Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does anyone know if there exists a PRG construction which takes as input an (RSA-sized) integer seed and outputs a fixed number of bits? There are number-theoretic PRGs such as the RSA, Micali-Schnorr, and BBB algorithms (see, but these require one to know both the seed and other parameters used in the construction (e.g., the modulus $n$). I need a construction that only requires the random integer seed as input. I'm aware that I could potentially fix a universal set of public parameters and then just specify the integer seed, but I'd like to avoid that since the parameters would likely need to be refreshed after a certain number of invocations or uses.

share|improve this question
Why do you want to use a number-theoretic PRNG in the first place? There are many nice stream ciphers which are faster and stronger. – CodesInChaos Feb 5 '14 at 10:35

Use any DRBG (deterministic random bit generator) in the NIST FIPS (the NIST 800-90 publication series). Except... don't use Dual EC DRBG, which has serious problems and is likely to be withdrawn. Use any DRBG in that standard other than Dual EC DRBG.

Or, hash the seed with SHA256, then use AES256 in counter mode to generate output.

Either of those will work fine.

Don't use BBS. It has major problems (search on this site for other examples). There is no reason to use any of the number-theoretic PRGs in practice.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.