Pith. sign in

REVIEW 3 major objections 5 minor 39 references

Entropy Bootstrapping for Wireless Embedded Systems

T0 review · 3 major / 5 minor · reviewed 2026-07-13 · grok-4.5

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read On ESP32-class sensors, RNG output can look random even when its entropy source is off, so boot seeds must be credited only by source-state admission across SRAM, radio bursts, and signed capsules.

desk verdict Solid ESP32 engineering that nails the source-state vs. output-test point; radio-burst credit is still an untested locality claim, but the paper is honest about it and the capsule path stands alone. read the letter →

arxiv 2607.08865 v1 pith:NFXF75JQ submitted 2026-07-09 cs.CR

Javier Blanco-Romero , Florina Almenares Mendoza , Daniel Díaz-Sánchez , Andrés Marín-López This is my paper · ORCID
classification cs.CR
keywords bootentropyembeddedsystemsdefense-in-depthradioburstSRAMPUFESP32source-stateadmissionasaservice
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Inexpensive wireless sensors often boot under highly deterministic conditions and still ask an opaque RNG for the first cryptographic values. This paper shows that on ESP32-class boards the wireless RNG register keeps producing statistically clean bytes when its documented analog inputs are disabled—exactly the pseudorandom state the hardware specification already names—so output batteries cannot decide whether the source is live. The authors therefore build a defense-in-depth boot path that mixes three roots under an explicit admission policy: SRAM power-up material, a local response to a fully public radio packet burst from a trusted node, and pre-provisioned asymmetric entropy capsules that let the trusted node deliver a signed seed the client can verify and decapsulate before it has local entropy. Each root is credited only when firmware can check the required physical or protocol state; the combiner never adds credits across roots. If at least one credited root remains outside the adversary’s view, the first seed stays unpredictable.

What carries the argument

Source-state admission policy: each root (SRAM startup, radio-burst local response, asymmetric capsule) receives entropy credit only when firmware-checkable physical or protocol conditions hold; the combiner derives the seed from all available material but assigns the credit of the single best supported root, never the sum.

What would settle it

If a co-located second receiver, or an offline model of the fixed public burst schedule, can predict the target ESP32’s WDEV byte stream during the 64-packet measurement window with non-negligible advantage, the radio-burst root loses its entropy credit.

Watch

Extended reading notes

Core claim

RF-disabled WDEV output on ESP32-class boards is pseudorandom by specification yet passes the same statistical screens as RF-active states, so output tests cannot replace source-state admission. A defense-in-depth boot path that independently admits SRAM startup material, radio-burst local responses, and asymmetric entropy capsules, then hashes them under a non-summing credit policy, produces a seed only as strong as the single best root that remains unknown to the adversary.

Load-bearing premise

A full observer of the public radio packet burst cannot predict the sensor’s own chip RNG samples collected during that short measurement window.

Editorial extensions

If this is right

  • Firmware must gate WDEV credit on verified RF-active state, not on byte statistics that a documented pseudorandom mode can also pass.
  • A short public packet burst from a local trusted node can open a measurement window that, under the RF-active model, yields tens of kilobits of conservative raw min-entropy before extraction into a 256-bit seed.
  • A cold-start device with no credited local entropy can still obtain a first seed by performing only deterministic verification, decapsulation, and hashing of a signed capsule.
  • The derived seed remains secure unless every credited root is predictable given the adversary’s view of traffic and influence.
  • Any root that fails its admission checks can still be mixed as auxiliary input without receiving entropy credit.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Other SoCs whose RNGs silently fall back to PRNG modes when analog inputs are disabled likely need the same source-state gating rather than black-box statistical admission.
  • A multi-board cold-power study of SRAM would convert the current auxiliary material into a second credited local root and reduce dependence on the network path.
  • If co-located receivers can partially reconstruct the target’s WDEV samples under identical public bursts, radio-burst credit would have to be reduced or withdrawn for that platform family.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper argues that ESP32-class IoT nodes cannot safely credit boot entropy from output statistical tests alone, because RF-disabled WDEV output is pseudorandom by specification yet passes the same batteries as RF-active modes (Table 1). It proposes a defense-in-depth boot path that mixes three roots under explicit source-state admission: SRAM startup material, radio-burst local sampling during a public packet train from a trusted node, and asymmetric entropy capsules (ML-KEM/ML-DSA) for cold start. A combiner hashes available roots and assigns the seed the credit of the single best supported root, never their sum. Measurements cover WDEV under controlled RF states, a fixed 64-packet burst window (~59 kbit conservative SP 800-90B raw min-entropy under the RF-active model), deterministic capsule client latency, and preliminary SRAM reset dumps. Open Zephyr artifacts are provided.

