3
$\begingroup$

A HRNG that is NIST 800-90 compliant must use a DRBG in some way regardless of whether it adheres to a RBG1, RBG2 RBG3(XOR), or RBG3(RS) construction. This violates the requirement that the OTP is truly random (since there is a DRBG involved). Therefore, it is true that a NIST 800-90 compliant device cannot be used to generate a OTP since a computationally unbound adversary could break the OTP.

Is my understanding correct?

$\endgroup$
1

2 Answers 2

3
$\begingroup$

Is my understanding correct?

Not quite.

For an RBG1 or an RBG2 (either flavor), it is correct (unless the RBG2 was reseeded extremely often, that is, effectively turning it into an RBG3(RS); see below for that case) - those are based in computational complexity assumptions and a computationally unbounded adversary could easily break it.

On the other hand, for RBG3(XOR), because the DRBG output is xor'ed in with the output of the entropy source, then if we assume that the entropy source has full entropy (that is, is itself informationally completely random), then the result is also full entropy. The xor'ing in of the data from the DRBG doesn't provide an in for our hypothetical attacker, as still any bit of the ultimate output is completely independent of all the rest of the bits of the ultimate output.

As for RBG3(RS), well, [Warning: significant hand-waving up ahead] I suspect our hypothetical attacker is likely to be able to distinguish a sufficiently long output from random; the idea is that the DRBG acts as $DRBG(S, RS) \rightarrow S', Output$, where $S$ is the initial state of the DRBG, $S'$ is the updated state, $RS$ is the reseeding data, and $Output$ is the block of output that the adversary can actually see. Now, this function is unlikely to generate $Output$ at exactly uniform probability distribution (and in addition, an unbounded adversary will get the updated probability distribution of $S'$, which is also not uniform); it appears likely to me that, for an unbounded adversary, the probability distributions would build up enough to be able to yield a distinguisher; however I am unable (being too lazy) to come up with any probable number of outputs needed.

$\endgroup$
3
  • $\begingroup$ It would be respectful to upvote the question if you've bothered answering it :-) $\endgroup$
    – Paul Uszak
    Jun 23, 2023 at 21:00
  • $\begingroup$ @PaulUszak: what, you're calling me respectable? You must have me confused with someone else... $\endgroup$
    – poncho
    Jun 23, 2023 at 21:54
  • $\begingroup$ Of course I’m not; though you still haven’t up voted the OP’s question have you? Nasty man. I’m messing with you (as I hope you’ve inferred; apologies if not), but I’m highlighting the greater injustice common across the Stack Exchange estate. Injustice may be behind why you’re all on strike. There are many many downvoted/close voted questions that have received answers with multiple upvotes and gained lots of rep points. Whilst the mods have called me “bat crazy” and mentally ill, I do not accept the notion of a “bad” question. Answer it, vote for it. $\endgroup$
    – Paul Uszak
    Jun 23, 2023 at 22:53
0
$\begingroup$

This is what we're all talking about:-

enter image description here

On the face of it, The (D)eterministic (R)andom (B)it (G)enerator is just there to mask a failure of the entropy source. If the pink blob is working, the DRBG (blue blob) is entirely irrelevant (unless manipulated by an adversary).

So yes, if pink (and green) is/are good, make your OTPs. But only if you ignore 800-90x and build a device yourself. See https://crypto.stackexchange.com/a/106942/23115 and https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3551&num=0&edition=prelim for the truth about US->global cryptography. I'm sorry that it's so boring, but cryptography is an art, yet control comes from political science.

Investigate and make your own judgement.

$\endgroup$
5
  • $\begingroup$ So, would your answer to the question be "A 800-90 compliant HRBG (at least, a RBG3(XOR) one) would not be suitable"? If so, do you anything to back up that claim "apart from 'this is a NIST design and NIST is EVIL' $\endgroup$
    – poncho
    Jun 24, 2023 at 19:26
  • $\begingroup$ @poncho And now you’re messing with me :-) NIST isn’t ”EVIL” . It’s patriotic and an arm of the US government. At any cost. All I’ll do is point you to reallyreallyrandom.com/problems/conspiracy/nist AGAIN AGAIN AGAIN , Has this forum been compromised by the NSA BULLRUN program? (AGAIN) which has many many up votes and yet suspiciously you seem to be aggressively pro-NIST, supporting that question's premise. $\endgroup$
    – Paul Uszak
    Jun 24, 2023 at 21:04
  • $\begingroup$ @poncho Which brings us neatly right round to the stupidity of cryptographic monoculture and that the only point of forcing AES on the world suggests that it’s broken in real time. Prove that it isn't. And if it isn’t, then why did one of our mods/(NSA contractors?) glory in doing ”OTP is going to be HNQ that need to be stopped. Yeah there are lots to talk about that, however, that should be enough. I'll add some internal links, too.”? $\endgroup$
    – Paul Uszak
    Jun 24, 2023 at 21:04
  • $\begingroup$ @poncho Why focus on eliminating one time pads? OTPs are impractical, stupid, and thus have never been used. Are one time pads still used, perhaps for military or diplomatic purposes? is probably just NSA disinformation. Or..? $\endgroup$
    – Paul Uszak
    Jun 24, 2023 at 21:13
  • $\begingroup$ @poncho You asked... $\endgroup$
    – Paul Uszak
    Jun 24, 2023 at 21:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.