Certified at the Source, Broken at the Boundary: An Effect-Based Threat Model for Random Number Generation

Abstract

Random number generation is usually assured at the source: validate the entropy source, monitor its health, condition its output, and confirm the result passes the standard test batteries. That approach answers the questions it was built for, and deployed generators are better for it. But the historical record suggests it is incomplete. Most RNG failures didn’t produce obviously bad bits. They surfaced later, as shared primes, reused nonces, and recoverable keys, and they usually broke at a boundary between components. This paper presents an effect-based threat model for the whole generation chain: two security objectives, entropy and privacy; seven components from entropy source to consumer; four attack classes, covering state compromise, entropy reduction, availability, and substitution; and three positions, tagged by the layer where each weakness lives. It maps twenty-two documented incidents and demonstrations to the model and finds that deployed failures cluster at boundaries and in platform software, and that most were exploited passively, from public outputs. It also shows how fail-closed certification turns availability attacks into substitution, and it works through nine threat scenarios.