Overview
Hash-DRBG derives and updates internal state with hash functions. Each generation request advances the state and emits hashed blocks until enough pseudorandom output is available.
CoreSource checked
Hash-DRBG
Generates deterministic random bits by iterating a cryptographic hash over internal state.
Quick Facts
Compact metadata for implementation and discovery.
- Category
- Cryptography
- Difficulty
- Intermediate
- Family
- Deterministic Random Bit Generators
- Tier
- Core
- Status
- Verified
- Review
- Source Checked
- Sources
- 1
- Formulas
- 0
- Relationships
- 2
- Code example
- Ready
- Visualization
- Ready
- Aliases
- Hash Deterministic Random Bit Generator
Core Concepts
cryptographic random generationdeterministic random bit generatorsbit maskshash lookuprandom samplingcryptography
Quick facts
Complexity
Runtime and memory behavior at a glance.
Best
O(V + E)
Average
O((V + E) log V)
Worst
O(V^2 + E)
Space
O(V + E)
When to Use
- Use through a reviewed implementation when the selected hash and security strength match the requirement.
- Use when entropy, nonce, personalization, and reseeding can be managed explicitly.
When Not to Use
- Avoid hand-written security-critical implementations.
- Avoid when state compromise, reseed, or request-limit handling is unclear.
What It Does
- Initializes state from entropy, nonce, and optional personalization input
- Expands state into pseudorandom output with a hash function
- Updates and reseeds state according to the security policy
Use Cases
- Standards-based DRBGs built from hash functions
- Systems where a hash primitive is already approved
- Deterministic random generation with explicit reseed handling
Inputs
- Message, key, modulus, seed, or public parameters
- Security parameter or nonce when required
Outputs
- Cryptographic value such as signature, random bits, proof, or modular result
Pseudocode
- 1.Instantiate hash-based state from entropy and nonce input
- 2.For a request, incorporate additional input if present
- 3.Hash state-derived values until enough output bytes are available
- 4.Update internal state after generation
- 5.Reseed before policy limits are exceeded
Canonical Example
- Input
- entropy input, nonce, and requested output length = 32 bytes
- Output
- 32 bytes of deterministic random output
- Explanation
- The DRBG hashes state-derived values to emit output and then advances its internal state.
Implementation Notes
- Keep state variables and update functions aligned with the specification.
- Use official derivation and hash generation steps rather than ad hoc hashing.
- Test that identical seeds reproduce outputs only in controlled test settings.
Common Pitfalls
- Confusing hash determinism with fresh entropy can lead to repeated streams.
- Skipping additional-input and reseed handling can violate the intended design.
- Ignoring output-length limits can weaken assumptions.
Interactive Mechanism Walkthrough
Graph Frontier & Edge RelaxationShow hashing internal state to produce and update pseudorandom output on a small cryptographic random generation example.
Step 1 of 5: Instantiate hash-based state from entropy and nonce input
cryptography-mechanismNotes
Hash-DRBG should be treated as a specified state machine rather than a direct call to a hash function.
Sources (1)
What each reference supports for this entry.
NIST SP 800-90A Rev. 1
DocumentationNIST reference for Hash-DRBG hash-based state updates, generation, and reseeding.
Open sourceExplore Next
Good next jumps from the relationship graph, ranked for useful discovery.
Relationships
View full relationship pageTags
CryptographyRandomnessHashingGraph