# What is an impure NIST true random number generator?

I'm working on a true random number generator, and I came across this phrase in the American NIST guide, in section 6.4.1 Non-Approved Conditioning Components:

The entropy rate provided shall be no greater than the entropy rate provided by the input to the conditioning component; full entropy shall not be provided by non-approved conditioning components.

This suggests that you can have a random number generator that does not provide full entropy. So if you use the de-rigour noisy diode source natively generating approximately 50% pure entropy, your generator can only output 50% entropy. I'm unaware of any source that can natively generate 8 bits /byte entropy. It would actually be undesirable to run the source sampling equipment cranked up to 100% for many engineering reasons.

What is the point of a true random number generator that only produces half pure entropy? Do you only use it half of the time? Or do you just use every other byte (the random ones), ignoring the predictable ones? Seriously though, is it just a thinly veiled warning that "it's our way or no way"? Or..?

• You need to condition and compress the entropy, see the whitepaper of Intel RDRAND on how they do it – Richie Frame Jan 8 '16 at 2:12
• also that document is for the entropy source of a random number generator, you should not use an entropy source directly for random bits – Richie Frame Jan 8 '16 at 2:23
• How do you get that a noisy diode source is natively generating approximately 50% pure entropy? For a start, it does not output bits; the conditioning circuit does, and it is very hard to tell the entropy rate of that output. – fgrieu Jan 8 '16 at 7:46
• @fgrieu Well actually... An analogue to digital conversion occurs in the sampling circuity. For reasons of gain linearity, slew rate limitations, and to get that 9 sigma spike you might well run amplification stages for 50% of max. rms output. You'll need a certain bias level just to turn the thing on. Hence (very roughly) 50% entropy going into the conditioning stage and my question. Entropy rate output is easily estimated via compression. Experimentation suggests 25% out from what goes into mine. – Paul Uszak Jan 8 '16 at 14:23

The NIST source you link to is SP 800-90B. If you look at the other two publications in the series: 90A and 90C, you can find explanations of how you can use a TRNG to instantiate a DRBG or requirements on how to condition the entropy.

Here is what section 7.1 of 90A says about entropy input to a DRBG:

Ideally, the entropy input will have full entropy; however, the DRBG mechanisms have been specified to allow for some bias in the entropy input by allowing the length of the entropy input to be longer than the required amount of entropy (expressed in bits). The entropy input can be defined to be a variable length (within limits), as well as fixed length.

So you can use a TRNG with 50% entropy rate to initialize a DRBG, you just need a longer input.

90C defines the assumptions more exactly in section 4.2:

1. An entropy source output string containing $2n$ bits of entropy can be conditioned into a string of $n$ bits that contains full entropy output1 using an approved conditioning function, where $n$ is the length of the output block of the approved derivation function (see SP 800-90B). Note that in SP 800-90C, a derivation function2 is used as a conditioning function.
2. A DRBG that has been instantiated at a given security_strength can be used to produce security_strength/2 bits of full entropy output if constructed as specified herein.

The approved conditioning functions are listed in 90B, after the section you quote. Anything else would fall under non-approved, but something sufficiently standard would be fine if you do not mind diverging from what NIST says.

So a half-entropy TRNG is very useful. You just need to take the entropy rate into account when using it.

• 1.) I think that one of us is confused, and I fear that it might be me. I understood that a TRNG produced true random numbers ready for use. That's what hardware manufacturers sell. That's what Wikipedia says. That's what HotBits do. Otherwise it's just an entropy source of indeterminate purity like smashing the keyboard. 2.) I'm looking to use the output from my generator directly, not as a seed for a DRBG. 3.) I specifically excluded section 4.2 from my question as I will be using an "unapproved" technique covered by section 6.4.1. Is this NSA leverage? – Paul Uszak Jan 8 '16 at 13:49
• @Paul Uszak: I have met many sources with allegedly 1-bit entropy rate, and found all to be either distinguishable from random with a lot of high-resolution samples and a careful test; documented as conditioned; or poorly documented. I conclude there are 3 kinds of TRNG sources: (1) unconditioned with less that 1-bit entropy rate; (2) conditioned with 1-bit entropy rate; (3) snake oil. – fgrieu Jan 8 '16 at 14:19
• @PaulUszak, 1) a full-entropy TRNG must use some kind of conditioning, which your NIST quote says cannot use a non-approved method (approved methods are in subsequent sections); 2) in that case you need conditioning, either "in" the TRNG or a layer above in software; 3) then why do you care about NIST requirements? – otus Jan 8 '16 at 15:19
• @PaulUszak in that case, you need to be aware that the document you referenced is ONLY talking about the entropy source, and its conditioning, not about randomness extraction. The notes about conditioned entropy are required for how to deal with extraction in the next stage, the DRBG, which has to make an assumption about the maximum entropy per bit of the source in order to produce quality output – Richie Frame Jan 9 '16 at 2:27
• @PaulUszak, so what is your question at this point? Because the answer to those in the last paragraph of the actual question post is, as I wrote above, that it can be used as a DRBG seed or be conditioned for immediate use. – otus Jan 9 '16 at 8:38