Entropy Bootstrapping for Wireless Embedded Systems
2026-07-09 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors explain that weak randomness can make devices like ESP32-based sensors less secure because their random number generators (RNGs) may act predictably. They tested the ESP32 and found that just checking output randomness isn’t enough to trust the RNG, especially when the radio is off. To improve security, they suggest a method combining multiple sources of randomness, including startup memory, radio signal bursts from a trusted nearby device, and encrypted 'entropy capsules' for devices that are just starting up. Their approach ensures that random numbers are only trusted if certain checks about the source state and communication protocols are met.
Random Number Generator (RNG)EntropyESP32IoT SecurityRadio Burst ExtractionAsymmetric CryptographySRAM StartupTrusted NodeSource-State AdmissionCryptographic Seed
Authors
Javier Blanco-Romero, Florina Almenares Mendoza, Daniel Díaz-Sánchez, Andrés Marín-López
Abstract
Weak randomness has broken deployed cryptography through implementation bugs, boot entropy scarcity, and backdoored generators. Inexpensive wireless sensors concentrate the risk because many boot or operate in highly deterministic conditions while relying on basic, rudimentary, or opaque RNGs. On ESP32-class boards, RF-disabled wireless device RNG register (WDEV) output is pseudorandom by specification yet passes the same statistical screens as RF-active states, showing that output tests cannot replace source-state admission. We propose a defense-in-depth boot path for ESP32-class IoT nodes that combines SRAM startup material, radio burst extraction, and asymmetric entropy capsules under explicit source-state admission. In radio burst extraction, a trusted node in the local IoT network, such as a gateway or dedicated entropy node, sends a public packet burst to open a measurement window. The client samples its own WDEV output and packet timing during that window, then credits only the local response. Capsules cover the cold-start case with a pre-provisioned asymmetric key pair. The trusted node encrypts fresh seed material to the client's public key and signs the capsule; the client verifies, decapsulates, and hashes before it has local entropy. We benchmark the ESP32 RNG under several radio operating modes, the fixed-burst extraction window, the deterministic capsule client path, and SRAM startup reads. Together, these measurements support an admission policy in which each root is credited only when its required source state and protocol checks hold.