Module hash 

Hash_DRBG — SP 800-90A Rev.1 §10.1.1.

Generic over any [tessera::Digest]; instantiated in practice over SHA-256 / SHA-384 / SHA-512. The derivation function is Hash_df (§10.3.1).

Parameters (SP 800-90A §10.1, Table 2)

Hash	security_strength	seedlen (bits)	seedlen (octets)
SHA-1	128	440	55
SHA-224	192	440	55
SHA-256	256	440	55
SHA-384	256	888	111
SHA-512	256	888	111

reseed_interval = 2^48, max_number_of_bits_per_request = 2^19 (= 65 536 octets), max_additional_input_length = 2^35 bits.

Side-channel posture

The state (V, C) is secret; see the module-level crate::drbg posture. The mod-2^seedlen additions of the Generate step go through the branch-free super::util::ct_add_into / super::util::ct_add_u64; the only lookups are into the (public) Hash_df counter byte and the digest itself, both data-oblivious. SHA-2 has no secret-dependent branch or table index.

Structs

HashDrbg

Hash_DRBG internal state (SP 800-90A §10.1.1.1): the value V, the constant C (both seedlen octets), and the reseed_counter.