Black Box Statistical Testing of Key Generation Algorithms

Abstract

Key generation for cryptographic algorithms is critical to the security of these algorithms. Weak sources of entropy can damage the security of generated keys, but even with a good source of entropy and a good key generation algorithm, errors in the implementation can compromise overall security. In the current work, we consider how to evaluate the robustness of the implementation of a key generation algorithm (and thus to some extent of the algorithm itself) to ensure that it is suitable for use. We consider the desirable properties of the generated keys and how to conduct a statistical test to validate that those properties are satisfied by the implementation. We then consider two key generation algorithms and apply statistical tests to those. The result is a test suite that can be applied to key generation algorithms before shipping code or after making changes to the code.