3 ms·
So what? The 32 bytes it gets goes back into a similar CSPRNG as the CSPRNG it came out of. So instead of requesting 4096 bits from a CSPRNG, it requests 256
by fleitz 13y ago
So what?
The 32 bytes it gets goes back into a similar CSPRNG as the CSPRNG it came out of.
So instead of requesting 4096 bits from a CSPRNG, it requests 256 bits from a CSPRNG and uses that to initialize another CSPRNG which it reads 4096 bits from. Cryptographically speaking it's the exact same thing.
The question to be asking is whether the output from either CSPRNG is predictable.
- vilda 13y agoCryptographically speaking you are completely wrong :) You need both: good algorithm and enough entropy. Ad absurdum if you read 1 one byte and feed it into your CSPRNG, you may get up to 256 random streams of 4096 bits, which is easily enumerable and hardly secure.
- tptacek 13y agoI don't know what you're trying to say here, but feeding 256 bits to a CSPRNG and then pulling 4096 bits of output from that CSPRNG is not "cryptographically completely wrong".