Skip to main content
Cryptography

Return to Answer

Fix typo to clarify what primitive was intended.
Source Link
D.W.
D.W.
  • 36.7k
  • 13
  • 105
  • 193

Most PRNGsSome CSPRNGs accept a constant width seed. That means they could only be used as randomness extractors for that input size; no less, no more. For example, AES-128 CTRCTR_DRBG CSPRNG (from 800-90A) would only accept 256 bits of seed for the key and initial vector in total.

Further, if the input is not fully random (as you'd expect with a randomness extractor), they can be vulnerable to related-key attacks. When used as a random number generator the key is usually assumed to be uniformly random – e.g. the CSPRNG I mentioned aboveAES-128 CTR_DRBG requires exactly 256 bits of entropy in the seed, unless a KDF is used for randomness extraction.

Most PRNGs accept a constant width seed. That means they could only be used as randomness extractors for that input size; no less, no more. For example, AES-128 CTR CSPRNG (from 800-90A) would only accept 256 bits of seed for the key and initial vector in total.

Further, if the input is not fully random (as you'd expect with a randomness extractor), they can be vulnerable to related-key attacks. When used as a random number generator the key is usually assumed to be uniformly random – e.g. the CSPRNG I mentioned above requires exactly 256 bits of entropy in the seed, unless a KDF is used for randomness extraction.

Some CSPRNGs accept a constant width seed. That means they could only be used as randomness extractors for that input size; no less, no more. For example, AES-128 CTR_DRBG CSPRNG (from 800-90A) would only accept 256 bits of seed for the key and initial vector in total.

Further, if the input is not fully random (as you'd expect with a randomness extractor), they can be vulnerable to related-key attacks. When used as a random number generator the key is usually assumed to be uniformly random – e.g. AES-128 CTR_DRBG requires exactly 256 bits of entropy in the seed, unless a KDF is used for randomness extraction.

Source Link
otus
otus
  • 32.4k
  • 5
  • 73
  • 167

Most PRNGs accept a constant width seed. That means they could only be used as randomness extractors for that input size; no less, no more. For example, AES-128 CTR CSPRNG (from 800-90A) would only accept 256 bits of seed for the key and initial vector in total.

Further, if the input is not fully random (as you'd expect with a randomness extractor), they can be vulnerable to related-key attacks. When used as a random number generator the key is usually assumed to be uniformly random – e.g. the CSPRNG I mentioned above requires exactly 256 bits of entropy in the seed, unless a KDF is used for randomness extraction.