Electronics Guide

True Random Number Generators

A true random number generator (TRNG), called a physical or non-deterministic generator in some standards, extracts randomness from a physical phenomenon whose behavior cannot be predicted from observation of the device. The generator converts that behavior into digital bits without relying on a deterministic algorithm for its unpredictability.

Operating Principles

A TRNG measures a noisy physical process and quantizes the measurement into binary values. The essential requirement is that the process carry genuine uncertainty at the point of sampling: the sampled value must remain unpredictable even to an observer who knows the circuit topology, the manufacturing parameters, and every previous output. Designers justify that claim with a stochastic model—a physical description that relates measurable circuit parameters, such as oscillator jitter variance or amplifier noise power, to a lower bound on the entropy delivered per sample.

Effective TRNGs share several characteristics:

• Non-determinism: Output cannot be predicted or reproduced, even with an identical device
• Justified entropy rate: A stochastic model bounds the entropy per raw sample from below
• Statistical uniformity: After conditioning, all output values are effectively equiprobable
• Independence: Successive outputs show no exploitable correlation
• Availability: The generator supplies values on demand, at a documented rate
• Failure detection: Health tests and tamper sensors reveal degradation or manipulation

Implementation Architecture

Practical TRNGs decompose into a small number of stages:

• Noise source: The physical process that carries the uncertainty
• Digitization: A sampler, comparator, or counter that converts the analog behavior into raw bits
• Health tests: Continuous checks applied to the raw output, before conditioning hides defects
• Conditioning: A bias-removal or cryptographic stage that compresses raw bits into near-uniform output
• Output interface: Buffering, flow control, and a status channel that reports failures to the consumer

The ordering matters. Health tests must observe the raw digitized samples, because a cryptographic conditioner will produce statistically perfect output from a dead noise source, masking exactly the failure the tests exist to catch. Many designs also implement several independent noise sources and combine them, which raises the cost of a single-point failure and of an attack that must capture every source at once.

Physical Entropy Sources

The noise source determines the character of the whole generator: its entropy rate, its die area and power, its sensitivity to temperature and supply voltage, and the ease with which an attacker can manipulate it. Silicon designs draw on a handful of well-understood phenomena.

Thermal Noise

Thermal noise, also called Johnson-Nyquist noise, arises from the random thermal motion of charge carriers in any resistive element above absolute zero. Its available noise power depends on absolute temperature and measurement bandwidth but not on the applied voltage or the resistance value; the open-circuit noise voltage across a resistor grows with the square root of the resistance, the temperature, and the bandwidth. The physics is textbook material, which makes thermal noise attractive for the stochastic model that certification requires.

A thermal-noise generator amplifies the microvolt-scale noise across a resistor or across a transistor channel with a low-noise amplifier, then digitizes the amplified signal with a comparator or an analog-to-digital converter. The design challenge is signal integrity rather than physics: the wanted noise is small, so supply coupling, substrate coupling, clock feedthrough, and external electromagnetic fields can easily dominate it. Because those interferers are deterministic or attacker-controlled, a design that mistakes them for entropy overstates its entropy rate.

Shot and Avalanche Noise

Shot noise follows from the discreteness of charge: carriers cross a potential barrier at random times, so a nominally constant current fluctuates. Common implementations include:

• Reverse-biased junctions: Random carrier generation and transit in the depletion region
• Avalanche diodes: Devices operated in breakdown, where carrier multiplication amplifies the fluctuation into a large, easily digitized signal—diodes marketed as Zener diodes break down predominantly by avalanche multiplication above roughly five to six volts, and it is that avalanche noise, not the Zener mechanism, that discrete designs typically exploit
• Photodiodes: Random photon arrival in a weak optical field, which is quantum in origin

These sources deliver larger signal amplitudes than a bare resistor, easing the amplifier requirements. In exchange, they need a bias voltage that is often higher than the digital supply, which complicates integration in a low-voltage CMOS process, and their noise amplitude drifts with temperature and with device aging.

Ring Oscillators and Jitter

The dominant fully digital approach samples one free-running ring oscillator with another, or with the system clock. Phase noise accumulates in the sampled oscillator between edges, so the sampled value becomes unpredictable once the accumulated jitter is comparable to the sampling period. Ring-oscillator sources synthesize from standard cells, port across processes, and cost little area, which makes them the usual choice for FPGA and system-on-chip integration.

