A randomness extractor conditions digitized output from a physical entropy source so the final bits have sufficient entropy and fewer biases. It sits after the raw source, not in place of it: raw output can become biased as conditions such as ambient temperature fluctuate. section 2.2.1 section 10.2
Extraction is only one part of a secure randomness pipeline. Continuously test raw bits before extraction against the physical model; if tests fail, stop generation. Testing extracted output instead would hide the source behavior that the tests are meant to detect. section 2.2.1 section 10.2
Use an extractor within a complete entropy design:
- Convert physical noise into digital bits, and retain access to raw output for health checking. section 2.2.1 section 10.2
- Run statistical health tests continuously on raw output; halt random-number generation when they fail. section 2.2.1 section 10.2
- Condition successful raw output with an extractor to remove bias, then use the resulting quality entropy to seed a CSPRNG. section 10.2
- Continuously reseed the CSPRNG, without letting the reseeding interval exceed its internal period. section 10.2
Figure 10.2 The recommended setup for using randomness for cryptographic applications: health tests should ensure the correct operation of the TRNG, which should periodically reseed a CSPRNG.
The pipeline places health tests before the extractor, then uses conditioned entropy to seed and periodically reseed a faster CSPRNG. section 10.2
