NIST Requests Comments on Computer Security Publication on Randomness

January 27, 2016

Contact: Chad Boutin

301-975-4261

The National Institute of Standards and Technology (NIST) is seeking public comment on its latest draft of a publication intended to help computer security experts use randomness to protect sensitive data.

Thermal noise is one of the physical phenomena that can be used as a source of randomness, and it helps to create the visual representation of “snow” that was once a familiar sight to owners of analog televisions.

Credit: ©Shutterstock

The Second Draft of Special Publication (SP) 800-90B, Recommendation for the Entropy Sources Used for Random Bit Generation, aims to help security specialists judge whether the source of random numbers they use as part of the data encryption process is sufficiently unpredictable. NIST is requesting public comments by May 9, 2016, on the draft document, which is available at NIST’s CSRC website.

Random numbers are a crucial element in cryptography, which is often used to protect private messages by encrypting them into a form that cannot be understood without knowledge of a secret value generated using the random number.

Creating the randomness needed requires the use of an entropy source, which includes a natural source of entropy, often a physical phenomenon such as thermal noise—the random motions of particles due to their temperature. Entropy sources that comply with SP 800-90B are intended to provide assurance that cryptographic algorithms provide the security needed to protect information.

“This draft document proposes a lot of tests that you can use to validate your entropy source to tell you how good a job it is doing,” says NIST’s Elaine Barker, one of the publication’s authors. “When you’re assessing your process for generating randomness, you want to make sure nothing is broken and that it is performing consistently. We would like the public’s input on ways we can improve these tests.”

The document is one of three interrelated publications that NIST has been developing: The first, SP 800-90A Rev. 1, specifies several random-number generation algorithms, all of which require an entropy source to provide a complete random number generator. SP 800-90B helps to assess an entropy source’s performance. The third publication, SP 800-90C, shows users how to combine the algorithms in SP 800-90A and the entropy sources in SP 800-90B into effective random-number generators.

Barker says that the team is also planning a public workshop to discuss both SP 800-90B and -90C. The workshop (preliminary announcement here) will be held on NIST’s Gaithersburg, Md., campus on May 2-3, 2016. Registration will be required. “We hope to have an updated draft version of SP 800-90C posted online before the workshop as well,” she says.

When completed, NIST’s Cryptographic Algorithm Validation Program (CAVP) and Cryptographic Module Validation Program (CMVP) plan to validate entropy sources using the tests and requirements provided in SP 800-90B.

SP 800-90B is available for free download here. To submit comments, use the provided template and send them with subject line “Comments on Draft SP 800-90B” to rbg_comments@nist.gov by May 9, 2016. Submissions received by the deadline will be used to improve the document, which is now undergoing its second public comment review.