# Using AES-CTR as a PRNG

AES-CTR is not considered as a CSPRNG, why ? Is it unsecure to use it when a password is hashed with Argon2id to produce the seed to generate all random data needed for an end-to-end encyption system such as keys and IVs.

AES-CTR is not considered as a CSPRNG, why?

I don't know why this was given as a negative.

AES-CTR can certainly used to generate a pseudo random stream of values. If that alone makes it a CSPRNG is up for debate if you ask me. For instance, the DRBG's specified by NIST all provide a reseeding operation, which is missing from AES-CTR. Although they do provide a counter based operation as well, AES-CTR clearly doesn't qualify.

Is it unsecure to use it when a password is hashed with Argon2id to produce the seed to generate all random data needed for an end-to-end encyption system such as keys and IVs.

It is probably not insecure, but it seems to me that you are not in need of a CSPRNG. It seems to me that you need a key derivation method. Now Argon2id is already that, so if you just need more data then you can just ask Argon2 for it. It can generate up to over 4 billion bytes ($$2^{32}$$), which should be plenty.

If you need multiple keys derived by sequence, I'd recommend to use a Key Based Key Derivation Function such as HKDF afterwards, using a label or indeed counter to generate multiple keys. Or you could use a ratchet or similar methods of key derivation.

A practical reason not to specify to use a CSPRNG is that the output of CSPRNG is generally just not precisely defined. The output must be pseudo-random of course, but slight changes in the implementation will generate random but different output even for the same seed. It is often not entirely clear if and when a reseed happens either. In that sense the output of a stream cipher such as AES-CTR is probably better defined in practice.