CTRDRBG

CTRDRBG, or CTR Deterministic Random Bit Generator, is a cryptographic pseudorandom number generator defined in NIST SP 800-90A. It is an AES-based DRBG that produces a stream of pseudorandom bits from an internal, secret state and entropy inputs. The generator is designed for use in security-critical software and hardware as a source of randomness for keys, nonces, and other cryptographic materials.

The design uses a block cipher in counter mode. The internal state consists of a secret key K and a value V. The standard specifies Instantiate, Reseed, and Generate operations. Instantiate initializes K and V from provided entropy input, a nonce, and an optional personalization string via a derivation function. Reseed mixes fresh entropy into the state and resets a reseed counter. Generate outputs are produced by encrypting V under the current key to form blocks of output data, which are concatenated and truncated to the requested length. After generation, an Update step may mix in additional input to further perturb K and V. If the reseed counter reaches its limit, a reseed is required before further generation.

Security and usage considerations: CTRDRBG is designed to provide strong cryptographic randomness as long as high-quality entropy is supplied during Instantiate and Reseed. Its security strength depends on the AES key length (commonly 128, 192, or 256 bits). It is widely implemented in software libraries and hardware modules and is commonly used for key generation, nonces, and protocol randomness. As with all DRBGs, it relies on the secrecy of its internal state; if the state is compromised, future outputs may be predictable. Regular reseeding with fresh entropy is recommended.

See also: NIST SP 800-90A, other DRBGs such as Hash_DRBG and HMAC_DRBG.