In NIST-SP-800-90Ar1, the Hash-DRBG is instantiated with hash functions using strange values for seed length (seedlen) such as 440, 888.
How are these values derived? How to derive values for other hash functions?
$\begingroup$
$\endgroup$
$\begingroup$
$\endgroup$
440 and 888 are the maximal values of seed length, that, when concatenated with 1 octet, yields a input to SHA256 and SHA512 respectively, requiring only 1 invocation of the compression function.
These values are fixed in such way that, it precludes the use of other hash functions, even ones approved as SHA3.
However, if one wants, the above rule can be used to derive seedlen for other hash functions, although, this would have no official document backing it.
For example, the minimal padding length in all SHA3 functions (when used in byte-oriented environment), is 1 byte, so seedlen for SHA3 functions is
$$ 1600-\mathit{capacity}-16 $$
Also, there's problem with Hash-DRBG that's missed in the publication.
The document states that the hash function used should be "one-way", but in reality, to obtain secure DRBG instances, the underlaying primitive have to behave random, or else, distinguish attacks will be possible.
-
$\begingroup$ In practical terms, 256 bits is plenty. $\endgroup$ – Squeamish Ossifrage Oct 20 '19 at 13:37
