Cryptographic entropy expresses uncertainty about values used to create a secret key or generator state. Assessment considers the distribution of possible inputs and information available to an adversary. A long output can originate in a small predictable space; security therefore starts at the source, continues through processing and includes state protection.
RFC 4086 distinguishes resistance to guessing from mere statistical irregularity. An attacker may know a startup time or serial number, or search a small range. Encoding it as a long string does not create an equally large secret space. One displayed key cannot reveal how well it was generated. [RFC 4086 — Unpredictability and source limitations]
A DRBG produces further outputs algorithmically from a secret initial state. This is a useful cryptographic construction, but additional bytes are not automatically fresh physical entropy. The same complete state and inputs produce the same continuation. Generator strength also depends on initialization and correct use. [NIST SP 800-90A Rev. 1 — Deterministic generation and reseeding]
NIST SP 800-90B requires a description of the noise source, dependencies and health tests. These check raw noise at startup and continuously, before subsequent processing. Environmental changes or a stuck source can invalidate assumptions; failure must be reported to the application rather than presented as good data. [NIST SP 800-90B — Entropy source design and health tests]
Processing called conditioning can reduce bias and concentrate available uncertainty into a shorter output. A hash cannot turn fully known inputs into a secret. Estimates for multiple sources cannot simply be added when they are dependent; more complicated mixing does not itself demonstrate independence or quality. [NIST SP 800-90B — Entropy source design and health tests] [RFC 4086 — Unpredictability and source limitations]
Someone obtaining a DRBG’s state may, depending on its construction, predict subsequent outputs. Restoring resistance to such prediction requires sufficient fresh entropy unknown to the attacker. Merely continuing the algorithm or adding a known time provides no such assurance. Generator recovery also does not invalidate a key already leaked. [NIST SP 800-90A Rev. 1 — Deterministic generation and reseeding]
BIP39 encodes 128 input bits plus 4 checksum bits as 12 words; for 256 input bits it adds 8 bits and produces 24 words. The checksum is derived and adds no entropy. These lengths do not prove input quality, and a longer list cannot repair predictable generation. [BIP39 — Entropy, checksum and mnemonic encoding]
NIST SP 800-22 explicitly distinguishes passing a statistical suite from cryptographic security. A test can detect a particular deviation, but cannot replace algorithm analysis or establish that an adversary does not know the input. Testing a finished file does not certify a wallet’s security. [NIST SP 800-22 Rev. 1a — Limits of statistical testing]
NIST SP 800-90C combines entropy sources and DRBG mechanisms into generator constructions. Assess a wallet’s concrete implementation, entropy acquisition and estimation, error handling and state protection. A standard reference or chip name alone does not establish that a particular release meets those requirements. [NIST SP 800-90B — Entropy source design and health tests] [NIST SP 800-90C — Complete random bit generator constructions]
For the clearest picture, read this entry together with Entropy Bit, CSPRNG, Dice Roll Entropy, Private Key. The reverse links also lead from Dice Roll Entropy, Entropy Bit, Brute Force Search Space, Random Number Generator.