🍀Fortuna

NEW

A CSPRNG that improves on Yarrow with multiple entropy pools, scheduled reseeding, and simpler, robust construction.

DESCRIPTION

Fortuna, designed by Ferguson and Schneier, organizes entropy into many pools and reseeds the generator at increasing intervals, avoiding complex entropy estimation. It uses strong cryptographic primitives and focuses on survivability after compromise. Fortuna influenced several OS RNGs and library implementations. While not a formal standard, it remains a respected design for practical, resilient CSPRNGs. Modern systems may also use standardized DRBGs for compliance requirements.

ALTERNATIVE DEFINITIONS

Wikipedia

Fortuna is a cryptographically secure pseudorandom number generator (CSPRNG) invented by Bruce Schneier and Niels Ferguson.

Attributes authorship and classifies Fortuna as a CSPRNG.

Source

Schneier.com

Fortuna uses multiple entropy pools with a reseeding strategy that avoids the need to estimate entropy.

Highlights the key design improvement over Yarrow: no entropy estimation.

Source

RELATED TERMS

Yarrow Cryptographically Secure Pseudorandom Number Generator Entropy Source Reseeding Pool-based PRNG Hash Function Operating System RNG

COMPETING TERMS

NIST SP 800-90A DRBG

KNOWLEDGE AREAS

Data Security Testing & Validation

TARGET AUDIENCE

Cybersecurity Engineer Security Architect Chief Information Security Officer Software Developer

EXTERNAL SOURCES

• Wikipedia - Fortuna (PRNG)
• Schneier.com - Authoritative Fortuna overview
• FreeBSD - OS RNG design (Fortuna)
• OpenBSD - OS RNG API context

TOP QUESTIONS

How does Fortuna differ from Yarrow?

It replaces entropy estimation with many pools and scheduled reseeding, simplifying operation and improving robustness.

Category: Concept

Is Fortuna standardized?

No. It’s a well-known design, but organizations often prefer NIST SP 800-90A DRBGs for compliance.

Category: Relevancy

Where is Fortuna used?

Influential in OS RNGs like FreeBSD and in some libraries; specifics vary by version and platform.

Category: Example

What are the components of Fortuna?

Entropy pools, reseed scheduler, generator based on cryptographic primitives, and a secure output interface.

Category: Concept

What happens after a state compromise in Fortuna?

Future reseeds with fresh entropy restore unpredictability, limiting the impact window.

Category: Risk

How should Fortuna be seeded?

Use diverse OS entropy sources; ensure early-boot collection and periodic reseeding.

Category: BestPractice

Is Fortuna suitable for embedded systems?

Yes, but entropy collection must be tailored to limited hardware sources and boot behavior.

Category: Opinion

Does Fortuna pass standard test suites?

Proper implementations do; however, cryptographic security relies on design and primitives, not tests alone.

Category: Testing

What alternatives to Fortuna exist?

NIST Hash_DRBG, HMAC_DRBG, and CTR_DRBG are strong standardized alternatives.

Category: Alternatives