Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to understand the operation of the Dual_EC_DRBG. I'm reading the formal specification (SP 800-90) and can't seem to find a definition of the $\phi$ function used throughout the definition that I can grasp. The definition I found is on page 65 of SP 800-90A. Just to be clear, I'm referring to the $\phi$ found in this diagram.

Can anyone explain what this function does exactly? Is it a common function in elliptic curves? Something in number theory that's just over my head? Any help would be much appreciated.

share|improve this question
You are almost surely aware of it, but in case you weren't and were considering to use Dual_EC_DRBG - don't, it's backdoored by the NSA. – orlp Dec 3 '13 at 5:45
@nightcracker Thanks. Fully understanding the back door is actually the reason for my interest in Dual_EC_DRBG. – Bill Dec 3 '13 at 5:51
Another resource on the backdoor: – pg1989 Dec 3 '13 at 7:33
On p. 65: "$\phi(x)$ maps field elements to non-negative integers, taking the bit vector representation of a field element and interpreting it as the binary expansion of an integer." You should explain what's wrong with that explanation. – K.G. Dec 3 '13 at 7:46
Another resource on the backdoor and how to exploit it: (I think this was the most clear article I read on the subject) – ddddavidee Dec 3 '13 at 8:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.