0
$\begingroup$

I want to construct a seeder for a big state PRNG (xorshift1024 based) and have been thinking about using Aes Ctr using multiple 256 bit keys, where the counter is simply encrypted multiple times (similar to 3DES).

Would this in any way reduce the statistical qualities of Aes Ctr? Security isn't a concern, but uniqueness of the generated random number sequences is. The reason I'm considering Aes is because it's built into .net and mono.

Improve this question
$\endgroup$
5
  • 2
    $\begingroup$ 3DES doesn't encrypt a counter multiple times. And AES-CTR as a CSPRNG is unique as long as the nonce is unique, which is a requirement for using counter mode. Why not just do that? $\endgroup$
    – forest - on strike ♦
    Dec 21, 2018 at 4:23
  • $\begingroup$ @forest - 3DES uses encrypt(decrypt(encrypt(counter))) from what I understand, but that's besides the point. The reason I want to use a similar approach is because of the amount of key material I have and because of the state size of the random number generator I want to seed. $\endgroup$
    – Thorham
    Dec 21, 2018 at 4:38
  • 1
    $\begingroup$ No, it does not encrypt a counter. It encrypts one single block, like regular DES. $\endgroup$
    – forest - on strike ♦
    Dec 21, 2018 at 6:35
  • $\begingroup$ Xorshifts don't have weak states (other than zero) so their seeding is trivial. 1,2,3... will work just as well as anything else. I'm the first to propose unusual solutions to problems, but from some experience I'm sensing that this is the classic XY problem. What do you really want to achieve with this? Are you simply looking for a large period? Remember that xor's aren't cryptographic and this is a crypto forum after all. And if the final quality is important, xorshifts are left wanting... $\endgroup$
    – Paul Uszak
    Dec 21, 2018 at 14:43
  • $\begingroup$ @Paul Uszak - Big state xorshifts definitely have weak states. Same as Mersenne twister, just not as bad. $\endgroup$
    – Thorham
    Dec 22, 2018 at 19:50

2 Answers 2

Reset to default
1
$\begingroup$

There is really no need to go beyond 256 bit security. If you want to combine multiple keys - presumably because you are not sure they provide enough security regardless of the size - then you could concat them and use them as Input Keying Material to a KBKDF that provides extraction as well as expansion (e.g. HKDF). Then the output can be used to seed your PRNG.

It seems you are trying to build your own KDF using CTR mode. Such KDF's already exist, but they generally don't provide extraction of the entropy, just expansion of statically sized (128, 192 or 256 bit) keying material. Proving that your scheme does extract entropy well will be tough to accomplish.

The only drawback of using HKDF for this is that the keying material must be in memory to perform the calculations; you should make sure that this is (1) possible and (2) possible to secure. How big this drawback is depends on the situation.

Improve this answer
$\endgroup$
1
  • $\begingroup$ I'm not sure if you will agree with this answer; it offers no security proof of the extraction phase after all. But at least you now know what you're trying to do and the correct terms :) $\endgroup$
    – Maarten Bodewes - on strike ♦
    Dec 22, 2018 at 0:26
0
$\begingroup$

If I understand your question correctly, you want to do use the output of the AES -CTR encryption as a seed for a PRNG with 1024bit states (so you need four outputs of the encryption).

So if you encrypt four times the all-zero-string using four different AES keys and concatenate the outputs, this should give you a statistical good and unique seed for your PRNG.

Improve this answer
$\endgroup$
7
  • $\begingroup$ Not exactly. I need something like Aes with larger keys for seeding multiple instances of the PRNG. $\endgroup$
    – Thorham
    Dec 21, 2018 at 9:51
  • $\begingroup$ So you want the AES-CTR encryption be your 1024bit PRNG? $\endgroup$
    – asante
    Dec 21, 2018 at 12:58
  • $\begingroup$ @Thorham If security isn't a concern, then why do you need larger keys? $\endgroup$
    – Ella Rose
    Dec 21, 2018 at 15:12
  • $\begingroup$ @Ella Rose - World wide uniqueness. $\endgroup$
    – Thorham
    Dec 21, 2018 at 15:28
  • 1
    $\begingroup$ AES is a bijection, and if you feed it with an incrementing counter that does not repeat, then the outputs will never repeat. If you use multiple keys, this property disappears and you will end up with repeat outputs after a certain point... $\endgroup$
    – Ella Rose
    Dec 21, 2018 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.