3 ms·

And why is it OK for use in a PRNG/DRBG and not a cipher?

• fleitz 13y ago
  Because generally the plaintext input to a PRNG using a cipher in CTR mode is uninteresting to attackers, and generally cannot be controlled. What a DRBG needs to do is provide unpredictable bits, not bits that can't be decrypted.
  • marshray 13y ago
    If the "plaintext input to a PRNG" becomes known to the attacker, the entire output of the PRNG becomes known (i.e., 'predictable') to the attacker.
    • fleitz 13y ago
      That's why I try not to give attackers root access to the system, that way they can't examine the state of my PRNG.
• tptacek 13y ago
  Because PRNG constructions tend to run the whole key schedule when they refresh their state; for instance, CTR_DRBG uses inputs to derive a nonce and a whole new key.