# EntropyWatch report — Coldcard 2026-07-31T1248-v4.2.0

- **Verdict:** 0xc0000bb2b0
- **UTC date:** 2026-08-18
- **Commit:** `4845161a9887771960660473f2d6cecfadc5085a`
- **Sample mode:** 0xc0000bb2c0
- **Source quality:** 0xc0000bb2d0
- **Construction:** 0xc0000bb2e0

%!s(*string=0xc0000bb2f0)

## Caveats

- Statistical tests can only fail a generator; they never prove cryptographic security.
- Short samples can look fine even when underlying entropy is low.
- Implementation bugs (state reuse, incorrect seeding, buffer issues) frequently destroy entropy in ways pure statistical tests miss.
- True confidence requires both high-quality sources and correct design/review.
- When sample_mode=firmware_sim_trng, statistical scores describe a software simulation of the documented mixer, not the device hardware TRNG.

## Entropy sources

- `ngu.random.bytes` in [external/libngu/ngu/ngu_tests/test_random.py](https://github.com/Coldcard/firmware/blob/4845161a9887771960660473f2d6cecfadc5085a/external/libngu/ngu/ngu_tests/test_random.py#L11) (crypto=false)
- `ngu.random.bytes` in [external/libngu/ngu/ngu_tests/test_random.py](https://github.com/Coldcard/firmware/blob/4845161a9887771960660473f2d6cecfadc5085a/external/libngu/ngu/ngu_tests/test_random.py#L15) (crypto=false)
- `Possible weak entropy seeding from Date / performance / timestamp` in [external/micropython/ports/javascript/library.js](https://github.com/Coldcard/firmware/blob/4845161a9887771960660473f2d6cecfadc5085a/external/micropython/ports/javascript/library.js#L45) (crypto=false)
- `Possible weak entropy seeding from Date / performance / timestamp` in [external/micropython/ports/javascript/wrapper.js](https://github.com/Coldcard/firmware/blob/4845161a9887771960660473f2d6cecfadc5085a/external/micropython/ports/javascript/wrapper.js#L36) (crypto=false)
- `yasmarang` in [external/micropython/ports/stm32/rng.c](https://github.com/Coldcard/firmware/blob/4845161a9887771960660473f2d6cecfadc5085a/external/micropython/ports/stm32/rng.c) (crypto=false)
- `RNG->DR` in [stm32/COLDCARD/rng.c](https://github.com/Coldcard/firmware/blob/4845161a9887771960660473f2d6cecfadc5085a/stm32/COLDCARD/rng.c) (crypto=true)
- `ngu.random.bytes` in [testing/test_rng.py](https://github.com/Coldcard/firmware/blob/4845161a9887771960660473f2d6cecfadc5085a/testing/test_rng.py#L27) (crypto=false)

## Findings

- **critical / weak_prng** Coldcard seed generation calls ngu.random while MICROPY_HW_ENABLE_RNG is 0 and libngu tests #ifndef (defined?), so rng_get resolves to MicroPython's Yasmarang software PRNG. Construction flaw — not a measured bit count.
- **critical / weak_prng** random.random appears in Coldcard firmware Python at external/micropython/tests/extmod/urandom_extra_float.py:18; must not seed keys.
- **medium / weak_entropy_source** Possible weak entropy seeding from Date / performance / timestamp
- **medium / weak_entropy_source** Possible weak entropy seeding from Date / performance / timestamp

## Packages on the secret-generation path


## Statistical results

These checks look at a large sample of bits we generated. A pass means we did not see an obvious pattern in that sample. That cannot prove the wallet is secure. Read the linked specifications if you want the formal test definitions and how p-values are interpreted.

- ent / arithmetic_mean: p=<nil> pass
- ent / chi_square: p=<nil> pass
- ent / entropy_bits_per_byte: p=<nil> pass
- ent / serial_correlation: p=<nil> pass
- nist_sp800_22 / BlockFrequency: p={7530806933241491 -16 false finite true} pass
- nist_sp800_22 / Frequency: p={31925014518032724 -17 false finite true} pass
- nist_sp800_22 / Runs: p={6221906326777771 -16 false finite true} pass
- rngtest / fips_140_2: p=<nil> pass

### Specifications

- [NIST SP 800-22 Rev. 1a — A Statistical Test Suite for Random and Pseudorandom Number Generators](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf)
- [NIST SP 800-90B — Recommendation for the Entropy Sources Used for Random Bit Generation](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf)
- [RFC 4086 — Randomness Requirements for Security](https://www.rfc-editor.org/rfc/rfc4086)
- [FIPS 140-2 — Security Requirements for Cryptographic Modules](https://csrc.nist.gov/pubs/fips/140-2/upd2/final)

### Reading the tools

- [Fourmilab ENT — A Pseudorandom Number Sequence Test Program](https://www.fourmilab.ch/random/)
- [Dieharder — A Random Number Test Suite (Robert G. Brown)](https://webhome.phy.duke.edu/~rgb/General/dieharder.php)
- [rngtest(1) — FIPS 140-2 RNG tests](https://manpages.debian.org/bookworm/rng-tools5/rngtest.1.en.html)
- [NIST STS source and user guide](https://csrc.nist.gov/projects/random-bit-generation/documentation-and-software)
- [CWE-338 — Use of Cryptographically Weak Pseudo-Random Number Generator](https://cwe.mitre.org/data/definitions/338.html)

## Min-entropy

Min-entropy asks how easy the most likely value would be to guess. Higher bits per symbol is better. This still cannot prove cryptographic strength.

- collision: {799984634420366 -14 false finite true} bits/symbol
- most_common_value: {7957656620206309 -15 false finite true} bits/symbol

---

This is not a certification. Statistical tests can only fail a generator.