HMAC-DRBG

NIST SP 800-90A standardizes several CSPRNG algorithms. HMAC-DRBG uses HMAC for state update + output:

State: K (key, 256 bits), V (counter, 256 bits)

generate(num_bytes):
    output = b""
    while len(output) < num_bytes:
        V = HMAC(K, V)
        output += V
    # Update state to prevent backtracking
    K = HMAC(K, V || 0x00)
    V = HMAC(K, V)
    return output[:num_bytes]

reseed(entropy):
    K = HMAC(K, V || 0x00 || entropy)
    V = HMAC(K, V)

Properties:

• Forward secrecy: even if K is leaked, past outputs are still secure.
• Backward secrecy: future outputs from a known state can't be predicted (after reseed).
• Reseeding: incorporate fresh entropy periodically.

Reseed limits: re-seed every 2^48 generates max (NIST). In practice: every few seconds or megabytes of output.

Other DRBGs:

• CTR-DRBG: AES-CTR based; very fast on AES-NI hardware.
• Hash_DRBG: SHA-256 based; conceptually similar.

Used in: Java SecureRandom, FIPS 140-2 modules, OpenSSL FIPS mode.

Note: NIST also standardized Dual_EC_DRBG which had a NSA backdoor (Snowden 2013). Don't use it.