Their weaknesses are equally well known. Much of an oscillator's jitter is global or flicker-dominated rather than independent thermal jitter, so a naive design overestimates its entropy. Worse, free-running oscillators injection-lock: published research has shown that an attacker who injects a signal on the power supply, or an electromagnetic field at a suitable frequency, can pull the rings into a fixed phase relationship and collapse the entropy of the sampled output while the generator continues to appear healthy. Countermeasures include on-chip regulation and filtering of the oscillator supply, differential and multi-ring architectures with dissimilar ring lengths, sampling that accumulates jitter over many periods, and health tests sensitive to sudden loss of variance.

Metastability

A latch or flip-flop driven into a setup-and-hold violation enters a metastable state whose resolution direction is decided by the noise present at the decision node. Metastability-based sources therefore convert thermal noise into a digital decision without an analog amplifier, and they can produce a bit per clock cycle. The practical difficulty is that any systematic timing offset or device mismatch biases the resolution strongly toward one value, so these circuits require calibration—often a closed control loop that trims a delay line to hold the sampling point at the balance condition across voltage, temperature, and aging.

Other Sources

Additional physical effects appear in production and research designs, including random telegraph noise in small transistors, the power-up state of uninitialized SRAM cells, and chaotic circuits built around discrete-time maps. Quantum-optical sources form a distinct family treated in a later section. Sources based on operating-system events—interrupt timing, disk latency, and human input—remain valuable for software generators but are classified separately, for example as non-physical true random number generators in the German scheme, because their unpredictability rests on system complexity rather than on physics.

Post-Processing and Conditioning

Raw entropy sources are biased and correlated. Conditioning compresses raw samples into a shorter output that is close to uniform, trading throughput for entropy density. A conditioner never creates entropy: the output can hold no more entropy than the input carried, and honest designs discard several raw bits for every output bit.

Bias Removal

Classical debiasing operates on the bit stream with no cryptographic assumptions:

• Von Neumann corrector: Examines non-overlapping pairs of consecutive bits, emitting 0 for "01" and 1 for "10" and discarding "00" and "11." It removes bias from independent bits without knowing their probability, but the yield is low: even for an unbiased source the output rate is at most one-quarter of the input rate, and it falls as bias grows. The variable output rate also creates a timing channel unless the design buffers the result.
• XOR combination: Exclusive-or of several bits pushes the result toward balance exponentially in the number of bits combined, but only if those bits are genuinely independent. Applied to correlated samples from a single source, it hides bias without removing predictability.
• Resilient functions: Linear codes and other Boolean constructions preserve uniformity in the presence of a bounded number of adversarially fixed inputs.

Cryptographic Conditioning

Modern designs condition with a cryptographic primitive: a hash such as SHA-256 or SHA-3, an HMAC, a CMAC, or CBC-MAC over a block cipher. NIST SP 800-90B designates these as vetted conditioning components and supplies formulas for the entropy that may be claimed at the output given the entropy at the input, the input length, and the output length. Security rests on the one-way behavior of the primitive: the algorithm is public, so the output is unpredictable only because the input carried enough entropy, which is why the compression ratio must be chosen against a conservative entropy estimate rather than an optimistic one.

Randomness Extractors

Extractor theory formalizes the same task with provable guarantees rather than cryptographic assumptions. An extractor maps a weakly random input with a known min-entropy bound to an output statistically close to uniform:

• Seeded extractors: Consume a short, independent, uniform seed and extract close to the full min-entropy of the input; the seed may be public and reused under some constructions
• Deterministic extractors: Operate without a seed but require structural assumptions about the source, such as independence between bits
• Two-source extractors: Combine two independent weak sources, which suits designs that already instantiate several dissimilar noise sources

Universal hash families, implemented as multiplication over a finite field, polynomial evaluation, or multiplication by a random binary matrix, are the workhorse seeded extractors. The leftover hash lemma quantifies the result: an output shorter than the input min-entropy by a security margin is exponentially close to uniform in that margin. Quantum generators, whose entropy claims are stated in information-theoretic terms, commonly use Toeplitz-matrix hashing for precisely this reason.

