From Definition of CSPRNG, it has two characteristics
- It satisfies the next-bit test.
- It withstands 'state compromise extensions' - part of all of the state being compromised does not allow for reconstruction of the prior stream of random numbers.
The Design of CSPRNG can be based on
- Cryptographic Primitives
- Number Theory Problems
- Sepcial Designs like Yarrow, Fortuna etc
If CSPRNG is constructed out of AES/Twofish/Camellia in CTR Mode, does it satisfy 2nd characteristic? i.e Compromise of internal state will not lead to reconstruction of prior stream of random numbers?
If we consider state as Counter only, or Counter and IV only (excluding the key). Will it be a CSPRNG?
Will any CPA secure Block Cipher working in Counter mode made CSPRNG under the assumption that compromise of internal state only consists of compromise of Counter only or Counter and IV only (not the key).