2
$\begingroup$

I thought I'd find an implementation in NaCl, but /dev/urandom is what I find. Search engines samples revealed most implementations are broken.

What libraries are there currently? (I'm only interested in the PRNG based on ChaCha20.)

$\endgroup$
  • $\begingroup$ Why not just use OpenSSL? $\endgroup$ – forest Mar 2 '19 at 2:15
  • 1
    $\begingroup$ OpenBSD is known to implement the arc4random function with ChaCha20 stream cipher. NIST SP 800-90Ar1 specifies HASH_DRBG and HMAC_DRBG that're based on hash functions and keyed-hash message authentication code, which you can instantiate with BLAKE2 hash functions which are in turn based on modified ChaCha PRF. $\endgroup$ – DannyNiu Mar 2 '19 at 7:13
  • 1
    $\begingroup$ The article you link to is a bit puzzling: the author makes a false claim about ChaCha (no, ChaCha is not a block cipher at all), and gives no examples of implementations they claim are ‘incorrect’ or of specific protocols that they implement incorrectly. Just be clear on what the 384-bit inputs are to ChaCha (key, input/counter) and how you concatenate or carve up the 512-bit outputs, and make sure you have test vectors. $\endgroup$ – Squeamish Ossifrage Mar 2 '19 at 21:03
  • $\begingroup$ @DannyNiu, thanks for the pointer. Indeed, I've been able to verify that /dev/urandom is based on ChaCha20 on OpenBSD starting at version 4.5 and NetBSD starting at version 7.0 and has also replaced SHA-1 in the Linux kernel starting at version 4.8. $\endgroup$ – user45491 Mar 3 '19 at 14:02
  • $\begingroup$ @forest, does OpenSSL implement a PRNG based on ChaCha20? I have not been able to verify this yet --- I'd appreciate pointers to OpenSSL's source code if you know it. $\endgroup$ – user45491 Mar 3 '19 at 14:07
3
$\begingroup$

Beyond what specific primitive your system will be based on, there are important things to consider while building a CSPRNG.

Bernstein's Fast-key-erasure random-number generators article is a good starting point, as well as how randomness generation is done in Amazon S2N.

Buffer output, but erase data as it's being read, frequently rotate the key, mix multiple entropy sources if possible.

Libsodium provides a Salsa20-based CSPRNG implementation. It is not used by default, as for most applications, reading /dev/urandom is perfectly fine.

ChaCha20 can be a drop-in replacement for Salsa20 here.

$\endgroup$
  • 2
    $\begingroup$ It's seeded using /dev/urandom (or equivalent), and RDRAND if available. If you're looking for a deterministic generator, you can simply use ChaCha20 in counter mode. $\endgroup$ – Frank Denis Mar 2 '19 at 20:17
  • $\begingroup$ Ah, no :-) I was seeking clarification of your answer from the OP's perspective. It's fine. $\endgroup$ – Paul Uszak Mar 2 '19 at 22:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.