ISO/IEC 18031:2011/Amd 1:2017

INTERNATIONAL ISO/IEC
STANDARD 18031
Second edition
2011-11-15
AMENDMENT 1
2017-02
Information technology — Security
techniques — Random bit generation
AMENDMENT 1: Deterministic random
bit generation
Technologies de l’information — Techniques de sécurité —
Génération de bits aléatoires
AMENDEMENT 1: Génération déterministe de bits aléatoires
Reference number
ISO/IEC 18031:2011/Amd.1:2017(E)
©
ISO/IEC 2017

---------------------- Page: 1 ----------------------
ISO/IEC 18031:2011/Amd.1:2017(E)

COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2017, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. +41 22 749 01 11
Fax +41 22 749 09 47
copyright@iso.org
www.iso.org
ii © ISO/IEC 2017 – All rights reserved

---------------------- Page: 2 ----------------------
ISO/IEC 18031:2011/Amd.1:2017(E)

Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www .iso .org/ patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO’s adherence to the
World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following
URL: w w w . i s o .org/ iso/ foreword .html.
Amendment 1 to ISO/IEC 18031-1:2011 was prepared by Joint Technical Committee ISO/IEC JTC 1,
Information technology, Subcommittee SC 27, IT Security techniques.
© ISO/IEC 2017 – All rights reserved iii

---------------------- Page: 3 ----------------------
ISO/IEC 18031:2011/Amd.1:2017(E)
Information technology — Security techniques — Random
bit generation
AMENDMENT 1: Deterministic random bit generation
Page 141
Add a new Annex K.
Annex K
(informative)
Example cases for MQ_DRBG
K.1  General
Annex K and its supporting files provides example cases for 14 settings listed in ISO/IEC 18031:2011,
Table C.5. The supporting files are available at the following URL:
http:// standards .iso .org/ iso/ 18031/
In each of the 14 settings described in Annex K, the bitstring P provides a randomly selected system of
multivariate quadratic equations that complies with the selection rules of C.5.2.5. The rank distribution
resulting from the verification of rank conditions is detailed for each setting.
P is given in the format described in C.5.2.4 which is recalled below. Each example case also includes a
sequence of consecutive input-output pairs for the Evaluate_MQ(…) function.
K.1.1    Format for representing field elements
field_size
Each system coefficient is an element of the binary field GF(2 ) and is a univariate polynomial
over GF(2) modulo the irreducible polynomial given in Table C.6. A field element is handled as a
bitstring of field_size bits composed of its GF(2) coefficients ordered by decreasing degree. For example,
3 4
the polynomial x + x + 1 in GF(2 ) is represented as the bitstring 1011.
K.1.2  Format for representing a single multivariate quadratic equation
The quadratic system used in MQ_DRBG operates on n = state_length / field_size variables and contains
n + m equations where m = block_length / field_size. A quadratic equation is written as the concatenation
of its coefficients in lexicographic order and by decreasing degree. Therefore the coefficient of the
monomial x x appears first, followed by that of x x and so forth, up to the coefficient of x x . The
1 1 1 2 1 n
coefficient of the monomial x x appears next, followed by that of x x and so forth, until the last
2 2 2 3
quadratic coefficient x x is reached. Then linear coefficients appear, starting with the coefficient of
n-1 n
the monomial x and ending with that of x . When field_size = 1, the linear coefficients are omitted since
1 n
the underlying field is GF(2) and x x = x . The string ends with the constant coefficient of the quadratic
i i i
equation.
K.1.3  Format for representing a complete system of quadratic equations
The quadratic system encoded into the bitstring P contains its n + m quadratic equations concatenated
in sequential order, starting with the coefficients of the first equation and ending with those of the
(n+m)-th equation. P is formed by the resulting bit string of length system_length.
K.1.4  Format for representing inputs and outputs
© ISO 2017 – All rights reserved 1

---------------------- Page: 4 ----------------------
ISO/IEC 18031:2011/Amd.1:2017(E)