Linear Whitening

Linear feedback shift registers and scramblers flatten the output spectrum and hide short-term correlation. They are cheap, but linearity means they add no entropy and their state is recoverable from the output, so they must never be the last stage of a cryptographic generator. Their most damaging property is cosmetic: an LFSR makes a failed noise source produce output that passes casual statistical inspection. Where whitening is used, it belongs ahead of a cryptographic conditioner and behind health tests that observe the raw samples.

Entropy Assessment

Every security claim about a hardware generator reduces to a claim about how much entropy the noise source delivers per sample. Assessment combines a physical model with empirical measurement, and the standards require both.

Min-Entropy as the Metric

Cryptographic practice measures unpredictability with min-entropy, which is determined by the single most probable outcome, rather than with Shannon entropy, which averages over the distribution. The distinction is not academic: a source that emits one fixed value nine times in ten still carries substantial Shannon entropy but offers an adversary a first guess that succeeds nine times in ten. Min-entropy captures exactly that best-guess probability, so it is the quantity that seeding and reseeding requirements are written against.

Stochastic Models

A defensible design derives entropy from device physics before it measures anything. A thermal-noise source models the entropy per sample from the temperature, the resistance, the measurement bandwidth, the amplifier noise figure, the comparator threshold, and the quantization step; a ring-oscillator source models it from the accumulated jitter variance relative to the sampling period. The model must account for everything that reduces uncertainty, including deterministic periodicity, correlation between successive samples, dead time in the sampler, and the environmental range over which the device must operate. Certification schemes expect the model to hold at the worst corner of that range, not at room temperature and nominal supply.

Empirical Estimation

NIST SP 800-90B specifies the measurement procedure that accompanies the model. A submission collects at least one million raw samples, then follows one of two tracks. If permutation testing supports the assumption that samples are independent and identically distributed, a most-common-value estimate suffices. Otherwise the non-IID track applies a battery of ten estimators—among them collision, Markov, compression, and several predictors that attempt to guess the next sample—and takes the smallest result. Taking the minimum is deliberate: an entropy estimate that is too high translates directly into keys weaker than advertised, whereas an estimate that is too low costs only throughput.

The Limits of Statistical Testing

General-purpose test suites answer a narrower question than designers often assume. A counter encrypted under AES passes every practical randomness test yet is perfectly predictable to anyone holding the key, so passing a suite cannot establish unpredictability. Statistical testing is valuable for catching gross implementation faults, for confirming that a build matches its model, and for regression testing across process corners, but entropy claims must come from the physical model and the SP 800-90B estimators applied to raw, unconditioned data.

Deterministic Generators and Hybrid Architectures

Physical sources are slow, bursty, and sensitive to their environment. Nearly every deployed system therefore uses the physical source to seed a deterministic algorithm that supplies the actual output stream at high rate.

Requirements for a Cryptographic Generator

A cryptographically secure deterministic generator must satisfy properties that ordinary simulation generators do not:

• Unpredictability: No efficient algorithm distinguishes the output from uniform bits without the internal state
• Backtracking resistance: An adversary who captures the current state cannot recover previously produced outputs
• Prediction resistance: An adversary who captures the current state cannot predict future outputs, which requires reseeding with fresh entropy before the next request
• State recovery: Reseeding with sufficient fresh entropy restores security after a compromise

The two resistance properties point in opposite directions in time and are achieved by different mechanisms. Backtracking resistance follows from a one-way state update performed inside the generator; prediction resistance cannot be achieved by any internal computation and requires new entropy from outside.

NIST DRBG Mechanisms

NIST SP 800-90A Revision 1 specifies three approved deterministic random bit generator mechanisms:

• Hash_DRBG: Built on an approved hash function, typically SHA-256 or SHA-512; compact and well suited to constrained devices that already contain a hash core
• HMAC_DRBG: Built on HMAC with an approved hash; its state update is simple to analyze, and it underlies the deterministic nonce construction used in modern signature schemes
• CTR_DRBG: Built on a block cipher in counter mode, in practice AES; the fastest option wherever an AES accelerator is present, and the usual choice in hardware

A fourth mechanism, Dual_EC_DRBG, was published in the original recommendation and is discussed among the failure modes below. Outside the NIST family, ChaCha20-based generators are widespread in operating systems and in open-source libraries, and the German scheme defines its own deterministic classes.

