The DOI matches its Crossref record; 4 of the 4 references it cites were found in a registry or an index; none of the 6 sources its claims cite is checked for support yet.
Recommendation for Random Number Generation Using Deterministic Random Bit Generators
Open accessAbstract
AuthorityThis publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3541 et seq., Public Law (P.L.) 113-283.NIST is responsible for developing information security standards and guidelines, including minimum requirements for Federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate Federal officials exercising policy authority over such systems.This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems, as analyzed in Circular A-130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in Circular A-130, Appendix III, Security of Federal Automated Information Resources.Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority.Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other Federal official.This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States.Attribution would, however, be appreciated by NIST.
Overview
AI snapshot
Written from the paper’s full text.
TL;DR
NIST SP 800-90A Rev. 1 specifies approved Deterministic Random Bit Generators (DRBGs) — Hash_DRBG, HMAC_DRBG, and CTR_DRBG — along with the requirements for instantiating, reseeding, generating from, and health-testing them. It defines the security strengths, entropy requirements, and output limits under which these mechanisms are considered secure.
Key findings
- The Recommendation supports exactly four security strengths: 112, 128, 192, or 256 bits; the security strength of output is `min(output_length, DRBG_security_strength)`, and concatenating outputs cannot exceed the instantiated strength.
- Approved mechanisms are hash-based (Hash_DRBG, HMAC_DRBG) and block-cipher-based (CTR_DRBG using TDEA, AES-128, AES-192, or AES-256). All were judged to provide acceptable security when published, and diversity of mechanisms allows transition if attacks are found on one class.
- Output constraints: hash-based DRBGs permit up to 2^48 generate requests of up to 2^19 bits each; AES CTR_DRBG the same; TDEA CTR_DRBG is limited to 2^32 requests of 2^13 bits. These limits exist to avoid a theoretical distinguishing attack (probability of distinguishing AES CTR_DRBG from ideal random at maximum output ≈ 2^-57; TDEA case ≈ 2^-6 in the described game).
- All DRBG mechanisms in the Recommendation are designed to provide backtracking resistance; prediction resistance requires reseeding with fresh entropy (at least the security strength) between consecutive requests.
- Dual_EC_DRBG was removed in Revision 1, along with the elliptic-curve appendices.
Methods
- This is a specification/standards document, not an empirical study: it defines DRBG mechanisms via pseudocode "envelopes" (instantiate, reseed, generate, uninstantiate, health test) around underlying algorithms, plus auxiliary derivation functions (Hash_df, Block_Cipher_df) and BCC/Block_Encrypt primitives.
- Conformance testing is to be conducted within the CMVP and CAVP frameworks; requirements are indicated by "shall," and some are out of scope for CMVP/CAVP validation.
- Informative appendices provide conversion routines (Appendix A), worked pseudocode examples for each mechanism (Appendix B), and DRBG mechanism selection guidance with a cost/constraint summary table (Appendix C).
Limitations
- Stated: "The precise structure, design and development of a random bit generator is outside the scope of this document"; entropy source design/validation is deferred to SP 800-90B and RBG construction to SP 800-90C.
- Stated: Hash_DRBG has known problems when instantiated with insufficient entropy for the requested strength and later supplied enough entropy via additional input during a generate request — though these do not affect security when instantiated with the entropy specified in the Recommendation.
- Stated: the CTR_DRBG distinguishing attack is "theoretical — it poses no practical threat to any real-world application of the DRBG"; the output limits are nonetheless required.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
96 Own interpretation · 10 No basis given · 7 Own method · 6 Not checked yet
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The actual security strength supported by a given instantiation depends on the DRBG implementation and on the amount of entropy provided to the instantiate function.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.4 Security Strengths Supported by an Instantiation
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“A concatenation of bit strings resulting from multiple calls to a DRBG will not provide a security strength for the concatenated string that is greater than the instantiated security strength of the DRBG.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Security_strength_of_output = min(output_length, DRBG_security_strength).
