arcana/drbg/

ctr.rs

// SPDX-License-Identifier: Apache-2.0
// Copyright 2026 Cédric Mesnil <cslashm@pm.me>

//! CTR_DRBG — SP 800-90A Rev.1 §10.2.1, over AES-128 / 192 / 256.
//!
//! Uses the existing [`crate::cipher::aes`] block cipher (see the T1-A
//! cache-leak note in [`crate::drbg`]). Both operating modes of §10.2.1
//! are provided:
//!
//! * **with a derivation function** ([`CtrDrbg::instantiate`], `use_df =
//!   true`) — `Block_Cipher_df` (§10.3.2) conditions the entropy input,
//!   so the entropy/nonce/personalization/additional-input lengths are
//!   free (only min-entropy applies).
//! * **without a derivation function** ([`CtrDrbg::instantiate_no_df`]) —
//!   the entropy input must be *full-entropy* and exactly `seedlen` octets;
//!   personalization / additional input, if present, must also be exactly
//!   `seedlen` octets (§10.2.1.3.2 / §10.2.1.5.1).
//!
//! # Parameters (SP 800-90A §10.2.1, Table 3)
//!
//! | Cipher   | keylen | blocklen | seedlen (= keylen+blocklen) | security_strength |
//! |----------|--------|----------|-----------------------------|-------------------|
//! | AES-128  | 16     | 16       | 32                          | 128               |
//! | AES-192  | 24     | 16       | 40                          | 192               |
//! | AES-256  | 32     | 16       | 48                          | 256               |
//!
//! `reseed_interval = 2^48`, `max_number_of_bits_per_request = 2^19`.
//!
//! # Side-channel posture
//!
//! `Key` and `V` are secret; see [`crate::drbg`]. Every routine here —
//! the Update, the df, the counter increment, the XOR folds — is
//! branch-free and index-oblivious in the state. The one residual leak is
//! the table-based AES core (roadmap `T1-A`), inherited unchanged.

use crate::BlockCipher;
use crate::cipher::aes::Aes;
use crate::drbg::Error;
use crate::drbg::util::ct_increment;

/// `reseed_interval` (SP 800-90A §10.2.1, Table 3): 2^48.
const RESEED_INTERVAL: u64 = 1 << 48;
/// `max_number_of_bits_per_request` = 2^19 bits = 65 536 octets.
const MAX_REQUEST_OCTETS: usize = 1 << 16;

/// AES block length in octets.
const BLOCKLEN: usize = 16;
/// Largest AES key length (AES-256).
const MAX_KEYLEN: usize = 32;
/// Largest seedlen (AES-256 → 48 octets).
const MAX_SEEDLEN: usize = MAX_KEYLEN + BLOCKLEN;
/// Stack scratch for the `Block_Cipher_df` `S = L || N || input || 0x80 || pad`
/// buffer. 512 octets comfortably holds `L(4) + N(4) + (entropy ‖ nonce ‖
/// personalization / additional-input) + 0x80 + padding` for every
/// SP 800-90A parameter set and every CAVP DRBGVS vector (whose df inputs
/// top out well under this). Out-of-scratch input is rejected with
/// [`Error::InvalidLength`] (no silent cap), not a panic.
const DF_MAX_S: usize = 512;

/// CTR_DRBG internal state (SP 800-90A §10.2.1.1): `Key` (`keylen` octets)
/// and `V` (`blocklen` octets), plus `reseed_counter`. Both are secret.
///
/// `keylen` (and thus `seedlen`) is fixed at instantiation by the entropy
/// / key width; AES width is selected by key length exactly as the
/// existing [`Aes`] core does.
pub struct CtrDrbg {
    key: [u8; MAX_KEYLEN],
    v: [u8; BLOCKLEN],
    keylen: usize,
    reseed_counter: u64,
    use_df: bool,
}

/// `security_strength` in bits for a CTR_DRBG key length (SP 800-90A
/// §10.2.1, Table 3).
const fn security_strength(keylen: usize) -> usize {
    keylen * 8
}

impl CtrDrbg {
    #[inline]
    fn seedlen(&self) -> usize {
        self.keylen + BLOCKLEN
    }

    /// One AES-ECB block encryption under the current `Key` (§10.2.1: the
    /// `Block_Encrypt(Key, V)` primitive). Data-oblivious apart from the
    /// inherited AES table lookups (T1-A).
    fn block_encrypt(key: &[u8], input: &[u8; BLOCKLEN], out: &mut [u8; BLOCKLEN]) {
        let cipher = Aes::new(key);
        out.copy_from_slice(input);
        cipher.encrypt_block(out);
    }

