Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any 128-bit pseudorandom number generator available?

I tried the Blum Blum Shub Generator, but I can't produce a 128-bit pseudo-random number. Maybe before I produce a 128-bit pseudorandom number, I need to input a 128-bit prime number which is hard to determine.

share|improve this question
Many mistakes here: a) in your recent other question it is clear your need a TRNG. b) BBS generates 1 bit at a time, and can be called 128 times to generate 128 bits. c) BBS needs a composite modulus that is hard to factor, and that implies primes much bigger than 128 bit. d) 128-bit primes are easy to get; follow this link for the smallest one. – fgrieu Jul 5 '12 at 17:04
@fgrieu I think you can output more than one bit at a time with BBS: up to $log_2(n)$ lower-order bits where $n$ is the size of your modulus, in bits. So for a 2048-bit modulus that's 11 bits per iteration (but 8 is probably more convenient). Not that it would make much difference from a computational point of view. – Thomas Jul 5 '12 at 18:03
@fgrieu I think it's a bit misleading to say he needs a true RNG. He needs a well seeded secure PRNG. – CodesInChaos Jul 5 '12 at 18:50
@Thomas: any source for that? The HAC, note 5.41, states that $j=c\lg\lg n$ bits can be used (where n is the modulus) but adds "an explicit range of values of $c$ for which the resulting generator is cryptographically secure under the intractability assumption of the integer factorization problem has not been determined". – fgrieu Jul 5 '12 at 22:50
@CodeInChaos: In order to seed the IV of OFB, we need not to repeat and not be influencable. A counter is fine. Being indistinguishable from random (the measure of security of a PRNG) is entirely optional. – fgrieu Jul 5 '12 at 22:54
up vote 3 down vote accepted

BBS is probably the wrong choice for you needs.

AES in counter (CTR) mode will take a 128-bit key and produce 128-bits of output per iteration.

It also happens to be a lot faster than BBS.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.