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, if there is an undetected failure in the randomness source of an already properly seeded DRBG instantiation, the DRBG instantiation will still retain any previous entropy when the reseed operation fails to introduce new entropy.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.6.8 Reseeding
hedgeddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This method produces a random value with a negligible skew, that is, the probability that a i =w for any particular value of w (0 ≤ w ≤ r-1) is not exactly 1/r.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > A.5.3 The Simple Modular Method
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Note that the claimed security strength for CTR_DRBG depends on limiting the total number of generate requests and the bits provided per generate request according to the table above.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 3. temp =
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The introduction of fresh entropy via reseeding will also make the DRBG less susceptible to cryptanalytic attack.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Figure 7: Sequence of DRBG States
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, for a large enough value of s, the difference between the probability that a i =w for any particular value of w and 1/r is negligible.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > A.5.3 The Simple Modular Method
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Without these limits, it becomes possible, in principle, for an attacker to observe enough outputs from CTR_DRBG to distinguish its outputs from ideal random bits.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 3. temp =
hedgeddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“The maximum security strength that can be supported by each DRBG based on a hash function is the security strength of the hash function for pre-image resistance; these security strengths are provided in [SP 800-107].”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 10.1 DRBG Mechanisms Based on Hash Functions
What the sources say
- Not checked yetcites [SP 800-107]
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The DRBG generates a maximum of 128 64-bit blocks per generate request, thus providing 2 13 bits per request.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“The maximum security strength that can be supported by the DRBG depends on the block cipher and key size used; the security strengths that can be supported by the block ciphers and key sizes are provided in [SP 800-57].”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Additional information
What the sources say
- Not checked yetcites SP 800-57
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This provides a distinguisheran attacker, given a sequence of 2 13 2 32 = 2 45 bits from an ideal random source, has about a 2 -19 probability of seeing an event happen that could never happen from TDEA CTR_DRBG.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“These output constraints apply to the use of CTR_DRBG for any single purpose, regardless of how many times the DRBG is reseeded.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“As shown in Table 3 of Section 10.2.1, for each of the three AES key sizes, up to 2 48 generate requests may be made, each of up to 2 19 bits, with a negligible chance of any weakness that does not represent a weakness in AES.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“(The block cipher is rekeyed between generate requests, so duplicate blocks can appear in different generate request outputs.)”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“The output constraints are necessary to avoid a distinguishing attack on the CTR_DRBG, described in [Campagna], in which the fact that a single generate call can never produce a duplicate block from the block cipher is used to build a distinguisher for the DRBG's outputs.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
What the sources say
- Not checked yetcites Campagna
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, these problems do not affect the DRBG's security when Hash_DRBG is instantiated with the amount of entropy specified in this Recommendation.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > C.1 Hash_DRBG
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Note that the pseudorandomness of HMAC is a widely used assumption in designs, and the HMAC_DRBG requires far less demanding properties of the underlying hash function than Hash_DRBG.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Security.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- The authors state this as an assumption: The pseudorandomness of HMAC is a widely used assumption in designs.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Hash_DRBG's security depends on the underlying hash function's behavior when processing a series of sequential input blocks.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > C.1 Hash_DRBG
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“AES CTR_DRBG permits up to 2 48 generate requests, so an attacker seeing the maximum length of output permitted (2 67 bits) from either an AES CTR_DRBG instance or an ideal random sequence will have a 2 -57 probability of being able to distinguish the two.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Probably not a substantial claim. 91
- It may state two separate claims as one. 28
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Each DRBG mechanism has restrictions on the security strength it can support, based on its design (see Section 10).”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.4 Security Strengths Supported by an Instantiation
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“This Recommendation specifies several DRBG mechanisms, all of which provided acceptable security when this Recommendation was published.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > This Recommendation includes:
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The DRBG mechanisms specified in this Recommendation support four security strengths: 112, 128, 192 or 256 bits.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.4 Security Strengths Supported by an Instantiation
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Each DRBG mechanism includes one or more cryptographic primitives (i.e., a hash function or block cipher algorithm).”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.5 DRBG Mechanism Boundaries
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Ideally, the entropy input would have full entropy; however, the DRBG mechanisms have been specified so that input with full entropy is not required.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 7.1 Entropy Input