    /// CTR_DRBG_Update (SP 800-90A §10.2.1.2).
    ///
    /// ```text
    ///   temp = ""
    ///   while len(temp) < seedlen:
    ///       V = (V + 1) mod 2^blocklen
    ///       output_block = Block_Encrypt(Key, V)
    ///       temp = temp || output_block
    ///   temp = leftmost seedlen octets of temp
    ///   temp = temp XOR provided_data
    ///   Key = leftmost keylen octets of temp
    ///   V   = rightmost blocklen octets of temp
    /// ```
    /// `provided_data` must be exactly `seedlen` octets (the callers pad it
    /// to `seedlen` before calling, as required by §10.2.1.3/.4/.5).
    fn ctr_drbg_update(&mut self, provided_data: &[u8]) {
        let seedlen = self.seedlen();
        debug_assert_eq!(provided_data.len(), seedlen);
        let mut temp = [0u8; MAX_SEEDLEN];
        let mut off = 0;
        let mut block = [0u8; BLOCKLEN];
        while off < seedlen {
            ct_increment(&mut self.v);
            Self::block_encrypt(&self.key[..self.keylen], &self.v, &mut block);
            let take = core::cmp::min(BLOCKLEN, seedlen - off);
            temp[off..off + take].copy_from_slice(&block[..take]);
            off += take;
        }
        // temp = temp XOR provided_data
        for i in 0..seedlen {
            temp[i] ^= provided_data[i];
        }
        // Key = leftmost keylen ; V = rightmost blocklen.
        self.key[..self.keylen].copy_from_slice(&temp[..self.keylen]);
        self.v.copy_from_slice(&temp[self.keylen..seedlen]);
    }

    /// Block_Cipher_df (SP 800-90A §10.3.2) — the CTR_DRBG derivation
    /// function. Conditions arbitrary-length `input_parts` down to
    /// `out.len()` octets using AES in a CBC-MAC-based BCC + CTR expansion.
    ///
    /// The df always uses AES-`keylen`/`out.len()`-sized state where
    /// `keylen`/`seedlen` match the DRBG being instantiated. The fixed df
    /// key `0x00010203…1F` (§10.3.2 step 8) is public.
    fn block_cipher_df(keylen: usize, input_parts: &[&[u8]], out: &mut [u8]) -> Result<(), Error> {
        let seedlen = keylen + BLOCKLEN;
        let outlen = out.len();
        debug_assert!(outlen <= seedlen);

        // L = len(input_string) in octets ; N = number_of_bits_to_return / 8.
        let l: u32 = input_parts.iter().map(|p| p.len() as u32).sum();
        let n: u32 = outlen as u32;
        // The df conditions its input into a fixed stack scratch (allocation-free,
        // no_std). Reject out-of-scratch input with a graceful error rather than
        // panicking on the copy below (no silent cap).
        if 8 + l as usize + 1 + BLOCKLEN > DF_MAX_S {
            return Err(Error::InvalidLength);
        }

        // S = L || N || input_string || 0x80, then zero-pad to a block multiple.
        // Built into a fixed stack buffer (allocation-free, no_std-friendly):
        // df inputs are bounded — entropy + nonce + personalization / additional
        // input, well under DF_MAX_INPUT for every SP 800-90A parameter set and
        // every CAVP DRBGVS vector.
        let mut sbuf = [0u8; DF_MAX_S];
        let mut slen = 0;
        sbuf[slen..slen + 4].copy_from_slice(&l.to_be_bytes());
        slen += 4;
        sbuf[slen..slen + 4].copy_from_slice(&n.to_be_bytes());
        slen += 4;
        for p in input_parts {
            sbuf[slen..slen + p.len()].copy_from_slice(p);
            slen += p.len();
        }
        sbuf[slen] = 0x80;
        slen += 1;
        while slen % BLOCKLEN != 0 {
            sbuf[slen] = 0x00;
            slen += 1;
        }
        let s = &sbuf[..slen];

        // The fixed df key: 0x00 01 02 … (keylen octets), §10.3.2 step 8.
        let mut df_key = [0u8; MAX_KEYLEN];
        for (i, b) in df_key.iter_mut().enumerate().take(keylen) {
            *b = i as u8;
        }
        let df_key = &df_key[..keylen];