The input x to Evaluate_MQ(P, x) is a vector of n field elements and is given as a bitstring formed by
concatenating their bitstring representations, starting with x and ending with x . Similarly, the output
1 n
y || z is a vector of n + m field elements represented in the same format.
K.1.5  Summary of example cases
Table K.1 summarizes the 14 example cases.
Table K.1 — Summary of example cases
block_length
requested_strength
112 128 192 256
K.2 K.4 K.7 K.11
Binary field GF(2) Binary field Binary field Binary field
4 6 8
GF(2 ) GF(2 ) GF(2 )
n = 112
n = 32 n = 32 n = 32
80
m = 112
m = 32 m = 32 m = 32
min_weight = 4
min_weight = 5 min_weight = 5 min_weight = 5
min_rank ≥ 106
min_rank ≥ 30 min_rank ≥ 30 min_rank ≥ 30
K.3 K.5 K.8 K.12
Binary field GF(2) Binary field GF(2) Binary field Binary field
4 4
GF(2 ) GF(2 )
n = 120 n = 128
n = 48 n = 64
112
m = 112 m = 128
m = 48 m = 64
min_weight = 4 min_weight = 4
min_weight = 5 min_weight = 5
min_rank ≥ 114 min_rank ≥ 122
min_rank ≥ 44 min_rank ≥ 60
K.6 K.9 K.13
Same as K.5 Binary field Same as K.12
3
GF(2 )
n = 64
128
m = 64
min_weight = 5
min_rank ≥ 60
K.10 K.14
Binary field GF(2) Binary field
2
GF(2 )
n = 200
n = 128
192
m = 192
m = 128
min_weight = 4
min_weight = 5
min_rank ≥ 192
min_rank ≥ 124
K.15
Binary field GF(2)
n = 272
256
m = 256
min_weight = 4
min_rank ≥ 264
K.2  Example case for requested_strength = 80 and block_length = 112
2 © ISO 2017 – All rights reserved

---------------------- Page: 5 ----------------------
ISO/IEC 18031:2011/Amd.1:2017(E)

K.2.1  System of multivariate quadratic equations
The bitstring P containing the system coefficients is provided in digital form in the file “coefficients-BL-
112-Sec-80-F2.bin” in accordance with the format described in K.1.3.
The file contains 177212 bytes and its SHA-1 checksum in hexadecimal form is
95d78546df132777af932886a887da96aa9afa46
The ranks are distributed as follows:
106: 4561
108: 2213145
110: 58156950
112: 43613144
Sum: 103987800
K.2.2  Inputs and outputs
The bitstrings x, y and z are provided in digital form in accordance with the format described in K.1.4.
Their hexadecimal values are:
x = 0000000000000000000000000001
y = bb8cf180cbc3a6002c19c770ed0d
z = 7847b864cfadf70fb359203e06d8
x = bb8cf180cbc3a6002c19c770ed0d
y = a1e0811b5b7733113ca8e22dd2b1
z = 57d27f7b0fc67aec0d5e8115cd93
x = a1e0811b5b7733113ca8e22dd2b1
y = 634ae5294dbc4cc79ce11cfeb1d7
z = c42c5cc5b5b61396df3fcf7a4e2b
x = 634ae5294dbc4cc79ce11cfeb1d7
y = 36701faea23130a0407a44f5e420
z = bf3ddd3cbb141fcd96cbba66ebb9
x = 36701faea23130a0407a44f5e420
y = 74b5baa1095f61eb6b15d317d5ed
© ISO 2017 – All rights reserved 3

---------------------- Page: 6 ----------------------
ISO/IEC 18031:2011/Amd.1:2017(E)

z = 7f4ad5787a0c5451bddcf2aef533
x = 74b5baa1095f61eb6b15d317d5ed
y = 62804addbe9da290c38e9de0fe71
z = 5f1f209b62cce21f75d9d03607a9
x = 62804addbe9da290c38e9de0fe71
y = 7d0892da52eed7facc377af1918f
z = 69d5bef53c03fa33a0273cf44c21
x = 7d0892da52eed7facc377af1918f
y = 8ee43a16842345d4cd182852cdea
z = ed479a677e6c2a3cffbbada0e765
x = 8ee43a16842345d4cd182852cdea
y = 2eb8cc9185445b2bab3f4b504aaf
z = 9407f0fe9393fa335051ac2bf414
x = 2eb8cc9185445b2bab3f4b504aaf
y = 8deb10cb70bc3818209a576fb5cb
z = 6106cb8aa8e9a7de949a506b2278
K.3  Example case for requested_strength = 112 and block_length = 112
K.3.1  System of multivariate quadratic equations
The bitstring P containing the system coefficients is provided in digital form in the file “coefficients-BL-
112-Sec-112-F2.bin” in accordance with the format described in K.1.3.
The file contains 210569 bytes and its SHA-1 checksum in hexadecimal form is
ae1c4ea33afc96e3aa421f6456055a7c7ee33989
The ranks are distributed as follows:
114: 5239
116: 2551294
118: 66936700
120: 50200265
4 © ISO 2017 – All rights reserved