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“A nonce may be required in the construction of a seed during instantiation in order to provide a security cushion to block certain attacks.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.6.7 Nonce
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The intent of a personalization string is to introduce additional input into the instantiation of a DRBG.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.7.1 Personalization String
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Note that a DRBG does not provide output until a seed is available, and the internal state has been initialized (see Section 10).”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.6.9 Seed Use
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Note that a DRBG does not rely on a personalization string to provide entropy, even though entropy could be provided in the personalization string”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.7.1 Personalization String
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The nonce provides greater assurance that the DRBG provides security_strength bits of security to the consuming application.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.6.7 Nonce
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Random number generation does not require interoperability between two entities, i.e., communicating entities may use different DRBG mechanisms without affecting their ability to communicate.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > This Recommendation includes:
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In some consuming applications, a single DRBG compromise could reveal long-term secrets (e.g., a compromise of the DSA per-message secret could reveal the signing key).”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.6.7 Nonce
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Because of the deterministic nature of the process, a DRBG is said to produce pseudorandom bits, rather than random bits.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Abstract
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The security provided by an RBG that uses a DRBG mechanism is a system implementation issue; both the DRBG mechanism and its randomness source must be considered when determining whether the RBG is appropriate for use by consuming applications.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Abstract
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Reseeding is a means of restoring the secrecy of the output of the DRBG if a seed or the internal state becomes known.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.6 Seeds
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“The secrecy of this information provides the basis for the security of the DRBG.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 7.1 Entropy Input
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If the seed is kept secret, and the algorithm is well designed, the bits output by the DRBG will be unpredictable, up to the instantiated security strength of the DRBG.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Abstract
plainconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Generating too many outputs from a seed (and other input information) may provide sufficient information for successfully predicting future outputs (see Section 8.8).”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.6.8 Reseeding
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The presence of more entropy than is required, especially during the instantiation, will provide a higher level of assurance than the minimum required entropy.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.6.3 Entropy Requirements for the Entropy Input
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“The DRBG reseed specifications within this Recommendation are designed to produce a new seed that is determined by both the old seed and newly obtained entropy input that will support the desired security strength.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.6.8 Reseeding
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If a DRBG were instantiated many times without a nonce, a compromise could become more likely.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.6.7 Nonce
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This information may or may not be required to be kept secret by a consuming application; however, the security of the DRBG itself does not rely on the secrecy of this information.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 7.2 Other Inputs
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, in the event that new attacks are found on a particular class of DRBG mechanisms, a diversity of approved mechanisms will allow a timely transition to a different class of DRBG mechanism.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > This Recommendation includes:
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If a DRBG instantiation was initially seeded with sufficient entropy, and the randomness source subsequently fails without being detected, then a new instantiation using the same (failed) source would not have sufficient entropy to operate securely.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.6.8 Reseeding
hedgeddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Periodic reseeding will reduce security risks, reducing the likelihood of a compromise of the data that is protected by cryptographic mechanisms that use the DRBG.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.6.8 Reseeding
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Seeds have a finite seedlife (i.e., the number of outputs that are produced during a seed period); the maximum seedlife is dependent on the DRBG mechanism used.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.6.8 Reseeding
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“knowledge of the personalization string by an adversary does not degrade the security strength of a DRBG instantiation, as long as the entropy input is unknown.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.7.1 Personalization String
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
- Rests on an assumption: The security of the DRBG depends on the secrecy of the entropy input.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Having more entropy than the assessed amount is acceptable; having less entropy than the assessed amount could be fatal to security.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.6.3 Entropy Requirements for the Entropy Input
hedgeddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Such validations provide a higher level of assurance that the DRBG mechanism is correctly implemented.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 11 Assurance
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This method produces a random number a with no skew (no bias).”
