ISO/IEC 18031:2011

Overview

ISO/IEC 18031:2011, "Information technology - Security techniques - Random bit generation", defines a conceptual model and security requirements for random bit generators (RBGs) used for cryptographic purposes. The standard covers both non‑deterministic random bit generators (NRBGs) and deterministic random bit generators (DRBGs), describes their main components (entropy sources, internal state, state transition and output generation functions, support and health tests), and gives guidelines for producing random numbers from random bit strings. Detailed statistical test techniques and full generator designs are explicitly out of scope.

Key Topics and Requirements

• RBG conceptual model: functional components and interactions required for secure random bit generation.
• Entropy sources: characteristics and roles of primary, physical and non‑physical entropy inputs; hybrid architectures.
• Internal state & transitions: requirements for maintaining and updating internal state securely.
• Output generation: requirements for deterministic and non‑deterministic output functions that produce cryptographic-quality bits.
• Additional inputs and support functions: use of personalization strings, reseeding, and auxiliary inputs to strengthen security.
• Health tests: continuous and startup checks for entropy sources and deterministic components to detect failures or degradation.
• Annexes and examples: normative guidance on combining RBGs, conversion methods for random numbers, and example DRBG mechanisms including Hash_DRBG, HMAC_DRBG, CTR_DRBG, Dual_EC_DRBG, MS_DRBG and others.

Practical Applications

ISO/IEC 18031 is essential for anyone designing, evaluating, or deploying cryptographic systems that require trustworthy randomness:

• Security architects & crypto engineers: design secure key generation, nonces, IVs, session keys and digital signature randomness.
• Hardware RNG designers: specify entropy source requirements and health monitoring for physical random generators.
• Software developers: build or select DRBG implementations that meet cryptographic requirements for applications (TLS, VPNs, PKI, secure tokens, IoT).
• Auditors and evaluators: assess RBG designs and operational practices against recognized security criteria. Using ISO/IEC 18031 helps reduce risks from poor randomness, such as predictable keys or repeated nonces that can compromise confidentiality and integrity.

Related Standards

ISO/IEC 18031 is typically used alongside other cryptographic and validation frameworks. Implementers often reference guidance from national standards bodies (for example, NIST DRBG recommendations and FIPS guidance) and other ISO/IEC security standards when selecting or certifying RBG implementations.

Keywords: ISO/IEC 18031, random bit generator, cryptographic RNG, entropy source, NRBG, DRBG, random number generation standard, security techniques.