by any approved randomness source that may or may not provide full entropy.

“Such an implementation may be seeded by any approved randomness source that may or may not provide full entropy.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

For TDEA, the input and output block lengths are 64 bits, and for AES, the lengths are 128 bits.

“Note that for TDEA, the input and output block lengths are 64 bits, and for AES, the lengths are 128 bits.”

May combine two claims.

For TDEA CTR_DRBG, each generate request is limited to 2^13 bits, and at most 2^32 such requests may be made.

“However, the smaller block size of TDEA imposes more constraints: each generate request is limited to 2 13 bits, and at most, 2 32 such requests may be made.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

At the end of each CTR_DRBG generate request, work equivalent to two, three or four encryptions is performed, depending on the choice of underlying block cipher algorithm, to generate new keys and counters for the next generate request.

“At the end of each generate request, work equivalent to two, three or four encryptions is performed, depending on the choice of underlying block cipher algorithm, to generate new keys and counters for the next generate request.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

HMAC_DRBG produces pseudorandom outputs considerably more slowly than the underlying hash function processes inputs; for SHA-256, a long generate request produces output bits at about 1/4 of the rate that the hash function can process input bits.

“HMAC_DRBG produces pseudorandom outputs considerably more slowly than the underlying hash function processes inputs; for SHA-256, a long generate request produces output bits at about 1/4 of the rate that the hash function can process input bits.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

When a derivation function is not used, CTR_DRBG is more efficient when the personalization string and any additional input are provided, but is less flexible because the lengths of the personalization string and additional input cannot exceed seedlen bits.

“When a derivation function is not used, CTR_DRBG is more efficient when the personalization string and any additional input are provided, but is less flexible because the lengths of the personalization string and additional input cannot exceed seedlen bits.”

May combine two claims.

There is not a reduction proof from the hash function's collision resistance properties to the security of the DRBG; the security of HMAC_DRBG ultimately relies on the pseudorandomness properties of the underlying hash function.

“On the other hand, there is not a reduction proof from the hash function's collision resistance properties to the security of the DRBG; the security of HMAC_DRBG ultimately relies on the pseudorandomness properties of the underlying hash function.”

• AssumptionThe authors state this as an assumption: An approved hash function used in the HMAC construction is a pseudorandom function family.

Classified as probably not a substantial claim.

Such implementations must be seeded by a randomness source that provides full entropy (e.g., an approved entropy source that has full entropy output or an approved NRBG).

“Such implementations must be seeded by a randomness source that provides full entropy (e.g., an approved entropy source that has full entropy output or an approved NRBG).”

Classified as probably not a substantial claim.

There are known problems with Hash_DRBG when it is instantiated with insufficient entropy for the requested security strength and later provided with enough entropy via additional input during a generate request.

“There are known problems with Hash_DRBG when the DRBG is instantiated with insufficient entropy for the requested security strength, and then later provided with enough entropy to attain the amount of entropy required for the security strength, via the inclusion of additional input during a generate request.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Hash_DRBG's Generate function is parallelizable because it uses counter mode.

“The Generate function is parallelizable, since it uses the counter mode.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The DRBG mechanisms specified in this Recommendation have different performance characteristics, implementation issues, and security assumptions.

“The DRBG mechanisms specified in this Recommendation have different performance characteristics, implementation issues, and security assumptions.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

The distinguishing attack is theoretical and poses no practical threat to any real-world application of the DRBG.

“However, the distinguishing attack is theoretical -it poses no practical threat to any real-world application of the DRBG.”

Probably not a substantial claim: may not pass S3 (load-bearing).

For each hash function, up to 2^48 generate requests may be made, each of up to 2^19 bits.

“As shown in Table 2 of Section 10.1, for each hash function, up to 2 48 generate requests may be made, each of up to 2 19 bits.”

Probably not a substantial claim: may not pass S3 (load-bearing).

In accordance with Table 3 in Section 10.2.1, security strengths of 112 and 128 bits may be supported.

“In accordance with Table 3 in Section 10.2.1, security strengths of 112 and 128 bits may be supported.”

• cites Table 3 in Section 10.2.1Not checked yet

  Not checked in the free run.