1、 American National Standard for Financial Services ANSI X9.82: Part 22015 Random Number Generation Part 2: Entropy Sources Accredited Standards Committee X9, Incorporated Financial Industry Standards Date Approved: September 25, 2015 American National Standards Institute American National Standards,
2、 Technical Reports and Guides developed through Accredited Standards Committee X9, Inc. are copyrighted. Copying these documents for personal or commercial use outside X9 membership agreements is prohibited without express written permission of the Accredited Standards Committee X9, Inc. For additio
3、nal information, please contact ASC X9, Inc., 275 West Street, Suite 107, Annapolis, Maryland 21401.ANSI X9.82-2-2015 2015 ASC X9, Inc. All rights reserved 2 Table of Contents Table of Contents 2 Foreword . 4 Introduction . 6 1 Scope . 14 2 Conformance . 14 3 Normative References . 14 4 Terms and De
4、finitions. 16 5 Symbols and Abbreviated Terms 23 6 General Discussion . 24 6.1 Summary . 24 6.2 Motivational Examples . 24 6.3 Entropy Estimation and Validation . 27 6.4 The Entropy Source 27 6.4.1 Entropy Source Model 27 6.4.2 Noise Source . 28 6.4.3 Conditioning Component 29 6.4.4 Health Tests 30
5、6.4.5 Security Boundaries 30 6.5 Conceptual Interfaces 31 6.5.1 GetEntropy: An Interface to the Entropy Source 31 6.5.2 GetNoise: An Interface to the Noise Source . 31 6.5.3 Health Test: An Interface to the Entropy Source 32 7 Entropy 32 7.1 What is Entropy, and How is it Measured? 32 7.2 A Simple E
6、xample 33 7.2.1 Description 33 7.2.2 The Noise Source 33 7.2.3 The Conditioning Component. 34 7.2.4 The Health Tests . 35 8 Entropy Source Development Requirements 37 8.1 Requirement Discussion . 37 ANSI X9.82-2-2015 2015 ASC X9, Inc. All rights reserved 3 8.2 Entropy Source Requirements 37 8.3 Nois
7、e Source Requirements 38 8.4 Conditioning Component Requirements. 39 8.5 Health Test Requirements . 39 8.5.1 General Discussion . 39 8.5.2 Health Tests on the Noise Source . 39 8.5.3 Health Tests on the Conditioning Component 49 9 Entropy Source Examples . 50 9.1 Overview . 50 9.2 Ring Oscillator Ex
8、ample . 50 9.2.1 Introduction . 50 9.2.2 Entropy Source Components 52 9.2.3 Entropy Estimation . 54 9.2.4 Implementation Issues 55 Annex A: Conditioning Using Von Neumann Unbiasing 56 Annex B: References 57 ANSI X9.82-2-2015 2015 ASC X9, Inc. All rights reserved 4 Foreword The Accredited Standards C
9、ommittee (ASC) on Financial Services (ANSI X9) has developed several cryptographic standards to protect financial information. Many of these standards require the use of Random Number Generators to generate random and unpredictable cryptographic keys and other critical security parameters. This Stan
10、dard, Random Number Generation, defines techniques for the generation of random numbers that are used when other ASC standards require the use of random numbers for cryptographic purposes. While the techniques specified in this Standard are designed to generate random numbers, the Standard does not
11、guarantee that a particular implementation is secure. It is the responsibility of the financial institution to put an overall process in place with the necessary controls to ensure that the process is securely implemented. Furthermore, the controls should include the application of appropriate valid
12、ation tests in order to verify compliance with this Standard. Approval of an American National Standard requires verification by ASC that the requirements for due process, consensus, and other criteria for approval have been met by the standards developer. Consensus is established when, in the judgm
13、ent of the ASC Board of Standards Review, substantial agreement has been reached by directly and materially affected interests. Substantial agreement means much more than a simple majority, but not necessarily unanimity. Consensus requires that all views and objections be considered, and that a conc
