CSPRNG that cannot be used as random extractor Are there any specific CSPRNG's that cannot be used as randomness extractor within a TRNG? 

In other words, can you simply provide enough entropy gathered from a good entropy source as seed in any CSPRNG, and be done with it?

I've got the strong feeling that the properties of a CSPRNG are largely overlapping that of randomness extraction, but Wikipedia claims that the properties of a (generic) PRNG may not necessarily overlap.


  However, the general PRG definition does not specify that a weakly random source must be used, and while in the case of an extractor, the output should be statistically close to uniform, in a PRG it is only required to be computationally indistinguishable from uniform, a somewhat weaker concept.


I presume that any hash based extractor should work, as it hashes the input. Hashing the entropy is - as far as I understood - considered a good method of extracting the randomness out of the entropy.

The only property that I can come up with that should be required from a CSPRNG is that it has to mix in all the data containing the entropy.



Notes regarding NIST SP 800-90B:


It is not necessary here to let the TRNG be a full entropy source as defined in that document; CSPRNG's are normally used to generate more output than the amount of entropy provided;
Chapter 6.4 contains requirements for the randomness extractor;
There is some relationship between the two notions, but a CSPRNG is designed to be computationally secure (secure against adversaries with bounded computation time), whereas a randomness extractor is required to be information-theoretically secure (unconditionally secure against adversaries with unbounded computation time).  So, they're different primitives.

I would not expect a typical CSPRNG to be a secure randomness extractor.  Typically CSPRNGs use computationally secure primitives, like AES etc.; they don't make any attempt or claims of providing security against adversaries with unlimited computing power.

Also, CSPRNGs are often designed to address other issues as well, such as recovery from state compromise (robustness against state compromise extension attacks), efficient use of the available entropy, and ability to stretch a finite amount of entropy into an unlimited stream of pseudorandom bits (e.g., using a PRG).

CSPRNGs are practical primitives, intended for applied cryptography, and were invented by applied cryptographers.  Randomness extractors have typically been studied in the theoretical literature and are rarely (if ever) used in practice, for a variety of reasons, and were invented by theoreticians for studying fundamental theoretical questions.  These differences reflect differences in the goals and values of those two communities.



We can also compare randomness extractors to pseudorandom generators (PRGs), but again, they're very different.  PRG's are not designed to act as a randomness extractor, so there is no reason whatsoever to expect any particular PRG to do a good job at randomness extraction.  Indeed, I'd expect that many secure PRG's might be perfectly good as a PRG but no good at all as a randomness extractor.  The purpose of a randomness extractor is designed to take a non-uniformly distributed seed and turn it into a uniformly distributed output.  That's very different from the task that PRG's are designed for.  PRG's are designed to be secure if their seed is distributed uniformly at random.  There is no guarantee whatsoever that they will be secure if the seed is distributed non-uniformly, and indeed, for some secure PRGs, they might be insecure when used with a non-uniformly distributed seed.



In short, if you take a CSPRNG or a PRG, I would not expect it to necessarily act as a secure randomness extractor.  They're just different things.