I need to write some high-level security requirements which include a random number generator suitable for use in cryptography. I don't need something very formal, this isn't a security certification or a work order. I just want to go to the next level from “supply a proper RNG”.
A proper RNG should be built on a cryptographic PRNG seeded from an appropriate entropy source. For the cryptographic PRNG and even the seeding method, it isn't hard to find applicable standards; for example, I'd be content to write that the PRNG must use one of the algorithms listed in FIPS 140-2 annex C, or attain an equivalent security level.
What about entropy collection or seeding? Is there a similar document that I can quote? Anything easily available in English would do, it doesn't have to be (or not to be) a government standard or an RFC or similar, but it's better if it looks somewhat official or trustworthy.
Offering concrete guidance would be a plus. However this could be hard since the requirements may need to be met in very different ways (e.g. a non-deterministic oscillator in an embedded device, a server with a radioactive source, a PC with someone wiggling the mouse, …).