---------------------- Page: 7 ----------------------
ISO/IEC 18031:2011/Amd.1:2017(E)

Sum: 119693498
K.3.2  Inputs and outputs
The bitstrings x, y and z are provided in digital form in accordance with the format described in K.1.4.
Their hexadecimal values are:
x = 000000000000000000000000000001
y = 46609cda28057a917a08b60a1d969d
z = a06fe3e456a8c24315dfde6088bd
x = 46609cda28057a917a08b60a1d969d
y = 37d12de7b69f2170ba8717e96f0f43
z = 8fb9899c9e2d4ef33056aadf946d
x = 37d12de7b69f2170ba8717e96f0f43
y = 463860297cec60797650c4897563d4
z = 89745528548d7bd3a2c9e5afd3fc
x = 463860297cec60797650c4897563d4
y = 6a4c5b16c156738e9b07c4c2c2818e
z = 5f9f14194e601f48657164f34e34
x = 6a4c5b16c156738e9b07c4c2c2818e
y = 289c50a28bb48a685703eb425597dd
z = c9dae7a3c32a01648a32d91b8728
x = 289c50a28bb48a685703eb425597dd
y = 4d96224af4aeaac54d8472374f645d
z = cf7a6cc73793049241497ee26603
x = 4d96224af4aeaac54d8472374f645d
y = df5ac81223125d967056d5dcdba088
z = 3d9741ec702076fe8473b7181aa9
x = df5ac81223125d967056d5dcdba088
© ISO 2017 – All rights reserved 5

---------------------- Page: 8 ----------------------
ISO/IEC 18031:2011/Amd.1:2017(E)

y = 41a1df8cc57c402f520d671464b728
z = 285d6b741e417e417b9f8fa87356
x = 41a1df8cc57c402f520d671464b728
y = 0af3539a48bc07e3afb00d3c529ff5
z = e6d4d36dcc2cca4826b94e76be10
x = 0af3539a48bc07e3afb00d3c529ff5
y = e2f7d8f01d2ae145a643b9351ada76
z = 29bdd54840cf84027f20e48ce195
K.4  Example case for requested_strength = 80 and block_length = 128
K.4.1  System of multivariate quadratic equations
The bitstring P containing the system coefficients is provided in digital form in the file “coefficients-BL-
128-Sec-80-F16.bin” in accordance with the format described in K.1.3.
The file contains 17952 bytes and its SHA-1 checksum in hexadecimal form is
d6614e19bd953ca88ff49f016b80f5ac17b7dab1
The ranks are distributed as follows:
30: 520948
32: 7782684
Sum: 8303632
K.4.2  Inputs and outputs
The bitstrings x, y and z are provided in digital form in accordance with the format described in K.1.4.
Their hexadecimal values are:
x = 00000000000000000000000000000001
y = f719e81ed992ca7c793258b5251d0534
z = 66092272f74a85ecaef639d78ed9831f
x = f719e81ed992ca7c793258b5251d0534
y = 37614b89b9bbd6eea4560ecb3bdb8807
z = 96b4c1aeb27aa47fbc7a3b1464343736
6 © ISO 2017 – All rights reserved

