Take the 2-minute tour ×

I have implemented the Fortuna random number generator as described in chapter 10 of "Practical Cryptography" (Ferguson and Schneier, Wiley, 2003), the result can be found at http://www.seehuhn.de/pages/fortuna .

My question: How can I test my implementation? Or more specifically:

  • Are there any known-correct test vectors for the Fortuna generator available?
  • Are there automated tests for the cryptographic properties of the output? (I know how to test the statistical properties of the output, but I don't know how to test the cryptographic properties.)
  • Any other testing methodologies I should consider?
share|improve this question
Take a look at Fourmilab, it seems to have what you need. –  rath Jul 24 '13 at 12:19
@rath, thanks for your suggestion. I have tried the tool from Fourmilab, and my generator passes without problems; results are now on my Fortuna web page. Slightly worryingly, the tests still pass when I deliberately break my code by disabling the rekeying (which is prescribed to happen after every megabyte of output). –  jochen Jul 24 '13 at 13:39
Although not the best thing to ask for (because results are completly dependant on 'ent' and this is getting too localized) could you also post the results of the control data? –  rath Jul 24 '13 at 14:18
@rath, I am not quite sure what you mean by "control data". Assuming you mean the output of ent for the generator without rekeying, I've put this up at gist.github.com/seehuhn/6071391 now. –  jochen Jul 24 '13 at 15:03
Related: how-to-prove-the-security-of-the-prng –  figlesquidge Dec 3 '13 at 10:46

2 Answers 2

up vote 2 down vote accepted

Robert Brown of Duke University has an excellent test suite called "Dieharder". Supposedly this is the most stringent battery of PRG tests available. I have never used it but it will be worth your while to check it out.

share|improve this answer
The answer wasn't quite what I had hoped for (the tests are mostly for the statistical properties of the output), but this being the only answer it's clearly also the best answer, so I have accepted it now :) –  jochen Aug 27 '13 at 22:30
@jochen: If you want to test the cryptographic properties you have to see if anyone can "break the generator" by using the output bits to find the secret key. –  William Hird Aug 27 '13 at 22:59

Perhaps obvious, but couldn't you download other implementations, design a test set of your own, and run it through multiple implementations to verify the same results?

There are these implementations:

If system entropy is an issue, you might be able to tweak all implementations to fudge the updates to be equal.

share|improve this answer
That's what I did in the end: the test vectors at seehuhn.de/pages/fortuna#sec:4.1.0 are generated using the Python Cryptography Toolkit and I managed to make the output of my implementation match with this. Many implementations are subtly different from Schneier's version (e.g. using a different number of entropy buffers), so I didn't get agreement with any other implementations. –  jochen Dec 3 '13 at 19:12

Your Answer