14、erted effort be made toward their resolution. The use of American National Standards is completely voluntary; their existence does not in any respect preclude anyone, whether he has approved the standards or not from manufacturing, marketing, purchasing, or using products, processes, or procedures n
15、ot conforming to the standards. The American National Standards Institute does not develop standards and will in no circumstances give an interpretation of any American National Standard. Moreover, no person shall have the right or authority to issue an interpretation of an American National Standar
16、d in the name of the American National Standards Institute. Requests for interpretations should be addressed to the secretariat or sponsor whose name appears on the title page of this Standard. CAUTION NOTICE: This American National Standard may be revised or withdrawn at any time. The procedures of
17、 the American National Standards Institute require that action be taken to reaffirm, revise, or withdraw this Standard no later than five years from the date of approval. ANSI X9.82-2-2015 2015 ASC X9, Inc. All rights reserved 5 Published by Accredited Standards Committee X9 Incorporated Financial I
18、ndustry standards 275 West Street, Suite 107 Annapolis, MD 21401 USA X9 Online http:/www.x9.org Copyright 2015 ASC X9, Inc. All rights reserved. No part of this publication may be reproduced in any form, in an electronic retrieval system or otherwise, without prior written permission of the publishe
19、r. Published in the United States of America. ANSI X9.82-2-2015 2015 ASC X9, Inc. All rights reserved 6 Introduction NOTE The users attention is called to the possibility that compliance with this Standard may require use of an invention covered by patent rights. By publication of this Standard, no
20、position is taken with respect to the validity of this claim or of any patent rights in connection therewith. The patent holder has, however, filed a statement of willingness to grant a license under these rights on reasonable and nondiscriminatory terms and conditions to applicants desiring to obta
21、in such a license. Details may be obtained from the standards developer. Suggestions for the improvement or revision of this Standard are welcome. They should be sent to the X9 Committee Secretariat, Accredited Standards Committee X9, Inc., Financial Industry Standards, 275 West Street, Suite 107, A
22、nnapolis, MD 21401 USA. This Standard was processed and approved for submittal to ANSI by the Accredited Standards Committee on Financial Services, X9. Committee approval of the Standard does not necessarily imply that all the committee members voted for its approval. The X9 committee had the follow
23、ing members: Roy DeCicco, X9 Chairman Claudia Swendseid, X9 Vice-Chairman Steve Stevens, Executive Director Janet Busch, Program Manager Organization Represented Representative ACI Worldwide Doug Grote ACI Worldwide Dan Kinney American Bankers Association Diane Poole American Express Company David M
24、oore Bank of America Daniel Welch Blackhawk Network.Anthony Redondo Bloomberg LP Corby Dear Capital One Marie LaQuerre Citigroup, Inc. Karla McKenna CLS Bank .Ram Komarraju Conexxus, Inc. .Michael Davis Conexxus, Inc. .Gray Taylor Delap LLP Darlene Kargel Deluxe Corporation Angela Hendershott Diebol
25、d Nixdorf .Bruce Chapa Discover Financial Services .Michelle Zhang eCurrency .David Wen Federal Reserve Bank Mary Hughes Federal Reserve Bank Janet LaFrence First Data Corporation .Andrea Beatty FIS Stephen Gibson-Saxty FiservDan Otten ANSI X9.82-2-2015 2015 ASC X9, Inc. All rights reserved 7 FIX Pr
26、otocol Ltd - FPL Jim Northey Futurex .Ryan Smith GilbarcoBruce Welch Harland Clarke .John McCleary Hewlett Packard .Susan Langford IBM Corporation Todd Arnold Independent Community Bankers of America Cary Whaley IngenicoRob Martin ISITCJason Brasile J.P. Morgan Chase .Roy DeCicco KPMG LLP Mark Lundi
27、n MagTek, Inc. Roger Applewhite MagTek, Inc. Mimi Hart MasterCard Europe Sprl Mark Kamers NACHA The Electronic Payments Association Priscilla Holland National Security Agency Paul Timmel Nautilus Hyosung.Joe Militello NCR Corporation .David Norris Office of Financial Research, U.S. Treasury Departme
