LM-DRBG is a cryptographic IP core providing deterministic random bit generation for FPGA and SoC designs.
The engine implements CTR_DRBG according to NIST SP 800-90A section 10.2.1, using AES-256 as the block cipher and including the block cipher derivation function of section 10.3.2. It supports instantiation with a personalization string, reseeding with additional input, prediction resistance, and generation requests of any length.
The core is delivered as vendor-neutral SystemVerilog and builds from one source on AMD, Altera and Efinix devices. Known-answer health tests run after every reset and on demand, and output is inhibited until they pass. ANSI C drivers are provided for fast integration.
Measured FPGA results
Product top, out of context, constrained at the target clock. AMD and Efinix report LUTs, Altera reports ALMs; the two are never combined.
| Device | Configuration | Logic | FF | Memory | DSP | Fmax |
|---|---|---|---|---|---|---|
| Altera Agilex 3A3CW135BM16AE6S · quartus-pro 26.1.1 | AXIS_W=32, SBOX_STYLE=0, SEED_BLK=8 | 3,564 ALM | 6,304 | 1 Kb M20K | 0 | 271.3 MHztarget 265 |
| AMD Kintex UltraScale+xcku3p-ffva676-1-e · vivado 2026.1 | AXIS_W=32, SBOX_STYLE=0, SEED_BLK=8 | 4,848 LUT | 3,231 | 0 BRAM | 0 | 341.8 MHztarget 300 |
| AMD Kintex UltraScale+xcku3p-ffva676-1-e · vivado 2026.1 | AXIS_W=32, SBOX_STYLE=1, SEED_BLK=8 | 3,971 LUT | 3,077 | 8 BRAM | 0 | 326.8 MHztarget 300 |
| Efinix Titanium Ti375Ti375N1156 · efinity 2026.1 | AXIS_W=32, SBOX_STYLE=0, SEED_BLK=8 | 8,605 LUT | 3,029 | 22 RAM | 0 | 338.4 MHztarget 300 |
Features
Mechanism
- CTR_DRBG with AES-256, NIST SP 800-90A section 10.2.1
- Block cipher derivation function, section 10.3.2
- Personalization string at instantiation
- Additional input on reseed and on generate
- Prediction resistance — a reseed forced before a generation
- Generation requests of any byte length
Health and assurance
- Known-answer tests on instantiate, generate and reseed, per section 11.3
- Tests run after every reset de-assert and on demand
- Output inhibited until the tests pass
- Alarm latch and interrupt on a health-test failure
- Reseed counter enforced — a generation past the seed life is refused, not served
Integration
- AMBA AXI4-Lite control and two AXI4-Stream data interfaces
- Entropy in on its own stream; random out on its own stream
- Responses have an end — a request for N bytes produces exactly N bytes with
tlast - Two delivery tops: complete AXI product, or bare mechanism for a custom fabric
- ANSI C driver, UVM RAL, IP-XACT, SystemRDL register description
Applications
- Key generation for symmetric and post-quantum cryptography
- Nonce, IV and salt generation
- Challenge generation in authentication protocols
- Padding and blinding values
- Any system needing repeatable, standards-traceable random bits from a seeded source
Block diagram
Interfaces
| Interface | Type | Width | Carries |
|---|---|---|---|
s_axil | AXI4-Lite slave | 32-bit | capability, control, command, status, alarms, counters |
s_axis (seed) | AXI4-Stream sink | AXIS_W | entropy input, personalization string, additional input |
m_axis (random) | AXI4-Stream source | AXIS_W, tkeep, tlast | the generated bits |
irq | level | 1-bit | completion, alarm |
The response stream has an end. A caller asks for a stated number of bytes and
receives exactly that, with tlast on the final transfer and tkeep qualifying it when
the length is not a whole number of transfers. That is the difference between a
deterministic generator and a physical noise source, and it is visible at the interface.
Security and assurance
Health tests are not optional and not deferred. Known-answer tests run on the instantiate, generate and reseed functions after every reset de-assert, and on demand. Data output is inhibited until they pass, as SP 800-90A section 11.3.1 requires — the tests are conducted on each DRBG function prior to first use.
A failure latches an alarm. The condition is visible in a register, raised on the interrupt, and the mechanism refuses to produce output.
The reseed counter is enforced. A generation requested past the seed life is refused rather than served — the standard's limit is a hardware behaviour, not a software convention.
Prediction resistance is available per request, forcing a reseed before generation.
The entropy source is the integrator's. This block is a deterministic generator: it requires entropy input of the security strength its instantiation claims. LM-TRNG is one such source. A DRBG seeded from an inadequate source produces output that is indistinguishable from good output by inspection, which is why the obligation is stated here rather than assumed.
Power analysis is not addressed. No masking or randomised schedule is implemented.
Configuration
| Parameter | Type | Effect |
|---|---|---|
SEED_BLK | elaboration | seed material buffering |
AXIS_W | elaboration | stream width |
SBOX_STYLE | elaboration | substitution implementation — memory or logic |
| prediction resistance | run time | per request |
| personalization / additional input | run time | on the seed stream |
| top choice | elaboration | full AXI product, or bare mechanism |
Resources and performance
Resource utilisation and maximum clock frequency for each target device are measured out of context and published per target in the measured results on this page. AMD and Efinix rows report LUTs; Altera rows report ALMs, and the two are never combined.
Generation rate follows the AES engine's cadence: one 128-bit block every fourteen clocks, sustained back to back.
Deliverables
| Item | Contents |
|---|---|
| RTL | parameterised SystemVerilog, vendor-neutral |
| Model | cycle-accurate C++ model |
| Registers | SystemRDL source plus six generated exports |
| Verification | UVM RAL, formal property wrappers, CAVP vector drivers |
| Software | ANSI C reference driver with generated header and JSON |
| Packaging | IP-XACT, IEEE 1685-2022 |
| Implementation | runnable flow script per FPGA vendor, file list, SDC |
| Documentation | integration guide, and a pairing note for use with LM-TRNG |