Security analysis of the ISO standard \(\textsf{OFB}\)-\(\textsf{DRBG}\)

Deterministic random bit generators (DRBGs) are essential tools in modern cryptography for generating secure and unpredictable random numbers. The ISO DRBG standards provide guidelines for designing and implementing DRBGs, including four algorithms: \(\textsf{HASH}\text {-}\textsf{DRBG}\) $\mathsf{HASH}\text{-}\mathsf{DRBG}$ , \(\textsf{HMAC}\text {-}\textsf{DRBG}\) $\mathsf{HMAC}\text{-}\mathsf{DRBG}$ , \(\textsf{CTR}\text {-}\textsf{DRBG}\) $\mathsf{CTR}\text{-}\mathsf{DRBG}$ , and \(\textsf{OFB}\text {-}\textsf{DRBG}\) $\mathsf{OFB}\text{-}\mathsf{DRBG}$ . While security analyses have been conducted for the former three algorithms, there is a lack of specific security analysis for the \(\textsf{OFB}\) $\mathsf{OFB}$ - \(\textsf{DRBG}\) $\mathsf{DRBG}$ algorithm. We prove its security in the robustness security framework that has been used to analyze \(\mathsf {CTR\text {-}DRBG}\) $\mathsf{CTR}\mathsf{\text{-}}\mathsf{DRBG}$ by Hoang and Shen at Crypto 2020. More precisely, we prove that \(\textsf{OFB}\) $\mathsf{OFB}$ - \(\textsf{DRBG}\) $\mathsf{DRBG}$ provides \(O(\min \left\{ \frac{\lambda }{3}, \frac{n}{2} \right\} )\) $O(min\left\{\frac{\lambda }{3},,,\frac{n}{2}\right\})$ -bit security, including ideal cipher queries, where \(\lambda \) $\lambda$ and n denote the lower bound of min-entropy and the size of the underlying block cipher, respectively. The proof strategy is to transform the robustness game of \(\textsf{OFB}\) $\mathsf{OFB}$ - \(\textsf{DRBG}\) $\mathsf{DRBG}$ into an indistinguishability game and then apply the H-coefficient technique to upper bound the distinguishing advantage.