A random-bit service is a chain of components with different jobs. A physical process can supply uncertainty, while a deterministic mechanism expands and manages state under defined assumptions. This guide shows how to draw the boundary between those jobs and assemble a useful engineering review. It does not certify a product or claim that an attractive output sample proves the whole system secure.
Start with the source and the mechanism
The NIST entropy-source definition includes a noise source, health tests and optional conditioning. The DRBG definition describes generation from a secret seed and other possible inputs. These are complementary roles. A reviewer should ask where uncertainty enters, which component stores state and which interface supplies bytes to the application. Calling the complete package hardware random or cryptographic random does not answer those questions. A diagram becomes useful when each arrow has a stated purpose and each component has an owner responsible for its assumptions.
A practical architecture evidence table
| Item | Evidence or distinction | Review question |
|---|---|---|
| Noise source | Provides the physical input to an entropy source | What operating conditions and failure modes were assessed? |
| Conditioning | Optional processing within the source design | Which transformation and input assumptions are documented? |
| DRBG mechanism | Maintains deterministic generation state | How are initialisation and later state operations controlled? |
| Application interface | Delivers output to a caller | How are errors, limits and concurrent requests handled? |
This is a review worksheet, not a prescribed circuit. Some architectures distribute these roles across hardware, firmware and operating-system services. Record the actual placement rather than assuming that a label on a chip describes the complete path used by the running application.
Keep physical assumptions attached to the deployment
A source evaluation is meaningful only alongside the environment it describes. Record the device revision, firmware, expected operating conditions and the point at which samples were collected. Ask whether a diagnostic export contains raw source observations or already processed output. Those datasets answer different questions. If an evaluation used one device configuration and deployment uses another, document the relationship instead of silently transferring the conclusion. A useful review note distinguishes evidence that was directly observed from a supplier statement and from a condition that still needs verification.
Treat deterministic state as an engineering responsibility
SP 800-90A Revision 1 specifies deterministic mechanisms based on hash functions or block ciphers. Choosing a named mechanism does not document how a product uses it. Review the implemented interface, state ownership and error handling against the selected design. Pay attention to lifecycle events such as process restart, restoration of a saved machine image and simultaneous callers. Ask the implementer to explain how these events are represented in tests. The purpose is to identify duplicated or mismanaged state in an authorised laboratory, not to infer secret state from a live third-party system.
Distinguish output quality from failure handling
A service can produce plausible-looking bytes while its surrounding application ignores an error. Include negative tests that exercise documented failure paths in an isolated test environment. Observe whether the caller receives a clear failure, whether the event is recorded and whether the system avoids presenting unavailable output as successful. Do not replace an error with a convenient constant merely to keep a demonstration running. Record the expected recovery process and who authorises return to service. A passed statistical batch and a correctly handled operational fault are separate pieces of evidence.
Make the boundary review reproducible
Prepare a small evidence bundle containing architecture version, component inventory, interface description, test environment and result references. Identify which component supplied each dataset and how the data moved into the test tool. Preserve the tool version and configuration so another reviewer can reproduce the analysis. If proprietary details cannot be published, maintain a public summary that states the boundary and exclusions without exposing sensitive internals. A confidential appendix should still have a stable identifier; secrecy is not a reason to lose traceability between the report and the evaluated build.
Architecture review checklist
- Identify the physical source, conditioning, deterministic state and application interface separately.
- Record hardware, firmware and software revisions for the evaluated configuration.
- Label each dataset by its collection point and processing history.
- Exercise documented error handling in an authorised test environment.
- Keep unresolved assumptions visible in the final review.
Before closing the review, ask someone unfamiliar with the design to follow one output request through the diagram. They should be able to identify the evidence supporting each boundary crossing. If the explanation relies on a broad marketing label, replace it with the specific component, interface or document that answers the question.
Frequently asked questions
Does physical randomness remove the need for software review?
No. Collection, processing, state management and error handling still need to be understood. A physical source is one component in the complete service.
Is a DRBG automatically unsuitable because it is deterministic?
No. Deterministic generation is an established design approach when the mechanism, initial input and state handling meet the relevant assumptions. The implementation and complete construction matter.
Can this article establish that a named product is certified?
No. It provides a review method. Product-specific validation requires evidence for the actual implementation, boundary and applicable scheme.
Sources and verification
- Entropy source glossary — NIST — 2026-10-23
- Deterministic random bit generator glossary — NIST — 2026-10-23
- SP 800-90A Revision 1: deterministic random bit generators — NIST — 2026-10-23
- SP 800-90B: entropy sources — NIST — 2026-10-23