Security Analysis of NIST CTR-DRBG
We study the security of \(\mathsf {CTR\text {-}DRBG}\), one of NIST’s recommended Pseudorandom Number Generator (PRNG) designs. Recently, Woodage and Shumow (Eurocrypt’ 19), and then Cohney et al. (S&P’ 20) point out some potential vulnerabilities in both NIST specification and common implementations of \(\mathsf {CTR\text {-}DRBG}\). While these researchers do suggest counter-measures, the security of the patched \(\mathsf {CTR\text {-}DRBG}\) is still questionable. Our work fills this gap, proving that \(\mathsf {CTR\text {-}DRBG}\) satisfies the robustness notion of Dodis et al. (CCS’13), the standard security goal for PRNGs.