Fortuna is a family of cryptographically secure PRNGs; devised by Bruce Schneier and Niels Ferguson, who published it in 2003.

learn more… | top users | synonyms

5
votes
1answer
46 views

In Fortuna, can I use ChaCha20 instead of a block cipher and Blake2b instead of iterated SHA256?

In the Fortuna CSPRNG, can I use ChaCha20 instead of a block cipher and Blake2b instead of double SHA256, and still retain security? My hypothesis is "yes" because: The block cipher's only use is ...
2
votes
1answer
61 views

Is it OK to reseed a Deterministic Random Bit Generator from itself?

I want a deterministic PRNG for simulation purposes, and I don't want to have to worry about spurious correlations like those the DMCT is designed to protect the Mersenne Twister against. So even ...
3
votes
1answer
101 views

Hashing entropy with only 128 bits of internal state

I am looking to implement the Fortuna algorithm (https://www.schneier.com/fortuna.pdf) on a system with very restrictive memory constraints, using AES-128 as the underlying cipher. As the key size is ...
1
vote
2answers
84 views

Fortuna: why are source ID and data length added together with entropy data into the pools

Section 9.5.6 of Cryptography Engineering states that The concatenation [of source number, length of data, and data itself] is then appended to the pool. Why are we including source number and ...
0
votes
2answers
275 views

Why are Fortuna entropy pools reset after a reseed?

I've implemented LibTomCrypt's version of fortuna and am wondering about the pool resetting after a reseed. In fortuna.c in libtomcrypt we have the following (which is that part that adds the entropy ...
1
vote
1answer
291 views

Why does Fortuna RNG use double SHA-256?

In the paper for Fortuna the authors say that you can use any good digest algorithm (obviously as long as its output is 256 bit) and then they recommend double SHA-256. Why? What's the benefit? What ...
6
votes
1answer
1k views

How much entropy is lost via hashing when you add known or low entropy data?

(I updated the title, as I think there was some confusion as to the question) Here's the question: For example, if I have a bit stream that is 64K bytes long and there is about 16 *8 bits worth of ...
4
votes
2answers
330 views

Advantages of combined PRNGs

This question is related to this one in intention, and this one in scope. Would I be guarding myself against future attacks on a single PRNG if I combine two (or more) together? I am thinking of ...
7
votes
3answers
519 views

Testing the Fortuna random number generator?

I have implemented the Fortuna random number generator as described in chapter 10 of "Practical Cryptography" (Ferguson and Schneier, Wiley, 2003), the result can be found at http://www.seehuhn.de/...
2
votes
2answers
667 views

Why does Fortuna (RNG) require entropy sources to specify accumulator pool?

Re-reading my copy of Cryptography Engineering for the holidays, I was struck by the following question about the Fortuna RNG: Why require an entropy source specify which pool a random event should ...