Questions tagged [fortuna]

Fortuna is a family of cryptographically secure PRNGs; devised by Bruce Schneier and Niels Ferguson, who published it in 2003.

Filter by
Sorted by
Tagged with
3
votes
1answer
389 views

Seeding the Fortuna PRNG for the first time

I am trying to understand how the Fortuna PRNG should be seeded correctly for the first time. Let's assume that we do have a large-enough seed file available, but not any entropy sources during first ...
1
vote
1answer
189 views

Fortuna: With a Single Entropy Source

I have worked on a random number generator that has turned out to give results pretty close to those of Fortuna with a single source. I was wondering how it affects the performance and claims of ...
2
votes
1answer
678 views

How Should Fortuna and Yarrow Compare When Tested With Dieharder

I have both Yarrow and Fortuna implemented as number generators. I ran 100 complete DieHarder (entropy tester) tests for each implementation using the same entropy source. The results were surprising: ...
3
votes
0answers
176 views

Fortuna PRNG: What is the effect of the block cipher key size?

The Fortuna PRNG uses AES-256 for generating output blocks by encrypting a counter value $C$ in CTR mode using a 256-bit key $K$. For the analysis, it seems the block size of 128 is the limiting ...
5
votes
1answer
270 views

In Fortuna, can I use ChaCha20 instead of a block cipher and Blake2b instead of iterated SHA256?

In the Fortuna CSPRNG, can I use ChaCha20 instead of a block cipher and Blake2b instead of double SHA256, and still retain security? My hypothesis is "yes" because: The block cipher's only use is in ...
1
vote
1answer
185 views

Is it OK to reseed a Deterministic Random Bit Generator from itself?

I want a deterministic PRNG for simulation purposes, and I don't want to have to worry about spurious correlations like those the DMCT is designed to protect the Mersenne Twister against. So even ...
3
votes
1answer
272 views

Hashing entropy with only 128 bits of internal state

I am looking to implement the Fortuna algorithm (https://www.schneier.com/fortuna.pdf) on a system with very restrictive memory constraints, using AES-128 as the underlying cipher. As the key size is ...
1
vote
2answers
114 views

Fortuna: why are source ID and data length added together with entropy data into the pools

Section 9.5.6 of Cryptography Engineering states that The concatenation [of source number, length of data, and data itself] is then appended to the pool. Why are we including source number and ...
1
vote
2answers
494 views

Why are Fortuna entropy pools reset after a reseed?

I've implemented LibTomCrypt's version of fortuna and am wondering about the pool resetting after a reseed. In fortuna.c in libtomcrypt we have the following (which is that part that adds the entropy ...
3
votes
1answer
576 views

Why does Fortuna RNG use double SHA-256?

In the paper for Fortuna the authors say that you can use any good digest algorithm (obviously as long as its output is 256 bit) and then they recommend double SHA-256. Why? What's the benefit? What ...
10
votes
1answer
2k views

How much entropy is lost via hashing when you add known or low entropy data?

(I updated the title, as I think there was some confusion as to the question) Here's the question: For example, if I have a bit stream that is 64K bytes long and there is about 16 *8 bits worth of ...
4
votes
2answers
405 views

Advantages of combined PRNGs

This question is related to this one in intention, and this one in scope. Would I be guarding myself against future attacks on a single PRNG if I combine two (or more) together? I am thinking of ...
8
votes
3answers
849 views

Testing the Fortuna random number generator?

I have implemented the Fortuna random number generator as described in chapter 10 of "Practical Cryptography" (Ferguson and Schneier, Wiley, 2003), the result can be found at http://www.seehuhn.de/...
3
votes
2answers
1k views

Why does Fortuna (RNG) require entropy sources to specify accumulator pool?

Re-reading my copy of Cryptography Engineering for the holidays, I was struck by the following question about the Fortuna RNG: Why require an entropy source specify which pool a random event should ...