# PRNG For RSA (ANSI_X9.31)

I have a query please , I want to know how to generate random numbers using ANSI_X9.31 algorithm for RSA Algorithm please . Thank u

• ANSI X9.31 is deprecated and no longer allowed in FIPS 140-2. There should be no need to generate new keys in this format. Jun 25 at 16:13
• Thank you for the help. plz can you tell me what is the Method used to generate random prime numbers for the RSA algorithm? Jun 25 at 16:16
• Your cryptographic library will generate keys for you. There's never any need to generate the random primes yourself. I don't like to provide advice that will let users implement insecure solutions. Also programming questions are mostly off-topic here. Jun 25 at 16:28
• I am working on this research, the goal is academic. I have no other intentions anyway, thank u Jun 25 at 16:31
• Then you can use an ancient version of OpenSSL to generate the keys in the correct format. Jun 25 at 17:00

ANS X9.31:1988 Digital Signatures Using Reversible Public Key Cryptography for the Financial Services Industry (rDSA) (per the name on my copy purchased in the last century) starts in

This standard, adapted from ISO/IEC 9796-2 and ISO/IEC 14888-3, defines a method for digital signature (signature) generation and verification for the protection of financial messages and data using reversible public key cryptography systems without message recovery. In addition, this rDSA Standard provides the criteria for the generation of public and private keys required by the algorithm and the procedural controls required for the secure use of the algorithm.

The signature scheme is still referenced (not described) in FIPS 186-4. When instantiated with SHA-1, RSA, and $$n$$ of $$8k$$-bit, a message $$m$$ is padded as the $$8k-1$$-bit $$R\gets\mathtt{6B}\,\mathtt{BB}\,\mathtt{BB}\ldots\mathtt{BB}\,\mathtt{BA}\mathbin\|\operatorname{SHA-1}(m)\|\mathtt{33}\,\mathtt{CC}$$ then the signature is the $$k$$-byte big-endian representation of$$\Sigma\gets\min((R^d\bmod n),n-(R^d\bmod n))$$ Verification is equivalent to checking the signature is $$k$$-byte and coding in big-endian representation an integer $$\Sigma'$$ with $$0\le\Sigma', computing $$R'\gets{\Sigma'}^e\bmod n$$, computing $$R$$ from $$m$$ as above, then checking $$R'$$ is one of $$R$$ or $$n-R$$ (thought that's not quite how the standard puts it).

That standard did not catch nearly as much as RSASSA-PKCS1-v1_5, which uses a slightly different padding, does not use the $$\min$$ trick, and eliminated the provisions for even $$e$$ (not described in the above for simplification).

The key generation scheme is now essentially replaced by FIPS 186-4 appendix B3.

There's also the often referenced "Appendix A: Random Number Generation". It's officially buried by FIPS 186-4:

ANS X9.31 contains an annex on random number generation. However, implementations of ANS X9.31 shall use approved random number generation methods.

It's not clear from the body of the question that it's relevant to what's asked. If it is, please tell what sub-section in comment. If that's not known, forget about it and use /dev/urandom or the local equivalent.