State Management and Security Strength

A DRBG maintains an internal state that evolves with every generate and reseed operation. Each mechanism is instantiated at a security strength—112, 128, 192, or 256 bits—and the seed material supplied at instantiation must carry at least that much entropy; requesting 256-bit security from a source that delivers 100 bits of entropy yields 100-bit security. Standards also bound the number of outputs between reseeds and the number of bits per request, so that no single state is stretched further than its analysis supports. Prediction resistance, when requested, forces a reseed before the generator produces the next block.

Hybrid Construction

Combining a physical source with a DRBG yields the properties that neither provides alone: a continuous high-rate stream, periodic injection of fresh entropy, tolerance of brief source outages through buffering, and a single validated interface for consumers. NIST SP 800-90C, published in September 2025, specifies how the pieces fit together and defines four construction classes. An RBG1 construction is seeded once from an external generator and has no entropy source of its own, which suits devices personalized in a factory. An RBG2 construction contains an entropy source available on demand. An RBG3 construction accesses its entropy source continuously and produces output with full entropy. An RBGC construction is a chain of generators on one computing platform, each seeded by the one above it—the model that matches an operating system distributing randomness to applications.

Entropy Pools in Operating Systems

Software generators aggregate many weak sources into a pool. The Linux kernel generator, reached through /dev/random, /dev/urandom, and the getrandom system call, mixes hardware generator instructions, interrupt and device timings, and boot-time seeds into an internal state. The subsystem was substantially rewritten in kernel versions 5.17 and 5.18: the legacy shift-register pool and SHA-1 extraction were replaced by BLAKE2s-based hashing for entropy extraction, with ChaCha20 instances—one per CPU, reseeded from a base generator—producing the output. Since kernel 5.6, /dev/random blocks only until the generator is initialized rather than against a running entropy estimate, and getrandom is the recommended interface for new code. Sound pool management in any system requires conservative entropy accounting, a mixing function that preserves entropy while preventing backtracking, extraction that does not expose the pool state, and a defined behavior for requests that arrive before initialization.

Health Monitoring

A noise source that fails silently is more dangerous than one that fails loudly, because the conditioner downstream will keep producing plausible output. Standards therefore require continuous testing of the raw source, and validation schemes treat the tests as part of the generator.

Start-Up Tests

Power-on self-tests run before any output reaches a cryptographic consumer:

• Known-answer tests: Verify deterministic components—hash, cipher, and DRBG—against fixed test vectors
• Noise source verification: Confirm that the source oscillates, swings, or resolves as designed
• Raw-sample testing: Apply the continuous tests to a defined number of samples before the source is trusted; SP 800-90B expects at least 1,024 consecutive raw samples to pass
• Stuck-output checks: Reject a source whose output holds constant through the start-up window

Continuous Tests

SP 800-90B defines two approved continuous health tests, and permits documented alternatives of at least equal sensitivity:

• Repetition count test: Signals failure when one value repeats more than a cutoff number of times in a row, catching catastrophic stuck-at faults within a few samples
• Adaptive proportion test: Counts occurrences of a sampled value within a sliding window—1,024 samples for binary sources and 512 for larger alphabets—and signals failure when one value dominates, catching gradual loss of entropy

Both cutoffs derive from the claimed min-entropy and a target false-alarm probability, commonly on the order of one in a million per test. Designers also add source-specific checks, such as oscillator frequency and duty-cycle monitors or variance estimators. When a test fails, the generator must stop supplying output for cryptographic use and report an error; silently returning stale, buffered, or zero values converts a detected fault into an undetected compromise.

Environmental and Tamper Monitoring

Most physical sources depend on temperature, supply voltage, and clock frequency, and an attacker who controls those variables can steer the source outside the range its entropy model covers. Hardened designs therefore add on-die sensors that report out-of-range temperature, supply voltage glitches or brownouts, clock frequency and duty-cycle violations, and strong electromagnetic fields, and they escalate to the same failure path as the health tests. In secure elements and hardware security modules these sensors join the wider tamper-response system, which may zeroize keys on a detected attack.

Quantum Random Number Generators

Quantum generators derive randomness from measurements whose outcomes quantum theory holds to be intrinsically indeterminate, rather than merely difficult to predict. That distinction is the principal argument for their use: a classical noise source is unpredictable because the adversary lacks information about a complicated system, whereas a quantum source is unpredictable because the information does not exist.

