What is the maximum bias recommended by NIST for random number generators?

This answer says that it is $2^{-64}$.

Is it same for all applications? Does NIST have a publication with more information?

I tried to browse through NIST Recommendation for Random Bit Generator Constructions, but couldn't find it.


1 Answer 1


Yes, NIST recommends $\epsilon \le 2^{-64}$. They consider such a sequence to have "full entropy". It's in the definitions (page 4) of SP800-90C.


Converting that to a probability bias, $P(x_i = 0, x_i = 1) \approx 0.5 \pm 2^{-66}$.

The interesting thing is that if the Leftover Hash Lemma is used, $\epsilon$ can be set by the designer. ID Quantique TRNGs are designed with extractors such that $\epsilon \approx 2^{-100}$.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.