# Practical (and secure) PRGs

Does anyone know if there exists a PRG construction which takes as input an (RSA-sized) integer seed and outputs a fixed number of bits? There are number-theoretic PRGs such as the RSA, Micali-Schnorr, and BBB algorithms (see http://cacr.uwaterloo.ca/hac/about/chap5.pdf), but these require one to know both the seed and other parameters used in the construction (e.g., the modulus $n$). I need a construction that only requires the random integer seed as input. I'm aware that I could potentially fix a universal set of public parameters and then just specify the integer seed, but I'd like to avoid that since the parameters would likely need to be refreshed after a certain number of invocations or uses.

• Why do you want to use a number-theoretic PRNG in the first place? There are many nice stream ciphers which are faster and stronger. – CodesInChaos Feb 5 '14 at 10:35

## 1 Answer

Use any DRBG (deterministic random bit generator) in the NIST FIPS (the NIST 800-90 publication series). Except... don't use Dual EC DRBG, which has serious problems and is likely to be withdrawn. Use any DRBG in that standard other than Dual EC DRBG.

Or, hash the seed with SHA256, then use AES256 in counter mode to generate output.

Either of those will work fine.

Don't use BBS. It has major problems (search on this site for other examples). There is no reason to use any of the number-theoretic PRGs in practice.