NIST Validation
What we measured, what it means, and where the limits are.
Quey's entropy pipeline has been validated against two NIST standards: SP 800-90B (source quality) and SP 800-22 Rev 1a (output quality). This page explains both results, links to the full certificate, and documents the scope of our validation. We publish this because transparency about our source is the foundation of the trust we're asking you to place in us.
01 NIST SP 800-90B — Entropy Source Validation Validated
What SP 800-90B measures: How much real entropy a physical source produces per bit — the conservative, worst-case estimate. This is the test that matters for a hardware random number generator. Any good software PRNG passes SP 800-22; only a real physical source can pass SP 800-90B.
Quey's result: Min-entropy of 0.6236 bits/bit, measured by the Compression (Maurer) estimator on 1 million raw LSB samples from the sensor. This is the minimum across all 10 non-IID estimators — NIST takes the worst case by design. The average across estimators is ~0.85 bits/bit, but the official value is always the floor.
What this means in practice: 0.6236 places the source in the upper range of NIST's "acceptable" band (0.5–0.7). After SHA3-256 conditioning at a 32:1 ratio, the effective safety margin is 20× the NIST minimum. Even if the source degraded to 10× worse than measured, the output would still meet cryptographic requirements.
Scope of this validation: Quey's entropy source has been validated using NIST's open-source reference tools (SP800-90B_EntropyAssessment, sts_assess), run against our own hardware, with reproducible methodology documented in the certificate below. This is an internal validation against NIST statistical standards — not a formal certification. Quey has not obtained FIPS 140-2/3, Common Criteria, or eIDAS certification, which require accredited third-party laboratory testing. If your use case requires one of these certifications, Quey is not the right fit today.
02 Output validation (SP 800-22 Rev 1a)
What SP 800-22 measures: Whether the conditioned output is statistically indistinguishable from perfect randomness. This is a necessary check, but not sufficient on its own — any decent PRNG also passes these tests.
Quey's result: 188 out of 188 sub-tests passed, with pass rates between 98.0% and 99.6% (NIST threshold: 96.89%). Tested on 100 MB of conditioned output, split into 838 bitstreams of 1 million bits each.
NIST SP 800-22 Test Suite — Latest Run
Last run: 2026-05-08 · 100 MB sample · 188/188 test lines passed across 15 categories
| Test name | P-value | Verdict |
|---|---|---|
| Frequency (Monobit) | 0.7382 | PASS |
| Frequency within Block | 0.4951 | PASS |
| Runs | 0.6128 | PASS |
| Longest Run of Ones | 0.8245 | PASS |
| Binary Matrix Rank | 0.3017 | PASS |
| Discrete Fourier Transform | 0.5894 | PASS |
| Non-overlapping Template | 0.4471 | PASS |
| Overlapping Template | 0.6712 | PASS |
| Maurer's Universal | 0.5320 | PASS |
| Linear Complexity | 0.7819 | PASS |
| Serial | 0.4203 | PASS |
| Approximate Entropy | 0.6594 | PASS |
| Cumulative Sums | 0.7841 | PASS |
| Random Excursions | 0.3962 | PASS |
| Random Excursions Variant | 0.5104 | PASS |
03 Methodology & Transparency
The NIST validation results above are based on production measurements: 100 MB of conditioned output captured from the hardware sensor on 8 May 2026, processed with the official NIST SP 800-22 Statistical Test Suite (v2.1.2) and SP 800-90B EntropyAssessment binaries. Sample binary files are SHA-256 fingerprinted; the methodology is fully reproducible.
We commit to publishing every NIST run, regardless of outcome. If a future test fails, the report stays online with a post-mortem; we do not retroactively edit historical data.
github.com/QueyQuantum