I'm trying to test my HMAC-DRBG implementation, but I do not understand how the AdditionalInput paramter should be used. From one test case (pr-false):

[PredictionResistance = False]
[EntropyInputLen = 256]
[NonceLen = 128]
[PersonalizationStringLen = 0]
[AdditionalInputLen = 256]
[ReturnedBitsLen = 1024]

EntropyInput = 05ac9fc4c62a02e3f90840da5616218c6de5743d66b8e0fbf833759c5928b53d
Nonce = 2b89a17904922ed8f017a63044848545
PersonalizationString = 
EntropyInputReseed = 2791126b8b52ee1fd9392a0a13e0083bed4186dc649b739607ac70ec8dcecf9b
AdditionalInputReseed = 43bac13bae715092cf7eb280a2e10a962faf7233c41412f69bc74a35a584e54c
AdditionalInput = 3f2fed4b68d506ecefa21f3f5bb907beb0f17dbc30f6ffbba5e5861408c53a1e
AdditionalInput = 529030df50f410985fde068df82b935ec23d839cb4b269414c0ede6cffea5b68
ReturnedBits = 02ddff5173da2fcffa10215b030d660d61179e61ecc22609b1151a75f1cbcbb4363c3a89299b4b63aca5e581e73c860491010aa35de3337cc6c09ebec8c91a6287586f3a74d9694b462d2720ea2e11bbd02af33adefb4a16e6b370fa0effd57d607547bdcfbb7831f54de7073ad2a7da987a0016a82fa958779a168674b56524

So I would basically instantiate my DRBG with EntropyInput and Nonce.

HmacDrbg drbg = new HmacDrbg(new DrbgParameter(macFactory,
                new byte[0]));

Then before generating output, I would reseed the DRBG with EntropyInputReseed and AdditionalInputReseed


But what should I do with the other 2 AdditionalInput inputs? The spec seems to only specify the reseed mechanic that takes AdditionalInput?


1 Answer 1


The other two AdditionalInput are to be used with the Generate function.

Page 47 of the spec describes it.

Step 2 of the algorithm performs:

 If additional_input ≠ Null then (Key, V) = HMAC_DRBG_Update (additional_input, Key, V)

Now, you might wonder why there are two strings AdditionalInput. Well, as described in the test spec there are two calls to the generate function for each test vector, so you have two additional inputs. Note that only the second output of the generate is printed in the test vector.

  • $\begingroup$ So the spec basically expects that a caller can update the additional_input" internal state at any point (without updating the seed with entropy_input)? $\endgroup$
    – Patrick
    Oct 9, 2017 at 16:38
  • $\begingroup$ Never mind, the generate takes a additionalInput $\endgroup$
    – Patrick
    Oct 9, 2017 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.