NIST SP 800-90a defines the CTR_DRBG in section 10.2.

There is a comment within the document that I don't understand.

Let's assume we want to achieve a security strength of 256 bits, using as underlying algorithm AES-256 and we do use a derivation function.

Therefore in Table 3 the entropy string is supposed to be within $[256,2^{35}]$ bits and the personalization string is up to $2^{35}$ bits. The seedlen is equal to $384$ bits.

But in section "Instantiation When a Derivation Function is Used" step 1 seed_material is defined as

seed_material = entropy_input || nonce || personalization_string

with the comment "Ensure that the length of the seed_material is exactly seedlen bits".

What is the sense of this comment ?

If personalization_string and entropy_input are allowed to grow up to $2^{35}$ bits, how can their concatenation (excluding the nonce) be forced to be exactly $384$ bits ?


1 Answer 1


I believe the comment is explaining the next line:

seed_material = df(seed_material, seedlen)

  • $\begingroup$ Ouch. Makes sense. $\endgroup$
    – Ruggero
    Commented Sep 6, 2017 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.