1

Consider following simple RBG where SHA-256 of random noise (more than 200Bytes of 4 bits entropy per byte) is computed to produce 256 output bits

$\text{output} = \operatorname{SHA-256}(\text{randomNoise})$

Is security strength of collision resistance or pre-image resistance applicable to it i.e it provides 128 or 256 bit security?

According to NIST SP 800-90A section 10.1

The maximum security strength that can be supported by each DRBG based on a hash function is the security strength of the hash function for pre-image resistance

kodlu
  • 25,146
  • 2
  • 30
  • 63
crypt
  • 2,522
  • 22
  • 33

1 Answers1

1

No.

Some clarification: SP 800-90A -> Recommendation for Random Number Generation Using Deterministic Random Bit Generators, as per your "DRBG" quotation. Yet your example is a TRNG covered by SP 800-90B -> Recommendation for the Entropy Sources Used for Random Bit Generation. But only in America. NIST does not have a monopoly on entropy nor random numbers.

The security strength of a TRNG is measured by the final output bias given that:-

$$ H_{out} \ngtr H_{in} $$

So post extraction, your 4 bit entropy source emerges with much better randomness, and a bias away from perfection bounded by the Leftover Hash Lemma:-

$$ \epsilon = 2^{-(sn-k)/2} $$

where we have $n$ = input bits at $s$ bits/bit of raw entropy from the source, $k$ is the number of output bits from the extractor (and ideally $\ll sn$). $\epsilon$ is the bias away from a perfectly uniform $k$ bit length string, i.e. $H(k) = 1 - \epsilon$ bits/bit. NIST accepts that $\epsilon < 2^{-64}$ for cryptographic applications.

Your $\epsilon \approx 2^{-272}$. So not bad assuming that your source does indeed produce 0.5 bits/bit of true entropy at all working temperatures.

Paul Uszak
  • 15,905
  • 2
  • 32
  • 83