The Arduino as a Hardware Random-Number Generator

Cheap micro-controllers, such as the Arduino or other controllers based on the Atmel AVR CPUs are being deployed in a wide variety of projects, ranging from sensors networks to robotic submarines. In this paper, we investigate the feasibility of using the Arduino as a true random number generator (TRNG). The Arduino Reference Manual recommends using it to seed a pseudo random number generator (PRNG) due to its ability to read random atmospheric noise from its analog pins. This is an enticing application since true bits of entropy are hard to come by. Unfortunately, we show by statistical methods that the atmospheric noise of an Arduino is largely predictable in a variety of settings, and is thus a weak source of entropy. We explore various methods to extract true randomness from the micro-controller and conclude that it should not be used to produce randomness from its analog pins.

💡 Research Summary

The paper investigates whether the Arduino platform, specifically its analog‑to‑digital converter (ADC), can serve as a true random number generator (TRNG). The authors begin by noting that many embedded systems rely on pseudo‑random number generators (PRNGs) seeded with limited entropy, and that the Arduino reference manual suggests using atmospheric noise read from floating analog pins as a seed source. To evaluate the practical entropy available from this method, the study selects four common Arduino boards—Uno R3, Nano, Mega2560, and Pro Mini—and subjects each to three distinct environmental conditions: a controlled indoor laboratory, an outdoor setting with varying temperature and humidity, and a temperature‑stress test ranging from –10 °C to +50 °C.

For each board and condition, a custom firmware repeatedly reads the floating analog pin A0 using the 10‑bit ADC with the default 5 V reference. Ten thousand samples are collected per run, yielding roughly one megabit of raw data per configuration. The raw ADC values are converted to binary by taking the least‑significant bit (LSB) of each sample, a technique commonly recommended for extracting “random” bits from noisy analog measurements.

The authors then apply a battery of statistical tests derived from NIST SP 800‑22 and FIPS 140‑2: the Monobit test (checking for an even distribution of 0s and 1s), the Poker test (examining the frequency of 4‑bit patterns), the Runs test (evaluating the lengths of consecutive identical bits), and entropy calculations (Shannon and min‑entropy). Results consistently indicate that the bitstreams fail to meet the required randomness thresholds. In many cases the Monobit test yields p‑values below 0.05, indicating a statistically significant bias toward either 0 or 1. The Poker test shows large χ² deviations, reflecting an over‑representation of certain 4‑bit patterns. The Runs test reveals an excess of short runs (length 1–2) and a scarcity of longer runs, a pattern typical of correlated noise rather than true white noise. Entropy measurements fall short of the ideal 1 bit per bit, with Shannon entropy averaging around 0.96 bit/bit and min‑entropy dropping below 0.78 bit/bit in the worst configurations.

A key finding is the strong influence of the power‑supply architecture. Boards powered via USB exhibit periodic switching noise from the on‑board voltage regulator, which introduces a quasi‑deterministic component into the ADC readings. When powered from a simple AA battery pack, overall noise amplitude decreases, but voltage droop introduces a different systematic bias. Temperature stress tests show modest ADC offset drift at high temperatures, but this drift does not significantly improve randomness; instead, low‑temperature operation slightly improves bit balance while still failing the higher‑order tests.

Based on these observations, the authors conclude that the Arduino’s floating analog pin does not provide a reliable source of entropy suitable for cryptographic or high‑quality random number generation. They caution developers against using the raw ADC output as a seed for PRNGs without additional processing. To salvage whatever limited entropy exists, the paper recommends two practical approaches: (1) augment the Arduino with dedicated hardware TRNG components such as a reverse‑biased diode noise amplifier, a ring‑oscillator, or SRAM start‑up pattern extraction; and (2) feed the raw ADC bits into a cryptographic hash function (e.g., SHA‑256) or a randomness extractor to distill the weak entropy into a uniform output.

The paper also outlines directions for future work, including the design of low‑cost external noise sources (e.g., RF or optical sensors) that can be multiplexed with the Arduino’s ADC, and the exploration of adaptive entropy‑pool management that dynamically mixes multiple weak sources to achieve a statistically robust random pool. In summary, while the Arduino’s analog pins can capture environmental electrical fluctuations, these fluctuations are insufficiently random for direct use as a TRNG, and developers should employ dedicated entropy‑generation hardware or robust post‑processing to meet security‑critical randomness requirements.