Centropy — Verifiable Entropy as a Service (PoC)

Post-quantum, auditable entropy infrastructure. Working proof of concept.

Weak entropy has silently drained hundreds of millions in crypto assets for over a decade — Debian OpenSSL (2008), Android SecureRandom (2013), Profanity (2022), Milk Sad (2023), Trust Wallet (2023), and the $116M Coldcard exploit (July 2026), where a firmware build error degraded seed strength from 128 to ~40 bits and went undetected for five years. Centropy is infrastructure to make that failure mode detectable, mitigable, and auditable.

What this PoC demonstrates (all working code)

1. Multi-source entropy pool with independent physical families, where a single honest source suffices for a secure output (SHAKE-256 extractor with domain separation).
2. Continuous health tests (NIST SP 800-90B §4.4: Repetition Count Test, Adaptive Proportion Test, plus monobit/chi²/Shannon batch statistics). A deliberately broken "stuck" source is detected and excluded automatically — the control that was missing in the Coldcard incident.
3. Post-quantum delivery end to end: batches encapsulated with ML-KEM-768 (FIPS 203) + AES-256-GCM; per-batch manifests signed with ML-DSA-65 (FIPS 204).
4. Transparency log: every batch manifest is anchored in an append-only Merkle tree (Certificate Transparency model) with client-verifiable inclusion proofs. Tampered batches are rejected.
5. Hybrid Seed SDK (the anti-Coldcard mechanism): seed = HKDF-SHA512(local_entropy, verified_remote_batch). The seed is unpredictable if either input is. In the included demo, a wallet relying only on a weak ~20-bit source is brute-forced in seconds; the same defective source passed through the hybrid SDK yields a key with 2^256 effective security. The provider never learns the final seed.

Key design honesty: statistical tests cannot detect predictable-but- well-distributed outputs (the Coldcard failure class). Health tests catch degradation; hybrid mixing neutralizes predictability. You need both.

Run it

pip install kyber-py dilithium-py cryptography
python3 -m centropy_poc.demo

Architecture (summary)

sources (≥4 independent physical families)
   └─> SP 800-90B health gate (auto-exclusion)
         └─> SHAKE-256 extractor  ──>  signed manifest (ML-DSA) ──> Merkle log
               └─> DRBG / batch  ──>  ML-KEM-768 + AES-GCM ──> client
                                                └─> hybrid mix with local entropy

Module	Role
centropy_poc/sources.py	Entropy sources incl. deliberately faulty ones for the demos
centropy_poc/health.py	SP 800-90B RCT/APT + batch statistics
centropy_poc/server.py	Extraction, ML-DSA manifests, ML-KEM delivery
centropy_poc/transparency.py	Append-only Merkle transparency log
centropy_poc/sdk.py	Client-side hybrid seed derivation (HKDF)
centropy_poc/drbg.py	HMAC_DRBG (SP 800-90A §10.1.2, SHA-512) with enforced reseeding (fail-closed)
centropy_poc/beacon.py	Public verifiable beacon: hash-chained rounds signed with ML-DSA-65
centropy_poc/demo.py	End-to-end demo incl. brute-force comparison
tests/	20 tests — every security property claimed above has a corresponding test

pip install pytest && pytest tests/ -v

CI runs the full suite plus the end-to-end demo on every push (.github/workflows/ci.yml, Python 3.11/3.12).

Notable test: test_weak_prng_is_statistically_invisible proves the design's central claim — a predictable-but-well-distributed source passes every statistical health test, which is why hybrid mixing (not testing) is the defense against the Coldcard failure class.

Production design (not in this PoC): hardware QRNGs from 2+ vendors, chaotic macroscopic sources, TEE remote attestation of the mixing binary, on-chain anchoring of the Merkle root, HSM-held signing keys, and a decentralized multi-node variant where clients mix contributions from N independent nodes.

Provenance

Authorship of this work (including two private design documents not published here) is timestamped via OpenTimestamps — Bitcoin-anchored proofs in timestamps/, SHA-256 digests in timestamps/hashes-sha256.txt. Stamped 2026-08-07.

To verify once confirmations land: ots verify timestamps/<file>.ots -f <file> (or ots upgrade first).

License

AGPL-3.0-or-later (see LICENSE). You may use, study, modify and redistribute this code, but any service built on it must publish its source under the same terms. Commercial licensing available — open an issue.

This repository is also intended as prior art: the mechanisms described here are published to preclude their patenting by third parties.

Status

Proof of concept — not audited, not production-ready. Do not use for real key generation yet.