Random Number Generation

Side-channel claim limit. Nothing on this page claims constant-time behaviour or side-channel resistance for any target: the side-channel harness covers nothing (finding A48) and no measurement exists. The Rust and C cores are designed for constant time and unmeasured; managed runtimes (JIT, GC, bounds checks) make no timing claim. Where this page names constant-time or side-channel techniques, in prose or in code, they are design intent or recommendations, not measured properties.

Cryptographically secure random number generators (CSPRNGs) are essential for generating keys, nonces, and other security-critical random values.

Available Random Number Generators

Deterministic Random Bit Generators

HMAC-DRBG

NIST-approved deterministic random bit generator based on HMAC.

  • Hash Functions: SHA-256, SHA-512, SHA-1
  • Security Level: Based on underlying hash function
  • Seed Length: Varies by hash function
  • Use Cases: Key generation, nonce generation, cryptographic protocols

Algorithm Details

HMAC-DRBG Features

  • Deterministic: Same seed produces same output sequence
  • Backtracking Resistance: Previous outputs can’t be computed from current state
  • Prediction Resistance: Future outputs can’t be predicted from current state
  • Reseedable: Can incorporate fresh entropy
  • NIST Approved: SP 800-90A compliant

Security Properties

Entropy Requirements

  • Initial Seed: Must have sufficient entropy (≥ security strength)
  • Reseeding: Periodic reseeding with fresh entropy recommended
  • Personalization: Optional personalization string for domain separation
  • Additional Input: Optional additional input for each generation

Security Levels

| Hash Function | Security Strength | Min Entropy | Max Requests | |—————|——————-|————-|————–| | SHA-1 | 80 bits | 80 bits | 2^48 | | SHA-256 | 128 bits | 128 bits | 2^48 | | SHA-512 | 256 bits | 256 bits | 2^48 |

Use Cases

Key Generation

# Generate cryptographic keys
drbg = HMAC_DRBG(entropy_source=os.urandom(32))
aes_key = drbg.generate(32)  # 256-bit AES key
hmac_key = drbg.generate(32)  # HMAC key

Nonce Generation

# Generate unique nonces
drbg = HMAC_DRBG(entropy_source=secure_entropy)
nonce = drbg.generate(12)  # 96-bit nonce for GCM

Protocol Randomness

# Generate protocol-specific random values
drbg = HMAC_DRBG(
    entropy_source=entropy,
    personalization=b"TLS_1_3_CLIENT"
)
client_random = drbg.generate(32)

Best Practices

Entropy Sources

  • Use high-quality entropy sources (hardware RNG, OS entropy)
  • Combine multiple entropy sources when possible
  • Monitor entropy quality in production systems
  • Implement entropy estimation and health checks

Seeding and Reseeding

  • Reseed periodically or after generating large amounts of data
  • Reseed after security events or state compromise
  • Use prediction resistance when available
  • Include timestamp and process ID in additional input

Implementation Security

  • Clear internal state on destruction
  • Protect against state disclosure attacks
  • Implement proper error handling
  • Use constant-time operations where applicable

Operational Considerations

  • Monitor DRBG health and entropy sources
  • Implement proper initialization procedures
  • Handle reseeding failures gracefully
  • Log security-relevant events

Comparison with System RNGs

Source Pros Cons Use Case
HMAC-DRBG Deterministic, portable, testable Requires entropy source Cryptographic applications
OS RNG High entropy, hardware-backed Platform-dependent General random values
Hardware RNG True randomness, high entropy May not be available Seeding, high-security

Selection Guide

For Cryptographic Applications

  • Primary: HMAC-DRBG with SHA-256 or SHA-512
  • Seeding: OS entropy source or hardware RNG
  • Reseeding: Every 2^20 requests or 24 hours

For Non-Cryptographic Applications

  • Fast Random: System PRNG (not cryptographically secure)
  • Simulation: Deterministic PRNG with known seed
  • Testing: HMAC-DRBG with fixed seed for reproducibility

For High-Security Applications

  • FIPS Compliance: HMAC-DRBG with approved hash functions
  • Prediction Resistance: Enable if supported
  • Frequent Reseeding: More aggressive reseeding schedule

Standards Compliance

  • NIST SP 800-90A: Recommendation for Random Number Generation Using Deterministic Random Bit Generators
  • FIPS 140-2: Federal Information Processing Standard for cryptographic modules
  • Common Criteria: International standard for computer security certification
  • RFC 6979: Deterministic Usage of DSA and ECDSA (uses HMAC-DRBG)