Module ctr 

CTR_DRBG — SP 800-90A Rev.1 §10.2.1, over AES-128 / 192 / 256.

Uses the existing crate::cipher::aes block cipher (see the T1-A cache-leak note in crate::drbg). Both operating modes of §10.2.1 are provided:

• with a derivation function (CtrDrbg::instantiate, use_df = true) — Block_Cipher_df (§10.3.2) conditions the entropy input, so the entropy/nonce/personalization/additional-input lengths are free (only min-entropy applies).
• without a derivation function (CtrDrbg::instantiate_no_df) — the entropy input must be full-entropy and exactly seedlen octets; personalization / additional input, if present, must also be exactly seedlen octets (§10.2.1.3.2 / §10.2.1.5.1).

Parameters (SP 800-90A §10.2.1, Table 3)

Cipher	keylen	blocklen	seedlen (= keylen+blocklen)	security_strength
AES-128	16	16	32	128
AES-192	24	16	40	192
AES-256	32	16	48	256

reseed_interval = 2^48, max_number_of_bits_per_request = 2^19.

Side-channel posture

Key and V are secret; see crate::drbg. Every routine here — the Update, the df, the counter increment, the XOR folds — is branch-free and index-oblivious in the state. The one residual leak is the table-based AES core (roadmap T1-A), inherited unchanged.

Structs

CtrDrbg

CTR_DRBG internal state (SP 800-90A §10.2.1.1): Key (keylen octets) and V (blocklen octets), plus reseed_counter. Both are secret.