Using NIST SP 800 - 90Ar1 Test Vectors for HMAC_DRBG with Reseeding and AdditionalInput

Question

I'm trying to test my HMAC-DRBG implementation, but I do not understand how the AdditionalInput paramter should be used. From one test case (pr-false):

[SHA-256]
[PredictionResistance = False]
[EntropyInputLen = 256]
[NonceLen = 128]
[PersonalizationStringLen = 0]
[AdditionalInputLen = 256]
[ReturnedBitsLen = 1024]

COUNT = 0
EntropyInput = 05ac9fc4c62a02e3f90840da5616218c6de5743d66b8e0fbf833759c5928b53d
Nonce = 2b89a17904922ed8f017a63044848545
PersonalizationString = 
EntropyInputReseed = 2791126b8b52ee1fd9392a0a13e0083bed4186dc649b739607ac70ec8dcecf9b
AdditionalInputReseed = 43bac13bae715092cf7eb280a2e10a962faf7233c41412f69bc74a35a584e54c
AdditionalInput = 3f2fed4b68d506ecefa21f3f5bb907beb0f17dbc30f6ffbba5e5861408c53a1e
AdditionalInput = 529030df50f410985fde068df82b935ec23d839cb4b269414c0ede6cffea5b68
ReturnedBits = 02ddff5173da2fcffa10215b030d660d61179e61ecc22609b1151a75f1cbcbb4363c3a89299b4b63aca5e581e73c860491010aa35de3337cc6c09ebec8c91a6287586f3a74d9694b462d2720ea2e11bbd02af33adefb4a16e6b370fa0effd57d607547bdcfbb7831f54de7073ad2a7da987a0016a82fa958779a168674b56524

So I would basically instantiate my DRBG with EntropyInput and Nonce.

HmacDrbg drbg = new HmacDrbg(new DrbgParameter(macFactory,
                entropyInput,
                nonce,
                new byte[0]));

Then before generating output, I would reseed the DRBG with EntropyInputReseed and AdditionalInputReseed

drbg.requestReseed(entropyInputReseed,additionalInputReseed);

But what should I do with the other 2 AdditionalInput inputs? The spec seems to only specify the reseed mechanic that takes AdditionalInput?

Answer 1

The other two AdditionalInput are to be used with the Generate function.

Page 47 of the spec describes it.

Step 2 of the algorithm performs:

 If additional_input ≠ Null then (Key, V) = HMAC_DRBG_Update (additional_input, Key, V)

Now, you might wonder why there are two strings AdditionalInput. Well, as described in the test spec there are two calls to the generate function for each test vector, so you have two additional inputs. Note that only the second output of the generate is printed in the test vector.