The core of this deterministic random number generator is implemented according to the document “NIST-Recommended Random Number Generator Based on ANSI X9.31 Appendix A.2.4 Using the 3-Key Triple DES and AES Algorithms”, dated 2005-01-31. This implementation uses the AES variant.
The generator is based on contexts to utilize the same core functions for all random levels as required by the high-level interface. All random generators return their data in 128 bit blocks. If the caller requests less bits, the extra bits are not used. The key for each generator is only set once at the first time a generator context is used. The seed value is set along with the key and again after 1000 output blocks.
On Unix like systems the GCRY_VERY_STRONG_RANDOM and
GCRY_STRONG_RANDOM generators are keyed and seeded using the
rndlinux module with the /dev/radnom device. Thus these
generators may block until the OS kernel has collected enough entropy.
When used with Microsoft Windows the rndw32 module is used instead.
The generator used for gcry_create_nonce is keyed and seeded
from the GCRY_STRONG_RANDOM generator. Thus is may also block
if the GCRY_STRONG_RANDOM generator has not yet been used
before and thus gets initialized on the first use by
gcry_create_nonce. This special treatment is justified by the
weaker requirements for a nonce generator and to save precious kernel
entropy for use by the “real” random generators.
A self-test facility uses a separate context to check the functionality of the core X9.31 functions using a known answers test. During runtime each output block is compared to the previous one to detect a stucked generator.
The DT value for the generator is made up of the current time down to microseconds (if available) and a free running 64 bit counter. When used with the test context the DT value is taken from the context and incremented on each use.