I want to run statistical tests on my implementation of AES. How should I convert it into a PRNG? Is there a standard way to go about doing this? I could not find much information about this although this was done by NIST while during the selection of AES back in the days.
The answer is simple. AES is in itself a pseudorandom function, so an output from a single block encryption will produce 128-bits of pseudorandom numbers.
Now to use AES to generate longer sequences, you will have to use a block-cipher mode that lets you do the same.
Here is a small list of a few very popular modes ment for PRNGs:
- Counter(CTR): Counter mode turns a block cipher into a synchronous stream cipher. It requires an IV or nonce which is combined with a counter and encrypted with a block cipher. The counter can be any non repeating function, however a simple increment by one is secure enough, and not to mention, the most efficient.
- Output Feedback (OFB): This also turns a block cipher into a synchronous stream cipher. It starts encryption with an IV, and operates by encrypting the previous block.
- Cipher Feedback (CFB): This one converts a block cipher into a self-synchronous stream cipher. It starts with an IV, XORs the output to get the first ciphertext block, and uses every previous ciphertext block as the next IV.
You could also use other modes too, but they might not be well suited for use in stream ciphers, so they will be slow. Otherwise, the ultimate answer to your question is to use a secure block cipher mode. And, not to mention, they work well with hash functions as well.
As David Wong commented, NIST has proposed CTR-DRBG as the secure way to do it. Here is a link to an implementation in Python using CTR-AES-128.
However, it should be noted that quite recently (2019-11) a side-channel attack was published (by Lauren De Meyer, COSICS) to recover the key and a nonce using only 256 power traces of CTR-AES.
Thus, one should be very careful when generating many random numbers from CTR-AES if adversaries have knowledge of power consumption of the device.