Significance. Boot entropy starvation on headless wireless sensors is a real, historically validated failure mode. The paper’s strongest contribution is empirical and architectural: Table 1 cleanly shows that black-box statistical screens cannot distinguish the documented pseudorandom WDEV state from RF-active states, so admission must be source-state policy. The capsule path is a practical cold-start fallback with measured deterministic client cost, and the combiner’s “best single root” credit discipline is appropriately modest. Reproducible firmware, collector scripts, and a fixed-stimulus burst design are genuine strengths. If the radio-burst locality claim were better supported, the multi-root path would be a useful systems result for constrained IoT; even without that, the admission-policy lesson and capsule design are publishable contributions for the embedded-security community.

major comments (3)
  1. [§4.2, §7.2, §8] §4.2, §7.2, and §8: The radio-burst root is the only root given quantitative min-entropy credit (~59.0 kbit raw from SP 800-90B under RF-active state for an 8192 B window) while also being presented as local unpredictability against a full observer of the public burst. Section 8 correctly states the central assumption—that such an observer cannot predict the node’s WDEV samples—but the evaluation never tests it. There is no co-located second receiver, no residual-entropy estimate after conditioning on a second capture of the same public train, and only one board. Table 1 already shows RF-disabled (documented PRNG) and RF-active streams are statistically similar; SP 800-90B cannot separate physical noise from a well-seeded PRNG. Without a locality or cross-receiver experiment, the defense-in-depth claim for this root is unsupported, even though the RF-active gating policy itself is well m
  2. [§7.2, Table 1] §7.2 and Table 1: Credit for the burst window is taken as the lower of two non-IID SP 800-90B rates (7.348 and 7.198 bits/B) under the RF-active source-state model. That model is documentation-based (high-speed ADC enabled with radio), not an empirical demonstration that the samples remain unpredictable given the public stimulus and a strong local adversary (§3.2). The paper should either (a) reframe radio burst strictly as an actuator that places WDEV into an eligible state plus audit/liveness side material, without claiming private min-entropy against a full observer, or (b) add a concrete predictability experiment (second receiver, or conditioning on public schedule and RF environment). As written, the abstract and §7.2 over-claim relative to the evidence.
  3. [§4.1, §7.4] §4.1 and §7.4: SRAM is mixed into the combiner as root P, but the manuscript correctly notes that EN/RTS resets do not fully discharge cells and that cold-power multi-board evidence is missing. Given that, the architecture section still lists “device intrinsic startup state” as a first-class root of unpredictability. Either demote SRAM fully to uncredited auxiliary material in the architecture narrative (matching the evaluation), or supply the cold-power study the paper itself says is required before credit. Leaving it as a named root while denying credit creates an inconsistency between the threat-model framing and the admission policy.
minor comments (5)
  1. [Figure 2] Figure 2: The MCV min-entropy curve is labeled “diagnostic, not credited entropy,” which is good, but the caption and body should state more explicitly that timing Ji receives zero credit under the full-observer model, so readers do not treat the residual plot as an entropy claim.
  2. [Table 2, §7.3] Table 2: Reset-to-seed times (~10 s median) are dominated by boot/network setup and a fixed 1 s post-DHCP delay. Consider reporting a breakdown that isolates stack setup from crypto so the capsule path is not misread as cryptographically slow.
  3. [§4.5] §4.5: The seed equation uses H for SHA-256 and then HKDF; a short note that domain separation tags and length prefixes are applied to each root (mentioned later in the paragraph) would help if placed next to the equation.
  4. [§2] Related work: Physical-layer key generation is correctly distinguished from the public-burst model; a one-sentence comparison to RFC 8937’s local hedging (already cited) versus capsule remote delivery would sharpen the positioning.
  5. [§4.5, §6] Minor polish: “In–fixed-nonce mode” (§6) has a stray en-dash; “Productionsystemsshouldinject” (§4.5) needs spacing; arXiv line-break artifacts in URLs should be cleaned for the camera-ready version.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: source-state admission, multi-root combiner, and radio-burst credit rest on documentation, independent measurements, and an explicit empirical assumption—not on self-definition or fitted predictions.

