Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
In NIST SP 800-90C, it said:"Small deviations in the behavior of the entropy source in an NRBG will be masked by the DRBG output" Why the DRBG can mask the small deviations in the behavior of the entropy source?
Can anyone give the mathematical or reference?
Consider this construct from 90C:-
The HMAC-DRBG is just NIST's overly complicated (intentionally?) PRNG. But it's still only a RNG with an iterated internal state. Once the state is instantiated (seeded) from the live entropy source, it runs.
If 'poor' entropy is used to seed it, the cryptographic hash functions (SHA-256) inside the DRBG along with their avalanche behaviours will still produce what looks like perfectly distributed random numbers. It will 'mask' the poor entropy. Imagine if the seed was only 16 bits of true entropy. 65,536 different output streams would probably go unnoticed (at least for a while).
And it can keep running even if the live entropy source dies or is disconnected. If the internal state is capable of a 256 bit security strength, the RNG could even cycle round and around (theoretically). If the DRBG was something else with a much small state, cycling is a real possibility. And from this Q & A, no randomness test will detect that what you have left is just a CSPRNG and not a TRNG.
Thus the masking effect. Dangerous.
