3
$\begingroup$

In NIST 800-90A, Hash_DRBG, HMAC_DRBG and CTR_DRBG (with derivation function) all require a nonce for instantiation.

I understand the usual application for a nonce to prevent replay attacks. However, I don't understand the security benefit a nonce provides for a CSPRNG. Additionally, I am wondering why CTR_DRBG without a derivation function does not require a nonce.

What am I missing here?

$\endgroup$
2
$\begingroup$

What am I missing here?

You could re-use the master secret over multiple invocations and just rely on different nonces.

This may come handy – for example – on embedded hardware without a proper True Random Number Generator.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.