# Seeding the Fortuna PRNG for the first time

I am trying to understand how the Fortuna PRNG should be seeded correctly for the first time.

Let's assume that we do have a large-enough seed file available, but not any entropy sources during first boot. To my understanding, I would:

• initialize the PRNG (section 9.5.4)
• load the seed file (section 9.6.2)
• produce random numbers (section 9.5.5)

The last step would produce an error: the check on the end of the pseudo-code in section 9.5.5 would assert that ReseedCnt is zero: PRNG not seeded yet.

When I track the usage of ReseedCnt, I observe the following:

• ReseedCnt is set to zero during initializiation.
• When reading the seed file, ReseedCnt is untouched.
• When generating random data, ReseedCnt is incremented when enough entropy is available in Pool[0] and enough time has passed (not the case during first boot).

So, is the paper missing some steps on what to do in this situation? Section 9.6.6 about first boot explicitly states: 'Having an outside source of randomness to create the first seed file is probably the best solution.'

• Looking at fortuna.c (as used in FreeBSD) might help if the pseudo-code confuses you a bit. – e-sushi Mar 12 '18 at 13:50
• I did, but this check I am talking about is not implemented in the FreeBSD version of Fortuna. But I don't know why, or why I can deviated from that. – BasilFX Mar 12 '18 at 13:55
• Sounds maybe strange, but we live in a world where the authors of most of the crypto primitives are still alive. You could simply contact Bruce and ask him :) He may not respond to every request of course, but this seems one that might be answered. – Maarten Bodewes Mar 12 '18 at 14:14