Common Quantum Sources

• Beam-splitter path choice: Single photons that transmit or reflect at a balanced splitter, detected on two channels
• Photon arrival timing: Randomness taken from the intervals between detections in an attenuated optical field
• Vacuum fluctuations: Homodyne detection of the quadrature noise of the vacuum field, which digitizes with ordinary photodiodes and yields high rates
• Phase diffusion in lasers: Spontaneous emission randomizing the phase of a laser driven near threshold, converted to amplitude noise in an interferometer
• Radioactive decay: Detection of decay events, historically important but impractical for embedded products

The vacuum-fluctuation and phase-diffusion approaches dominate commercial products because they use standard telecom components rather than single-photon detectors, and they integrate into photonic circuits.

Device-Independent and Self-Testing Designs

The strongest guarantees come from certifying randomness by observing a violation of a Bell inequality, which no classical model of the device can reproduce. Device-independent generators therefore bound the output entropy without trusting the internal workings of the apparatus, and semi-device-independent variants relax the requirements in exchange for limited trust assumptions. Loophole-free Bell experiments are demanding—they require high detection efficiency and space-like separation—so these systems remain laboratory instruments with modest output rates, not embedded components.

Practical Considerations

Commercial quantum generators ship as PCIe cards, USB modules, network appliances, and integrated photonic chips. In practice their randomness is never purely quantum: detector dark counts, afterpulsing, dead time, amplifier noise, and digitizer imperfections all contribute classical noise that an adversary might in principle control. A credible product therefore models the quantum and classical contributions separately, claims only the quantum part, and applies an information-theoretic extractor to distill it—the same discipline the classical standards demand, applied to a different physical model. Certification follows the same route as any other entropy source under SP 800-90B or the German AIS 20/31 classes. A companion article on quantum random numbers treats these devices in more detail.

Generators in Deployed Hardware

Concrete implementations show how the stages above combine under real area, power, and certification constraints.

Processor Instructions

Intel's on-die generator, introduced with the Ivy Bridge microarchitecture, digitizes thermal noise in a self-clocking all-digital circuit at roughly 3 gigabits per second, conditions pairs of 256-bit raw samples with AES in CBC-MAC mode, and seeds an SP 800-90A CTR_DRBG built on AES. Two instructions expose the result: RDRAND, present since Ivy Bridge, returns DRBG output and forces a reseed after at most 511 128-bit results, while RDSEED, added with the later Broadwell microarchitecture, returns conditioned entropy suitable for seeding another generator. Both instructions report success in the carry flag and may fail under heavy demand, so correct software checks the flag and retries rather than consuming the register blindly.

The Arm architecture defines an optional equivalent from Armv8.5-A onward. Reading the RNDR system register returns 64 random bits from a generator whose DRBG is reseeded at an implementation-defined rate, while RNDRRS forces a reseed from the entropy source before returning. The architecture expects the underlying entropy source to conform to SP 800-90B or AIS 31 and the DRBG to SP 800-90A. As with the x86 instructions, the read sets condition flags to indicate whether a value was actually returned.

Security Chips and Modules

A trusted platform module contains a certified generator that seeds all on-chip key generation and never exposes its raw entropy source. Smart cards and secure elements face the tightest constraints—microwatts of budget, a few thousand gates, and a hostile physical environment—so they favor ring-oscillator or metastability sources with aggressive health testing. A hardware security module, unconstrained by area, typically instantiates several dissimilar sources, combines them, and exposes throughput of megabits per second under a FIPS 140-3 certificate.

FPGA and ASIC Integration

Field-programmable devices cannot instantiate analog amplifiers or precision bias circuits, so their generators are built from lookup tables and flip-flops, most often as ring oscillators or as transition-effect designs that sample the propagation of an edge through a delay chain. Two hazards recur: place-and-route tools may optimize away or merge the very combinational loops the design depends on unless those loops are protected by synthesis constraints, and neighboring logic can inject enough switching noise to lock the oscillators. In an ASIC, the corresponding tasks are isolating the noise source with guard rings and dedicated supply regulation, and characterizing the entropy across process corners and the full temperature and voltage range rather than at nominal conditions.

Standards, Validation, and Testing

Government, payment, and telecommunications procurement generally requires that a generator be validated against a recognized standard by an accredited laboratory. Two families dominate.

