How to Test an Entropy Source

Step 1: define what you are testing

Write down the actual source boundary.

Is the dataset:

• raw ADC output?
• a digitized comparator output?
• post-processed data?
• conditioned bits?
• DRBG output?

Those are not interchangeable. If you do not know where the file was captured, the resulting entropy number can be impossible to interpret.

Step 2: document the source model

Describe where unpredictability is expected to come from and how the hardware converts that physical behavior into samples.

For a QRNG, include the claimed quantum phenomenon and the classical measurement chain. For a classical TRNG, document the physical noise source and acquisition path.

The model should also identify predictable or classical contributions that may appear in the measurement.

Step 3: collect raw sequential data

Collect data representative of normal operation and preserve the rawest practical point required by the evaluation.

Record:

• sample encoding and width;
• sample rate;
• device configuration;
• environment;
• software/firmware version;
• acquisition duration;
• any discarded startup period.

Do not “improve” the file before assessment unless the evaluation explicitly targets that processed stage.

Step 4: decide whether IID is justified

Do not choose IID because it returns a stronger entropy estimate.

If the source lacks a compelling independence/stationarity argument, start with the non-IID path. NIST's EntropyAssessment repository notes that most commonly used entropy sources are not IID.

If you later make an IID claim, document the physical and statistical justification.

Step 5: run entropy estimation

Use the applicable SP 800-90B assessment method on the appropriate data.

Record the individual estimator results rather than only the final minimum. The most conservative estimator can reveal what kind of structure is limiting the entropy estimate.

Also record the assessment-tool version and exact command line or configuration.

Step 6: evaluate restart behavior

If the source can be restarted, collect a genuine restart dataset rather than slicing a continuous file.

Restart analysis can reveal repeated initialization structure that sequential testing misses.

Document the restart definition and any delay between restart and first collected sample.

Step 7: review health tests

Ask what the implementation monitors while running.

A laboratory entropy estimate does not protect against a later stuck signal, disconnected sensor, temperature excursion or other source failure. Operational health tests should have documented failure behavior.

Step 8: review conditioning

Identify the conditioning function, input/output widths, entropy budget and its position in the system.

Avoid inferring entropy from the uniformity of conditioned output. A deterministic post-processing step can hide defects from simple output statistics.

Step 9: stress the source model

A meaningful engineering evaluation considers relevant operating conditions rather than one convenient bench setup.

Depending on the device, this may include temperature, supply variation, clock conditions, electromagnetic environment, aging, manufacturing spread or source-specific stresses.

Do not publish universal stress ranges unless they come from the implementation's actual specification or evaluation plan.

Step 10: separate pre-assessment from validation

A local tool can tell you useful things about datasets. It does not issue a NIST certificate.

NIST's ESV process includes tool execution plus documentation and CMVP review. Use phrases such as “preliminary engineering assessment” unless you have the formal validation evidence for a specific product and configuration.

A compact evidence package

A useful internal assessment folder contains:

• source architecture diagram;
• source-model description;
• sequential dataset hash and acquisition notes;
• restart dataset hash and acquisition notes;
• assessment tool/version;
• estimator outputs;
• health-test description;
• conditioning description;
• operating-condition notes;
• open issues and assumptions.

This is much more useful than a screenshot showing “PASS.”

Free local workflow

QRNG.io provides a local assessment kit so engineers can run NIST's entropy-assessment tooling without uploading proprietary raw datasets. Use it as a preliminary assessment and keep the full standards and formal validation requirements in view.

Sources and further reading

1. NIST SP 800-90B
2. NIST EntropyAssessment
3. NIST ESV
4. NIST ESV documents