4

What is the maximum bias recommended by NIST for random number generators?

This answer says that it is $2^{-64}$.

Is it same for all applications? Does NIST have a publication with more information?

I tried to browse through NIST Recommendation for Random Bit Generator Constructions, but couldn't find it.

Ritesh Singh
  • 319
  • 1
  • 8

1 Answers1

3

Yes, NIST recommends $\epsilon \le 2^{-64}$. They consider such a sequence to have "full entropy". It's in the definitions (page 4) of SP800-90C.

grab

Converting that to a probability bias, $P(x_i = 0, x_i = 1) \approx 0.5 \pm 2^{-66}$.

The interesting thing is that if the Leftover Hash Lemma is used, $\epsilon$ can be set by the designer. ID Quantique TRNGs are designed with extractors such that $\epsilon \approx 2^{-100}$.

Paul Uszak
  • 15,390
  • 2
  • 28
  • 77