The NIST SP 800-90 Series

• SP 800-90A Revision 1: Recommendation for random number generation using deterministic random bit generators—specifies Hash_DRBG, HMAC_DRBG, and CTR_DRBG
• SP 800-90B: Recommendation for the entropy sources used for random bit generation—specifies the entropy estimation procedures, health tests, and documentation required of a noise source
• SP 800-90C: Recommendation for random bit generator constructions—defines the RBG1, RBG2, RBG3, and RBGC classes that assemble a validated entropy source and an approved DRBG into a complete generator; the final version was published in September 2025 after several public drafts

Validation runs through the Cryptographic Algorithm Validation Program for the DRBG mechanism and the Entropy Source Validation program for the noise source, with module-level certification under FIPS 140-3 through the Cryptographic Module Validation Program. FIPS 140-3, which aligns United States requirements with ISO/IEC 19790, superseded FIPS 140-2 for new submissions; entropy source documentation, including the stochastic model and the estimation data, is a required part of a module submission.

The Status of SP 800-22

SP 800-22 Revision 1a, a statistical test suite comprising fifteen tests, is the most widely cited randomness document and the most widely misused. Its tests examine frequency and block frequency, runs and longest runs, binary matrix rank, spectral structure, overlapping and non-overlapping template matches, the universal statistical test, approximate entropy, serial correlation, linear complexity, cumulative sums, and random excursions. In April 2022 NIST announced a decision to revise the document—not to withdraw it—explicitly to clarify its purpose and to reject its use for assessing cryptographic random number generators. The practical guidance is unchanged and now official: use the suite to detect gross faults, and never as evidence of cryptographic quality.

German and International Schemes

The German Federal Office for Information Security specifies functionality classes in AIS 20 and AIS 31, applied within Common Criteria evaluations and revised as a unified document in 2024. The classes are widely used in the smart card industry: PTG.2 and PTG.3 cover physical generators, the latter adding cryptographic post-processing; NTG.1 covers non-physical true generators that draw on system events; and DRG.2 through DRG.4 cover deterministic generators with increasing resistance to state compromise. The scheme's insistence on an explicit stochastic model for the noise source has influenced practice well beyond Europe, and vendors serving both markets commonly seek AIS 31 and SP 800-90B evidence from the same characterization campaign.

Attacks and Failure Modes

Random number generators fail in characteristic ways, and the historical record is the best guide to which defenses matter.

Physical Degradation

Analog noise sources drift and die: amplifiers and comparators age, bias currents shift, avalanche devices degrade under stress, and latent manufacturing defects surface in the field. Temperature extremes, radiation, and supply instability move the source outside its modeled range. None of these failures announce themselves at the output of a conditioner, which is precisely why continuous testing on raw samples and environmental monitoring are mandatory rather than optional.

Active Attacks

An attacker with physical access can attempt to reduce entropy rather than to read it. Frequency injection through the power supply or an electromagnetic field can lock ring oscillators; cooling a device or lowering its supply voltage can shift a metastable source into a biased regime; clock or voltage glitching can disturb the sampling instant; and focused illumination of a decapsulated die can bias an optical or junction source. Generators also leak through the usual side channels—power traces and electromagnetic emissions that correlate with the values being produced or with the conditioner's operation, and timing variation in entropy collection. Countermeasures pair internal regulation, filtering, and shielding with health tests, tamper sensors, and constant-time output paths.

Seeding and State Failures

The most common real-world failures are architectural rather than physical:

• Boot-time entropy starvation: Embedded devices that generate keys on first boot, before interrupts and timing variation have accumulated, may produce predictable or duplicated keys. A large-scale survey of internet-facing TLS and SSH hosts published in 2012 found repeated and factorable keys across many devices for exactly this reason.
• State cloning: Virtual machines resumed from a snapshot, or images duplicated across a fleet, restart with an identical generator state and repeat their output until reseeded; hypervisors and guest kernels now provide explicit reseeding on clone or resume.
• Missing reseeds: A long-lived DRBG that never receives fresh entropy retains no prediction resistance after a state compromise.
• Nonce misuse: Signature schemes such as DSA and ECDSA leak the private key outright if the per-signature nonce repeats, and lattice techniques recover the key from a few bits of bias across many signatures. The 2010 compromise of a PlayStation 3 signing key followed from a nonce held constant across signatures, and a 2013 defect in the Android system generator that returned repeated values led to theft of bitcoin from affected wallets. Deterministic nonce generation, which derives the nonce from the message and the private key with HMAC, removes the dependence on a runtime generator for this case.

