TRNG Design: True Random Number Generators for Cryptographic Systems
Every cryptographic operation ultimately depends on unpredictable secret values: session keys, nonces, initialization vectors, padding, blinding factors, and key-pair seeds. A True Random Number Generator (TRNG) harvests randomness from a physical, non-deterministic process and conditions it into high-quality bits. Unlike software pseudo-random generators, a well-designed TRNG produces entropy that cannot be predicted or reproduced even by an attacker with full knowledge of the design. This article covers the architecture, entropy sources, health testing, and standards compliance required to build a TRNG suitable for security silicon.
Quick Summary
| Entropy Source | Physical noise (oscillator jitter, metastability, thermal noise) produces raw, biased bits |
| Health Tests | Continuous online tests (repetition count, adaptive proportion) detect source failure |
| Conditioning | Post-processing (von Neumann, cryptographic hash) removes bias and concentrates entropy |
TRNG vs PRNG vs DRBG
Understanding the distinction between these three classes is fundamental to correct system design. They are not interchangeable, and confusing them is a common source of cryptographic weakness.
- TRNG (True / Physical RNG): Derives entropy from a non-deterministic physical phenomenon. Output is unpredictable and non-reproducible. Throughput is limited by the physics of the noise source.
- PRNG (Pseudo-Random Number Generator): A deterministic algorithm that expands a seed into a long sequence. Fast and reproducible, but fully predictable if the seed or internal state leaks. Not safe for keys unless cryptographically strong and properly seeded.
- DRBG (Deterministic Random Bit Generator): A cryptographically secure PRNG defined in NIST SP 800-90A (CTR_DRBG, Hash_DRBG, HMAC_DRBG). It is seeded by a TRNG and provides backtracking resistance and reseeding.
The standard architecture pairs them: a TRNG provides the entropy seed, and a DRBG expands that seed into the high-rate stream that applications consume. This gives both true unpredictability and the throughput required for line-rate cryptography.
rand()) to generate cryptographic keys. The full state can be recovered from a handful of outputs.
Physical Entropy Sources
The entropy source is the heart of any TRNG. It must convert an unpredictable analog physical process into a digital bitstream. Three families dominate on-chip designs.
Ring Oscillator Jitter
A ring oscillator is an odd number of inverters connected in a loop, producing a free-running clock whose period exhibits phase jitter from thermal and flicker noise. By sampling a fast jittery oscillator with a slower reference clock (or sampling one ring with another), the accumulated jitter randomizes the sampled bit. Multiple independent rings are commonly XOR-combined to increase per-bit entropy and reduce correlation. Ring oscillators are popular because they are fully digital, synthesizable, and process-portable, but they are sensitive to deterministic coupling, power-supply injection, and frequency locking, all of which must be mitigated.
Metastability
When a flip-flop's data input violates setup/hold timing, the device may enter a metastable state and resolve to 0 or 1 unpredictably. A purpose-built metastability cell drives a latch or arbiter into its balance point so that thermal noise decides the outcome. Metastability-based sources can offer high per-bit entropy with a compact footprint, but they require careful balancing because device mismatch and offset bias the resolution toward one value, demanding strong post-processing.
Thermal (Johnson-Nyquist) Noise
Thermal noise is the voltage fluctuation across a resistor caused by random carrier motion, with power spectral density proportional to kTR. It is a fundamental, well-characterized physical source. An analog front end amplifies this noise and a comparator/ADC digitizes it. Thermal-noise sources have a strong theoretical entropy model, but they require analog design effort, are area- and power-hungry, and are more susceptible to amplifier offset and EMI than digital ring-oscillator approaches.
Sampling and Raw Bit Generation
The digitization stage samples the analog/timing randomness into a raw bitstream (digitized noise source output). Two parameters dominate design quality:
- Sampling rate: Sampling too fast relative to how quickly fresh entropy accumulates produces highly correlated, low-entropy bits. The interval must allow enough jitter/noise to build up between samples.
- Bias and serial correlation: Raw bits are almost never ideal. They typically show a bias (P(1) ≠ 0.5) and short-range correlation. These are expected and are removed downstream, never by assuming the source is perfect.
Crucially, designers must estimate the entropy of the raw bits before conditioning, because conditioning cannot create entropy, only concentrate it. The amount of raw data that must be compressed is set by the measured min-entropy of the source.
Min-Entropy of a Source
H∞ = -log2(pmax)
Where pmax is the probability of the most likely output value. Min-entropy is the conservative worst-case measure used by NIST SP 800-90B; it bounds an attacker's best single-guess success probability.
Example: If the most probable bit value occurs with pmax = 0.55, then H∞ = -log2(0.55) ≈ 0.862 bits of entropy per raw bit. To extract a 256-bit full-entropy key you must compress at least ⌈256 / 0.862⌉ = 298 raw bits.
Online Health Tests
A TRNG must continuously verify that its entropy source is still alive and healthy. A source can degrade silently due to aging, temperature extremes, voltage manipulation, or an active fault-injection attack. NIST SP 800-90B mandates two specific continuous tests, plus a more thorough start-up test.
Repetition Count Test
This test detects a catastrophic "stuck" source. It counts how many times the most recent sample value repeats consecutively; if the run length reaches a cutoff C derived from the claimed per-sample entropy and a target false-alarm rate (typically 2-20 to 2-40), the test raises an alarm. It catches a source that has frozen to a constant value almost immediately.
