A deterministic random bit generator (DRBG) generates pseudorandom bits from an unpredictable seed, i.e. a seed drawn from any ramdom source with sufficient entropy. The current paper formalizes a security notion for a DRBG, allowing the attacker to compromise the internal state of the DRBG, requiring the DRBG to maintain the security of generated output bits prior to the compromise, and also requiring the DRBG to recover from a state compromise, once a new random seed becomes available to the DRBG. The paper proposes xdrbg, a new DRBG based on any eXtended Output Function (XOF) and proves the security of xdrbg in the ideal-XOF model. The proven bounds are tight, as demonstrated by matching attacks. The paper also discusses the security of xdrbg against quantum attackers. Finally, the paper proposes concrete instantiations of xdrbg, employing either the SHAKE128 or the SHAKE256 XOFs. Alternative instantiations suitable for lightweight applications can be based on ASCON.
A deterministic random bit generator (DRBG) generates pseudorandom bits from an unpredictable seed, i.e. a seed drawn from any ramdom source with sufficient entropy. The current paper formalizes a security notion for a DRBG, allowing the attacker to compromise the internal state of the DRBG,...
See full abstract
A deterministic random bit generator (DRBG) generates pseudorandom bits from an unpredictable seed, i.e. a seed drawn from any ramdom source with sufficient entropy. The current paper formalizes a security notion for a DRBG, allowing the attacker to compromise the internal state of the DRBG, requiring the DRBG to maintain the security of generated output bits prior to the compromise, and also requiring the DRBG to recover from a state compromise, once a new random seed becomes available to the DRBG. The paper proposes xdrbg, a new DRBG based on any eXtended Output Function (XOF) and proves the security of xdrbg in the ideal-XOF model. The proven bounds are tight, as demonstrated by matching attacks. The paper also discusses the security of xdrbg against quantum attackers. Finally, the paper proposes concrete instantiations of xdrbg, employing either the SHAKE128 or the SHAKE256 XOFs. Alternative instantiations suitable for lightweight applications can be based on ASCON.
Hide full abstract