---------------------- Page: 9 ----------------------
ISO/IEC 18031:2011/Amd.1:2017(E)

x = 37614b89b9bbd6eea4560ecb3bdb8807
y = 136bf7d8fbcbabd37a2baa321a5d94f7
z = 29141359d8099496eaf84ae3d863591a
x = 136bf7d8fbcbabd37a2baa321a5d94f7
y = bc6316205ac244b4fc8dcee70f423874
z = d8005ccefa012118820cf02c9eb4328d
x = bc6316205ac244b4fc8dcee70f423874
y = 64d8adbf03a6418fa549f235e5f84bcd
z = 9c0aad312ef00336d0f055e81f2b3677
x = 64d8adbf03a6418fa549f235e5f84bcd
y = 3ac1c733b68ca734550343d950649d5a
z = 1f07210c4a6d4fd784ee0f9f9789c5ab
x = 3ac1c733b68ca734550343d950649d5a
y = 1a22cbbe771e641373700306718dbf6e
z = ba8064102a7e8d714e92e0dfddfbe607
x = 1a22cbbe771e641373700306718dbf6e
y = fa2eabf2c9794f6b9bac6561409aab0d
z = 7e2bae34daaf284557bbe5ae48e54d26
x = fa2eabf2c9794f6b9bac6561409aab0d
y = 46f6f74d23504a64565b2c35cd0036df
z = c6285e77cbf16150457d03bfc6015ef7
x = 46f6f74d23504a64565b2c35cd0036df
y = 729bc30c32fd7fec1ccb95bc4aabfa27
z = 963bda8ab7dc84ee2dd5a60a9c4392cd
K.5  Example case for requested_strength = 112 and block_length = 128
© ISO 2017 – All rights reserved 7

---------------------- Page: 10 ----------------------
ISO/IEC 18031:2011/Amd.1:2017(E)

K.5.1  System of multivariate quadratic equations
The bitstring P containing the system coefficients is provided in digital form in the file “coefficients-BL-
128-Sec-112-F2.bin” in accordance with the format described in K.1.3.
The file contains 264224 bytes and its SHA-1 checksum in hexadecimal form is
fcd983e78ddd489a9425be58b8139e04c89fb6c6
The ranks are distributed as follows:
122: 7704
124: 3783524
126: 99303857
128: 74493971
Sum: 177589056
K.5.2  Inputs and outputs
The bitstrings x, y and z are provided in digital form in accordance with the format described in K.1.4.
Their hexadecimal values are:
x = 00000000000000000000000000000001
y = c04f664eb59219b1e6b0d0e0fc5ae660
z = 894f5e21cc208ce73ebb136c0c7b6e47
x = c04f664eb59219b1e6b0d0e0fc5ae660
y = 10da311bd87ba42fd89a17f45b0b0931
z = f3561e3a42a23037d04b7991e44f98d0
x = 10da311bd87ba42fd89a17f45b0b0931
y = c42c14916632d8518f435796c069a381
z = 461593a9b73573772cf8f8a93020eada
x = c42c14916632d8518f435796c069a381
y = 325ebb605c4037b6092a7952adedd16d
z = 3f80f69b2f81f012994189125cba6b00
x = 325ebb605c4037b6092a7952adedd16d
y = 596cdd4392413988fa7a15fa7fb5d74b
8 © ISO 2017 – All rights reserved

---------------------- Page: 11 ----------------------
ISO/IEC 18031:2011/Amd.1:2017(E)

z = 8ec0f223da49f826f6faf8d25b54b231
x = 596cdd4392413988fa7a15fa7fb5d74b
y = 17790ac47b8112312631c0e3b0066fd0
z = 8d98258ade35f74057a98542c0d7d937
x = 17790ac47b8112312631c0e3b0066fd0
y = d76a00f9e3318091e0f113b48f0cb752
z = 8b9664e30122848541b91743171b4812
x = d76a00f9e3318091e0f113b48f0cb752
y = 4ffffdf6def93bb391d90312a801ece5
z = d17acb75d2f57976df164061716601e0
x = 4ffffdf6def93bb391d90312a801ece5
y = 89b596d08123105f5994679f5e428136
z = 1de72c77e98fa45090197c81e4d2a3a3
x = 89b596d08123105f5994679f5e428136
y = 7294da76d6d2bf9dfb9d2c1d03ca4928
z = 96cea7ffad3bc8be151106cd4c067565
K.6  Example case for requested_strength = 128 and block_length = 128
The example case is the same as in K.5.
K.7  Example case for requested_strength = 80 and block_length = 192
K.7.1  System of multivariate quadratic equations
The bitstring P containing the system coefficients is provided in digital form in the file “coefficients-BL-
192-Sec-80-F64.bin” in accordance with the format described in K.1.3.
The file contains 26928 bytes and its SHA-1 checksum in hexadecimal form is
dad206d21189e0b9aaa5bb60298e0cf3f918ae81
The ranks are distributed as follows:
30: 129895
© ISO 2017 – All rights reserved 9