        // Step 9: temp = "" ; i = 0 ; while len(temp) < keylen+blocklen (= seedlen):
        //   IV = i (as a blocklen-octet integer, big-endian, left-justified)
        //   temp = temp || BCC(df_key, IV || S)
        //   i += 1
        let mut temp = [0u8; MAX_SEEDLEN];
        let mut i: u32 = 0;
        let mut off = 0;
        while off < seedlen {
            let mut iv = [0u8; BLOCKLEN];
            iv[..4].copy_from_slice(&i.to_be_bytes());
            let mut chain = [0u8; BLOCKLEN];
            Self::bcc(df_key, &iv, s, &mut chain);
            let take = core::cmp::min(BLOCKLEN, seedlen - off);
            temp[off..off + take].copy_from_slice(&chain[..take]);
            off += take;
            i += 1;
        }

        // Step 10-15: K = leftmost keylen of temp ; X = next blocklen of temp ;
        //   then CTR-expand: temp2 = "" ; while len(temp2) < outlen:
        //     X = Block_Encrypt(K, X) ; temp2 = temp2 || X
        //   return leftmost outlen of temp2.
        let k = {
            let mut kk = [0u8; MAX_KEYLEN];
            kk[..keylen].copy_from_slice(&temp[..keylen]);
            kk
        };
        let mut x = [0u8; BLOCKLEN];
        x.copy_from_slice(&temp[keylen..keylen + BLOCKLEN]);

        let mut off = 0;
        let mut blk = [0u8; BLOCKLEN];
        while off < outlen {
            Self::block_encrypt(&k[..keylen], &x, &mut blk);
            x.copy_from_slice(&blk);
            let take = core::cmp::min(BLOCKLEN, outlen - off);
            out[off..off + take].copy_from_slice(&x[..take]);
            off += take;
        }
        Ok(())
    }

    /// BCC (SP 800-90A §10.3.3) — the CBC-MAC over `IV || data` under `key`.
    fn bcc(key: &[u8], iv: &[u8; BLOCKLEN], data: &[u8], out: &mut [u8; BLOCKLEN]) {
        let mut chaining = [0u8; BLOCKLEN];
        // Step: chaining_value = 0^blocklen ; block_0 = IV.
        // BCC processes IV first, then each data block, CBC-chaining.
        let mut input = [0u8; BLOCKLEN];
        // Process IV.
        for j in 0..BLOCKLEN {
            input[j] = chaining[j] ^ iv[j];
        }
        Self::block_encrypt(key, &input, &mut chaining);
        // Process each data block (data is a multiple of blocklen).
        let mut off = 0;
        while off < data.len() {
            for j in 0..BLOCKLEN {
                input[j] = chaining[j] ^ data[off + j];
            }
            Self::block_encrypt(key, &input, &mut chaining);
            off += BLOCKLEN;
        }
        out.copy_from_slice(&chaining);
    }

    // ------------------------------------------------------------------
    // Public API — with derivation function
    // ------------------------------------------------------------------

    /// Instantiate a CTR_DRBG **with** a derivation function
    /// (SP 800-90A §10.2.1.3.2).
    ///
    /// `key_len` selects the AES width (16 / 24 / 32). Entropy / nonce /
    /// personalization lengths are unconstrained beyond min-entropy
    /// (`8·entropy_input.len() ≥ security_strength`, §8.6.3).
    ///
    /// ```text
    ///   seed_material = entropy_input || nonce || personalization_string
    ///   seed_material = Block_Cipher_df(seed_material, seedlen)
    ///   Key = 0^keylen ; V = 0^blocklen
    ///   (Key, V) = CTR_DRBG_Update(seed_material, Key, V)
    ///   reseed_counter = 1
    /// ```
    pub fn instantiate(
        key_len: usize,
        entropy_input: &[u8],
        nonce: &[u8],
        personalization: &[u8],
    ) -> Result<Self, Error> {
        if !matches!(key_len, 16 | 24 | 32) {
            return Err(Error::InvalidLength);
        }
        if entropy_input.len() * 8 < security_strength(key_len) {
            return Err(Error::InsufficientEntropy);
        }
        let seedlen = key_len + BLOCKLEN;
        let mut s = CtrDrbg {
            key: [0u8; MAX_KEYLEN],
            v: [0u8; BLOCKLEN],
            keylen: key_len,
            reseed_counter: 1,
            use_df: true,
        };
        let mut seed_material = [0u8; MAX_SEEDLEN];
        Self::block_cipher_df(
            key_len,
            &[entropy_input, nonce, personalization],
            &mut seed_material[..seedlen],
        )?;
        // Key = 0, V = 0 already; then Update with the conditioned material.
        s.ctr_drbg_update(&seed_material[..seedlen]);
        s.reseed_counter = 1;
        Ok(s)
    }

