01
Multi-bit, off device
Successive-approximation converters prefer some codes. Extracting or Von Neumann-whitening a single bit on the acquisition device throws away most of the analog entropy and remains exposed to that preference.
SciMetrology
Black-box validation.
Hardware schematics, analog operating points, and digitization layouts are unpublished. Public assurance rests on a negative control, a conservative SP 800-90B entropy estimate, vetted conditioning, and receipts a third party can check. These figures are engineering measurements. They are not a NIST certificate, not a FIPS 140-3 validation, and not a GLI-19 certificate.
Solid-state avalanche sources → Raw digitization → SP 800-90B health gate → HMAC-SHA-256 (CP2) → Serve-once pool
Physical avalanche breakdown is the sole declared entropy source. The server never mixes or substitutes vendor on-chip RNGs, operating-system CSPRNGs, or deterministic DRBGs into conditioned output.
01Negative control
Isolate the source. Leave the rest of the chain on.
A uniformity battery cannot prove that a stream comes from a physical noise phenomenon rather than deterministic silicon state or power-rail hum. Each source architecture is validated against a matched baseline: analog amplification and digitization stay powered and terminated at an equivalent DC impedance while the avalanche stage is isolated.
Reference campaign: 1,000,000 samples, source engaged against source isolated.
| Metric | Active avalanche source | Negative control |
|---|---|---|
| Sample standard deviation (σ) | 249.21 counts | 14.44 counts |
| Variance ratio (σ² on / σ² off) | ~298× | 1× baseline floor |
| Spectral flatness, 10 Hz to Nyquist | 0.9956 | 0.6428 |
| Raw lag-1 autocorrelation | −0.00085 | +0.37706 |
| Raw lag-32 autocorrelation | +0.00110 | +0.23059 |
| First-order LSB transition independence | p = 0.933 | p = 2.95 × 10⁻⁵³ |
When the avalanche stage is isolated, variance collapses by 99.66% (about 298×), spectral flatness drops into low-frequency electronic drift, and strong temporal memory persists past 32 lags. Engaging the avalanche stage dominates the channel with wideband, near-white fluctuations whose lag-1 autocorrelation drops below 10⁻³. Later production profiles sit further above that floor (σ above 300 counts, spectral flatness at least 0.9989).
02Why integrated RNGs stay out
Uniform bytes can still be a formula.
A separate 8,000,000-word control evaluated standard microcontroller hardware RNG registers both with internal RF entropy injection active and in deterministic PRNG fallback (RF disabled). Both modes produced byte min-entropy near 7.97 bits/byte, zero 32-bit consecutive duplicates, and indistinguishable binomial popcounts.
Standard uniformity tests cannot tell a deterministic silicon PRNG from live physical entropy. Built-in microcontroller RNG peripherals are therefore excluded from the Analog Seed path. Every served bit traces to digitized analog avalanche breakdown checked against a physical negative control.
02
Health before compression
Online gates inspect the unconditioned multi-bit stream, where a locked rail, a lost avalanche stage, narrowband interference, or a stalled converter is visible.
03
Condition under a credit
Cryptographic conditioning compresses blocks of raw multi-bit samples under a conservative entropy credit. It absorbs converter non-idealities without assuming uniform quantization.
03SP 800-90B non-IID
Assessed floor 4.313. Credited floor 2.
Eleven sequential 1,000,000-sample field audit blocks were evaluated with the official NIST SP 800-90B suite (ea_non_iid 1.1.8), checked against the reference self-test suite to within 1.01 × 10⁻¹³. The 1-bit and 8-bit figures are projections of the same samples. They are never summed.
0.786
bit/sample · 1-bit LSB
Minimum initial entropy H_I = 0.785960 bit/sample, bounded by the compression test.
4.313
bit/sample · 8-LSB floor
Minimum H_original = 5.086706 bit/sample. Minimum 8 × H_bitstring = 4.313228, bounded by the bitstring collision test. Worst-case floor across all eleven blocks: 4.313227856926572 bit/sample. Range: 4.313228 to 4.397476.
2
bit/sample · CP2 credit
Less than half the assessed floor, then compressed again 2:1 by HMAC-SHA-256. This run is an initial non-IID estimate. It does not include the 1,000-restart matrix of SP 800-90B §3.1.4.1.
CP2Conditioning construction
- Consecutive non-overlapping windows of 256 raw samples (512 bytes) enter each step. Trailing samples at the end of a 1,000,000-sample block are discarded.
- Credited input per window: 256 × 2 bits = 512 bits, over about 1,104 bits assessed.
- Output per window: 256 bits (32 bytes), the 2:1 ratio used in SP 800-90C for full-entropy output.
- K_cond is a 256-bit secret held only on the server and counts for zero bits of entropy.
- Older CP1 segments stay labeled CP1 (0.5 bit/sample, 1,024 samples per 32-byte output) until they are consumed. A new circuit does not inherit CP2.
out_i = HMAC-SHA-256(K_cond, "AS-CP2" || session_id || u32le(chunk_seq) || u32le(i) || window_i)
04Online health gates
Fail one check and the block never enters the pool.
Every incoming raw block must pass all of the following before classification. A failure is quarantined and contributes zero bytes. The gate does not raise the credit.
| Check | Rejection criterion |
|---|---|
| Structural and CRC integrity | Frame mismatch, sample count other than 1,000,000, or CRC-32 failure |
| Avalanche variance floor | Global σ < 150 counts, or σ < 100 counts in any 65,536-sample window |
| LSB bias | P(LSB = 1) outside [0.45, 0.55] |
| Repetition Count Test (RCT, 90B §4.4.1) | Identical raw-code run length ≥ 8 (reference maximum observed: 3) |
| Adaptive Proportion Test (APT, 90B §4.4.2) | First-symbol count ≥ 410 in any 512-LSB window (H = 0.5, α = 2⁻²⁰) |
| Short-lag memory | Absolute raw lag-1 autocorrelation ≥ 0.05 |
| Acquisition rate stability | Sample rate outside ±10% of the calibrated nominal for that source profile |
05Audit and production
One block in sixteen is kept. The rest of the raw is destroyed.
Accepted blocks are routed before their sample values are inspected, using only the sequence number. Audit and production are disjoint. No stored archive can reconstruct a served output.
- 01AuditRetained. Never served.
- 02ProductionConditioned. Raw destroyed in RAM.
- 03ProductionConditioned. Raw destroyed in RAM.
- 04ProductionConditioned. Raw destroyed in RAM.
- 05ProductionConditioned. Raw destroyed in RAM.
- 06ProductionConditioned. Raw destroyed in RAM.
- 07ProductionConditioned. Raw destroyed in RAM.
- 08ProductionConditioned. Raw destroyed in RAM.
- 09ProductionConditioned. Raw destroyed in RAM.
- 10ProductionConditioned. Raw destroyed in RAM.
- 11ProductionConditioned. Raw destroyed in RAM.
- 12ProductionConditioned. Raw destroyed in RAM.
- 13ProductionConditioned. Raw destroyed in RAM.
- 14ProductionConditioned. Raw destroyed in RAM.
- 15ProductionConditioned. Raw destroyed in RAM.
- 16ProductionConditioned. Raw destroyed in RAM.
1/16Audit
Sequence 0 and every sequence divisible by 16. Retained privately for spectral and statistical drift monitoring. Never conditioned into the pool. Never served.
15/16Production
Conditioned in memory with HMAC-SHA-256. The conditioned output is appended to the serve-once pool. The raw samples are destroyed immediately and never touch disk.