---------------------- Page: 12 ----------------------
ISO/IEC 18031:2011/Amd.1:2017(E)

32: 8173737
Sum: 8303632
K.7.2  Inputs and outputs
The bitstrings x, y and z are provided in digital form in accordance with the format described in K.1.4.
Their hexadecimal values are:
x = 000000000000000000000000000000000000000000000001
y = 9b021d45d52d7637ca3350732d880265bc826a1a7e9969b4
z = f5df581e7eb83f86d7f1101b248b4740662733897f4b4689
x = 9b021d45d52d7637ca3350732d880265bc826a1a7e9969b4
y = 937625307ba580d0763a6272e3ba7d9256536795a0017b7c
z = 338d582a1b8c37812aed0f07f2958101f11ac11ee962a02a
x = 937625307ba580d0763a6272e3ba7d9256536795a0017b7c
y = d9d32553f1299fcd1444030c23f084d1c85fd08a2ef5275b
z = 9bb8f5de5ff6c6aba79ae510429221a6dc3b0ab7ef1b27ca
x = d9d32553f1299fcd1444030c23f084d1c85fd08a2ef5275b
y = 329800d2a8f045893d24c54d6993e67e0e2c34b2956ee269
z = 0a01d2046afc3adbd68e024f1205ca00cee736e53c7aaabe
x = 329800d2a8f045893d24c54d6993e67e0e2c34b2956ee269
y = 723a5476da2e4617f9418545014266ac7179f591451952e9
z = 5cf9cfeefb0d0ebf2985a4cc8e66c7ba0fcf332971a4ebad
x = 723a5476da2e4617f9418545014266ac7179f591451952e9
y = 67786dd966efde83df99af5f6059f4c3f07f84fe5ae1d656
z = f68fa0ae09b71a71f780550280204bb9430318733649ea3d
x = 67786dd966efde83df99af5f6059f4c3f07f84fe5ae1d656
y = 03ecc9b12c99215531b56f5a99e5407d5c343ac6b7793c54
z = 34a9a04510415ad411fc14f8046f6538e4df891b1744462d
10 © ISO 2017 – All rights reserved

---------------------- Page: 13 ----------------------
ISO/IEC 18031:2011/Amd.1:2017(E)

x = 03ecc9b12c99215531b56f5a99e5407d5c343ac6b7793c54
y = 8bf2fd718e72802e62209a681399d08f609142e3745c5af0
z = 18f2e2af78854c66b7aaffc9ece76c981e4080ebb1bafa89
x = 8bf2fd718e72802e62209a681399d08f609142e3745c5af0
y = e2424fdcdfd6bc8e02ff7a4bc445190945e7292af2aa8926
z = e2f2ee9d272702f367f73456604eb633c01bdeadacc2d6ef
x = e2424fdcdfd6bc8e02ff7a4bc445190945e7292af2aa8926
y = d94f6dc6299ae4069f06333edb94335e4553b4e20cfe9896
z = 1acb06c4e696cc73520197e331aad76185d6d246f2115d32
K.8  Example case for requested_strength = 112 and block_length = 192
K.8.1  System of multivariate quadratic equations
The bitstring P containing the system coefficients is provided in digital form in the file “coefficients-BL-
192-Sec-112-F16.bin” in accordance with the format described in K.1.3.
The file contains 58800 bytes and its SHA-1 checksum in hexadecimal form is
151f9a4c9b32f6e9236ae071408bbba39b597585
The ranks are distributed as follows:
44: 2
46: 4054618
48: 60538940
Sum: 64593560
K.8.2  Inputs and outputs
The bitstrings x, y and z are provided in digital form in accordance with the format described in K.1.4.
Their hexadecimal values are:
x = 000000000000000000000000000000000000000000000001
y = 4bc49157a1cfc4e81a00e38073c3c330716846f262fd6bd8
z = 9f9c37ccbf0351e173402c9778721e07b7f92e7ad9c13a0c
x = 4bc4
...