Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
What is the maximum bias recommended by NIST for random number generators?
This answer says that it is $2^{-64}$.
Is it same for all applications? Does NIST have a publication with more information?
I tried to browse through NIST Recommendation for Random Bit Generator Constructions, but couldn't find it.
Yes, NIST recommends $\epsilon \le 2^{-64}$. They consider such a sequence to have "full entropy". It's in the definitions (page 4) of SP800-90C.
Converting that to a probability bias, $P(x_i = 0, x_i = 1) \approx 0.5 \pm 2^{-66}$.
The interesting thing is that if the Leftover Hash Lemma is used, $\epsilon$ can be set by the designer. ID Quantique TRNGs are designed with extractors such that $\epsilon \approx 2^{-100}$.