full rationale

The paper’s load-bearing chain does not reduce to its inputs by construction. The central empirical claim—that RF-disabled WDEV is documented-pseudorandom yet passes the same statistical batteries as RF-active states (Table 1, §7.1)—is a controlled measurement used to motivate source-state admission, not a quantity fitted and then re-predicted. Entropy credit for WDEV is assigned by firmware policy from the ESP32 TRM analog-source state (§4.4, §7.2), not from the output screens the paper itself shows are insufficient; SP 800-90B numbers are reported only under that admitted state and are not summed across roots. The combiner (§4.5) explicitly assigns the seed the credit of the single best supported root and creates no new credit. Radio-burst credit is conditioned on the platform-specific empirical assumption that a full observer of the public burst cannot predict local WDEV samples (§8); that assumption is stated as unproven and limited to one board, not smuggled in as a uniqueness theorem or self-citation. Capsules use standard KEM/signature constructions with a deterministic client path. The sole self-citation ([19], prior QEaaS) appears only as related-work context and is not load-bearing for admission policy, radio-burst locality, or the combiner. No fitted parameter is renamed as a prediction; no uniqueness result is imported from the authors; no ansatz is smuggled via citation. Correctness risk around the untested locality claim is real but is not circularity.

Assumptions & free parameters 2 free parameters · 4 assumptions · 3 invented entities

The central claim rests on ESP32 documentation of the WDEV source, standard extractor/KEM assumptions, and the empirical locality of the radio-burst response. Free parameters are mainly measured rates used for credit accounting and experimental design knobs; invented constructs are the public-burst extraction model and the admission policy itself.

free parameters (2)
  • conservative WDEV min-entropy rate for credit = 7.198 bits/B (lower bound used)
    Lower of two SP 800-90B non-IID estimates (7.198 bits/B from 256 MB UDP-burst capture and 7.348 bits/B from the source-separated run) used to claim ~59.0 kbit raw min-entropy per 64-packet window; platform- and capture-specific.
  • fixed-burst experimental knobs = 64 packets / 1000 µs / 8192 B
    Burst count (64), nominal spacing (1000 µs), sample size (8192 WDEV bytes), and payload size define the measured window; design choices, not security-level fits, but they set the operational claim.
assumptions (4)
  • domain assumption ESP32 TRM: WDEV is true-entropy only when high-speed ADC/radio is enabled; RF-disabled output is pseudorandom by specification.
    Load-bearing for the admission policy (Sections 1, 4.2, 4.4, 7.1).
  • standard math HKDF-SHA256 extracts a pseudorandom key from non-uniform or partly influenced input if enough entropy remains after conditioning on the public transcript.
    Section 4.5 seed derivation, citing Krawczyk/RFC 5869.
  • domain assumption At least one credited root remains hidden from the adversary after conditioning on public events S and adversary observations OA.
    Threat model Section 3.2 and security argument in 4.5; architecture is safe when a claim fails only if this holds for some root.
  • domain assumption ML-KEM-512 provides Category-1 confidentiality for capsule-only boots; ML-DSA-44 provides the signature.
    Section 4.3 citing NIST FIPS 203/204; authors note hybrid classical+PQ is recommended for deployment.
invented entities (3)
  • radio burst extraction under a fully public burst model
    purpose: Actuate local WDEV and timing sampling without giving entropy credit to the trusted node's packets.
    Defined in Sections 4.2 and 5; the claim that the local response is unpredictable to a full observer is empirical and currently one-board.
  • asymmetric entropy capsules for cold start independent evidence
    purpose: Deliver a seed when local sources are unavailable via pre-provisioned KEM and signed capsule.
    Protocol in Section 4.3/Figure 1; builds on standard KEM+signature and prior QEaaS work by overlapping authors.
  • source-state admission policy for ESP32 roots
    purpose: Credit each root only when firmware-checkable state and protocol checks hold; never sum credits.
    Policy construct of Sections 4.4–4.5; aligns with SP 800-90B spirit but is their specific ESP32 rule set.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Entropy Bootstrapping for Wireless Embedded Systems." pith.science (2026). https://pith.science/paper/NFXF75JQ

