How a Certified Random Number Generator Keeps Checking Itself While It Runs
A certified random number generator does not stop being tested once its certificate is issued: NIST SP 800-90B requires its entropy source to run two continuous self-checks on every single output it produces. For a source assessed at 2.0 bits of entropy per sample, the Repetition Count Test’s cutoff is exactly 11 identical values in a row before it signals a failure — a live, on-the-fly check the one-time lab certificate described elsewhere on this site does not itself perform.
A worked example with numbers
Work through the Repetition Count Test’s own formula, quoted directly from the standard: C = 1 + ⌈−log2(α) ÷ H⌉, where H is the assessed min-entropy per sample in bits and α is the acceptable false-positive probability, commonly fixed at 2⁻²⁰ (about one failure per million samples by pure chance). Since −log2(2⁻²⁰) = 20, an entropy source assessed at H = 2.0 bits per sample gets a cutoff of C = 1 + ⌈20 ÷ 2.0⌉ = 1 + 10 = 11 — eleven identical consecutive outputs is enough to declare a catastrophic failure, exactly the example the standard itself works through. Raise the assessed entropy to H = 4.0 bits per sample and the same formula gives C = 1 + ⌈20 ÷ 4.0⌉ = 6; at H = 8.0 bits per sample it drops further to C = 1 + ⌈20 ÷ 8.0⌉ = 4. A richer source needs far fewer repeats before something is clearly wrong, because a genuinely healthy high-entropy source should almost never repeat even a handful of times running. Unlike a lab review that happens once before a product ships, this test runs on every single sample the device or library produces, for as long as it keeps operating.
How to set the rule before the result
The companion Adaptive Proportion Test catches a different, more subtle failure: not a source stuck on one value, but one value becoming disproportionately common without ever repeating consecutively. It counts how many times a chosen sample value recurs within the next W−1 samples of a fixed window, declaring a failure if that count reaches a cutoff C; the standard’s own published table, for non-binary sources using a window of W = 512 and the same α = 2⁻²⁰, gives C = 410 at H = 0.5 bits, C = 311 at H = 1 bit, C = 177 at H = 2 bits, C = 62 at H = 4 bits, and C = 13 at H = 8 bits per sample. To check whether a specific device or library actually implements either test, look for an explicit SP 800-90B compliance statement or a FIPS 140-3 module validation certificate that names its entropy source — a generic claim of “tested for randomness” with no cited standard is not the same thing, and a batch of self-run statistics after the fact is a different check entirely from a live, continuously running one.
Common mistakes that change the odds or the process
A common mistake is assuming these two tests catch every possible bias, when the standard is explicit that the Repetition Count Test is “not very powerful” — it exists only to catch a source stuck outputting one value, not a subtly skewed one; a source that degrades from 8 bits to 4 bits of entropy per sample without ever repeating six times in a row would sail past this specific test undetected by it alone, which is exactly why the Adaptive Proportion Test exists as a separate, second check rather than a redundant one. A second mistake is assuming a larger window size W always makes the Adaptive Proportion Test stricter; the standard instead fixes W by whether the source is binary (W = 1024) or not (W = 512), a design choice tied to alphabet size, not a tunable strictness dial. A third mistake is treating either test’s pass as proof the source is fully healthy — both are deliberately narrow, resource-light checks meant to run continuously without slowing the device down, not a replacement for the fuller statistical battery, such as NIST SP 800-22, that a source is expected to pass before it is ever certified in the first place.
Where this method stops being appropriate
These two tests apply specifically to the raw entropy source inside a certified random number generator, the noise-measuring layer described in SP 800-90B; they say nothing about a downstream algorithmic generator several steps removed from that raw noise, such as a browser’s crypto.getRandomValues(), which is evaluated instead under the separate deterministic-generator standard, SP 800-90A. They also do not replace the one-time design and seeding review a lab performs under a standard like GLI-19 before certification is granted in the first place — the continuous tests and the one-time review catch different failure classes at different points in a generator’s life, and a system missing either one has a real, documented gap, not a redundant extra.
How the random source fits into the rule
NIST SP 800-90B documents both continuous health tests quoted above, including the exact cutoff formulas and the published example values; Gaming Laboratories International’s GLI-19 standard for interactive gaming systems documents the one-time design and seeding review these continuous tests run alongside, rather than replace, once a generator reaches production.
Repetition Count Test cutoffs at four entropy levels
| Min-entropy per sample (H) | Repeats needed to trigger a failure (C) |
|---|---|
| 1.0 bits | 21 |
| 2.0 bits | 11 |
| 4.0 bits | 6 |
| 8.0 bits | 4 |
Every row uses the same α = 2⁻²⁰ false-positive target and the same formula, C = 1 + ⌈20 ÷ H⌉. A richer source is expected to vary more from sample to sample, so a shorter run of identical values is already suspicious for it, while a sparser source needs a longer identical run before the same conclusion is statistically justified.
A second case: what the Adaptive Proportion Test catches that repetition-counting misses
Suppose a hardware noise diode degrades gradually rather than failing outright, so that one particular sample value starts appearing on roughly 15% of samples instead of its expected, much smaller share, without ever occurring six or more times consecutively. The Repetition Count Test, watching only for unbroken runs, would not flag this at all. The Adaptive Proportion Test would: at a modest assessed entropy of H = 2 bits per sample, its cutoff of C = 177 recurrences inside a 512-sample window is reached quickly once one value’s true share climbs well above its expected roughly 25% share for a 2-bit alphabet, precisely the “large loss of entropy” failure mode the standard states this second test is designed to catch.
Why neither test replaces the one-time certification review
The one-time review behind a GLI-19 or similar certificate examines the generator’s design, seeding method, and system integration before it ever ships — questions about architecture that a live statistical test, running only on already-produced output, cannot ask. The two SP 800-90B continuous tests instead answer a narrower, ongoing question: is this specific unit, right now, still behaving the way its original design and entropy assessment said it would. A generator can pass its one-time certification and still need these continuous tests running for its entire operational life, because a certificate describes the design as reviewed on one date, not a guarantee that the physical noise source inside a specific unit cannot degrade months or years later.
The binary-source cutoff table, for comparison
| Min-entropy per sample (H) | Adaptive Proportion cutoff C (binary, W = 1024) |
|---|---|
| 0.2 bits | 941 |
| 0.4 bits | 840 |
| 0.6 bits | 748 |
| 0.8 bits | 664 |
| 1.0 bits | 589 |
The standard fixes the window at W = 1024 for a binary source — one that only ever outputs two distinct values — rather than the W = 512 used for the non-binary table shown earlier, because a coarser two-value alphabet needs a longer observation window to distinguish an ordinary run of one value from a genuine loss of entropy. A source producing a wider alphabet of possible values gets flagged sooner, with a shorter window, because any one value recurring unusually often inside a smaller sample is already a stronger signal when there were many other values it could have been instead.