Cryptography and Network SecurityChapter 12.ppt

The essential elements of any pseudorandom number generator (PRNG) are a seed value and a deterministic algorithm for generating a stream of pseudorandom bits. If the algorithm is used as a pseudorandom function (PRF) to produce a required value, such as a session key, then the seed should only be known to the user of the PRF. If the algorithm is used to produce a stream encryption function, then the seed has the role of a secret key that must be known to the sender and the receiver. We noted in Chapters 7 and 10 that, because an encryption algorithm produces an apparently random output, it can serve as the basis of a (PRNG). Similarly, an hash function or MAC produces apparently random output and can be used to build a PRNG. Both ISO standard 18031 (Random Bit Generation) and NIST SP 800-90 (Recommendation for Random Number Generation Using Deterministic Random Bit Generators) define an approach for random number generation using a cryptographic hash function. SP 800-90 also defines a random number generator based on HMAC. We look at these two approaches in turn. * Stallings Figure 12.12a shows the basic strategy for a hash-based PRNG specified in SP 800-90 and ISO 18031. The algorithm takes as input: V = seed; seedlen = bit length of V = k + 64, where k is a desired security level expressed in bits; n = desired number of output bits. The algorithm uses the cryptographic hash function H with an hash value output of outlen bits. The basic operation of the algorithm is: m = ceil(n/outlen) data = V W = the null string for i = 1 to m wi = H(data) W = W || wi data = (data + 1) mod 2seedlen return leftmost n bits of W Thus, the pseudorandom bit stream is w 1 || w2 || … || wm, with the final block truncated if required. The SP 800-90 specification also provides for periodically updating V to enhance security. The specification also indicates that there are no known or suspected weaknesses in the hash- based appr