Random, Pseudo-Random and Cryptographically Secure Are Three Different Promises

When buying a generator meant for cryptographic use, look for specific specifications.

These terms form a hierarchy, not a triad of meaning: a "random bit generator" will have a deterministic algorithm fed by an unpredictable seed.

A cryptographically secure pseudo-random number generator is a deterministic random-bit generator that's acceptable for use in cryptographic modules.

"Randomness" captures the unpredictable input, while "cryptographic security" describes the outputs.

Readers may think the terms are synonyms, referring to "random number generators" or "RNGs" meant for encryption.

However, "random," "pseudorandom," and "cryptographically secure" describe different kinds of guarantees rather than a single property.

Three layers, not one thing

According to NIST, random-bit generation has three main parts:

• Deterministic algorithms, which produce pseudorandom outputs
• Entropy sources, which provide unpredictable input
• Random-bit generator (RBG) constructions, which put the two together

NIST's framework reports make clear:

NIST SP 800-90A Rev. 1 is titled “Recommendation for Random Number Generation Using Deterministic Random Bit Generators,” and it was published on 2015-06-24. NIST, https://csrc.nist.gov/pubs/sp/800/90/a/r1/final, 2015-06-24

Specifically:

NIST SP 800-90A specifies mechanisms for generating random bits using deterministic methods. NIST Random Bit Generation RBG project page, https://csrc.nist.gov/projects/random-bit-generation, 2016-05-24

NIST SP 800-90B is titled “Recommendation for the Entropy Sources Used for Random Bit Generation.” NIST Random Bit Generation RBG project page, https://csrc.nist.gov/projects/random-bit-generation, 2016-05-24

NIST SP 800-90B specifies the design principles and requirements for entropy sources used by RBGs and the tests for validating entropy sources. NIST Random Bit Generation RBG project page, https://csrc.nist.gov/projects/random-bit-generation, 2016-05-24

NIST SP 800-90C is titled “Recommendation for Random Bit Generator (RBG) Constructions.” NIST Random Bit Generation RBG project page, https://csrc.nist.gov/projects/random-bit-generation, 2016-05-24

NIST SP 800-90C specifies constructions for the implementation of RBGs. NIST Random Bit Generation RBG project page, https://csrc.nist.gov/projects/random-bit-generation, 2016-05-24

Shopping for a cryptography generator should distinguish deterministic algorithms from their entropy sources and algorithmic constructions.

Deterministic does not mean insecure

NIST's DRBG approach may sound like an oxymoron, but randomness in cryptographic use is designed to be deterministic.

Predictability is kept out by not reusing seeds, and entropy entering the algorithm comes from a specific entropy source.

NIST says the entropy input required to seed or reseed a DRBG shall be obtained either directly or indirectly from an entropy source. NIST SP 800-90R legacy PDF, https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-90r.pdf, date not shown in search result

NIST says the entropy source is the critical component of an RBG that provides un-guessable values for the deterministic algorithm to use as entropy. NIST SP 800-90R legacy PDF, https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-90r.pdf, date not shown in search result

The deterministic part is a deterministic algorithm that runs with its entropy sources and constructs to generate randomness in a cryptographic application.

Entropy sources, which provide unpredictable input, include everything from highly-entropic hardware to algorithmic constructions like hash functions.

Constructed Random Bit Generators then combine a DRBG with entropy sources to create what NIST calls Random Bit Generators. A cryptographically-secure framework provides:

• Deterministic algorithms
• Entropy sources providing seeds
• Constructions
• Cryptographic protection

Entropy is the supply line

NIST separates the deterministic from the entropy sources.

Entropy to seed a DRBG algorithm can come from an expertly-constructed entropy source:

NIST says the security of random number generators depends on both the unpredictability of the noise source output, quantified in entropy, and algorithmic properties, quantified as security strength. NIST IR 8446 draft PDF, https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8446.ipd.pdf, date not shown in search result

Those happen to be the generators reviewed by NIST, with SP 800-90A 1 describing rebuilding processes for DRBG.

SP 800-90B 3 specifies the design principles and requirements for entropy sources used by RBGs, and the tests for validating entropy sources. A good entropy source meets the requirements of SP 800-90B.

SP 800-90C 5 specifies constructions for the implementation of RBGs

What standards bodies test

Testing cryptographic security brings important distinctions between the standards:

NIST’s SP 800-22 is titled “A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications.” NIST Random Bit Generation RBG project page, https://csrc.nist.gov/projects/random-bit-generation, 2016-05-24

Statistical testing methods look for statistical properties that NIST identified.

Validating cryptographic operation against a particular standard depends on testing both the entropy source and the construction.

That level of validation requires an official standard, and documented results from a 3rd party.

RFC 4086 is titled “Randomness Requirements for Security.” IETF Datatracker, https://datatracker.ietf.org/doc/html/rfc4086, date not shown in search result

For example, the ANSI X9F1 committee was developing the standard for random-number generation based on a combination of true randomness and pseudorandom number generation.

RFC 4086 says the ANSI X9F1 committee was in the final stages of creating a standard for random number generation covering both true randomness generators and pseudo-random number generators. IETF RFC 4086, https://datatracker.ietf.org/doc/html/rfc4086, date not shown in search result

This guidance distinguishes testing, meeting a standard, and ultimately legal compliance.

The compliance boundary

If a product claims compliance with a FIPS-140 recommendation, find:

FIPS 140-2 Annex C is a list of Approved random number generators applicable to FIPS PUB 140-2. NIST FIPS 140-2 Annex C, https://csrc.nist.gov/files/pubs/fips/140-2/upd2/final/docs/fips1402annexc.pdf, date not shown in search result

It is worth taking before a cryptographic module runs its benchmark.

If a product claims to be cryptographically made, check if a standards body validates entropy, constructed with entropy from an entropy source, and runs the construction unbiased by algorithm.

Rather than take the product spec for granted, check for the right claims, made by the right people, with their reasons.