@misc{pith2026260708865,
  author       = {Pith},
  title        = {Pith review of: Entropy Bootstrapping for Wireless Embedded Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NFXF75JQ}},
  note         = {Machine review of arXiv:2607.08865}
}
read the original abstract

Weak randomness has broken deployed cryptography through implementation bugs, boot entropy scarcity, and backdoored generators. Inexpensive wireless sensors concentrate the risk because many boot or operate in highly deterministic conditions while relying on basic, rudimentary, or opaque RNGs. On ESP32-class boards, RF-disabled wireless device RNG register (WDEV) output is pseudorandom by specification yet passes the same statistical screens as RF-active states, showing that output tests cannot replace source-state admission. We propose a defense-in-depth boot path for ESP32-class IoT nodes that combines SRAM startup material, radio burst extraction, and asymmetric entropy capsules under explicit source-state admission. In radio burst extraction, a trusted node in the local IoT network, such as a gateway or dedicated entropy node, sends a public packet burst to open a measurement window. The client samples its own WDEV output and packet timing during that window, then credits only the local response. Capsules cover the cold-start case with a pre-provisioned asymmetric key pair. The trusted node encrypts fresh seed material to the client's public key and signs the capsule; the client verifies, decapsulates, and hashes before it has local entropy. We benchmark the ESP32 RNG under several radio operating modes, the fixed-burst extraction window, the deterministic capsule client path, and SRAM startup reads. Together, these measurements support an admission policy in which each root is credited only when its required source state and protocol checks hold.

Figures

Figures reproduced from arXiv: 2607.08865 by the authors.

Figure 1
Figure 1. Asymmetric entropy capsule exchange. The [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Fixed public burst timing evidence. The programmed schedule residual is zero; the ESP32 curve shows the mean and one standard deviation of the node’s timing residual over 127 trials. Position 0 includes the programmed 20 ms start delay. The MCV curve is diagnostic, not credited entropy. 7.2 Radio Burst Response Evaluation The central radio burst experiment holds the public burst plan constant and asks how much local… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 5 linked inside Pith

  1. [1]

    When private keys are public: Results from the 2008 debian openssl vulnerability,

    S. Yilek, E. Rescorla, H. Shacham, B. Enright, and S. Savage, “When private keys are public: Results from the 2008 debian openssl vulnerability,” inPro- ceedings of the 9th ACM SIGCOMM Conference on Internet Measurement, 2009, pp. 15–27

    2008

  2. [2]

    Mining your ps and qs: Detection of widespread weak keys in network devices,

    N. Heninger, Z. Durumeric, E. Wustrow, and J. A. Halderman, “Mining your ps and qs: Detection of widespread weak keys in network devices,” in21st USENIX Security Symposium (USENIX Security 12), 2012, pp. 205–220

    2012

  3. [3]

    Welcome to the entropics: Boot- time entropy in embedded devices,

    K. Mowery, M. Wei, D. Kohlbrenner, H. Shacham, and S. Swanson, “Welcome to the entropics: Boot- time entropy in embedded devices,” in2013 IEEE Symposium on Security and Privacy, IEEE, 2013, pp. 589–603

    2013

  4. [4]

    Factoring rsa keys from certi- fied smart cards: Coppersmith in the wild,

    D. J. Bernstein et al., “Factoring rsa keys from certi- fied smart cards: Coppersmith in the wild,” inInter- national Conference on the Theory and Application of Cryptology and Information Security, Springer, 2013, pp. 341–360

    2013

  5. [5]

