In NIST SP 800-90C, it said:"Small deviations in the behavior of the entropy source in an NRBG will be masked by the DRBG output" Why the DRBG can mask the small deviations in the behavior of the entropy source?

Can anyone give the mathematical or reference?


1 Answer 1


Consider this construct from 90C:-


The HMAC-DRBG is just NIST's overly complicated (intentionally?) PRNG. But it's still only a RNG with an iterated internal state. Once the state is instantiated (seeded) from the live entropy source, it runs.

If 'poor' entropy is used to seed it, the cryptographic hash functions (SHA-256) inside the DRBG along with their avalanche behaviours will still produce what looks like perfectly distributed random numbers. It will 'mask' the poor entropy. Imagine if the seed was only 16 bits of true entropy. 65,536 different output streams would probably go unnoticed (at least for a while).

And it can keep running even if the live entropy source dies or is disconnected. If the internal state is capable of a 256 bit security strength, the RNG could even cycle round and around (theoretically). If the DRBG was something else with a much small state, cycling is a real possibility. And from this Q & A, no randomness test will detect that what you have left is just a CSPRNG and not a TRNG.

Thus the masking effect. Dangerous.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.