    /// Instantiate a CTR_DRBG **without** a derivation function
    /// (SP 800-90A §10.2.1.3.1).
    ///
    /// The entropy input must be *full-entropy* and exactly `seedlen`
    /// octets. `personalization`, if non-empty, must also be exactly
    /// `seedlen` octets (it is `entropy XOR pers`; a shorter pers is padded
    /// with zeros per §10.2.1.3.1 note, but CAVP supplies full-length or
    /// empty). No nonce is used in no-df mode.
    pub fn instantiate_no_df(key_len: usize, entropy_input: &[u8], personalization: &[u8]) -> Result<Self, Error> {
        if !matches!(key_len, 16 | 24 | 32) {
            return Err(Error::InvalidLength);
        }
        let seedlen = key_len + BLOCKLEN;
        if entropy_input.len() != seedlen {
            return Err(Error::InsufficientEntropy);
        }
        if !personalization.is_empty() && personalization.len() != seedlen {
            return Err(Error::InvalidLength);
        }
        let mut s = CtrDrbg {
            key: [0u8; MAX_KEYLEN],
            v: [0u8; BLOCKLEN],
            keylen: key_len,
            reseed_counter: 1,
            use_df: false,
        };
        // seed_material = entropy_input XOR (personalization padded to seedlen).
        let mut seed_material = [0u8; MAX_SEEDLEN];
        seed_material[..seedlen].copy_from_slice(&entropy_input[..seedlen]);
        for i in 0..personalization.len() {
            seed_material[i] ^= personalization[i];
        }
        s.ctr_drbg_update(&seed_material[..seedlen]);
        s.reseed_counter = 1;
        Ok(s)
    }

    /// Reseed a CTR_DRBG (SP 800-90A §10.2.1.4). Uses the df iff the
    /// instance was instantiated with one.
    ///
    /// With df: `seed_material = Block_Cipher_df(entropy || additional, seedlen)`.
    /// Without df: `seed_material = entropy XOR (additional padded)`, and both
    /// must be exactly `seedlen` octets.
    pub fn reseed(&mut self, entropy_input: &[u8], additional_input: &[u8]) -> Result<(), Error> {
        let seedlen = self.seedlen();
        let mut seed_material = [0u8; MAX_SEEDLEN];
        if self.use_df {
            if entropy_input.len() * 8 < security_strength(self.keylen) {
                return Err(Error::InsufficientEntropy);
            }
            Self::block_cipher_df(
                self.keylen,
                &[entropy_input, additional_input],
                &mut seed_material[..seedlen],
            )?;
        } else {
            if entropy_input.len() != seedlen {
                return Err(Error::InsufficientEntropy);
            }
            if !additional_input.is_empty() && additional_input.len() != seedlen {
                return Err(Error::InvalidLength);
            }
            seed_material[..seedlen].copy_from_slice(&entropy_input[..seedlen]);
            for i in 0..additional_input.len() {
                seed_material[i] ^= additional_input[i];
            }
        }
        self.ctr_drbg_update(&seed_material[..seedlen]);
        self.reseed_counter = 1;
        Ok(())
    }

    /// Generate pseudorandom bits (SP 800-90A §10.2.1.5.2).
    ///
    /// ```text
    ///   if reseed_counter > reseed_interval: return "Reseed required"
    ///   if additional_input != Null:
    ///       if using df: additional_input = Block_Cipher_df(additional_input, seedlen)
    ///       else        : additional_input = additional_input padded to seedlen
    ///       (Key, V) = CTR_DRBG_Update(additional_input, Key, V)
    ///   else additional_input = 0^seedlen
    ///   temp = ""
    ///   while len(temp) < requested_bits:
    ///       V = (V + 1) mod 2^blocklen
    ///       temp = temp || Block_Encrypt(Key, V)
    ///   returned_bits = leftmost requested_bits of temp
    ///   (Key, V) = CTR_DRBG_Update(additional_input, Key, V)
    ///   reseed_counter += 1
    /// ```
    pub fn generate(&mut self, out: &mut [u8], additional_input: &[u8]) -> Result<(), Error> {
        if out.len() > MAX_REQUEST_OCTETS {
            return Err(Error::RequestTooLarge);
        }
        if self.reseed_counter > RESEED_INTERVAL {
            return Err(Error::ReseedRequired);
        }
        let seedlen = self.seedlen();

        // Step 2: condition additional_input to exactly seedlen octets.
        let mut add = [0u8; MAX_SEEDLEN];
        let have_add = !additional_input.is_empty();
        if have_add {
            if self.use_df {
                Self::block_cipher_df(self.keylen, &[additional_input], &mut add[..seedlen])?;
            } else {
                if additional_input.len() != seedlen {
                    return Err(Error::InvalidLength);
                }
                add[..seedlen].copy_from_slice(&additional_input[..seedlen]);
            }
            self.ctr_drbg_update(&add[..seedlen]);
        }
        // (add is already 0^seedlen when no additional_input.)

