27 Feb 2020

An Update on IG G7.18 Entropy Estimation and Compliance with SP 800-90

2020 begins as a year of transitions, and the Cryptographic Module Validation Program (CMVP) has introduced another change to note. Implementation Guidance (IG) G7.18, Entropy Estimation and Compliance with SP 800-90B, is quite prescriptive.

As of November 7, 2020, all entropy testing must be done according to NIST publication SP 800-90B.  This takes some of the guesswork out of the CMVP testing requirements for entropy. However, vendors and labs still must check other guidance to see if the module requires an entropy assessment. IG 7.14 explains the scenarios requiring an entropy assessment, while IG 7.18 firms up the rather loose requirements given in IG 7.15.

Having to use the requirements given in SP 800-90B means that min-entropy will be used as a measure, not Shannon entropy, collision entropy or other entropic measurements. This will standardize the type of entropic discussions that a vendor must make. It also means the tests implemented in SP 800-90B must be implemented in the cryptomodule. All "shall" statements in SP 800-90B are required by CMVP.

The salient pieces of SP 800-90B are:

    • Section 1: An Introduction.
    • Section 2: Provides a general discussion with a definition of min-entropy and a mathematical formula for estimating it:  

             = min (−log2pi),
                = −log2 max pi

There is also a source model and an explanation of the three types of interfaces that may be required for interacting with the entropy source: GetEntropy; GetNoise and HealthTest interfaces.





the requested amount of entropy


The string that provides the requested entropy




A Boolean value that is TRUE if the request has been satisfied and is FALSE otherwise.





An integer value that indicates the requested number of samples to be returned from the noise source.


The sequence of samples from the noise source with a length of number_of_samples_requested.



A Boolean value that is TRUE if the request has been satisfied and is FALSE otherwise.





A bitstring that indicates the type or suite of tests to be performed (this may vary from one entropy source to another).


A Boolean value that is TRUE if the request has been satisfied and is FALSE otherwise.


  • Section three: Discusses entropy validation, including a flow chart that outlines the process:
    1. Data must be collected (1,000,000 bits of raw data before conditioning).
    2. If there is a conditioning component (not listed in section, List of Vetted Conditioning Components consisting of HMAC, CMAC, CBC-MAC, Any Approved hash function, or hash_df from SP 800-90A and Block_Cipher.df from SP 800-90A), then an additional 1,000,000 bits of conditioned data must be collected for testing.
    3. Restart tests must be run. The entropy source must be restarted 1000 times and the data is stored in a 1000 x 1000 matrix.

Once the data is collected it must then be tested using the min-entropy tests found at GitHub.

In each case, the lab must ensure that all of the "shall" statements in SP 800-90B have been met. The lab is also required to provide a heuristic discussion on the entropy source, as well as the more technical discussion of the entropy source and the type of bits produced (IID vs. non-IID). The vendor is required to provide access to the raw data; this is a departure from the past, since it has not always been possible to gain access to a third-party chip etc. However, as IG 7.18 requires this action from the vendor, achieving this may present special problems for some vendors.  A restart test needs to be addressed. 

Health Tests, to ensure the Entropy source is still able to produce entropic bits, are required.  These are different than the DRBG health tests in SP 800-90A. An IID sample must be proven to be in fact IID, which will require an in-depth heuristic discussion *in addition* to the testing requirements in SP 800-90B. The version number of the test tool used must be in the Entropy report. There are other requirements as well, both for the vendor and the lab.

The testing for entropy sources has now been rigorously defined in IG 7.18, and vendors need to be aware of this. All modules that are re-validated after November 7, 2020, will be required to satisfy this new entropy requirement. This an IG is worth looking at – especially given all the changes that CMVP has planned for 2020.


Richard Adams,
Cryptographic and Security Testing Lab Manager


Richard Adams began work for Intertek EWA-Canada in 2009 as a Security Content Automation Protocol (SCAP) Tester and quickly moved into the role of Lead Tester.  He trained and assisted in various other areas within the company, such as Cryptographic Module Validation (FIPS 140-2) testing; Common Criteria (CC) testing; Personal Identification Verification (PIV) testing; Visa Ready Program for Mobile Point of Sale (Visa mPOS) testing; and Certificate Authority (CA) Activities during this time.  He was later promoted to the role of CST Lab Manager. 


Dawn Adams,
Senior IT Security Specialist


Dawn Adams has been with Intertek EWA-Canada for more than 13 years.  She has been involved with the FIPS program for 21 years; she was a Lab Manager for 9 years.  She has worked in and was a Manager in the Common Criteria, PCI, PIV and SCAP workspaces as well. She is currently an IT Security Specialist working mainly in Common Criteria and auditing.

You may be interested in...