Secure cryptographic mechanisms and protocols require good random numbers. Therefore, random number generators used in cryptographic products need to provide random and unpredictable data.

For this purpose the BSI defined guidelines for the evaluation and certification of random number generators in the mathematical/technical reference A proposal for: Functionality classes for random number generators - Version 2.0 (18th September 2011) and A proposal for: Functionality classes for random number generators - Version 3.0 (10th September 2024), which form the cryptographic foundations for AIS 20 and AIS 31.

The creation of version 3.0 was accompanied by a commenting phase of a draft ( A proposal for: Functionality classes for random number generators - Version 2.35 - Draft) and a workshop (More information).

Furthermore, various BSI studies examine and evaluate individual random number generators:

BSI study: Documentation und Analysis of the Linux Random Number Generator

For several years now, the BSI continuously examined the random number generator (RNG for short) /dev/random for each newly released version of Linux. This enables the BSI to make security statements about this RNG, but also about cryptographic systems that use this RNG to generate key material. The main aspect of the investigation is to prove that the Linux RNG is compliant with a certain functionality class.

BSI study: Random Number Generation in Virtualized Environments

With the increasing use of virtual machines, especially in cloud-based solutions, the question arises whether random numbers of sufficient quality can be provided here as well. A study by the BSI therefore investigated how virtualization influences the entropy of the noise sources feeding the random number generators and what can be done to ensure that the virtual machines (VM) are supplied with sufficient random numbers. As an example, the Linux open-source random number generator was investigated in virtual machines running on different virtual-machine monitors (VMM) such as KVM, VirtualBox, Microsoft Hyper-V, and VMWare ESXi.

BSI study: Analysis of Random Number Generation in Browsers

In a web browser good random numbers are a prerequisite for establishing secure connections on the Internet. This study contains the assessment of the algorithmic part of the random number generators supporting cryptographic functionalities in the web browsers Chromium, Firefox and Safari (assuming usage of the Corecrypto library). For each of the random number generators the implementation is described in detail and it is analyzed whether the requirements from AIS 20 and AIS 31 on good random numbers are satisfied.