Using what may be considered today's "best" or "most secure" CSPRNGs, how much maximum data N can you read from a CSPRNG given seed input of length n before the output starts becoming predictable (without reseeding)? Can one read from it indefinitely and still get unpredictable output?
More concretely: can I generate 20kb of data from a hardware random number device, feed that to a stateful CSPRNG, get rid of the hardware random number generator, and indefinitely use the data from the CSPRNG for cryptographic purposes?

Note: I realize "length" may be problematic, so this question may be answered in terms of entropy quality.


This is exactly what /dev/urandom does, actually.

A PRNG with a seed of length N bits will have a period (repetition length) of 2^N bits, due to the pigeonhole principle. So as long as your CSPRNG is perfectly secure and has a seed length of, say, 256 bits, you don't have to worry about ever repeating before the heat death of the universe. (Note that seeds are of fixed lengths.)

The reason this is considered dangerous is because if for any reason your PRNG leaks state, say because an attacker uses a kernel info-disclosure bug, all the "random" data is compromised until the next reseed. OTOH, fetching "real" randomness when you need it provides perfect forward security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.