Getting Randomness Right: A Guide to the NIST SP 800-90 Standards

Abstract. Random Bit Generators (RBGs) serve as the foundation for modern cryptographic protocols and applications. When bits are not sufficiently random, the security of an entire system may be compromised. The NIST Special Publication (SP) 800-90 series establishes standards for random bit generators through a three-part framework: deterministic random bit generator (DRBGS) mechanisms (SP 800-90A), entropy sources (SP 800-90B), and random bit generator constructions (SP 800-90C).

In this talk, I will provide a technical overview of the series, with a primary focus on SP 800-90C, published in September 2025. We will examine various methods for composing entropy sources and DRBG mechanisms into robust RBG constructions. We will briefly touch on relationship between the SP 800-90 series and BSI's AIS 20/31, as well as the statistical test suite presented in SP 800-22.

Suggested readings:

• SP 800-90C: Recommendation for Random Bit Generator (RBG) Constructions
• NIST Project on Random Bit Generation

Based on joint work: John Kelsey, Meltem Sönmez Turan, Elaine Barker, Hamilton Silberg, Kerry McKay