        // Step 4-5: CTR expansion into `out`.
        let mut off = 0;
        let mut block = [0u8; BLOCKLEN];
        while off < out.len() {
            ct_increment(&mut self.v);
            Self::block_encrypt(&self.key[..self.keylen], &self.v, &mut block);
            let take = core::cmp::min(BLOCKLEN, out.len() - off);
            out[off..off + take].copy_from_slice(&block[..take]);
            off += take;
        }

        // Step 6: (Key, V) = CTR_DRBG_Update(additional_input, Key, V).
        self.ctr_drbg_update(&add[..seedlen]);
        // Step 7: reseed_counter += 1.
        self.reseed_counter += 1;
        Ok(())
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::drbg::test_util::hx;

    // Official NIST CAVP DRBGVS vectors (CAVS 14.3, "drbgtestvectors").
    // Same two-generate DRBGVS procedure as the hash mechanisms.

    // drbgvectors_no_reseed / CTR_DRBG.txt — [AES-256 use df], Pers=0, AddIn=0, COUNT=0.
    #[test]
    fn ctr_aes256_usedf_no_reseed_pers0_add0() {
        let entropy = hx("36401940fa8b1fba91a1661f211d78a0b9389a74e5bccfece8d766af1a6d3b14");
        let nonce = hx("496f25b0f1301b4f501be30380a137eb");
        let mut drbg = CtrDrbg::instantiate(32, &entropy, &nonce, &[]).unwrap();
        let mut out = [0u8; 64];
        drbg.generate(&mut out, &[]).unwrap();
        drbg.generate(&mut out, &[]).unwrap();
        assert_eq!(
            out[..],
            hx("5862eb38bd558dd978a696e6df164782ddd887e7e9a6c9f3f1fbafb78941b535\
                a64912dfd224c6dc7454e5250b3d97165e16260c2faf1cc7735cb75fb4f07e1d")[..]
        );
    }

    // drbgvectors_no_reseed / CTR_DRBG.txt — [AES-256 use df], Pers=256, AddIn=256, COUNT=0.
    #[test]
    fn ctr_aes256_usedf_no_reseed_pers_add() {
        let entropy = hx("87b56e964eba227154724bb9484b812d3e2c0c43b3d17f6098d9526e16e6d0ef");
        let nonce = hx("9bea6a7ff2358df142e6c23e2157fb83");
        let pers = hx("9860b432edd58d1ccbfeecbce99ffaee7d935a614860d4e965bd67041403096b");
        let add0 = hx("99a5cc87924e8ea65a596f81fd17d63f5b4542fe6e8e1511b5d35c835dfadb0b");
        let add1 = hx("9a8dec54734a34582a2332f3452e82313524c3e0dfb485faeac6ca5fc0ff504d");
        let mut drbg = CtrDrbg::instantiate(32, &entropy, &nonce, &pers).unwrap();
        let mut out = [0u8; 64];
        drbg.generate(&mut out, &add0).unwrap();
        drbg.generate(&mut out, &add1).unwrap();
        assert_eq!(
            out[..],
            hx("dbc6a2330b19b5cddd8cd6392ec1fb508678c805e87d1aca07ac265007632503\
                044a00610c79d98375afa7ab4cca1a90989cbfe7c674af5d823ced11c47e9af6")[..]
        );
    }

    // drbgvectors_no_reseed / CTR_DRBG.txt — [AES-256 no df], Pers=0, AddIn=0, COUNT=0.
    // No-df mode: entropy input is full-entropy and exactly seedlen (48) octets,
    // no nonce.
    #[test]
    fn ctr_aes256_nodf_no_reseed_pers0_add0() {
        let entropy = hx("df5d73faa468649edda33b5cca79b0b05600419ccb7a879ddfec9db32ee494e5\
                          531b51de16a30f769262474c73bec010");
        let mut drbg = CtrDrbg::instantiate_no_df(32, &entropy, &[]).unwrap();
        let mut out = [0u8; 64];
        drbg.generate(&mut out, &[]).unwrap();
        drbg.generate(&mut out, &[]).unwrap();
        assert_eq!(
            out[..],
            hx("d1c07cd95af8a7f11012c84ce48bb8cb87189e99d40fccb1771c619bdf82ab22\
                80b1dc2f2581f39164f7ac0c510494b3a43c41b7db17514c87b107ae793e01c5")[..]
        );
    }