§ Recommendation for Random Number Generation Using Deterministic RBGs > A.5.1 The Simple Discard Method
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“When the reseed function returns an error (see Section 9.2), the indicated instantiation will not have been reseeded (i.e., the internal state will not have been injected with fresh entropy).”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 9 DRBG Mechanism Functions
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Note that since SHA-224 is based on SHA-256, there is no efficiency benefit when using SHA-224, rather than SHA-256.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 10.1 DRBG Mechanisms Based on Hash Functions
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The complex discard method may have better overall performance than the simple discard method if many random numbers are needed.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > A.5.2 The Complex Discard Method
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“That is, an amount of entropy that is sufficient to support the security strength of the DRBG being reseeded (i.e., an amount that is at least equal to the security strength) must be provided to the DRBG in a way that ensures that knowledge of the current DRBG internal state does not allow an adversary any useful knowledge about future DRBG internal states or outputs.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Figure 7: Sequence of DRBG States
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- The authors state this as an assumption: The adversary is incapable of performing work that matches the claimed security strength of the RBG.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Also note that since SHA-384, SHA-512/224 and SHA-512/256 are based on SHA-512, there is no efficiency benefit for using these three SHA mechanisms, rather than using SHA-512.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 10.1 DRBG Mechanisms Based on Hash Functions
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The complex discard method coincides with the simple discard method when t = 1.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > A.5.2 The Complex Discard Method
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If the additional input is kept secret and has sufficient entropy, the input can provide more assurance when recovering from the compromise of the entropy input, the seed or one or more DRBG internal states.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.7.2 Additional Input
plainconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“A possible disadvantage of this method, in general, is that the time needed to generate such a random a is not a fixed length of time because of the conditional loop.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > A.5.1 The Simple Discard Method
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The hash-based DRBG mechanisms specified in this Recommendation have been designed to use any approved hash function and may be used by consuming applications requiring various security strengths, providing that the appropriate hash function is used and sufficient entropy is obtained for the seed.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 10.1 DRBG Mechanisms Based on Hash Functions
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
In the paper
“In accordance with Table 2 in Section 10.1, security strengths of 112, 128, 192 and 256 bits may be instantiated.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > B.2 HMAC_DRBG Example
What the sources say
- Not checked yetcites Table 2 in Section 10.1
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“Therefore, entropy input used for testing shall not be used for normal operational use.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 11 Assurance
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Note that any entropy input used for testing (either for validation testing or health testing) may be publicly known.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 11 Assurance
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Reseeding will insert additional entropy into the generation of pseudorandom bits.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 9.2 Reseeding a DRBG Instantiation
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The Get_entropy_input call could return a status of ERROR_FLAG to indicate that entropy is currently unavailable, and could return CATASTROPHIC_ERROR_FLAG to indicate that an entropy source failed.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Instantiate Process:
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
In the paper
“In accordance with Table 2 in Section 10.1, the 112-and 128-bit security strengths may be instantiated.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > B.1 Hash_DRBG Example
What the sources say
- Not checked yetcites Table 2 in Section 10.1
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“A DRBG implementation shall perform self-tests to obtain assurance that the DRBG continues to operate as designed and implemented (health testing).”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 11.3 Health Testing
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If r/2 m is close to 1, then the above method is simple and efficient.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > A.5.1 The Simple Discard Method
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The error codes may, in fact, provide information about the reason for the error; for example, when ERROR_FLAG is returned because of an incorrect input parameter, the ERROR_FLAG may indicate the problem.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 9 DRBG Mechanism Functions
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This method produces random numbers (a 0 , a 1 , … , a t-1 ) with no skew.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > A.5.2 The Complex Discard Method
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“A possible disadvantage of this method, in general, is that the time needed to generate these numbers is not a fixed length of time because of the conditional loop.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > A.5.2 The Complex Discard Method
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The simple modular method can be coded to take constant time.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > A.5.3 The Simple Modular Method
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Note that a DRBG does not rely on additional input to provide entropy, even though entropy could be provided in the additional input”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.7.2 Additional Input
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The use of additional input may be a means of providing more entropy for the DRBG internal state that will increase assurance that the entropy requirements are met.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.7.2 Additional Input
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The ratio r/2 m is a measure of the efficiency of the technique, and this ratio will always satisfy 0.5 < r/2 m ≤ 1.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > A.5.1 The Simple Discard Method
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Prediction resistance can be provided when the randomness source is or has direct or indirect access to an entropy source or an NRBG (see Section 8.6.5).”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Figure 7: Sequence of DRBG States
plainconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- The authors state this as an assumption: The adversary is incapable of performing work that matches the claimed security strength of the RBG.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The ratio r t /2 m is a measure of the efficiency of the technique, and this ratio will always satisfy 0.5 < r t /2 m ≤ 1.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > A.5.2 The Complex Discard Method