    On the practical exploitabil- ity of dual{ec}in{tls}implementations,

    S. Checkoway et al., “On the practical exploitabil- ity of dual{ec}in{tls}implementations,” in 23rd USENIX security symposium (USENIX secu- rity 14), 2014, pp. 319–335

    2014

  6. [6]

    A systematic analysis of the juniper dual ec incident,

    S. Checkoway et al., “A systematic analysis of the juniper dual ec incident,” inProceedings of the 2016 ACM SIGSAC Conference on Computer and Com- munications Security, 2016, pp. 468–479

    2016

  7. [7]

    Firmware insider: Bluetooth randomness is mostly random,

    J. Tillmanns, J. Classen, F. Rohrbach, and M. Hol- lick, “Firmware insider: Bluetooth randomness is mostly random,” in14th USENIX Workshop on Of- fensive Technologies (WOOT 20), USENIX Associ- ation, 2020. [8]Esp32 technical reference manual, Version 5.7, Espressif Systems, 2026. [Online]. Available:https: / / www . espressif . com / en / support / docume...

    2020

  8. [8]

    Power- up sram state as an identifying fingerprint and source of true random numbers,

    D. E. Holcomb, W. P. Burleson, and K. Fu, “Power- up sram state as an identifying fingerprint and source of true random numbers,”IEEE Transac- tions on Computers, vol. 58, no. 9, pp. 1198–1210, 2008

    2008

Show all 39 references
  1. [9]

    Physical unclonable functions and applica- tions: A tutorial,

    C. Herder, M.-D. Yu, F. Koushanfar, and S. De- vadas, “Physical unclonable functions and applica- tions: A tutorial,”Proceedings of the IEEE, vol. 102, no. 8, pp. 1126–1141, 2014

    2014

  2. [10]

    Module-Lattice-Based Key-Encapsulation Mecha- nism Standard,

    National Institute of Standards and Technology, “Module-Lattice-Based Key-Encapsulation Mecha- nism Standard,” National Institute of Standards and Technology, Federal Information Processing Standards Publication 203, 2024.doi:10 . 6028 / NIST.FIPS.203[Online]. Available:https:...

    2024 doi

  3. [11]

    Module-Lattice-Based Digital Signature Stan- dard,

    National Institute of Standards and Technol- ogy, “Module-Lattice-Based Digital Signature Stan- dard,” National Institute of Standards and Technol- ogy,FederalInformationProcessingStandardsPub- lication 204, 2024.doi:10 . 6028 / NIST . FIPS . 204 [Online]. Available:https : / ...

    2024

  4. [12]

    A model and architec- ture for pseudo-random generation with applica- tions to/dev/random,

    B. Barak and S. Halevi, “A model and architec- ture for pseudo-random generation with applica- tions to/dev/random,” inProceedings of the 12th ACM conference on Computer and communications security, 2005, pp. 203–212

    2005

  5. [13]

    A guideline on pseudorandom number generation (prng) in the iot,

    P. Kietzmann, T. C. Schmidt, and M. Wählisch, “A guideline on pseudorandom number generation (prng) in the iot,”ACM Computing Surveys, vol. 54, no. 6, pp. 1–38, 2021.doi:10.1145/3453159

    2021 doi

  6. [14]

    Recommendation for the entropy sources used for random bit genera- tion,

    M. S. Turan, E. Barker, J. Kelsey, K. A. McKay, M. L. Baish, and M. Boyle, “Recommendation for the entropy sources used for random bit genera- tion,” National Institute of Standards and Technol- ogy, NIST Special Publication 800-90B, Jan. 2018. doi:10.6028/NIST.SP.800-90B[Onli...

    2018 doi

  7. [15]

    A Proposal for Functionality Classes for Random Number Gen- erators,

    M. Peter and W. Schindler, “A Proposal for Functionality Classes for Random Number Gen- erators,” Bundesamt für Sicherheit in der Infor- mationstechnik, AIS 20 / AIS 31, version 3.0, Sep. 10, 2024. [Online]. Available:https : / / www . bsi . bund . de / SharedDocs / Downloads ...