28、nt .Justin Stekervetz PCI Security Standards Council.Troy Leach RouteOne .Chris Irving RouteOne .Jenna Wolfe SWIFT/Pan Americas Frank Vandriessche Symcor Inc. Debbi Fitzpatrick TECSEC Incorporated .Ed Scheidt The Clearing House .Sharon Jablon U.S. Bank .John King U.S. Commodity Futures Trading Commi
29、ssion (CFTC) .Robert Stowsky USDA Food and Nutrition Service Kathy Ottobre Vantiv LLC Gary Zempich VeriFone, Inc. Dave Faoro VISA Kim Wagner Wayne Fueling Systems .Steven Bowles Wells Fargo Bank Mark Schaffer The X9F subcommittee on Data and Information Security had the following members: Ed Scheidt
30、, Chairman Organization Represented Representative ACI Worldwide Doug Grote ACI Worldwide Dan Kinney ACI Worldwide Julie Samson American Bankers Association Tom Judd American Express Company Farid Hatefi American Express Company John Timar American Express Company Kevin Welsh Bank of America Amanda
31、Adams ANSI X9.82-2-2015 2015 ASC X9, Inc. All rights reserved 8 Bank of America Peter Capraro Bank of America Andi Coleman Bank of America Lawrence LaBella Bank of America Will Robinson Bank of America Michael Smith Bank of America Daniel Welch BlackBerry Limited .Daniel Brown BlackBerry Limited .Sa
32、ndra Lambert Blackhawk Network.Vijay Bolina Blackhawk Network.Anthony Redondo Bloomberg LP Erik Anderson Bloomberg LP Corby Dear Capital One Marie LaQuerre Capital One Johnny Lee Cipherithm .Scott Spiker comForte 21 GmbH .Thomas Gloerfeld comForte 21 GmbH .Henning Horst Communications Security Estab
33、lishment Jonathan Hammell Communications Security Establishment David Smith Conexxus, Inc. .Alan Thiemann CUSIP Service Bureau .Scott Preiss Delap LLP David Buchanan Delap LLP Darlene Kargel Deluxe Corporation Angela Hendershott Deluxe Corporation Margiore Romay Deluxe Corporation Andy Vo Diebold Ni
34、xdorf .Christoph Bruecher Diebold Nixdorf .Andrea Carozzi Diebold Nixdorf .Bruce Chapa Diebold Nixdorf .Michael Nolte Diebold Nixdorf .Michael Ott Diebold Nixdorf .Dave Phister Discover Financial Services .Cheryl Mish Discover Financial Services .Diana Pauliks Discover Financial Services .Jordan Sch
35、aefer eCurrency .David Wen Federal Reserve Bank Patrick Adler Federal Reserve Bank Guy Berg Federal Reserve Bank Marianne Crowe Federal Reserve Bank Amanda Dorphy Federal Reserve Bank Mary Hughes Federal Reserve Bank Heather Hultquist Federal Reserve Bank Janet LaFrence Federal Reserve Bank Susan Pa
36、ndy Federal Reserve Bank Patti Ritter Federal Reserve Bank Daniel Rozycki ANSI X9.82-2-2015 2015 ASC X9, Inc. All rights reserved 9 First Data Corporation .Andrea Beatty First Data Corporation .Lisa Curry First National Bank of Omaha .Kristi White FIS Chelsea Lopez FIS John Soares FIS Sunny Wear Fis
37、ervBud Beattie FiservDan Otten Futurex .Ryan Smith GEOBRIDGE Corporation Donna Gem GEOBRIDGE Corporation Jason Way GilbarcoScott Turner GilbarcoBruce Welch Harland Clarke .Joseph Filer Heartland Payment Systems Scott Meeker Hewlett Packard .Susan Langford Hewlett Packard .Luther Martin Hewlett Packa
38、rd .Terence Spies IBM Corporation Todd Arnold Independent Community Bankers of America Cary Whaley IngenicoRob Martin ITS, Inc. (SHAZAM Networks) Manish Nathwani J.P. Morgan Chase .Bruce Geller J.P. Morgan Chase .Kathleen Krupa J.P. Morgan Chase .Jackie Pagn J.P. Morgan Chase .Darryl Scott K3DES LLC
39、.Azie Amini KPMG LLP Mark Lundin MagTek, Inc. Jeff Duncan MagTek, Inc. Mimi Hart MasterCard Europe Sprl Mark Kamers MasterCard Europe Sprl Joshua Knopp MasterCard Europe Sprl Larry Newell MasterCard Europe Sprl Adam Sommer MasterCard Europe Sprl Michael Ward National Institute of Standards and Techn
40、ology (NIST) .Elaine Barker National Institute of Standards and Technology (NIST) .Lily Chen National Security Agency Mike Boyle National Security Agency Paul Timmel Nautilus Hyosung.Joe Militello Nautilus Hyosung.Jay Shin NCR Corporation .Tanika Eng NCR Corporation .Charlie Harrow NCR Corporation .