Adaptive Proportion Test
This test detects a loss of entropy that is less severe than a full stuck-at fault, such as a growing bias. It selects a sample, then counts how many times that value reappears within a sliding window (1024 samples for binary, 512 for non-binary). If the count exceeds a statistically derived cutoff, the source is declared unhealthy. Together, the repetition count and adaptive proportion tests provide fast detection of both abrupt and gradual failures.
Post-Processing and Conditioning
Raw entropy bits are biased and correlated, so a conditioning stage compresses them into a shorter, near-uniform output. Conditioning increases entropy per bit but never increases total entropy, which is why accurate raw-source entropy estimation is non-negotiable.
Von Neumann Debiasing
The von Neumann corrector removes bias from independent bits with unknown but fixed probability. It examines non-overlapping bit pairs: 01 → output 0, 10 → output 1, and discards 00 and 11. The output is perfectly unbiased provided the input bits are independent, but it requires that independence and discards a large fraction of input (throughput drops by at least 75%). It does not correct serial correlation, so it is best used on sources that are biased but largely uncorrelated.
Cryptographic Conditioning (Hashing)
For sources with both bias and correlation, a cryptographic conditioning function is preferred. A vetted function such as SHA-256, SHA-3, AES-CBC-MAC, or HMAC compresses a block of raw bits carrying more than n bits of entropy into an n-bit output that is computationally indistinguishable from uniform. NIST SP 800-90B lists these as approved "vetted conditioning components." This is the dominant choice in modern security IP because it tolerates imperfect sources and integrates cleanly with the downstream DRBG.
Standards and Certification
Cryptographic TRNGs are not validated by inspection; they must conform to recognized standards and, for many markets, pass formal certification.
NIST SP 800-90A / B / C
- SP 800-90A: Specifies approved DRBG mechanisms (Hash_DRBG, HMAC_DRBG, CTR_DRBG) used to expand a TRNG seed.
- SP 800-90B: Defines requirements for entropy sources, including the min-entropy estimation methodology, the IID and non-IID test suites, and the mandatory health tests.
- SP 800-90C: Defines RBG constructions that combine an entropy source (90B) with a DRBG (90A) to build a complete random bit generator.
FIPS 140-3
FIPS 140-3 is the overarching U.S./Canadian standard for cryptographic modules. For the RNG, it requires the entropy source to meet SP 800-90B, the DRBG to meet SP 800-90A, and the assembly to follow SP 800-90C. It also mandates power-on self-tests, conditional self-tests, and documented entropy justification (an Entropy Source Validation, ESV, report). Compliance is required for U.S. federal procurement and is widely demanded in regulated industries.
AIS-31 (BSI)
AIS-31 is the German BSI evaluation methodology used within Common Criteria, defining functionality classes PTG.1, PTG.2, and PTG.3. PTG.2 requires a stochastic model of the noise source plus online tests; PTG.3 additionally requires cryptographic post-processing combined with a DRG. AIS-31 is the de facto requirement for smart cards, secure elements, and many European/global certifications.
| Entropy Source | Implementation | Throughput | Area / Power | Key Vulnerability |
|---|---|---|---|---|
| Ring Oscillator Jitter | Fully digital, synthesizable | Medium-High | Low | Frequency locking, power-supply injection |
| Metastability | Digital, requires balancing | High | Very Low | Device mismatch / offset bias |
| Thermal Noise | Analog front end + ADC | Medium | High | Amplifier offset, EMI coupling |
| Shot Noise (diode) | Analog, reverse-biased junction | Medium | Medium-High | Temperature drift, process variation |
Implementation Best Practices
- Build a stochastic model: Characterize the physical source mathematically (AIS-31 PTG.2/PTG.3 require this) rather than relying solely on empirical pass/fail testing.
- Estimate min-entropy conservatively: Use the SP 800-90B non-IID estimators and design the compression ratio around the lowest measured per-bit entropy across the full PVT (process, voltage, temperature) corner range.
- Combine independent noise sources: XOR multiple independent ring oscillators or stages to reduce correlation and resist single-point environmental manipulation.
- Run health tests on raw bits: Apply the repetition count and adaptive proportion tests to the source output before conditioning, so a failing source cannot be masked by the conditioner.
- Use vetted cryptographic conditioning: Prefer SHA-2/SHA-3 or AES-based conditioners over ad-hoc XOR folding to tolerate bias and correlation.
- Seed a SP 800-90A DRBG: Expand the conditioned entropy with a certified DRBG and implement reseeding to bound the seed lifetime.
- Harden against attacks: Add power-supply filtering, isolation, and active shielding to resist frequency injection, glitching, and fault-injection attacks; gate output on any health-test alarm.
- Implement self-tests: Provide known-answer tests for the conditioner/DRBG and start-up entropy tests to satisfy FIPS 140-3 power-on self-test requirements.
Conclusion
A trustworthy TRNG is the foundation of every secure system: keys, nonces, and signatures are only as strong as the randomness behind them. Robust design demands a well-characterized physical entropy source, conservative min-entropy estimation, continuous online health testing, and proper cryptographic conditioning, all combined with a certified DRBG to deliver both unpredictability and throughput.
Compliance with NIST SP 800-90A/B/C, FIPS 140-3, and AIS-31 transforms a clever circuit into a certifiable, audit-ready security primitive that customers and regulators can trust. Cutting corners on entropy estimation or health testing is one of the most common, and most catastrophic, failures in cryptographic hardware.
Vcores offers silicon-proven security and RNG IP, including standards-compliant entropy sources, health-test logic, and SP 800-90 DRBGs, with full documentation and certification support for your FPGA and ASIC designs.