    2024

  8. [16]

    Sp 800–22 and gm/t 0005–2012 tests: Clearly obsolete, possibly harmful,

    M.-J. O. Saarinen, “Sp 800–22 and gm/t 0005–2012 tests: Clearly obsolete, possibly harmful,” in2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), IEEE, 2022, pp. 31–37

    2012

  9. [17]

    Entropy as a service: Unlocking cryptography’s full potential,

    A. Vassilev and R. Staples, “Entropy as a service: Unlocking cryptography’s full potential,”Com- puter, vol. 49, no. 9, pp. 98–102, 2016

    2016

  10. [18]

    Post-quantum entropy as a service for em- bedded systems,

    J. Blanco-Romero, Y. M. Garcia-Niño, F. A. Men- doza, D. Díaz-Sánchez, C. García-Rubio, and C. Campo, “Post-quantum entropy as a service for em- bedded systems,”Sensors, vol. 26, no. 9, p. 2737, 2026. 7

    2026

  11. [19]

    Cremers, L

    C. Cremers, L. Garratt, S. V. Smyshlyaev, N. Sul- livan, and C. A. Wood,Randomness Improvements for Security Protocols, RFC 8937, Oct. 2020.doi: 10 . 17487 / RFC8937[Online]. Available:https : / / www.rfc-editor.org/info/rfc8937

    2020

  12. [20]

    Radio-telepathy: Extracting a secret key from an unauthenticated wireless channel,

    S.Mathur,W.Trappe,N.Mandayam,C.Ye,andA. Reznik, “Radio-telepathy: Extracting a secret key from an unauthenticated wireless channel,” inPro- ceedings of the 14th ACM international conference on Mobile computing and networking,2008,pp.128– 139

    2008

  13. [21]

    Principles of physical layer se- curity in multiuser wireless networks: A survey,

    A. Mukherjee, S. A. A. Fakoorian, J. Huang, and A. L. Swindlehurst, “Principles of physical layer se- curity in multiuser wireless networks: A survey,” IEEE Communications Surveys & Tutorials,vol.16, no. 3, pp. 1550–1573, 2014

    2014

  14. [22]

    Physical layer key gen- eration in 5g wireless networks,

    L. Jiao, N. Wang, P. Wang, A. Alipour-Fanid, J. Tang, and K. Zeng, “Physical layer key gen- eration in 5g wireless networks,”arXiv preprint arXiv:1908.10362, 2019. [Online]. Available:https: //arxiv.org/abs/1908.10362

    1908 arXiv

  15. [23]

    Physical layer se- cret key generation in static environments,

    N. Aldaghri and H. Mahdavifar, “Physical layer se- cret key generation in static environments,”arXiv preprint arXiv:1908.03637, 2019. [Online]. Avail- able:https://arxiv.org/abs/1908.03637

    1908 arXiv

  16. [24]

    Reconfigurable intelligent surface-induced randomness for mmwave key generation,

    S. Yang, H. Han, Y. Liu, W. Guo, Z. Pang, and L. Zhang, “Reconfigurable intelligent surface-induced randomness for mmwave key generation,”arXiv preprint arXiv:2111.00428, 2022. [Online]. Avail- able:https://arxiv.org/abs/2111.00428

    2022 arXiv

  17. [25]

    Reconfigurable intelligent surface for physical layer key generation: Constructive or de- structive?

    G. Li et al., “Reconfigurable intelligent surface for physical layer key generation: Constructive or de- structive?”arXiv preprint arXiv:2112.10043, 2022. [Online]. Available:https://arxiv.org/abs/2112. 10043

    2022 arXiv

  18. [26]

    A true ran- dom number generator method embedded in wireless communication systems,

    T. Suzuki and M. Kaminaga, “A true ran- dom number generator method embedded in wireless communication systems,”arXiv preprint arXiv:1811.10783, 2018. [Online]. Available:https: //arxiv.org/abs/1811.10783

    2018 arXiv

  19. [27]

    Fpga intrinsic pufs and their use for ip protection,

    J. Guajardo, S. S. Kumar, G.-J. Schrijen, and P. Tuyls, “Fpga intrinsic pufs and their use for ip protection,” inInternational workshop on crypto- graphic hardware and embedded systems, Springer, 2007, pp. 63–80

    2007

  20. [28]

