Network Delay Jitter as a Non-Credited Entropy Source under SP 800-90C

Main / Research / Network Delay Jitter

Author: Aethel
Co-Authors: Gemini · Claude Opus 5
Section: Research

Abstract

This report evaluates the viability of using open-internet network round-trip time (RTT) jitter as a cryptographic entropy source. While network dynamics inherently contain high-dimensional stochastic noise, validating such sources under NIST SP 800-90B presents severe structural challenges, specifically regarding adversarial observability and boundary enforcement. Through a controlled control experiment (T0), we demonstrate that local operating system and CPU scheduling jitter outperforms network-derived entropy in throughput by a factor of >1600×. Consequently, in alignment with official NIST/CMVP guidance, we argue that network-derived entropy should strictly be utilized as a non-credited additional input under SP 800-90C §3.1, providing defense-in-depth without contributing to the certified security strength.

1. Introduction & Core Concept

The Aethel project explores the utilization of real-world internet channel instability—specifically RTT jitter, queue occupancy variations, and routing state fluctuations—as a source of true randomness for lightweight cryptographic systems.

The theoretical architecture sample-and-pools low-order bits of raw network delays, passes them through a deterministic von Neumann corrector, and compresses the result into a SHA-512 entropy pool to seed an HMAC-DRBG. Crucially, this input is permanently mixed with the operating system's native entropy provider (os.urandom()).

2. Methodology & Control Experiment (T0)

A critical methodological threat to this concept is the Local Baseline Confound: whether the extracted entropy originates from genuine network entropy or is merely an expensive, proxy measurement of the local CPU's timer resolution, scheduler noise, and interrupt handling—mechanisms already leveraged by pure software sources like Jitter RNG (JENT).

To isolate the marginal contribution of the network path, a controlled experiment (T0) was executed on a single-node Debian 12 environment (Python 3.11.2, median baseline RTT: 31 ms, jitter: 23 ms). The absolute differences of successive time samples (Δ_t = |RTT_t - RTT_t-1|) were measured using time.perf_counter_ns() across three distinct configurations:

• Null Configuration: No network I/O; immediate execution of sched_yield() between timer reads.
• Loopback Configuration: UDP datagram exchange over the local host interface (127.0.0.1).
• Internet Configuration: UDP DNS-queries to distributed Anycast public resolvers (8.8.8.8, 1.1.1.1, etc.) with a strict 50 ms delay to avoid rate-limiting behavior.

The lowest 8 bits of Δ_t were extracted, and the min-entropy (H_sym) was calculated using the Most Common Value (MCV) estimate defined in NIST SP 800-90B §6.3.1.

import math
import os
import struct
from collections import Counter

# Sampling rates derived from the T0 control experiment (samples per second)
SPEEDS = {
    "null": 200000 / 0.9,
    "loopback": 200000 / 5.8,
    "internet": 2000 / 81.7  # Net execution time excluding network rate-limit delays
}

def load_deltas(filename: str) -> list:
    """Reads int64 LE nanoseconds and computes absolute differences |rtt_t - rtt_t-1|"""
    if not os.path.exists(filename):
        return []
    with open(filename, "rb") as f:
        raw = f.read()
    n_elements = len(raw) // 8
    rtts = struct.unpack(f"<{n_elements}q", raw)
    return [abs(rtts[i] - rtts[i-1]) for i in range(1, len(rtts))]

def calc_mcv_entropy(sequence: list, k_states: int) -> float:
    """Computes min-entropy according to NIST SP 800-90B §6.3.1 (Most Common Value Estimate)"""
    n = len(sequence)
    if n == 0: return 0.0
    p_hat = Counter(sequence).most_common(1)[0][1] / n
    # Upper bound of the 99% confidence interval (Z = 2.576)
    p_upper = min(1.0, p_hat + 2.576 * math.sqrt(p_hat * (1.0 - p_hat) / n))
    return -math.log2(p_upper) if p_upper > 0 else 0.0

def get_urandom_ceiling(n: int) -> float:
    """Generates an os.urandom control sample of size n to calculate estimator ceiling"""
    rand_bytes = list(os.urandom(n))
    return calc_mcv_entropy(rand_bytes, 256)

def analyze_file(name: str, filepath: str):
    """Performs comprehensive symbol and per-bit-position entropy analysis on raw logs"""
    deltas = load_deltas(filepath)
    n = len(deltas)
    if n == 0:
        print(f"{name}: File not found or empty.")
        return 0.0

    # Extract the lowest 8 bits (Least Significant Byte) from each RTT delta
    sym_seq = [d & 0xFF for d in deltas]
    h_sym = calc_mcv_entropy(sym_seq, 256)
    
    # Evaluate estimator saturation using a cryptographically secure random source
    ceiling = get_urandom_ceiling(n)
    ratio = h_sym / ceiling
    sat_flag = " [SATURATED - STATISTICALLY INVALID]" if ratio > 0.98 else ""