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This personalization string might contain values unknown to an attacker, or values that tend to differentiate this DRBG instantiation from all others.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 8.7.1 Personalization String
hedgedcorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Without the explicit prediction resistance request, the entropy input could be provided from either a DRBG with no access to an entropy source (i.e., fresh entropy would not be provided), or the entropy input could be provided by an entropy source or by an RBG with access to an entropy source (i.e., fresh entropy would be provided in these cases).”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 9.2 Reseeding a DRBG Instantiation
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Backtracking resistance can be provided by ensuring that the DRBG generation algorithm is a one-way function.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Figure 7: Sequence of DRBG States
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
- The authors state this as an assumption: The adversary is incapable of performing the work required to negate the claimed security strength of the DRBG.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Prediction resistance can be provided only by ensuring that a DRBG is effectively reseeded with fresh entropy between producing output for consecutive DRBG requests.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Figure 7: Sequence of DRBG States
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- The authors state this as an assumption: The adversary is incapable of performing work that matches the claimed security strength of the RBG.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“All DRBG mechanisms in this Recommendation have been designed to provide backtracking resistance.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Figure 7: Sequence of DRBG States
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
- The authors state this as an assumption: The adversary is incapable of performing the work required to negate the claimed security strength of the DRBG.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“Health tests on the DRBG mechanism shall be implemented within a DRBG mechanism boundary or sub-boundary in order to determine that the process continues to operate as designed and implemented.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 11 Assurance
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, if r/2 m is close to 0.5, then the simple discard method is less efficient”
§ Recommendation for Random Number Generation Using Deterministic RBGs > A.5.1 The Simple Discard Method
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Each generate request also involves additional overhead equivalent to processing 2048 extra bits with SHA-256.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > C.2 HMAC_DRBG
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, a general-purpose hash function implementation can always be used to implement HMAC.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“When instantiation is performed using this method, a nonce is required, whereas using the method in Section 10.2.1.3.1 does not require a nonce, since full entropy is provided when using that method.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Additional information
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In this case, the TDEA CTR_DRBG received 2 45 generate requests.An ideal random sequence has a probability of about 2 -6 of having a duplicate block in one of the generate outputs; the CTR_DRBG outputs will never have one.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If the hash function is replaced by a random oracle, Hash_DRBG is secure.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > C.1 Hash_DRBG
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Furthermore, CTR_DRBG is parallelizable.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Performance.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The case for AES CTR_DRBG is similar: each generate request may produce no more than 2 19 bits, which means 2 12 128-bit blocks.In an ideal random sequence of 2 12 128-bit blocks, the probability that any two blocks will be the same is approximately 2 -105 ; AES CTR_DRBG will never provide a generate output with duplicate blocks.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“TDEA CTR_DRBG permits the use of up to 2 32 generate requests.An ideal random source, providing 2 32 sequences of 128 64-bit blocks, would have a probability of about 2 -19 of having a duplicate block in one of those sequences of 128 64-bit blocks; the CTR_DRBG will never have such a duplicate block.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The security of CTR_DRBG is directly based on the security of the underlying block cipher algorithm, in the sense that, as long as some limits on the total number of outputs are observed, any attack on CTR_DRBG represents an attack on the underlying block cipher algorithm.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Security.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“When a derivation function is used, CTR_DRBG can process the personalization string and any additional input in the same way as any other DRBG mechanism, but at a cost in performance because of the use of the derivation function (as opposed to not using the derivation function; see below).”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The block cipher DRBG mechanism specified in this Recommendation has been designed to use any approved block cipher algorithm and may be used by consuming applications requiring various security strengths, providing that the appropriate block cipher algorithm and key length are used, and sufficient entropy is obtained for the seed.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Additional information
hedgedconditional- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Within a generate request, each outlen-bit block of output requires one hash function computation and several addition operations; an additional hash function computation is required to provide the backtracking resistance.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > C.1 Hash_DRBG
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“At the end of the generate request, and before the pseudorandom output is returned to the consuming application, the secret value V is updated in order to prevent backtracking.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > C.1 Hash_DRBG
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Hash_DRBG produces pseudorandom output bits in about half the time required by HMAC_DRBG.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > C.1 Hash_DRBG
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“An ideal random source would have a very small probability (about 2 -51 ) of producing a pair of identical 64-bit blocks within that generate request output; each generate request from the CTR_DRBG is generated by running the block cipher in counter mode, so there can never be a duplicate block produced within a generate request output.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“For large generate requests, CTR_DRBG produces outputs at the same speed as the underlying block cipher algorithm encrypts data.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Performance.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“An attacker looking at the sequence will not be able to determine that it came from the CTR_DRBG, though he would have a pretty large advantage in a distinguishing game.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“It is difficult to relate the properties of the hash function required by Hash_DRBG with common properties, such as collision resistance, pre-image resistance, or pseudorandomness.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > C.1 Hash_DRBG
plain- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In general, even relatively weak hash functions seem to be quite strong when used in the HMAC construction.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Security.