Implementation and Standardization Failures

• Debian OpenSSL, 2008: A packaging change made in 2006 and discovered in 2008 removed nearly all entropy from the seeding path, leaving key generation dependent on the process identifier and producing a small enough key space to enumerate exhaustively. Every affected key had to be regenerated and revoked.
• Dual_EC_DRBG: An elliptic-curve DRBG standardized in the original SP 800-90A and widely believed to contain a deliberate trapdoor in its published curve points. NIST recommended against its use in September 2013, removed it from the draft in 2014, and published SP 800-90A Revision 1 without it in June 2015. The episode remains the standard argument for transparent parameter generation and for designs whose security does not depend on the provenance of a constant.
• Untested integration: Correct components assembled incorrectly—entropy claimed twice from the same source, health test failures ignored by the caller, or a conditioner fed fewer raw bits than its entropy claim assumes—fail as completely as a broken noise source.

Implementation Considerations

Beyond the entropy source and the algorithms, several engineering constraints shape a deployable design.

Throughput Requirements

Applications differ by orders of magnitude in the rate they demand:

• Long-term key generation: A few hundred bits per key, at the highest assurance
• Protocol handshakes: Thousands of bits per session, at rates set by connection volume
• Bulk encryption and storage: Continuous streams for initialization vectors and tweak values, met by a DRBG rather than by a physical source
• Masking countermeasures: Large and steady demand, since fresh masks are consumed on every protected operation
• Simulation and modeling: Very high rates with no adversary, where a non-cryptographic generator is appropriate

Only the seed path needs the physical source. Sizing the design means matching the source's entropy rate to the reseed interval, not to the output rate.

Power and Area

Analog noise sources draw current continuously and resist scaling with process technology, whereas digital sources scale with the logic around them. Battery-powered designs commonly generate entropy on demand, power-gate the source between requests, buffer enough conditioned entropy to amortize the start-up and health-test sequence, and fall back to a DRBG between reseeds. The trade-off is latency: a gated source must complete its start-up tests before its first output may be trusted.

Interface Design

A generator's interface should make misuse difficult. That means blocking or returning an explicit error rather than stale data when entropy is unavailable, exposing health status to the consumer, distinguishing a seeding interface from a bulk output interface as RDSEED and RDRAND do, and refusing to operate before initialization completes. Many historical failures trace to interfaces that silently returned something rather than reporting that they could not.

Verification and Production Test

Entropy cannot be verified by inspection, so verification spans the whole life cycle: simulation and formal checks of the deterministic logic, silicon characterization across process corners and the full voltage and temperature range, entropy measurement on raw samples from many devices rather than one, per-unit production testing that confirms the source is alive and unbiased, and field monitoring through the continuous health tests. Recertification after a process shrink or a foundry change is necessary because the entropy model depends on device physics that both alter.

Applications

Random values underpin nearly every cryptographic mechanism, with requirements that vary by use.

Key Generation

Symmetric keys and asymmetric key pairs demand the highest assurance, because a weak key compromises everything it protects for its entire lifetime and, unlike a session value, cannot be discarded after one use. Key generation typically draws from a freshly reseeded DRBG or directly from conditioned entropy, and it is the operation most often placed inside a certified module.

Protocol Values

Handshakes consume random nonces, initialization vectors, ephemeral key shares, and session identifiers in volume. Individual values are short-lived, but predictability is fatal: a guessable TLS client random or a repeated GCM initialization vector under the same key breaks confidentiality outright. High-volume servers are the usual driver for hybrid architectures.

Countermeasures and Protocol Hygiene

Randomness also defends implementations rather than messages. Masking and blinding schemes described in side-channel attack prevention consume fresh random values on every operation, address space layout randomization and pointer authentication rely on unpredictable values at boot, and probabilistic padding schemes such as RSA-OAEP and RSA-PSS require randomness for their security proofs.

Blockchain and Digital Assets

A cryptocurrency private key is a random number, and the transactions it authorizes are irreversible. Predictable generation has repeatedly led to theft, sometimes years after the keys were created, because an attacker can scan the public ledger for addresses derived from weak keys. Hardware wallets exist largely to move key generation into a device with a certified generator and no network exposure.