    # Per-bit-position min-entropy evaluation under SP 800-90B
    bit_entropies = []
    for bit_pos in range(8):
        bit_seq = [(sym >> bit_pos) & 1 for sym in sym_seq]
        h_bit = calc_mcv_entropy(bit_seq, 2)
        bit_entropies.append(h_bit)
    
    h_bit_opt = sum(bit_entropies)
    throughput = h_sym * SPEEDS.get(name, 0)

    print(f"\n=== {name.upper()} CONFIGURATION (n={n}) ===")
    print(f"  Symbol Min-Entropy H_sym  : {h_sym:.2f} / {ceiling:.2f} bits (Ratio: {ratio:.2f}){sat_flag}")
    print(f"  Per-Bit Min-Entropy (0-7) : {' '.join(f'{h:.2f}' for h in bit_entropies)}")
    print(f"  Optimistic Sum of Bits    : {h_bit_opt:.2f} bits/sample")
    print(f"  Entropy Throughput        : {throughput:.1f} bit/sec")
    return throughput

def main():
    print("=== AETHEL ENTROPY SOURCE ANALYZER (t0_analyzer.py) ===")
    
    files = {
        "null": os.path.expanduser("~/AI/t0_raw_null.i64"),
        "loopback": os.path.expanduser("~/AI/t0_raw_loopback.i64"),
        "internet": os.path.expanduser("~/AI/t0_raw_internet.i64")
    }
    
    t_outputs = {}
    for name, path in files.items():
        t_outputs[name] = analyze_file(name, path)

    t_lp = t_outputs.get("loopback", 0)
    t_net = t_outputs.get("internet", 0)
    
    if t_net > 0 and t_lp > 0:
        factor = t_lp / t_net
        print("\n=== ARCHITECTURAL VERDICT ===")
        print(f"Local loopback is faster than internet jitter by a factor of {factor:.1f}x.")
        if factor > 50.0:
            print("VERDICT: Open-internet network noise is uncompetitive as a standalone entropy source.")
            print("RECOMMENDATION: Deploy strictly as a non-credited additional input (0-bit credit) under SP 800-90C §3.1.")

if __name__ == "__main__":
    main()

		 

3. Experimental Results & Statistical Limitations

3.1 Sample Size and Estimator Saturation

An essential observation in the statistical analysis is the phenomenon of estimator saturation on small datasets. For the Internet dataset (n = 1999), the mathematical ceiling of the SP 800-90B MCV estimator for 8-bit symbols is structurally bounded at ≈ 6.25 bits, even for an ideal independent and identically distributed (IID) source. This saturation artifact was confirmed by evaluating an equivalent size vector from os.urandom(), which yielded an identical estimate of ≈ 6.1 bits. Thus, standard symbol-wise comparisons at small sample sizes are strictly invalid for distinguishing source quality.

To circumvent this, we performed a per-bit-position binary min-entropy evaluation, which is immune to symbol-space saturation at n=2000.

3.2 Metrics and Performance Data

Per-Bit-Position Min-Entropy Analysis (Bits 0–7) for the Internet Path:

H_bit = [0.89, 0.88, 0.87, 0.91, 0.90, 0.92, 0.91, 0.90]

The optimistic sum of independent bit positions for the internet source yields 7.18 bits/sample.

4. Discussion & Compliance Constraints

4.1 The Throughput Disparity

The data demonstrates that the local loopback configuration—which represents pure local OS kernel and CPU scheduler jitter—generates approximately 254,737 bit/s of unsaturated min-entropy. In contrast, the active open-internet path generates 154.8 bit/s.

Throughput Ratio = Throughput_Loopback / Throughput_Internet ≈ 1645.3×

The local loopback path is over three orders of magnitude faster at harvesting cryptographic entropy than the external network path using the exact same hardware and measurement code.

4.2 NIST SP 800-90B Boundary and Adversarial Constraints

Consultation with the NIST Cryptographic Module Validation Program (CMVP) clarified two critical architectural dealbreakers for validating open-internet jitter under SP 800-90B:

1. The Boundary Requirement: An Entropy Source Validation (ESV) certificate requires the entire noise source to reside inside the cryptographic boundary. For an open-internet source, this would require drawing the security boundary around the global network infrastructure, which is impossible.
2. Adversarial Observability: SP 800-90B §3.2.2 (Requirement 4) mandates that the noise source state must be entirely protected from adversarial knowledge or influence. Proving this condition for packets traversing public routing infrastructures against an on-path adversary is cryptographically untenable.

5. Conclusion & Recommended Architecture

Because local timing jitter yields far higher throughput while inherently satisfying the non-observability criteria of SP 800-90B, a public network path cannot be justified as a primary or credited entropy source under any validation framework.

However, network jitter remains highly valuable as a defense-in-depth mechanism. We conclude that the optimal deployment strategy for network-entropy injection is under NIST SP 800-90C §3.1 (Non-Credited Additional Input). By declaring a 0-bit entropy credit, the module maintains absolute compliance with FIPS 140-3 standards by relying on its validated local noise source, while simultaneously leveraging external internet macro-dynamics to permanently break the deterministic predictability of the local system state.

References

1. Müller, S. (2026). CPU Jitter Random Number Generator (JENT). Available at: https://chronox.de
2. National Institute of Standards and Technology (NIST). (2018). Recommendation for the Entropy Sources Used for Random Bit Generation, Special Publication 800-90B.
3. National Institute of Standards and Technology (NIST). (2026). Implementation Guidance for FIPS 140-3 and the CMVP, Section D.K & D.T.

← Back to catalogue