    // drbgvectors_no_reseed / CTR_DRBG.txt — [AES-256 no df], Pers=384, AddIn=384, COUNT=0.
    #[test]
    fn ctr_aes256_nodf_no_reseed_pers_add() {
        let entropy = hx("0dd4d80062ecc0f359efbe7723020be9b88b550fe74088094069e74428395856\
                          f63eed4f5b0e7d1e006f0eaff74f638c");
        let pers = hx("d2aa2ccd4bc6537e51f6550ab6d6294547bef3e971a7f128e4436f957de9982c\
                       93ee22110b0e40ab33a7d3dfa22f599d");
        let add0 = hx("0b081bab6c74d86b4a010e2ded99d14e0c9838f7c3d69afd64f1b66377d95cdc\
                       b7f6ec5358e3516034c3339ced7e1638");
        let add1 = hx("ca818f938ae0c7f4f507e4cfec10e7baf51fe34b89a502f754d2d2be7395120f\
                       e1fb013c67ac2500b3d17b735da09a6e");
        let mut drbg = CtrDrbg::instantiate_no_df(32, &entropy, &pers).unwrap();
        let mut out = [0u8; 64];
        drbg.generate(&mut out, &add0).unwrap();
        drbg.generate(&mut out, &add1).unwrap();
        assert_eq!(
            out[..],
            hx("6808268b13e236f642c06deba2494496e7003c937ebf6f7cb7c92104ea090f18\
                484aa075560d7844a06eb559948c93b26ae40f2db98ecb53ad593eb4c78f82b1")[..]
        );
    }

    // drbgvectors_pr_false / CTR_DRBG.txt — [AES-256 use df], Pers=0, AddIn=0, COUNT=0.
    // With reseed interposed between instantiate and the first generate.
    #[test]
    fn ctr_aes256_usedf_pr_false_reseed() {
        let entropy = hx("2d4c9f46b981c6a0b2b5d8c69391e569ff13851437ebc0fc00d616340252fed5");
        let nonce = hx("0bf814b411f65ec4866be1abb59d3c32");
        let reseed_entropy = hx("93500fae4fa32b86033b7a7bac9d37e710dcc67ca266bc8607d665937766d207");
        let mut drbg = CtrDrbg::instantiate(32, &entropy, &nonce, &[]).unwrap();
        drbg.reseed(&reseed_entropy, &[]).unwrap();
        let mut out = [0u8; 64];
        drbg.generate(&mut out, &[]).unwrap();
        drbg.generate(&mut out, &[]).unwrap();
        assert_eq!(
            out[..],
            hx("322dd28670e75c0ea638f3cb68d6a9d6e50ddfd052b772a7b1d78263a7b8978b\
                6740c2b65a9550c3a76325866fa97e16d74006bc96f26249b9f0a90d076f08e5")[..]
        );
    }

    // --- Per-width coverage: AES-128 / AES-192, use-df AND no-df. ---
    // drbgvectors_no_reseed / CTR_DRBG.txt, COUNT=0; ReturnedBits = SECOND
    // generate. no-df EntropyInput is full-entropy and exactly seedlen
    // (AES-128 → 32 octets, AES-192 → 40 octets), no nonce.

    // [AES-128 use df], Pers=0, AddIn=0, COUNT=0.
    #[test]
    fn ctr_aes128_usedf_no_reseed_pers0_add0() {
        let entropy = hx("890eb067acf7382eff80b0c73bc872c6");
        let nonce = hx("aad471ef3ef1d203");
        let mut drbg = CtrDrbg::instantiate(16, &entropy, &nonce, &[]).unwrap();
        let mut out = [0u8; 64];
        drbg.generate(&mut out, &[]).unwrap();
        drbg.generate(&mut out, &[]).unwrap();
        assert_eq!(
            out[..],
            hx("a5514ed7095f64f3d0d3a5760394ab42062f373a25072a6ea6bcfd8489e94af6\
                cf18659fea22ed1ca0a9e33f718b115ee536b12809c31b72b08ddd8be1910fa3")[..]
        );
    }