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“When instantiation is performed using this method, the entropy input may or may not have full entropy; in either case, a nonce is required.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Additional information
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Note, however, that hash functions are typically quite fast; few if any consuming applications are expected to need output bits faster than HMAC_DRBG can provide them.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > C.2 HMAC_DRBG
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“At the end of a generation request, the HMAC_DRBG generates a new Key and V, each requiring one HMAC computation.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > C.2 HMAC_DRBG
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Such an implementation may be seeded by any approved randomness source that may or may not provide full entropy.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Note that for TDEA, the input and output block lengths are 64 bits, and for AES, the lengths are 128 bits.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Additional information
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, the smaller block size of TDEA imposes more constraints: each generate request is limited to 2 13 bits, and at most, 2 32 such requests may be made.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“At the end of each generate request, work equivalent to two, three or four encryptions is performed, depending on the choice of underlying block cipher algorithm, to generate new keys and counters for the next generate request.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Performance.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“HMAC_DRBG produces pseudorandom outputs considerably more slowly than the underlying hash function processes inputs; for SHA-256, a long generate request produces output bits at about 1/4 of the rate that the hash function can process input bits.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > C.2 HMAC_DRBG
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“When a derivation function is not used, CTR_DRBG is more efficient when the personalization string and any additional input are provided, but is less flexible because the lengths of the personalization string and additional input cannot exceed seedlen bits.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“On the other hand, there is not a reduction proof from the hash function's collision resistance properties to the security of the DRBG; the security of HMAC_DRBG ultimately relies on the pseudorandomness properties of the underlying hash function.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Security.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- The authors state this as an assumption: An approved hash function used in the HMAC construction is a pseudorandom function family.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Such implementations must be seeded by a randomness source that provides full entropy (e.g., an approved entropy source that has full entropy output or an approved NRBG).”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“There are known problems with Hash_DRBG when the DRBG is instantiated with insufficient entropy for the requested security strength, and then later provided with enough entropy to attain the amount of entropy required for the security strength, via the inclusion of additional input during a generate request.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > C.1 Hash_DRBG
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The Generate function is parallelizable, since it uses the counter mode.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > C.1 Hash_DRBG
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The DRBG mechanisms specified in this Recommendation have different performance characteristics, implementation issues, and security assumptions.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Appendix C: (Informative) DRBG Mechanism Selection
plaincorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“However, the distinguishing attack is theoretical -it poses no practical threat to any real-world application of the DRBG.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“As shown in Table 2 of Section 10.1, for each hash function, up to 2 48 generate requests may be made, each of up to 2 19 bits.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“In accordance with Table 3 in Section 10.2.1, security strengths of 112 and 128 bits may be supported.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > B.3 CTR_DRBG Example Using a Derivation Function
What the sources say
- Not checked yetcites Table 3 in Section 10.2.1
hedged- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The authors state this as an assumption.
The adversary is incapable of performing the work required to negate the claimed security strength of the DRBG.
“This assumes that the adversary is incapable of performing the work required to negate the claimed security strength of the DRBG.”
The authors state this as an assumption.
The adversary is incapable of performing work that matches the claimed security strength of the RBG.
“incapable of performing work that matches the claimed security strength of the RBG”
The paper relies on this without support.
The security of the DRBG depends on the secrecy of the entropy input.
“The security of the DRBG depends on the secrecy of the entropy input.”
The authors state this as an assumption.
An approved hash function used in the HMAC construction is a pseudorandom function family.
“The security of HMAC_DRBG is based on the assumption that an approved hash function used in the HMAC construction is a pseudorandom function family.”
The authors state this as an assumption.
The pseudorandomness of HMAC is a widely used assumption in designs.
