What is the maximum bias recommended by NIST for random number generators?

This answer says that it is $2^{-64}$.

Is it same for all applications? Does NIST have a publication with more information?

I tried to browse through NIST Recommendation for Random Bit Generator Constructions, but couldn't find it.


1 Answer 1


Yes, NIST recommends $\epsilon \le 2^{-64}$. They consider such a sequence to have "full entropy". It's in the definitions (page 4) of SP800-90C.


Converting that to a probability bias, $P(x_i = 0, x_i = 1) \approx 0.5 \pm 2^{-66}$.

The interesting thing is that if the Leftover Hash Lemma is used, $\epsilon$ can be set by the designer. ID Quantique TRNGs are designed with extractors such that $\epsilon \approx 2^{-100}$.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.