    // [AES-128 use df], Pers=128, AddIn=128, COUNT=0.
    #[test]
    fn ctr_aes128_usedf_no_reseed_pers_add() {
        let entropy = hx("cae48dd80d298103ef1ec0bf1bb96270");
        let nonce = hx("d827f91613e0b47f");
        let pers = hx("cc928f3d2df31a29f4e444f3df08be21");
        let add0 = hx("7eaa1bbec79393a7f4a8227b691ecb68");
        let add1 = hx("6869c6c7b9e6653b3977f0789e94478a");
        let mut drbg = CtrDrbg::instantiate(16, &entropy, &nonce, &pers).unwrap();
        let mut out = [0u8; 64];
        drbg.generate(&mut out, &add0).unwrap();
        drbg.generate(&mut out, &add1).unwrap();
        assert_eq!(
            out[..],
            hx("920132cd284695b868b5bc4b703afea4d996624a8f57e9fbf5e793b509cb15b4\
                beaf702dac28712d249ae75090a91fd35775294bf24ddebfd24e45d13f4a1748")[..]
        );
    }

    // [AES-192 use df], Pers=0, AddIn=0, COUNT=0.
    #[test]
    fn ctr_aes192_usedf_no_reseed_pers0_add0() {
        let entropy = hx("c35c2fa2a89d52a11fa32aa96c95b8f1c9a8f9cb245a8b40");
        let nonce = hx("f3a6e5a7fbd9d3c68e277ba9ac9bbb00");
        let mut drbg = CtrDrbg::instantiate(24, &entropy, &nonce, &[]).unwrap();
        let mut out = [0u8; 64];
        drbg.generate(&mut out, &[]).unwrap();
        drbg.generate(&mut out, &[]).unwrap();
        assert_eq!(
            out[..],
            hx("8c2e72abfd9bb8284db79e17a43a3146cd7694e35249fc3383914a7117f41368\
                e6d4f148ff49bf29076b5015c59f457945662e3d3503843f4aa5a3df9a9df10d")[..]
        );
    }

    // [AES-192 use df], Pers=256, AddIn=256, COUNT=0.
    #[test]
    fn ctr_aes192_usedf_no_reseed_pers_add() {
        let entropy = hx("d5973b5c9105cbf67e978f419924790d83023e86a8b5dd6b");
        let nonce = hx("358af1ae9a842c6e03f88dfa2a311161");
        let pers = hx("294d7d35f53a5d7ddef5ca4100f3547112c93e41251257dc0a19b6dfaa4a60a4");
        let add0 = hx("0805f31446c51d5d9d27b7cbb16e840b9e8b0dfe6fb4b69792bc8de9e3bd6d92");
        let add1 = hx("934d7fd5e716376342607123ea113d6b20170ccda53fc86541407a156cd94904");
        let mut drbg = CtrDrbg::instantiate(24, &entropy, &nonce, &pers).unwrap();
        let mut out = [0u8; 64];
        drbg.generate(&mut out, &add0).unwrap();
        drbg.generate(&mut out, &add1).unwrap();
        assert_eq!(
            out[..],
            hx("cb95459d1735cb9bce8a75bf097a099c9f7c70bad43e3e431f2d3829d7ca9d06\
                17b9a99337af5248d4741cb5a60dff6f8c5221e23f3cb524a94ffdd2190bfb3b")[..]
        );
    }

    // [AES-128 no df], Pers=0, AddIn=0, COUNT=0. Entropy = seedlen (32) octets.
    #[test]
    fn ctr_aes128_nodf_no_reseed_pers0_add0() {
        let entropy = hx("ce50f33da5d4c1d3d4004eb35244b7f2cd7f2e5076fbf6780a7ff634b249a5fc");
        let mut drbg = CtrDrbg::instantiate_no_df(16, &entropy, &[]).unwrap();
        let mut out = [0u8; 64];
        drbg.generate(&mut out, &[]).unwrap();
        drbg.generate(&mut out, &[]).unwrap();
        assert_eq!(
            out[..],
            hx("6545c0529d372443b392ceb3ae3a99a30f963eaf313280f1d1a1e87f9db373d3\
                61e75d18018266499cccd64d9bbb8de0185f213383080faddec46bae1f784e5a")[..]
        );
    }

    // [AES-128 no df], Pers=256, AddIn=256, COUNT=0.
    #[test]
    fn ctr_aes128_nodf_no_reseed_pers_add() {
        let entropy = hx("50b96542a1f2b8b05074051fe8fb0e45adbbd5560e3594e12d485fe1bfcb741f");
        let pers = hx("820c3030f97b3ead81a93b88b871937278fd3d711d2085d9280cba394673b17e");
        let add0 = hx("1f1632058806d6d8e231288f3b15a3c324e90ccef4891bd595f09c3e80e27469");
        let add1 = hx("5cadc8bfd86d2a5d44f921f64c7d153001b9bdd7caa6618639b948ebfad5cb8a");
        let mut drbg = CtrDrbg::instantiate_no_df(16, &entropy, &pers).unwrap();
        let mut out = [0u8; 64];
        drbg.generate(&mut out, &add0).unwrap();
        drbg.generate(&mut out, &add1).unwrap();
        assert_eq!(
            out[..],
            hx("02b76a66f103e98d450e25e09c35337747d987471d2b3d81e03be24c7e985417\
                a32acd72bc0a6eddd9871410dacb921c659249b4e2b368c4ac8580fb5db559bc")[..]
        );
    }

