Methodology

EntropyWatch scores three questions separately and never collapses them into a single STS p-value.

1. Source. Which APIs or TRNGs supply bits, and are they cryptographic?
2. Construction. How those bits are mixed, extracted, truncated, checksummed, and turned into a seed, key, nonce, or salt.
3. Sanity statistics. Catastrophic failure detection on a collected sample. Full batteries (NIST SP 800-22, Dieharder, TestU01, ent, rngtest, SP 800-90B) run when the wallet implements a mixer or firmware path we can honestly exercise.

What is in scope

Static analysis only considers code that generates a signing key used in transaction signing: mnemonic or HD-seed entropy, private-key creation, and keyring or vault construction. Tracking, MetaMetrics, rewards, QR-sync, notifications, onboarding UI (including recovery-phrase confirm shuffles), session IDs, and transaction nonces are out of scope even when they call Math.random, Date.now, or WordArray.random.

Hardware and firmware

Trezor, Coldcard, BitBox02, and Keystone are reviewed from published firmware. Mixers such as SHA-256(device‖host) are recorded as theoretical notes. Simulator samples are labeled firmware_sim_trng and are not a measurement of the chip TRNG. Ledger BOLOS is closed: the brand stays source_availability=partial and cannot receive a green firmware-TRNG badge.

What a pass means

Overall verdict is the worst of construction grade and source quality. Host-CSPRNG statistical failures are warnings (they usually mean a broken test host). Statistical tests can only fail a generator.

How to read a report

Each public report is a snapshot of one wallet version. Source and construction decide the badge. Statistical scores are a sanity check on a collected sample; they can fail a generator but cannot prove it is secure.

Statistical tests

These checks look at a large sample of bits we generated. A pass means we did not see an obvious pattern in that sample. That cannot prove the wallet is secure. Read the linked specifications if you want the formal test definitions and how p-values are interpreted.

Min-entropy asks how easy the most likely value would be to guess. Higher bits per symbol is better. This still cannot prove cryptographic strength.

A typical report may include ent (byte-level mix), rngtest (old FIPS 140-2 health checks), a subset of NIST SP 800-22, Dieharder on large samples, and simple min-entropy estimators. Host-CSPRNG samples describe the test machine, not the wallet. Firmware-simulator samples describe a software stand-in, not the chip TRNG.

Specifications

• NIST SP 800-22 Rev. 1a — A Statistical Test Suite for Random and Pseudorandom Number Generators (2010-04)
  Official STS document. Section 4 explains p-values and what a pass does and does not mean.
• NIST SP 800-90B — Recommendation for the Entropy Sources Used for Random Bit Generation (2018-01)
  How min-entropy of an entropy source is estimated. Our collision figure is a simplified cousin, not the full 90B estimator.
• RFC 4086 — Randomness Requirements for Security (2005-06)
  Why cryptographic secrets need a CSPRNG, and why statistical batteries are only a sanity check.
• FIPS 140-2 — Security Requirements for Cryptographic Modules (2002-12)
  Historical module standard. rngtest implements the old FIPS 140-2 continuous RNG health checks.

Reading the tools

These are the same manuals and project pages the suites themselves publish. They are the best place to see what a given p-value or bits-per-byte figure is supposed to mean.

• Fourmilab ENT — A Pseudorandom Number Sequence Test Program (2008-01)
  What entropy bits/byte, chi-square, arithmetic mean, and serial correlation mean on a byte stream.
• Dieharder — A Random Number Test Suite (Robert G. Brown)
  Successor to Marsaglia's Diehard. Needs a large sample; we only run it at ≥ 10 MiB.
• rngtest(1) — FIPS 140-2 RNG tests
  Man page for the rng-tools FIPS battery we record as rngtest.fips_140_2.
• NIST STS source and user guide
  Software and notes that accompany SP 800-22.
• CWE-338 — Use of Cryptographically Weak Pseudo-Random Number Generator (2006-07)
  The weakness statistical tests can hint at but cannot prove is absent.