NIST SP 800-90 vs BSI AIS 20/31

Why engineers get confused

Terms such as RNG, TRNG, entropy source, DRBG, physical RNG and hybrid construction are not always used in exactly the same way across standards communities.

A team can therefore make a technically reasonable statement in one framework and accidentally overstate equivalence in another.

The goal should be translation, not forced one-to-one mapping.

NIST's structure

The current NIST SP 800-90 framework has three parts:

• SP 800-90A Rev. 1 - deterministic random bit generator mechanisms;
• SP 800-90B - entropy sources;
• SP 800-90C - complete random bit generator constructions.

This creates a component-oriented view: entropy source, deterministic mechanism and construction.

BSI AIS 20/31

AIS 20/31 is used in the German Common Criteria context and defines functionality classes for different kinds of random-number generators.

The current mathematical-technical reference distinguishes classes for deterministic, physical true and non-physical true generators, with requirements organized around those classes.

That class-based structure is different from the way the NIST SP 800-90 documents are divided.

Use IR 8446 for the comparison

NIST IR 8446 was written specifically to compare AIS 20/31 and the SP 800-90 series. Its stated aim is to explain similarities and differences in terminology, assumptions and requirements and to improve shared understanding.

That makes it safer than constructing a mapping from marketing summaries or old versions of either framework.

Do not say “AIS class X equals NIST Y” casually

There can be conceptual overlap without full equivalence.

A high-quality QRNG.io comparison should explain:

• what each framework is trying to assure;
• how components/classes are defined;
• where terminology overlaps;
• where assumptions differ;
• what evidence each expects;
• which certification/validation ecosystem applies.

Avoid reducing that to a single table that implies automatic equivalence.

Entropy-source perspective

For teams focused specifically on physical entropy, SP 800-90B offers a detailed NIST framework around entropy-source modeling, assessment, health tests and conditioning.

AIS 20/31 takes a broader class-based RNG perspective in the BSI/Common Criteria ecosystem. The exact applicable class depends on the generator design and intended assurance claims.

A QRNG can potentially be discussed under either ecosystem, but the classification and evidence need to follow the actual framework rather than a vendor-created label.

Certification and validation are framework-specific

An SP 800-90B Entropy Validation Certificate and a Common Criteria evaluation involving AIS 20/31 are not the same credential.

QRNG.io should therefore name the exact scheme whenever discussing formal assurance:

• who issued or reviewed it;
• which standard/version;
• which product/configuration;
• which certificate/report;
• what scope is covered.

Never compress all of that into the word “certified” without context.

Why this matters for international product teams

A semiconductor or security product may target customers across the US, Europe and other assurance environments.

Understanding both frameworks early can influence:

• architecture boundaries;
• raw-data access;
• documentation;
• health-test design;
• conditioning choices;
• validation strategy;
• what claims can be made publicly.

It is much easier to preserve evidence during development than to reconstruct it after the design is frozen.

A practical reading order

1. Read SP 800-90B for the NIST entropy-source model.
2. Read the applicable AIS 20/31 material for the BSI class model.
3. Use NIST IR 8446 to compare terminology and assumptions.
4. Use the actual validation/certification programme documents for procedural requirements.

QRNG.io editorial boundary

This page should never state that an iQrypto product satisfies either framework unless exact current evidence supports that claim. Its purpose is to help engineers understand the standards landscape.

Sources and further reading

1. NIST IR 8446
2. NIST SP 800-90B
3. NIST SP 800-90C
4. BSI AIS 20/31 v3.0