This question already has an answer here:

Let's say we "seed" a xof function (eg. SHAKE256) with x cryptographically random bytes (enough so that they can't be bruteforced), could said function be used as a cryptographically secure random generator? If so, when should the function be reseeded and start the process over?


marked as duplicate by Squeamish Ossifrage, kelalaka, Community May 9 at 19:49

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • $\begingroup$ You really don't want to use XOFs or stream ciphers or similar constructions for CSPRNGs. Just use a standardised CSPRNG like the NIST AES-CTR DRBG (and if you really want to, replace "aes-ctr" with your stream cipher) $\endgroup$ – SEJPM May 9 at 12:40
  • 1
    $\begingroup$ @SEJPM Maybe consider pointing out what DRBGs have that XOFs don't? $\endgroup$ – DannyNiu May 9 at 12:43
  • $\begingroup$ Not an exact duplicate, but it may answer your question. $\endgroup$ – Squeamish Ossifrage May 9 at 14:16
  • $\begingroup$ @SEJPM Why? I guess backtracking, but with short lived RNGs that's not a critical property for random number generation. (Unless secrets don't get erased from memory. But, regardless, the output may be a secret that needs erasing just as well.) $\endgroup$ – Future Security May 9 at 15:10