I need to generate thousands of random 128-bit IVs per second and would like to amortize calls to
How can AES-256-CTR be used to construct a CSPRNG?
For example, would the following be acceptable?
- Get 48 bytes from
- Use the first 32 bytes as the AES-256-CTR key.
- Use the next 16 bytes as the AES-256-CTR IV.
- Encrypt 65536 bytes of zeroes.
- Slice the ciphertext up into 4096 128-bit IVs (65536 / 16).
- Rinse and repeat steps 1 to 6 every 4096 IVs.
Does it matter whether one encrypts 65536 bytes of zeroes at a time, or 16 bytes of zeroes at a time (i.e. should the size of the plaintext be no more than the cipher's block size)?
Would this scheme stretch the 256-bit + 128-bit entropy (initial AES key + intial AES IV) equally across the 65536 bytes of ciphertext? How does this translate to each IV sliced out of it? Would each IV have at least 128-bits of entropy or would the entropy of each IV be reduced in some way?
How could this scheme be improved?