CoreSource checked

CTR-DRBG

Generates deterministic random bits with a block-cipher counter construction.

Explore relationships Open constellationBrowse atlas

Quick Facts

Compact metadata for implementation and discovery.

Category: Cryptography
Difficulty: Intermediate
Family: Deterministic Random Bit Generators
Tier: Core
Status: Verified
Review: Source Checked
Sources: 1
Formulas: 0
Relationships: 4
Code example: Ready
Visualization: Ready
Aliases: Counter-mode Deterministic Random Bit Generator

Overview

CTR-DRBG keeps a block-cipher key and counter-like value as internal state. It encrypts successive values to emit pseudorandom blocks and updates the state between requests.

Core Concepts

cryptographic random generationdeterministic random bit generatorsbit masksrandom samplingcryptography

Quick facts

Complexity

Runtime and memory behavior at a glance.

Best

O(V + E)

Average

O((V + E) log V)

Worst

O(V^2 + E)

Space

O(V + E)

When to Use

Use through a validated library when a block-cipher DRBG is required.
Use when entropy input and reseed policy can be enforced.

When Not to Use

Avoid if key and counter state cannot be protected.
Avoid custom implementations that skip update, reseed, or request-limit rules.

What It Does

Initializes block-cipher state from entropy input
Encrypts successive counter values to generate output blocks
Updates and reseeds state according to the DRBG policy

Use Cases

Standards-based random bit generation using block ciphers
Systems with hardware-accelerated AES
Deterministic test fixtures that still model DRBG state transitions

Inputs

Message, key, modulus, seed, or public parameters
Security parameter or nonce when required

Outputs

Cryptographic value such as signature, random bits, proof, or modular result

Pseudocode

1.Instantiate key and counter state from entropy and nonce input
2.For each output block, increment the counter-like value
3.Encrypt the value with the current key and append the block
4.Update key and value state after generation
5.Reseed before policy limits are exceeded

Canonical Example

Input: entropy input and requested output length = 48 bytes
Output: three AES-sized output blocks
Explanation: The generator encrypts successive internal values and updates its key/value state after the request.

Implementation Notes

Separate instantiate, generate, update, and reseed operations.
Use official derivation-function and no-derivation-function modes correctly.
Test counter increment behavior across block boundaries.

Common Pitfalls

Reusing state across independent security domains can repeat or correlate outputs.
Ignoring request-size and reseed limits breaks the intended construction.
Counter update bugs can repeat output blocks.