Cryptographically Secure Random Number Reference
Reference for CSPRNGs, entropy sources, and standards for secure random generation.
CSPRNG Requirements
A CSPRNG produces output indistinguishable from true randomness to any polynomial-time observer. It must maintain forward secrecy: past outputs cannot be predicted from future state compromises. Backtracking resistance ensures past outputs cannot be recovered after state compromise. The generator must be seeded with sufficient entropy before producing output. NIST SP 800-90A specifies approved DRBG algorithms.
- indistinguishable
- Output looks random
- forward secrecy
- Future compromise safe
- backtracking
- Past safe after compromise
no polynomial testreseed regularlyone-way stateApproved Algorithms
Hash-DRBG uses a hash function to expand and update state. HMAC-DRBG uses HMAC for state update. CTR-DRBG uses a block cipher in counter mode. All require periodic reseeding from entropy sources. In practice, operating system CSPRNGs (getrandom, BCryptGenRandom) are preferred over application-level DRBGs. Web Crypto provides crypto.getRandomValues for browser contexts. Never use Math.random for security.
- Hash-DRBG
- Hash-based state
- CTR-DRBG
- Block cipher counter
- OS CSPRNG
- getrandom, BCryptGenRandom
NIST SP 800-90AAES-CTR-DRBGpreferred source