# What should be used as a source for entropy?

I have hardware based RNG which consists of TRNG and PRNG. TRNG is giving out 512 bit number which is being used as seed for PRNG. RNG is generating 160 bit random number using PRNG and reseeding is done after 2^20 numbers. I want to use hardware based RNG as entropy source. What should be used as source of entropy i.e. output of TRNG or PRNG ?

• As pure entropy source for a software (CS)PRNG? Always use the TRNG. – SEJPM Jul 29 '16 at 22:13
• For information-theoretical reasons, the roughly $160$ million bits obtained from the PRNG before reseeding still have a total entropy of at most $512$ bits. On the other hand, the TRNG should in theory yield a full bit of entropy per extracted bit. – yyyyyyy Jul 29 '16 at 23:17
• SEjPM & yyyyyyy , Thanks for your replies. @yyyyyyy , simplified formula for entropy (log2n) gives value of 7.32 for 160 bits and 9 for 512 bits. Will I be justified to claim 7.32 bit entropy if I decide to use output of RNG ? – user2363993 Jul 30 '16 at 0:05
• Why can't you just use the TRNG as the RNG without interposing a PRNG? The randomness is better that way... – Paul Uszak Sep 11 '16 at 21:55

If you need an entropy source, that's the TRNG, kind of by definition. A TRNG provides unpredictable output by physical means. An entropy source is one that provides unpredictable output; the entropy is a measure of how unpredictable.

Hardware entropy sources are rarely uniform, so they should never be used as an RNG, but as a seed to a CSPRNG, i.e. a deterministic algorithm that “smoothen” all correlations between bits.

So if you really need an entropy source, use the TRNG. But if what you're doing is anything other than seeding a CSPRNG, then what you really need is a random source; for that, use the CSPRNG seeded by the TRNG.

Having a 160-bit output makes me fear that your CSPRNG is based on SHA-1. SHA-1 is deprecated, but not broken yet. If you're using SHA-1, you should plan to replace it by SHA-256, but it isn't very urgent. What matters is primarily that you use a good CSPRNG algorithm on top of whatever hash or other cryptographic primitive you're using, hopefully NIST's Hash_DRBG or HMAC_DRBG if it's based on a hash.

simplified formula for entropy (log2n) gives value of 7.32 for 160 bits and 9 for 512 bits. Will I be justified to claim 7.32 bit entropy if I decide to use the output of RNG?

Your calculation doesn't make sense. Think of what $$n$$ is in this formula! The entropy of a source with $$n$$ possible different equiprobable values is $$\log_2(n)$$. The entropy of a source that provides $$k$$ independent bits is $$k$$. If your source provided 512 independent bits then you would get 512 bits of entropy from it, but in practice physical sources have some amount of correlation that's hard to evaluate precisely, so you probably have much less. In any case, what matters with entropy is that it's sufficient to make the probability that a brute-force attack would succeed negligible. For this purpose, there is no meaningful difference between 160 bits and 512 bits.

• Just to clarify some confusions. Entropy source $\ne$ TRNG. And a TRNG doesn't require a CSPRNG which is actually kinda dangerous. Or any type of cryptographic processing whatsoever. The inherent security comes from non determinism. – Paul Uszak Nov 3 at 2:52
• @PaulUszak As you've been told many times on this site, you don't understand how to build a random generator. A random generator without a CSPRNG would be very dangerous. Please stop spamming uninformed comments. – Gilles 'SO- stop being evil' Nov 3 at 10:31
• Okey-dokey, but I'm trying to help you with the 1st part of your answer which is pretty wrong. It's a common mistake to think that cryptography is necessary within a TRNG. Commercial and laboratory one's (or mine) don't do it that way. – Paul Uszak Nov 3 at 13:45