Tempest v3 PRNG via register_prng() - complete ltc_prng_descriptor implementation

[paim-creater]

Proposal: Tempest v3 PRNG for LibTomCrypt

Discussion issue — not a PR. I'd like to gauge interest before investing in a full pull request.

Summary

Tempest v3 is a cryptographic-grade CSPRNG (17.7 Gbit/s, 2^128 ZFC-provable security) with a 48-byte state and no external dependencies — well-suited for LibTomCrypt's embedded use cases. A complete ltc_prng_descriptor implementing all 9 callbacks is ready.

Key Characteristics

Metric	Tempest v3	Fortuna	Yarrow
Throughput (scalar)	17.7 Gbit/s	~2 Gbit/s	~1.5 Gbit/s
Throughput (AVX-512)	65.4 Gbit/s	—	—
State size	48 bytes	~5 KB	~1 KB
Security paradigm	ZFC-provable DP bound	heuristic	heuristic
Code size	~200 lines C	~800 lines	~600 lines

Integration

Uses register_prng() / ltc_prng_descriptor:

#include "tempest_prng.h"

int prng_idx = register_prng(&tempest_prng_desc);
if (prng_idx == -1) { /* handle error */ }

// Use with any libtomcrypt function
unsigned char key[32];
prng_descriptor[prng_idx].read(key, sizeof(key), NULL);

Full implementation: https://github.com/paim-creater/prng/tree/main/libtomcrypt_tempest

Callback Implementation

Callback	Implementation
start	Allocates marker
add_entropy	No-op (CSPRNG; optional entropy mixing)
ready	Seeds from OS entropy via os_get_random()
read	Generates via tempest_bytes()
done	Secure zeroing
export	Exports marker + 48-byte state
import	Restores marker + state
test	Known-answer test (determinism + non-zero)

Security

Tempest v3's 2^128 security is mathematically proven within ZFC set theory:

• Differential: DP^(1) ≤ 2^(-256), proven via wide trail (a₁ ≥ 4 structural) + AND-mix cascade (DP ≤ 2^(-64) proven)
• Algebraic: deg ≥ 256 after 2 rounds (XL complexity ≥ 2^597)
• Decorrelation: Weyl sequence per-round (proven-unique round functions)

Questions

1. Would LibTomCrypt be interested in Tempest v3 as an additional PRNG option?
2. Any concerns about the security proof methodology (self-contained, not community-vetted)?
3. Preferred integration: direct PRNG table entry or contributed example?

Reference

• Project & full test results: https://github.com/paim-creater/prng
• Design & security analysis: https://github.com/paim-creater/prng/blob/main/DESIGN.md
• NIST SP 800-90A DRBG: 12/12 tests PASS

[sjaeckel]

Sounds very interesting! Please feel free to open a PR!

Full implementation: https://github.com/paim-creater/prng/tree/main/libtomcrypt_tempest

This link doesn't work.

[paim-creater]

Fixed the link, should work now. I'll open the PR shortly. Thank you.

[karel-m]

To be honest, I have doubts that this kind of experimental work by an anonymous author, which is basically only self-reviewed and self-analysed without any serious independent review, is a good candidate for inclusion in LibTomCrypt.

We usually tend to include algorithms that are either standardised by a reputable body, used in reputable software projects such as OpenSSL, OpenSSH etc. This is none of those.

At first sight, it seems to me that this is probably a very fast random generator, which is obvious and, in my opinion, its only clear advantage. However, I am not sure whether the claims that it is cryptographically secure are true.

[sjaeckel]

To be honest, I have doubts that this kind of experimental work by an anonymous author, which is basically only self-reviewed and self-analysed without any serious independent review, is a good candidate for inclusion in LibTomCrypt.

You're absolutely right, and I didn't check all details, but would've when reviewing the PR. Let's see what comes out of the review by the wolfSSL guys wolfSSL/wolfssl#10802 ;) If they get the time to look at it properly maybe the result will be interesting!?!

[karel-m]

After looking at other GitHub repositories, I am puzzled by what is going on here. To me, it looks like a possible attempt to introduce a weak random generator into as many open-source cryptographic libraries as possible

• Proposal: Tempest v3 as Custom RNG Backend for libsodium jedisct1/libsodium#1545 (closed / rejected with clear reasoning)
• Add Tempest_RNG: cryptographic-grade CSPRNG (17.7 Gbit/s, 2^128) randombit/botan#5707 (closed)
• Proposal: Tempest v3 CSPRNG as optional custom RNG backend wolfSSL/wolfssl#10802 (reserved feedback)
• Tempest v3 CSPRNG as external RNG backend via MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Mbed-TLS/mbedtls#10795
• Add tempest-rng to PRNG section rust-cc/awesome-cryptography-rust#19

[karel-m]

I am now looking at tempest_v3.h where I see:

void tx5cmul_seed(tx4_state *s, uint64_t seed);

Are we seriously seeding a cryptographically secure PRNG with a uint64_t value?

[sjlombardo]

I'm just a user, but some things lead me to be skeptical. For example cmul_hl and cmul_lh don't appear to use carryless multiply, where that is the stated intent.

[gilles-peskine-arm]

Mbed TLS maintainer here. This is at best a kook, at worst a backdoor attempt, and not worthy of serious consideration. It may also pass the threshold for spam if it's been mass-submitted to a lot of projects.