Gaming and Lotteries

Regulated gaming requires unpredictable and unbiased outcomes, and jurisdictions generally mandate certified generators, documented entropy sources, periodic re-testing by an accredited laboratory, and tamper-evident hardware. The financial incentive to attack these systems is direct, and the assurance requirements are correspondingly close to those in cryptography.

Emerging Directions

Research continues on new physical effects, on integration, and on the analysis that supports entropy claims.

New Physical Mechanisms

• Emerging memory devices: Stochastic switching in resistive, phase-change, and magnetic memory cells, which promises dense generators co-located with storage
• Spintronic sources: Thermally driven fluctuation of superparamagnetic tunnel junctions, offering high rates at low energy per bit
• Integrated photonics: Vacuum-fluctuation and phase-diffusion quantum sources reduced to a chip alongside their detectors
• Device-level noise: Random telegraph noise, which grows more pronounced as transistors shrink

Each faces the same barrier to adoption: a convincing stochastic model and stable behavior across temperature, voltage, and aging. Chaotic circuits illustrate the difficulty, since a chaotic map is deterministic by construction and its output is unpredictable only to the extent that genuine noise is amplified, which is a claim that must be quantified rather than asserted.

Post-Quantum Requirements

Quantum computers threaten the public-key algorithms now in use but not the generators that seed them. The post-quantum algorithms standardized by NIST in 2024 remain heavy consumers of randomness: their key generation expands short random seeds into large keys, and their signature operations may be randomized to resist fault and side-channel attacks. Because a seed of a few dozen bytes determines an entire key pair, entropy quality matters at least as much as before, and migration plans should verify the generator alongside the algorithms.

Analysis and Tooling

Machine learning is being applied from both directions: as an adversary, where predictors detect structure that classical tests miss and now appear among the SP 800-90B estimators in spirit, and as a design aid for anomaly detection in continuous health monitoring. Formal verification of the deterministic parts of a generator, and automated checking that health tests are actually wired to the failure path, address the integration errors that account for many field failures.

Best Practices

Experience across several decades of failures suggests a short list of rules.

Design

• Model before measuring: Derive an entropy bound from device physics, then confirm it empirically; do not infer entropy from test-suite results
• Estimate conservatively: Claim the smallest defensible entropy rate and validate at the worst environmental corner
• Test raw samples: Place health tests before conditioning, and route their failures to a hard stop
• Use several sources: Dissimilar noise sources raise the cost of a single failure and of an injection attack
• Reuse vetted primitives: Prefer standardized DRBGs and conditioning components over custom constructions
• Follow a recognized scheme: Design to SP 800-90B, AIS 31, or both from the outset, since retrofitting the required evidence is expensive

Operation

• Seed early and fully: Provide a factory or provisioning seed so that first-boot key generation never runs entropy-starved
• Reseed regularly: Refresh the DRBG on a schedule and after any event that may have cloned or exposed its state
• Fail loudly: Treat a health test failure as an availability problem, never as something to ignore
• Keep the path updatable: Firmware update capability allows algorithms, thresholds, and tests to be corrected in the field
• Rotate keys: Limiting key lifetime bounds the damage from a generator weakness discovered later

Documentation

Certification and post-incident analysis both depend on records: a description of the noise source and its stochastic model, the entropy estimation method and its raw data, the conditioning and extraction design with its entropy accounting, health test specifications and cutoffs with their false-alarm rates, the environmental range over which claims hold, and the validation certificates that apply.

Conclusion

Random number generation is the foundation on which the rest of a cryptographic system rests, and it is the layer whose failures are hardest to observe. Physical sources supply genuine uncertainty at modest rates; conditioning and extraction concentrate that uncertainty into uniform bits; deterministic generators amplify it into a usable stream; and health tests, environmental monitoring, and validation provide the evidence that the whole chain still works.

The recurring lesson from the field is that the algorithms are rarely the problem. Entropy overestimated at a favorable temperature, health tests whose failures nothing acts upon, devices that generate keys before any entropy exists, and states cloned along with a virtual machine have compromised far more systems than any weakness in AES or SHA-2. A designer who models the noise source honestly, tests it where it is still raw, reseeds diligently, and fails loudly will have addressed most of the ways that generators go wrong.

Related Topics