    // [AES-192 no df], Pers=0, AddIn=0, COUNT=0. Entropy = seedlen (40) octets.
    #[test]
    fn ctr_aes192_nodf_no_reseed_pers0_add0() {
        let entropy = hx("f1ef7eb311c850e189be229df7e6d68f1795aa8e21d93504e75abe78f04139587\
                          3540386812a9a2a");
        let mut drbg = CtrDrbg::instantiate_no_df(24, &entropy, &[]).unwrap();
        let mut out = [0u8; 64];
        drbg.generate(&mut out, &[]).unwrap();
        drbg.generate(&mut out, &[]).unwrap();
        assert_eq!(
            out[..],
            hx("6bb0aa5b4b97ee83765736ad0e9068dfef0ccfc93b71c1d3425302ef7ba4635f\
                fc09981d262177e208a7ec90a557b6d76112d56c40893892c3034835036d7a69")[..]
        );
    }

    // [AES-192 no df], Pers=320, AddIn=320, COUNT=0.
    #[test]
    fn ctr_aes192_nodf_no_reseed_pers_add() {
        let entropy = hx("8db47ca284294daeb303e6459422e32577ca539c00fead8839d42946bad8eb30\
                          e489c6d858763a28");
        let pers = hx("c2491a6ce1ef9bd13eb66a86c0f5be3d2f3239bf7f713e830e8ae8907a2084f8\
                       73ed3f5eddf5b569");
        let add0 = hx("e9a3f24180345a0c0680aacdb89ce7cf841c7ad547ef92dad54f8262445e2f0c\
                       54c8f8e42350f79c");
        let add1 = hx("e2427b93738424c0fce14cb6c5f1d6b6a0532787157b6d907bc55d1c9a670494\
                       776212a643a9fb2c");
        let mut drbg = CtrDrbg::instantiate_no_df(24, &entropy, &pers).unwrap();
        let mut out = [0u8; 64];
        drbg.generate(&mut out, &add0).unwrap();
        drbg.generate(&mut out, &add1).unwrap();
        assert_eq!(
            out[..],
            hx("494b1957ab382b382054f54bb62f0b5b464afb3b18492c60809c26e86e45b6b9\
                fa44524dd89ecdca99c60e68ed107ff336be1591cadd6fd7e35f742611809f2e")[..]
        );
    }

    // [AES-128 use df], Pers=0, AddIn=0, COUNT=0, prediction-resistance
    // FALSE with a single reseed interposed (drbgvectors_pr_false).
    #[test]
    fn ctr_aes128_usedf_pr_false_reseed() {
        let entropy = hx("0f65da13dca407999d4773c2b4a11d85");
        let nonce = hx("5209e5b4ed82a234");
        let reseed_entropy = hx("1dea0a12c52bf64339dd291c80d8ca89");
        let mut drbg = CtrDrbg::instantiate(16, &entropy, &nonce, &[]).unwrap();
        drbg.reseed(&reseed_entropy, &[]).unwrap();
        let mut out = [0u8; 64];
        drbg.generate(&mut out, &[]).unwrap();
        drbg.generate(&mut out, &[]).unwrap();
        assert_eq!(
            out[..],
            hx("2859cc468a76b08661ffd23b28547ffd0997ad526a0f51261b99ed3a37bd407b\
                f418dbe6c6c3e26ed0ddefcb7474d899bd99f3655427519fc5b4057bcaf306d4")[..]
        );
    }

    #[test]
    fn ctr_aes256_nodf_rejects_wrong_entropy_len() {
        // no-df requires exactly seedlen = 48 octets.
        let bad = [0u8; 32];
        assert_eq!(
            CtrDrbg::instantiate_no_df(32, &bad, &[]).err(),
            Some(Error::InsufficientEntropy)
        );
    }

    #[test]
    fn ctr_rejects_bad_key_len() {
        assert_eq!(
            CtrDrbg::instantiate(20, &[0u8; 32], &[0u8; 16], &[]).err(),
            Some(Error::InvalidLength)
        );
    }
}