pub struct CtrDrbg { /* private fields */ }Expand description
CTR_DRBG internal state (SP 800-90A §10.2.1.1): Key (keylen octets)
and V (blocklen octets), plus reseed_counter. Both are secret.
keylen (and thus seedlen) is fixed at instantiation by the entropy
/ key width; AES width is selected by key length exactly as the
existing Aes core does.
Implementations§
Source§impl CtrDrbg
impl CtrDrbg
Sourcepub fn instantiate(
key_len: usize,
entropy_input: &[u8],
nonce: &[u8],
personalization: &[u8],
) -> Result<Self, Error>
pub fn instantiate( key_len: usize, entropy_input: &[u8], nonce: &[u8], personalization: &[u8], ) -> Result<Self, Error>
Instantiate a CTR_DRBG with a derivation function (SP 800-90A §10.2.1.3.2).
key_len selects the AES width (16 / 24 / 32). Entropy / nonce /
personalization lengths are unconstrained beyond min-entropy
(8·entropy_input.len() ≥ security_strength, §8.6.3).
seed_material = entropy_input || nonce || personalization_string
seed_material = Block_Cipher_df(seed_material, seedlen)
Key = 0^keylen ; V = 0^blocklen
(Key, V) = CTR_DRBG_Update(seed_material, Key, V)
reseed_counter = 1Sourcepub fn instantiate_no_df(
key_len: usize,
entropy_input: &[u8],
personalization: &[u8],
) -> Result<Self, Error>
pub fn instantiate_no_df( key_len: usize, entropy_input: &[u8], personalization: &[u8], ) -> Result<Self, Error>
Instantiate a CTR_DRBG without a derivation function (SP 800-90A §10.2.1.3.1).
The entropy input must be full-entropy and exactly seedlen
octets. personalization, if non-empty, must also be exactly
seedlen octets (it is entropy XOR pers; a shorter pers is padded
with zeros per §10.2.1.3.1 note, but CAVP supplies full-length or
empty). No nonce is used in no-df mode.
Sourcepub fn reseed(
&mut self,
entropy_input: &[u8],
additional_input: &[u8],
) -> Result<(), Error>
pub fn reseed( &mut self, entropy_input: &[u8], additional_input: &[u8], ) -> Result<(), Error>
Reseed a CTR_DRBG (SP 800-90A §10.2.1.4). Uses the df iff the instance was instantiated with one.
With df: seed_material = Block_Cipher_df(entropy || additional, seedlen).
Without df: seed_material = entropy XOR (additional padded), and both
must be exactly seedlen octets.
Sourcepub fn generate(
&mut self,
out: &mut [u8],
additional_input: &[u8],
) -> Result<(), Error>
pub fn generate( &mut self, out: &mut [u8], additional_input: &[u8], ) -> Result<(), Error>
Generate pseudorandom bits (SP 800-90A §10.2.1.5.2).
if reseed_counter > reseed_interval: return "Reseed required"
if additional_input != Null:
if using df: additional_input = Block_Cipher_df(additional_input, seedlen)
else : additional_input = additional_input padded to seedlen
(Key, V) = CTR_DRBG_Update(additional_input, Key, V)
else additional_input = 0^seedlen
temp = ""
while len(temp) < requested_bits:
V = (V + 1) mod 2^blocklen
temp = temp || Block_Encrypt(Key, V)
returned_bits = leftmost requested_bits of temp
(Key, V) = CTR_DRBG_Update(additional_input, Key, V)
reseed_counter += 1