Your randomness passed. We still find the flaw.

RawGauge is an independent, deep audit of your raw entropy source. At the same false-alarm rate as the mandated NIST health tests, we catch the bias, hidden correlation, and structural deficits that pass certification and quietly weaken keys. We measure the source, not the mask.

Request an audit See what we detect

Sample measurements below: 10 devices, 24 hours, ~13 GB of raw output examined on-chip, 0 integrity errors across 4,553,540 records. Produced on the FIT IoT-LAB open testbed.

Raw source · live reading STANDARD TEST: PASS

standard view RAWGAUGE: FLAGGED — 0.5% bias what we resolve

The silent-failure problem

A healthy-looking output can hide a failing source.

Cryptographic conditioning makes a biased or correlated source look statistically perfect. The mandated health tests — NIST SP 800-90B's RCT and APT — fire only on gross failure, so a subtle per-device deficit passes straight through, and keeps passing while the raw source quietly degrades in the field. Debian's OpenSSL and ROCA are what this failure class looks like after it ships.

How it works

Send the raw source. Get a result you can re-run.

Send the raw source

Raw TRNG output, before conditioning — just noise, no keys or secrets. If you can't export it, that gap is itself a finding, and we help you scope it.

We run both batteries, matched

The standard NIST battery and our deep scan, calibrated to each device's own baseline and to the same false-alarm rate — so the comparison is like-for-like, not stacked.

You get a reproducible report

An audit report you can reproduce, plus a signed, hashed evidence pack for your auditor or regulator. Pre-registered criteria included.

What we detect

The same false-alarm rate. A different result.

Every detector is tuned to the ~0% false-alarm rate of the standard tests, so this is like-for-like. Detection rate across trials, measured on a commodity hardware source.

Standard NIST tests (RCT / APT) RawGauge deep scan

Fine bias, 0.5%below full entropy per bit

standard

rawgauge

100%

Bias, 2%

standard

13%

rawgauge

100%

Hidden serial correlationoutput stays perfectly balanced

standard

0–2%

rawgauge

100%

Periodic leakat P(1)=0.5

standard

rawgauge

99–100%

Byte-symbol biasbit marginals look clean

standard

rawgauge

100%

Cross-channel shared entropycorrelation between devices

standard

rawgauge

100%

A 1 MiB min-entropy spot-check can't resolve the deficit either: estimator noise is about 30× larger than the signal. It shows only over volume, with a targeted, calibrated test.

Verify your own source in your browser

Where we are exceptional

What single-channel certification is blind to — by design.

Some failure classes aren't a question of sensitivity. A single-channel test cannot see them even in principle. This is where we don't just test better — we cover ground the standard can't reach.

Shared entropy across devices

Two units quietly drawing on correlated entropy pass every single-channel test — each stream looks perfect on its own. Our pairwise monitor catches the correlation between them. The "Mining your Ps and Qs" failure class, made visible.

Structure a balanced stream hides

Byte-level symbol bias and periodic leaks can leave the bit statistics looking ideal. We resolve them at the same false-alarm rate — not by relaxing the alarm, but by measuring what the standard never looks at.

A fair fight we still win

Every figure we show is measured at the same ~0% false-alarm rate as the tests we beat, confirmed on a null control. We don't move the goalposts to look sensitive. The comparison is honest, and the gap is real.

Why the numbers hold up

Rigor you can audit, not a claim you take on trust.

Pre-registered

Pass/fail criteria are fixed before the data is examined. No tuning to the result after the fact.

Control-calibrated

Measured against the same estimator on a known-good control, never against a theoretical ideal — so estimator noise is never mistaken for a deficit.

Matched false-alarm rate

Our detectors and the standard tests are tuned to the same ~0% false-alarm rate, confirmed on a null control, so every comparison is fair.

Per-device baseline

Each unit is judged against its own fingerprint, not a population average — the deficit that hides in the aggregate shows up per device.

What we don't claim

The boundary is part of the product.

Not an accredited certificate

This is an independent technical audit. Where you need FIPS 140-3 or Common Criteria, we pre-screen and complement it — we don't replace it.

We measure, we don't predict

We report what is present now, which you can verify yourself. We make no early-warning or forecasting claim.

The source, not the whole system

We detect anomalies that show up in the raw source. Attacks that don't touch it — key theft, a backdoored conditioner, side channels — are out of scope.

Products

One method, three ways to deliver it.

Service · online RawGauge Audit

A deep audit of your raw source, delivered online. One-off or repeatable, with the report and evidence pack.

Embedded · IP licence RawGauge Monitor

The detector suite as embeddable firmware/IP, for continuous on-device health beyond the built-in RCT/APT.

Fleet · SaaS RawGauge Attest

Each unit watched against its own baseline across the fleet, with a signed, auditable health token.

Who it's for

When the whole system's trust rests on the RNG.

Secure-silicon & TRNG / PQC vendors IoT & embedded makers HSM / PKI / KMS / CA operators Fleet operators Defense & regulated sectors

Request an audit

Send a raw sample and what you need to prove.

We scope it with you under NDA, with encrypted transfer and a defined retention and destruction policy. Quick screen, full audit, or continuous monitoring.

info@rawgauge.com

RawGauge is operated by Cascade Investment LLC.