# What are implementations of PRNGs based on ChaCha20? [closed]

I thought I'd find an implementation in NaCl, but /dev/urandom is what I find. Search engines samples revealed most implementations are broken.

What libraries are there currently? (I'm only interested in the PRNG based on ChaCha20.)

• Why not just use OpenSSL? – forest Mar 2 '19 at 2:15
• OpenBSD is known to implement the arc4random function with ChaCha20 stream cipher. NIST SP 800-90Ar1 specifies HASH_DRBG and HMAC_DRBG that're based on hash functions and keyed-hash message authentication code, which you can instantiate with BLAKE2 hash functions which are in turn based on modified ChaCha PRF. – DannyNiu Mar 2 '19 at 7:13
• The article you link to is a bit puzzling: the author makes a false claim about ChaCha (no, ChaCha is not a block cipher at all), and gives no examples of implementations they claim are ‘incorrect’ or of specific protocols that they implement incorrectly. Just be clear on what the 384-bit inputs are to ChaCha (key, input/counter) and how you concatenate or carve up the 512-bit outputs, and make sure you have test vectors. – Squeamish Ossifrage Mar 2 '19 at 21:03
• @DannyNiu, thanks for the pointer. Indeed, I've been able to verify that /dev/urandom is based on ChaCha20 on OpenBSD starting at version 4.5 and NetBSD starting at version 7.0 and has also replaced SHA-1 in the Linux kernel starting at version 4.8. – user45491 Mar 3 '19 at 14:02
• @forest, does OpenSSL implement a PRNG based on ChaCha20? I have not been able to verify this yet --- I'd appreciate pointers to OpenSSL's source code if you know it. – user45491 Mar 3 '19 at 14:07

Libsodium provides a Salsa20-based CSPRNG implementation. It is not used by default, as for most applications, reading /dev/urandom is perfectly fine.
• It's seeded using /dev/urandom (or equivalent), and RDRAND if available. If you're looking for a deterministic generator, you can simply use ChaCha20 in counter mode. – Frank Denis Mar 2 '19 at 20:17