Questions tagged [fortuna]

Fortuna is a family of cryptographically secure PRNGs; devised by Bruce Schneier and Niels Ferguson, who published it in 2003.

Filter by
Sorted by
Tagged with
3 votes
0 answers
52 views

Why the unreasonable effectiveness of simple brute-force attack on LWE Lattice Secret Key?

Exploring LWE Lattice crypto. Generate system matrix and secret key from cryptographic PRNG (Fortuna). Derive public key as |p> = A|s>, then add NBits of zero mean uniform noise to the public ...
DBM's user avatar
  • 157
0 votes
0 answers
68 views

Article explaining Fortuna algorithm

Does anyone know an article that explains Fortuna algorithm for people without cryptographical background? If not, I would like to have an explanation because I don't manage to understand it.
Yoav Avidan's user avatar
3 votes
1 answer
1k views

Seeding the Fortuna PRNG for the first time

I am trying to understand how the Fortuna PRNG should be seeded correctly for the first time. Let's assume that we do have a large-enough seed file available, but not any entropy sources during first ...
BasilFX's user avatar
  • 31
1 vote
1 answer
363 views

Fortuna: With a Single Entropy Source

I have worked on a random number generator that has turned out to give results pretty close to those of Fortuna with a single source. I was wondering how it affects the performance and claims of ...
Jay's user avatar
  • 195
2 votes
1 answer
904 views

How Should Fortuna and Yarrow Compare When Tested With Dieharder

I have both Yarrow and Fortuna implemented as number generators. I ran 100 complete DieHarder (entropy tester) tests for each implementation using the same entropy source. The results were surprising: ...
Whome's user avatar
  • 143
3 votes
0 answers
391 views

Fortuna PRNG: What is the effect of the block cipher key size?

The Fortuna PRNG uses AES-256 for generating output blocks by encrypting a counter value $C$ in CTR mode using a 256-bit key $K$. For the analysis, it seems the block size of 128 is the limiting ...
quantifier's user avatar
5 votes
1 answer
509 views

In Fortuna, can I use ChaCha20 instead of a block cipher and Blake2b instead of iterated SHA256?

In the Fortuna CSPRNG, can I use ChaCha20 instead of a block cipher and Blake2b instead of double SHA256, and still retain security? My hypothesis is "yes" because: The block cipher's only use is in ...
Demi's user avatar
  • 4,793
1 vote
1 answer
325 views

Is it OK to reseed a Deterministic Random Bit Generator from itself?

I want a deterministic PRNG for simulation purposes, and I don't want to have to worry about spurious correlations like those the DMCT is designed to protect the Mersenne Twister against. So even ...
Alex Coventry's user avatar
3 votes
1 answer
427 views

Hashing entropy with only 128 bits of internal state

I am looking to implement the Fortuna algorithm (https://www.schneier.com/fortuna.pdf) on a system with very restrictive memory constraints, using AES-128 as the underlying cipher. As the key size is ...
Foogod's user avatar
  • 171
1 vote
2 answers
129 views

Fortuna: why are source ID and data length added together with entropy data into the pools

Section 9.5.6 of Cryptography Engineering states that The concatenation [of source number, length of data, and data itself] is then appended to the pool. Why are we including source number and ...
wmjdgla's user avatar
  • 203
1 vote
2 answers
580 views

Why are Fortuna entropy pools reset after a reseed?

I've implemented LibTomCrypt's version of fortuna and am wondering about the pool resetting after a reseed. In fortuna.c in libtomcrypt we have the following (which is that part that adds the entropy ...
Duncan Drennan's user avatar
3 votes
1 answer
756 views

Why does Fortuna RNG use double SHA-256?

In the paper for Fortuna the authors say that you can use any good digest algorithm (obviously as long as its output is 256 bit) and then they recommend double SHA-256. Why? What's the benefit? What ...
xxxxxxxxx's user avatar
  • 548
12 votes
1 answer
3k views

How much entropy is lost via hashing when you add known or low entropy data?

(I updated the title, as I think there was some confusion as to the question) Here's the question: For example, if I have a bit stream that is 64K bytes long and there is about 16 *8 bits worth of ...
Blaze's user avatar
  • 551
4 votes
2 answers
432 views

Advantages of combined PRNGs

This question is related to this one in intention, and this one in scope. Would I be guarding myself against future attacks on a single PRNG if I combine two (or more) together? I am thinking of ...
rath's user avatar
  • 2,548
8 votes
3 answers
1k views

Testing the Fortuna random number generator?

I have implemented the Fortuna random number generator as described in chapter 10 of "Practical Cryptography" (Ferguson and Schneier, Wiley, 2003), the result can be found at http://www.seehuhn.de/...
jochen's user avatar
  • 183
3 votes
2 answers
1k views

Why does Fortuna (RNG) require entropy sources to specify accumulator pool?

Re-reading my copy of Cryptography Engineering for the holidays, I was struck by the following question about the Fortuna RNG: Why require an entropy source specify which pool a random event should ...
Kevin Montrose's user avatar