0
$\begingroup$

I considered Extendable-Output Function (XOF) with a random seed but it seems I would have to specify the output length at the start and store the entire output. I don't know how many bytes I will need in advance, and I don't want to store a very long string.

I also considered some ad-hoc stateful construction using XOF that maintains a running counter. I wonder what is the "standard" and efficient way to do this.

$\endgroup$
2
  • 1
    $\begingroup$ Is there some nuance that's not apparent from the question's title? Why not just do the standard thing: CSPRNG? $\endgroup$
    – Paul Uszak
    Feb 7, 2022 at 21:37
  • $\begingroup$ @PaulUszak One thing that might be an issue is that many CSPRNG implementations are seeded by the system, may be reseeded etc. So they are not reliable to generate the same bits all the time. Some CSPRNG's may also specify a specific speed size, so there's that. But yeah, if this is just about getting random bytes or integers: use a CSPRNG. $\endgroup$
    – Maarten Bodewes
    Feb 7, 2022 at 21:59

1 Answer 1

0
$\begingroup$

I considered Extendable-Output Function (XOF) with a random seed but it seems I would have to specify the output length at the start and store the entire output.

No; the standard SHAKE XOF doesn't need to know up front how long of an output it can generate; there's no reason why you can't keep on 'squeezing' to get as much output as you need.

Now, it's possible that the API for the crypto library that you are using has such a limitation (that is, it'll always generate all its output at once, and has no provision to generate any more). On the other hand, I wouldn't naively expect that from a library - have you looked to ensure that your library doesn't have a 'generate more output' function/API available (possibly by simply calling the 'generate output API' with the SHAKE state)?

$\endgroup$
3
  • $\begingroup$ I'm looking at Python hashlib docs.python.org/3/library/hashlib.html and it doesn't seem to have such an API. $\endgroup$
    – Myath
    Feb 7, 2022 at 23:39
  • $\begingroup$ @Myath: I suspect that calling shake.digest(length) multiple times will generate consecutive parts of the shake output. $\endgroup$
    – poncho
    Feb 8, 2022 at 3:17
  • $\begingroup$ @poncho Sadly, that is not the case; I just tested it. It looks like @Myath will have to use a 3rd-party library such as pycryptodome—neither the standard library nor pyca/cryptography supports that functionality, strangely. $\endgroup$ Feb 9, 2022 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.