Foreword
Introduction
1 Scope
2 Conformance
3 Normative references
4 Terms and definitions
5 Symbols and Abbreviations
6 General Discussion
6.1 Overview of Document
6.2 The Need for Random Numbers
6.3 Examples of Cryptographic Use of Random Numbers
7 Overview of Random Bit Generators
7.1 Secure RBG
7.2 Idealized Coin Flipping - The Canonical RBG
7.2.1 Coin Flipping Preliminaries
7.2.2 Properties of Idealized Coin Flipping
7.2.3 Possible Problems with Actual Coin Flipping
7.2.4 von Neumann Unbiasing
7.3 Random Bit Generation Functional Model
7.3.1 Entropy Source
7.3.2 Algorithmic Processing
7.3.3 Interfacing with the RBG
7.4 Types of Random Bit Generators
7.4.1 Non-deterministic Random Bit Generator (NRBG)
7.4.2 Deterministic Random Bit Generator (DRBG)
7.4.3 The RBG Spectrum
7.4.4 Summary of an Approved RBG
8 Security Properties of a Random Bit Generator
8.1 General Discussion
8.2 Security Strengths
8.3 Entropy and Min-Entropy
8.4 Backtracking Resistance and Prediction Resistance
8.5 Indistinguishability Versus Unpredictability
8.6 Prediction Resistance and Backtracking Resistance
Considerations
8.7 Desired RBG Output Properties
8.8 Desired RBG Operational Properties
9 Converting Random Bits to/from Random Numbers
9.1 The Need for Conversion Routines
9.2 Converting Random Bits into a Random Number
9.2.1 The Simple Discard Method
9.2.2 The Complex Discard Method
9.2.3 The Simple Modular Method
9.2.4 The Complex Modular Method
9.3 Converting a Random Number into Random Bits
9.3.1 The No Skew (Variable Length Extraction) Method
9.3.2 The Negligible Skew (Fixed Length Extraction)
Method
Annex A (Informative) Security Considerations
A.1 Attack Model
A.2 RBG Security Analysis
A.3 Computationally-Indistinguishable Randomness Theorems
A.4 Min-Entropy as the Measure of Entropy
A.4.1 Why Shannon Entropy Is Not Appropriate
A.4.2 Why Guessing Entropy Is Not Appropriate
A.4.3 Min-Entropy Tutorial
Annex B (Informative) Bibliography