Security Analysis of NIST CTR-DRBG

Hoang, Viet Tung; Shen, Yaobin

doi:10.1007/978-3-030-56784-2_8

Cited by 9 publications

(18 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…• We provide full security proof for BKRNG in the robustness security game by Dodis et al [2] . The proof bears similarity to the proofs for FCRNG [5] and CTR_DRBG [4] . Similar to the previous PRNG security proofs, we treat the internal TPRF primitive as ideal, which means that we consider it to be randomly drawn from all possible TPRFs with the same input, output, and tweakey size.…”

Section: Contributionssupporting

confidence: 52%

“…Following [4,12] , we consider the interactions of a distinguisher A with an abstract system 𝑆 that answers A's queries. The resulting interaction then generates a transcript 𝜏 = ((𝑋 1 , 𝑌 1 ), ..., (𝑋 𝑞 , 𝑌 𝑞 )) of query-answer pairs.…”

Section: Systems Transcripts and The H-coefficient Proof Techniquementioning

confidence: 99%

“…(Cohney et al [3] noted that 67.8% of all certified implementations from NIST's Cryptographic Module Validation Program (CMVP) in 2019 supported CTR_DRBG, making it the most popular design among these certifications.) Its security was formally analyzed in 2020 by Hoang and Shen [4] . The CTR_DRBG design includes some odd choices, such as running CBC-MAC three times for the randomness extraction algorithm (called CtE by Hoang and Shen [4] ), without a clear justification for its provable security.…”

Section: Introductionmentioning

confidence: 99%

“…Its security was formally analyzed in 2020 by Hoang and Shen [4] . The CTR_DRBG design includes some odd choices, such as running CBC-MAC three times for the randomness extraction algorithm (called CtE by Hoang and Shen [4] ), without a clear justification for its provable security.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

A TPRF-based pseudo-random number generator

Andreeva,

Weninger

2024

Journal of Surveillance, Security and Safety

View full text Add to dashboard Cite

Most cryptographic applications use randomness that is generated by pseudo-random number generators (PRNGs). A popular PRNG practical choice is the NIST standardized $$ \rm{CTR\_DRBG}$$ . In their recent ACNS 2023 publication, Andreeva and Weninger proposed a new and more efficient and secure PRNG called $$ \mathtt{FCRNG}$$ . $$ \mathtt{FCRNG}$$ is based on $$ \rm{CTR\_DRBG}$$ and uses the $$ n $$ -to-$$ 2n $$ forkcipher expanding primitive ForkSkinny as a building block. In this work, we create a new BKRNG PRNG, which is based on $$ \mathtt{FCRNG}$$ and employs the novel $$ n $$ -to-$$ 8n $$ expanding primitive Butterknife. Butterknife is based on the Deoxys tweakable blockcipher (and thus AES) and realizes a tweakable expanding pseudo-random function. While both blockciphers and forkciphers are invertible primitives, tweakable expanding pseudo-random functions are not. This functional simplification enables security benefits for BKRNG in the robustness security game - the standard security goal for a PRNG. Contrary to the security bound of $$ \rm{CTR\_DRBG}$$ , we show that the security of our BKRNG construction does not degrade with the length of the random inputs, nor the number of requested output pseudo-random bits. We also empirically verify the BKRNG security with the NIST PRNG test suite and the TestU01 suite. Furthermore, we show the $$ n $$ -to-$$ 8n $$ multi-branch expanding nature of Butterknife contributes to a significant speed-up in the efficiency of BKRNG compared to $$ \mathtt{FCRNG}$$ . More concretely, producing random bits with BKRNG is 30.0% faster than $$ \mathtt{FCRNG}$$ and 49.2% faster than $$ \rm{CTR\_DRBG}$$ .

show abstract

Section: Contributionssupporting

confidence: 52%

Section: Systems Transcripts and The H-coefficient Proof Techniquementioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A TPRF-based pseudo-random number generator

Andreeva,

Weninger

2024

Journal of Surveillance, Security and Safety

View full text Add to dashboard Cite

show abstract

“…The performance of the 𝐴𝐸𝑆_𝐶𝑇𝑅 algorithm was tested in [47] to ensure that it is suitable as the internal state algorithm in DRBG block encryption. However, some researchers found security vulnerability in the 𝐶𝑇𝑅_𝐷𝑅𝐵𝐺, as discussed in [48][49][50]. A practical attack occurred in 𝐶𝑇𝑅_𝐴𝐸𝑆 𝐷𝑅𝐵𝐺 128, and the attacker could obtain the input of the internal state that was being used.…”

Section: A Ctr_aes Drbg 128mentioning

confidence: 99%