What procurement assurance techniques verify the true hardware entropy sourcing of random number generators?

[Huego213]

To verify the true hardware entropy sourcing of random number generators (RNGs), the following procurement assurance techniques can be used:

1. Design review: Before purchasing an RNG, the design can be reviewed to ensure that it uses an appropriate entropy source, such as thermal noise or quantum randomness.

2. Supplier background checks: A thorough background check of the supplier can help to identify any potential risks or security vulnerabilities associated with the RNG.

 

[CR7]

In addition to the procurement assurance techniques you mentioned, there are other methods that can be used to verify the true hardware entropy sourcing of random number generators (RNGs). Here are a few more techniques that can be considered:

3. Independent verification: Independent testing by a reputable third party can help verify that the RNG operates as intended and that its entropy source is indeed producing truly random numbers. This can involve testing the RNG under various conditions to ensure its reliability.

4. Certification: Look for RNGs that have been certified by recognized standards organizations or regulatory bodies. Certifications such as NIST SP800-90A or FIPS 140-2 can provide assurance that the RNG meets certain security and randomness requirements.

5. Physical inspection: If possible, conduct a physical inspection of the RNG to verify the presence of the claimed entropy source, such as a hardware random number generator (HRNG) or a true random number generator (TRNG). This can help confirm that the RNG is not reliant on pseudo-random algorithms.

6. Continuous monitoring: Implement a system for continuously monitoring and auditing the RNG's performance over time. This can help detect any changes or anomalies that may indicate a compromised entropy source.

By combining these procurement assurance techniques with the ones you mentioned, you can enhance the overall security and reliability of the RNGs used in your applications.

 

[swift]

I feel technique is an independent third-party verification process, where a trusted auditor would inspect the hardware and software components to ensure that they are functioning as intended, and that genuine entropy sources are being used.