There are three classes of random number generators (my own informal classes), dependant on the relative entropies that flow in and out:-
Class 1. Hout < Hin, which is a true random number generator (the most secure and best) such as those by Swiss company ID Quantique. This is the class of generator that can be used for creating one time pad material.
Class 2. Hout > Hin, the most common commercial type like ultra fast beam splitters and ostensibly /dev/random.
Class 3. Hout >> Hin, which is a reseeded psuedo random number generator like /dev/urandom.
where H is the entropy.
Let's try and make a Class 1 type which is the most pure and secure.
- Capture 1MB from your entropy source over 28 hours. Why rush?
- Aquire a good compression tool like fp8.exe.
- Compress the entropy sample, divide by two for safety and you have a very good estimate of usable cryptographic entropy rate from the source. This step is CRUCIAL in determining the entropy rate. Do not try to use the fancy Shannon formula as it won't work if there is any auto correlation in the entropy stream.
- I'm unfamiliar with the input width to HKDF, but simply divide it by your generation rate and that's the time between re seeding.
- You don't need the PRNG. The HKDF whilst exorbitant, will act perfectly as an entropy extractor.
As an example, if you're using SHA-256 it would need 256 bits of entropy as an input. If your raw entropy rate is 10 bits /s, it might be say 4 when you measure it using my technique. So feed SHA-256 every
64 seconds will create a class one generator which is a true random number generator. Reducing the feed rate will reduce the security and you will have a class two which might be acceptable to you.
PS. I find it a bad idea to use a cryptographic function as a randomness extractor. It's mathematically unnecessary and dangerous in that if the entropy source misbehaves or you've underestimated the entropy generator rate, you'll never know. If you use a much simpler randomness extractor such as a compression function /matrix, any mistake you've made will immediately become obvious in the quality of the final output. HDKF will continue to produce uniformly distributed random numbers with any kind of rubbish input and you'll never know which class the generator is running within.
PPS. Don't follow any of the NIST guidance. It's specifically crippled to preclude the creation of true random number generators and therefore not as secure as it could be. Unfortunately (but not unexpectedly) you will find a heavy bias towards NIST on this forum. If you need further guidance, look to Europe like AIS or ISO standards. Maybe the French too :-(