Deterministic Random Bit Generator (DRBG)

Updated Aug 1, 2026

A deterministic random bit generator (DRBG) is another name for a pseudorandom number generator (PRNG). It is an algorithm that produces a sequence of bits that appears random but is generated entirely from a fixed starting value, called a seed, using a deterministic formula. Given the same seed, a DRBG always produces the same output.

Key facts

  • DRBG and PRNG describe the same category of algorithm. NIST's official standard governing these algorithms, Special Publication 800-90A, uses the term "deterministic random bit generator," while PRNG is the more common term in general cryptography and software engineering.

  • A DRBG does not create randomness. It stretches a smaller amount of true randomness, its seed, into a much longer sequence of bits through a fixed algorithm. The quality of a DRBG's output depends entirely on the quality and unpredictability of that seed.

  • A DRBG's seed is drawn from entropy: randomness collected from an unpredictable source, such as a hardware noise generator or system-level entropy pool. Without sufficient entropy at the seeding stage, a DRBG produces predictable, insecure output no matter how strong its internal algorithm is.

  • Common DRBG constructions standardized by NIST include Hash-DRBG, HMAC-DRBG, and CTR-DRBG, each built around a different cryptographic primitive (a hash function, a keyed-hash function, or a block cipher in counter mode).

  • Not every DRBG design has held up under scrutiny. Dual_EC_DRBG was a NIST-standardized DRBG later shown to likely contain a backdoor, and it was withdrawn from the standard in 2014. This is a documented case where a flawed DRBG threatened the security of every system that relied on it.

  • Wallet software that generates a seed phrase relies on this same chain: entropy feeds a DRBG-class algorithm, which produces the random number that BIP39 then converts into a word sequence. Hardware wallets reduce this dependency by generating keys with a true random number generator (TRNG) inside a dedicated secure chip rather than a general-purpose DRBG. Tangem's private key is generated this way, directly on the secure element, with BIP39 phrases available only as an optional feature.

See also

Entropy · Private Key · Seed Phrase · BIP39