Doubts about the usage of HMAC_DRBG

[crypto-int]

Hi, I'm new to cryptography and I was wondering if you could help me with a question I have about how to make the structure.

I don't know when to include the nonce and the personalization_string in the botan code.

I would also like to use this initialization structure with jitter_entropy but i don't know how to put a entropy size and this HMAC_DRBG(std::unique_ptr prf, RandomNumberGenerator& underlying_rng, size_t reseed_interval = BOTAN_RNG_DEFAULT_RESEED_INTERVAL, size_t max_number_of_bytes_per_request = 64 * 1024);

I make this code:

std::string hmac_drbg(std::string const &nonce, std::string const &msg, uint8_t const &output_size)
{
    std::unique_ptr<Botan::MessageAuthenticationCode> hmac(Botan::MessageAuthenticationCode::create_or_throw("HMAC(SHA-512)"));
    hmac->set_key(Botan::hex_decode(nonce));
    hmac->update(msg);
    Botan::Jitter_RNG jitter;
    Botan::HMAC_DRBG drbg(std::move(hmac), jitter);
    std::vector<uint8_t> output(output_size);
    drbg.randomize(output.data(), output.size());
    std::string ret{Botan::hex_encode(output)};
    return ret;
}

[reneme]

First and foremost: welcome in the fascinating world of cryptography!

If all you need is a cryptographically strong random byte generator without any additional requirements, please let me suggest to just use Botan's AutoSeeded_RNG:

#include <botan/auto_rng.h>
#include <botan/hex.h>

#include <iostream>

int main() {
   Botan::AutoSeeded_RNG rng;
   std::cout << Botan::hex_encode(rng.random_vec(32)) << '\n';
   return 0;
}

AutoSeeded_RNG uses HMAC_DRBG internally and seeds it with randomness pulled from your operating system. For many applications that is simply good enough.

If you really want to incorporate entropy from the newly added Jitter_RNG, for instance because you need an RNG that fulfills certain governmental regulatory requirements, you could do this:

#include <botan/auto_rng.h>
#include <botan/hex.h>
#include <botan/entropy_src.h>

#include <iostream>

int main() {
   Botan::Entropy_Sources entropy_sources({"system_rng", "jitter_rng"});
   Botan::AutoSeeded_RNG rng(entropy_sources);
   std::cout << Botan::hex_encode(rng.random_vec(32)) << '\n';
   return 0;
}

In both cases, there's no need the manually deal with HMAC_DRBG or MessageAuthenticationCode, all these details happen behind the scenes. Please see the documentation for further details.

[crypto-int]

Thanks!
But what happens if I want to follow NIST as stated in section 10.1.2.3 Instantiation of HMAC_DRBG with the initial values: entropy_input, nonce, personalization_string.

I don't really know how to add these variables to botan's HMAC_DRBG

[reneme]

I'm guessing you refer to NIST SP.800-90A?

If you instantiate a pure Botan::HMAC_DRBG (not as implementation detail of AutoSeeded_RNG), it will initially not be seeded. You can use the .initialize_with() method to essentially invoke the "HMAC_DRBG Instantiate Process" described in Section 10.1.2.3. Afterwards, your RNG will be seeded and can be used to produce random bits.

I'll post some code as a new proposed answer.

[reneme]

Botan::HMAC_DRBG has an .initialize_with() method exactly for this use case. This method takes a single parameter "input" that is a byte array of "seed material" as required in NIST SP.800-90A Section 10.1.2.3. Here's some code to illustrate this usage:

#include <botan/hex.h>
#include <botan/hmac_drbg.h>
#include <botan/system_rng.h>

#include <iostream>
#include <ranges>

auto as_bytes(std::string_view s) {
   const auto start = reinterpret_cast<const uint8_t*>(s.data());
   const auto end = start + s.size();
   return std::vector<uint8_t>(start, end);
}

template <std::ranges::input_range... Ts>
   requires(std::same_as<uint8_t, std::ranges::range_value_t<Ts>> && ...)
constexpr auto concat(const Ts&... ranges) {
   std::vector<uint8_t> result;
   (result.insert(result.end(), ranges.begin(), ranges.end()), ...);
   return result;
}

int main() {
   // Instead of the system RNG you could use the Jitter_RNG to obtain
   // initial seed material aka. entropy bits.
   auto entropy_input = Botan::system_rng().random_vec(64);
   auto nonce = Botan::system_rng().random_vec(16);
   auto personalization_string = as_bytes("example application");

   Botan::HMAC_DRBG rng("SHA-512");

   // prints 'false'
   std::cout << "seeded? " << std::boolalpha << rng.is_seeded() << std::endl;

   rng.initialize_with(concat(entropy_input, nonce, personalization_string));

   // prints 'true'
   std::cout << "seeded? " << std::boolalpha << rng.is_seeded() << std::endl;

   return 0;
}

[crypto-int]

Thanks!!