41、David Norris PCI Security Standards Council.Leon Fell PCI Security Standards Council.Troy Leach ANSI X9.82-2-2015 2015 ASC X9, Inc. All rights reserved 10 PCI Security Standards Council.Ralph Poore RSA, The Security Division of EMC Steve Schmalz SafeNet, IncAmit Sinha Security Innovation Mark Etzel
42、Security Innovation William Whyte Security Innovation Lee Wilson Security Innovation Zhenfei Zhang TECSEC Incorporated .Ed Scheidt TECSEC Incorporated .Dr. Wai Tsang TECSEC Incorporated .Jay Wack Thales UK Limited Larry Hines Thales UK Limited James Torjussen The Clearing House .Henry Farrar Trustwa
43、ve .John Amaral Trustwave .Tim Hollebeek U.S. Bank .Stephen Case U.S. Bank .Peter Skirvin Vantiv LLC Jeffrey Singleton Vantiv LLC Bill Weingart Vantiv LLC Gary Zempich Vantiv LLC James Zerfas VeriFone, Inc. John Barrowman VeriFone, Inc. David Ezell VeriFone, Inc. Dave Faoro VeriFone, Inc. Doug Manch
44、ester VeriFone, Inc. Brad McGuinness VeriFone, Inc. Joachim Vance VISA Shahzad Khan VISA Kim Wagner Wayne Fueling Systems .Steven Bowles Wells Fargo Bank William Felts, IV Wells Fargo Bank Phillip Griffin Wells Fargo Bank Jan Kohl Wells Fargo Bank Garrett Macey Wells Fargo Bank Kelly ODonnell Wells
45、Fargo Bank Mark Schaffer Wells Fargo Bank Jeff Stapleton XYPRO Technology Steve Tcherchian Under ASC X9 procedures, a working group may be established to address specific segments of work under the ASC X9 Committee or one of its subcommittees. A working group exists only to develop standard(s) or gu
46、ideline(s) in a specific area and is then disbanded. The individual experts are listed with their affiliated organizations. However, this does not imply that the organization has approved the content of the standard or guideline. (Note: Per X9 policy, company names of non-member participants are lis
47、ted only if, at time of publication, the X9 ANSI X9.82-2-2015 2015 ASC X9, Inc. All rights reserved 11 Secretariat received an original signed release permitting such company names to appear in print.) The X9F1 Cryptographic Tool Standards and Guidelines group that developed this part of the Standar
48、d had the following members: Terence Spies, Chairman Mary Baish, Michael Boyle, John Kelsey, Project Editor Organization Represented Representative American Bankers Association Tom Judd American Express Company Jonathan Gwynn Bank of America Amanda Adams Bank of America Peter Capraro Bank of America
49、 Andi Coleman Bank of America Lawrence LaBella Bank of America Daniel Welch BlackBerry Limited .Daniel Brown BlackBerry Limited .John O. Goyo BlackBerry Limited .Sandra Lambert Capital One Johnny Lee Cipherithm .Scott Spiker comForte 21 GmbH .Henning Horst Communications Security Establishment Jonathan Hammell Communications Security Establishment David Smith Delap LLP Darlene Kargel Diebold Nixdorf .Christoph Bruecher Diebold Nixdorf .Rick Brunt Diebold Nixdorf .Andrea Carozzi Diebold Nixdorf .Bruce Chapa Diebold Nixdorf .Scott Harroff Diebold Ni
