If the software produced by the project is an application or library, and its primary purpose is not to implement cryptography, then it SHOULD only call on software specifically designed to implement cryptographic functions; it SHOULD NOT re-implement its own.

_{[crypto_call]}

The security mechanisms within the software produced by the project MUST generate all cryptographic keys and nonces using a cryptographically secure random number generator, and MUST NOT do so using generators that are cryptographically insecure.

A cryptographically secure random number generator may be a hardware random number generator (/dev/random), or it may be a cryptographically secure pseudo-random number generator (CSPRNG) using an algorithm such as Hash_DRBG, HMAC_DRBG, CTR_DRBG, Yarrow, or Fortuna. Examples of calls to secure random number generators include Java's java.security.SecureRandom and JavaScript's window.crypto.getRandomValues. Examples of calls to insecure random number generators include Java's java.util.Random and JavaScript's Math.random.

For additional guidance and examples about what kind of specifications to rate a random bit generator (RBG) please review: 

• NIST 800-90C explains putting various pieces together (entropy source and the "pseudo-random number generator" PRNG) - Recommendation for Random Bit Generator (RBG) Constructions.
• NIST 800-90A references the PRNG algorithms - Recommendation for Random Number Generation Using Deterministic Random Bit Generators.
• NIST 800-90B references testing requirements for entropy sources - Recommendation for the Entropy Sources Used for Random Bit Generation.

_{[crypto_random]}

The default security mechanisms within the software produced by the project MUST NOT depend on broken cryptographic algorithms (e.g., MD4, MD5, single DES, RC4, Dual_EC_DRBG), or use cipher modes that are inappropriate to the context, unless they are necessary to implement an interoperable protocol (where the protocol implemented is the most recent version of that standard broadly supported by the network ecosystem, that ecosystem requires the use of such an algorithm or mode, and that ecosystem does not offer any more secure alternative). The documentation MUST describe any relevant security risks and any known mitigations if these broken algorithms or modes are necessary for an interoperable protocol.
ECB mode is almost never appropriate because it reveals identical blocks within the ciphertext as demonstrated by the ECB Penguin, and CTR mode is often inappropriate because it does not perform authentication and causes duplicates if the input state is repeated. In many cases it's best to choose a block cipher algorithm mode designed to combine secrecy and authentication, e.g., Galois/Counter Mode (GCM) and EAX. Projects MAY allow users to enable broken mechanisms (e.g., during configuration) where necessary for compatibility, but then users know they're doing it.

_{[crypto_working]}