ctr drbg bug

[fanatid]

Implement with algorithm described in NIST SP 800-90A, checked with founded C implementations one two, but still return wrong result 😢

[chjj]

I have a working JS implementation here: https://github.com/bcoin-org/bcrypto/blob/master/lib/ctr-drbg.js

I ran into the same problems you guys did. It took several hours to debug and fix it. The derivation is just confusing as hell and not explained well anywhere.

I was considering using it for something but ultimately decided against it, so I guess it was a lot of work for nothing. :)

I'm not sure what's wrong with this implementation, but using the above one as a guide might be useful.