“Note that the pseudorandomness of HMAC is a widely used assumption in designs, and the HMAC_DRBG requires far less demanding properties of the underlying hash function than Hash_DRBG.”
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Weaknesses in random number generation (RNG) have historically led to severe security breaches1.”
From Raw QPP-RNG randomness via system jitter across platforms: a NIST SP 800-90B evaluation (2025) · cites this paper as [1]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Recommendation for Random Number Generation Using Deterministic RBGs > B.2 HMAC_DRBG Example
“The internal state contains the values for V, Key, reseed_counter, and security_strength, where V and C are bitstrings, and reseed_counter and security_strength are integers.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > 10.1.2.1 HMAC_DRBG Internal State
“The values of V and Key are the critical values of the internal state upon which the security of this DRBG mechanism depends (i.e., V and Key are the "secret values" of the internal state).”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Recommendation for Random Number Generation Using Deterministic RBGs > B.3 CTR_DRBG Example Using a Derivation Function
“Since prediction resistance is known to be supported, there is no need for prediction_resistance_flag in the internal state.”
§ Recommendation for Random Number Generation Using Deterministic RBGs > References
“If ((reseed_required_flag = 1) OR (prediction_resistance_flag = 1)), then 7.1 status = CTR_DRBG_Reseed_function (state_handle, prediction_resistance_request, additional_input).”
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
“an attacker who sees 2 64 bits of output from the TDEA CTR_DRBG across at least one reseed”
§ Recommendation for Random Number Generation Using Deterministic RBGs > Constraints on Outputs.
“In this case, the TDEA CTR_DRBG received 2 45 generate requests.”
Citations
Cites
1 retracted
Recommendation for Random Bit Generator (RBG) Constructions
Barker, E. B., Kelsey, J. M., McKay, K. A., Roginsky, A. L., & Turan, M. S. (2022) · doi:10.6028/nist.sp.800-90c.3pd · Cited by 58
Self-citationRetractedRecommendation for the Entropy Sources Used for Random Bit Generation
Turan, M. S., Barker, E., Kelsey, J., McKay, K. A., Baish, M. L., & Boyle, M. (2018) · NIST Special Publication 800-90B · doi:10.6028/nist.sp.800-90b · Cited by 489
Self-citationRecommendation for applications using approved hash algorithms
Dang, Q. H. (2012) · doi:10.6028/nist.sp.800-107r1 · Cited by 137
Security Bounds for the NIST Codebook-based Deterministic Random Bit Generator.Preprint
Campagna, M. (2006) · IACR Cryptology ePrint Archive · Cited by 12
Cited by
Sorted by citations
Internet of Things: A survey on the security of IoT frameworks
Ammar, M., Russello, G., & Bruno Crispo, A. (2017) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2017.11.002 · Cited by 874
Recommendation for the Entropy Sources Used for Random Bit Generation
Turan, M. S., Barker, E., Kelsey, J., McKay, K. A., Baish, M. L., & Boyle, M. (2018) · NIST Special Publication 800-90B · doi:10.6028/nist.sp.800-90b · Cited by 489
Self-citationRecommendation for Key Management Part 1: General
Barker, E. B. (2016) · doi:10.6028/nist.sp.800-57pt1r4 · Cited by 447
Self-citationRecommendation for key management: part 1 - general
Barker, E. (2020) · doi:10.6028/nist.sp.800-57pt1r5 · Cited by 271
Self-citationModule-Lattice-Based Key-Encapsulation Mechanism Standard
National Institute of Standards and Technology (US) (2024) · doi:10.6028/nist.fips.203 · Cited by 268
Metadata
- Authors
- Barker, E. B., & Kelsey, J. M.
- Published
- 2015-06
- OpenAlex
- W4298403653
- Cited by
- 304
- References
- 4
- Citations by year
- 2026: 49 · 2025: 53 · 2024: 27 · 2023: 31 · 2022: 22 · 2021: 18 · 2020: 19 · 2019: 26 · 2018: 13 · 2017: 16 · 2016: 8 · 2015: 4
- Type
- report
- Language
- en
- Open access
- gold
- doi.org
- Funders
- National Institute of Standards and Technology
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
- Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
- Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
- Keywords
- random number generation, random bit generation, cryptographic key generation, information security standards
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-10-09, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-10-09 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
