Let's say we "seed" a xof function (eg. SHAKE256) with x cryptographically random bytes (enough so that they can't be bruteforced), could said function be used as a cryptographically secure random generator? If so, when should the function be reseeded and start the process over?

  • $\begingroup$ You really don't want to use XOFs or stream ciphers or similar constructions for CSPRNGs. Just use a standardised CSPRNG like the NIST AES-CTR DRBG (and if you really want to, replace "aes-ctr" with your stream cipher) $\endgroup$
    – SEJPM
    May 9 '19 at 12:40
  • 1
    $\begingroup$ @SEJPM Maybe consider pointing out what DRBGs have that XOFs don't? $\endgroup$
    – DannyNiu
    May 9 '19 at 12:43
  • $\begingroup$ Not an exact duplicate, but it may answer your question. $\endgroup$ May 9 '19 at 14:16
  • $\begingroup$ @SEJPM Why? I guess backtracking, but with short lived RNGs that's not a critical property for random number generation. (Unless secrets don't get erased from memory. But, regardless, the output may be a secret that needs erasing just as well.) $\endgroup$ May 9 '19 at 15:10