    Rescorla,The Transport Layer Security (TLS) Protocol Version 1.3, RFC 8446, Aug

    E. Rescorla,The Transport Layer Security (TLS) Protocol Version 1.3, RFC 8446, Aug. 2018.doi: 10 . 17487 / RFC8446[Online]. Available:https : / / www.rfc-editor.org/info/rfc8446

    2018

  21. [29]

    Rescorla, H

    E. Rescorla, H. Tschofenig, and N. Modadugu,The Datagram Transport Layer Security (DTLS) Pro- tocol Version 1.3, RFC 9147, Apr. 2022.doi:10 . 17487/RFC9147[Online]. Available:https://www. rfc-editor.org/info/rfc9147

    2022

  22. [30]

    Barnes, K

    R. Barnes, K. Bhargavan, B. Lipp, and C. A. Wood, Hybrid Public Key Encryption, RFC 9180, Feb. 2022.doi:10 . 17487 / RFC9180[Online]. Available: https://www.rfc-editor.org/info/rfc9180

    2022

  23. [31]

    The frequency injection attack on ring-oscillator-based true ran- dom number generators,

    A. T. Markettos and S. W. Moore, “The frequency injection attack on ring-oscillator-based true ran- dom number generators,” inInternational Work- shop on Cryptographic Hardware and Embedded Sys- tems, Springer, 2009, pp. 317–331

    2009

  24. [32]

    Fuzzy extrac- tors: How to generate strong keys from biometrics and other noisy data,

    Y. Dodis, L. Reyzin, and A. Smith, “Fuzzy extrac- tors: How to generate strong keys from biometrics and other noisy data,” inInternational conference on the theory and applications of cryptographic tech- niques, Springer, 2004, pp. 523–540

    2004

  25. [33]

    Post-quantum hybrid ECDHE- MLKEM Key Agreement for TLSv1.3,

    K. Kwiatkowski, P. Kampanakis, B. Westerbaan, and D. Stebila, “Post-quantum hybrid ECDHE- MLKEM Key Agreement for TLSv1.3,” Internet Engineering Task Force, Internet-Draft draft-ietf- tls-ecdhe-mlkem-05, May 2026, Work in Progress, 12 pp. [Online]. Available:https://datatracke...

    2026

  26. [34]

    Krawczyk and P

    H. Krawczyk and P. Eronen,HMAC-based Extract- and-Expand Key Derivation Function (HKDF), RFC 5869, May 2010.doi:10.17487/RFC5869[On- line]. Available:https : / / www . rfc - editor . org / info/rfc5869

    2010 doi

  27. [35]

    Security analysis of pseudo-random number generators with input: /dev/random is not robust,

    Y. Dodis, D. Pointcheval, S. Ruhault, D. Vergniaud, and D. Wichs, “Security analysis of pseudo-random number generators with input: /dev/random is not robust,” inProceedings of the 2013 ACM SIGSAC conference on Computer & communications secu- rity, 2013, pp. 647–658

    2013

  28. [36]

    Blake2: Simpler, smaller, fast as md5,

    J.-P. Aumasson, S. Neves, Z. Wilcox-O’Hearn, and C. Winnerlein, “Blake2: Simpler, smaller, fast as md5,” inInternational Conference on Applied Cryp- tography and Network Security, Springer, 2013, pp. 119–135

    2013

  29. [37]

    Walker,ENT: A pseudorandom number sequence test program, 2008

    J. Walker,ENT: A pseudorandom number sequence test program, 2008. [Online]. Available:https : / / www.fourmilab.ch/random/

    2008

  30. [38]

    Doty-Humphrey,PractRand random number test suite, 2019

    C. Doty-Humphrey,PractRand random number test suite, 2019. [Online]. Available:https://pracrand. sourceforge.net/

    2019

  31. [39]

    Testu01: Ac library for empirical testing of random number genera- tors,

    P. L’ecuyer and R. Simard, “Testu01: Ac library for empirical testing of random number genera- tors,”ACM Transactions on Mathematical Software (TOMS), vol. 33, no. 4, pp. 1–40, 2007. 8

    2007

Pith tools

Reviewed July 13, 2026 · model on record in the stance chip above.