Questions tagged [fortuna]
Fortuna is a family of cryptographically secure PRNGs; devised by Bruce Schneier and Niels Ferguson, who published it in 2003.
16
questions
3
votes
0
answers
55
views
Why the unreasonable effectiveness of simple brute-force attack on LWE Lattice Secret Key?
Exploring LWE Lattice crypto. Generate system matrix and secret key from cryptographic PRNG (Fortuna). Derive public key as |p> = A|s>, then add NBits of zero mean uniform noise to the public ...
- 157
0
votes
0
answers
73
views
Article explaining Fortuna algorithm
Does anyone know an article that explains Fortuna algorithm for people without cryptographical background? If not, I would like to have an explanation because I don't manage to understand it.
3
votes
1
answer
1k
views
Seeding the Fortuna PRNG for the first time
I am trying to understand how the Fortuna PRNG should be seeded correctly for the first time.
Let's assume that we do have a large-enough seed file available, but not any entropy sources during first ...
- 31
1
vote
1
answer
367
views
Fortuna: With a Single Entropy Source
I have worked on a random number generator that has turned out to give results pretty close to those of Fortuna with a single source.
I was wondering how it affects the performance and claims of ...
- 195
2
votes
1
answer
906
views
How Should Fortuna and Yarrow Compare When Tested With Dieharder
I have both Yarrow and Fortuna implemented as number generators. I ran 100 complete DieHarder (entropy tester) tests for each implementation using the same entropy source. The results were surprising: ...
- 143
3
votes
0
answers
397
views
Fortuna PRNG: What is the effect of the block cipher key size?
The Fortuna PRNG uses AES-256 for generating output blocks by encrypting a counter value $C$ in CTR mode using a 256-bit key $K$. For the analysis, it seems the block size of 128 is the limiting ...
- 31
5
votes
1
answer
518
views
In Fortuna, can I use ChaCha20 instead of a block cipher and Blake2b instead of iterated SHA256?
In the Fortuna CSPRNG, can I use ChaCha20 instead of a block cipher and Blake2b instead of double SHA256, and still retain security?
My hypothesis is "yes" because:
The block cipher's only use is in ...
- 4,793
1
vote
1
answer
326
views
Is it OK to reseed a Deterministic Random Bit Generator from itself?
I want a deterministic PRNG for simulation purposes, and I don't want to have to worry about spurious correlations like those the DMCT is designed to protect the Mersenne Twister against. So even ...
- 121
3
votes
1
answer
433
views
Hashing entropy with only 128 bits of internal state
I am looking to implement the Fortuna algorithm (https://www.schneier.com/fortuna.pdf) on a system with very restrictive memory constraints, using AES-128 as the underlying cipher.
As the key size is ...
- 171
1
vote
2
answers
129
views
Fortuna: why are source ID and data length added together with entropy data into the pools
Section 9.5.6 of Cryptography Engineering states that
The concatenation [of source number, length of data, and data itself] is then appended to the pool.
Why are we including source number and ...
- 203
1
vote
2
answers
580
views
Why are Fortuna entropy pools reset after a reseed?
I've implemented LibTomCrypt's version of fortuna and am wondering about the pool resetting after a reseed. In fortuna.c in libtomcrypt we have the following (which is that part that adds the entropy ...
- 293
3
votes
1
answer
759
views
Why does Fortuna RNG use double SHA-256?
In the paper for Fortuna the authors say that you can use any good digest algorithm (obviously as long as its output is 256 bit) and then they recommend double SHA-256.
Why? What's the benefit? What ...
- 558
12
votes
1
answer
3k
views
How much entropy is lost via hashing when you add known or low entropy data?
(I updated the title, as I think there was some confusion as to the question)
Here's the question:
For example, if I have a bit stream that is 64K bytes long and there is about 16 *8 bits worth of ...
- 551
4
votes
2
answers
433
views
Advantages of combined PRNGs
This question is related to this one in intention, and this one in scope.
Would I be guarding myself against future attacks on a single PRNG if I combine two (or more) together?
I am thinking of ...
- 2,548
8
votes
3
answers
1k
views
Testing the Fortuna random number generator?
I have implemented the Fortuna random number generator as described in chapter 10 of "Practical Cryptography" (Ferguson and Schneier, Wiley, 2003), the result can be found at http://www.seehuhn.de/...
- 183
3
votes
2
answers
1k
views
Why does Fortuna (RNG) require entropy sources to specify accumulator pool?
Re-reading my copy of Cryptography Engineering for the holidays, I was struck by the following question about the Fortuna RNG:
Why require an entropy source specify which pool a random event should ...
- 165