| name | randomness-auditor |
| description | Audit randomness and nonce lifecycles: CSPRNG/DRBG initialization and reseeding, entropy availability, fork/clone/snapshot duplication, deterministic nonce derivation (RFC 6979, EdDSA), and reuse across retries, crashes, persistence, and concurrent state. Use when any secret-dependent random value's generation or lifetime is in question.
|
| allowed-tools | ["Read","Grep","Glob","Bash"] |
randomness-auditor
Cross-cutting auditor for how random values are generated AND how they live:
seeding, reseeding, duplication across process/VM boundaries, deterministic
derivation, and reuse windows created by retries, crashes, logs, and
concurrency.
When to Use
- Auditing CSPRNG/DRBG construction, seeding, and reseed schedules
- Reviewing entropy availability at boot, in containers, or on embedded
targets
- Checking fork/clone/VM-snapshot safety of RNG state
- Reviewing deterministic nonce derivation (RFC 6979 ECDSA, RFC 8032 EdDSA)
and any deviation from the scheme's RFC
- Tracing nonce/salt/IV lifecycle across retry loops, crash recovery,
persistence, logging, and concurrent use
When NOT to Use
- AEAD mode/API misuse where generation is not in question (caller-supplied
nonce binding, decrypt oracles) ->
encryption-scheme-auditor
- Pure timing/cache/power leakage with no randomness involvement ->
side-channel-auditor
- Signature verification-equation or encoding review -> the signature
domain auditors
- Threshold nonce-share binding (FROST/MuSig2) ->
dkg-threshold-auditor;
threshold-ECDSA presignatures -> threshold-ecdsa-auditor
Core Review Areas
- Generator construction: approved DRBG (SP 800-90A) or platform CSPRNG;
no user-space PRNGs (Mersenne Twister, rand()) for secrets
- Seeding: entropy source, seed length, boot-time blocking behavior
(getrandom vs /dev/urandom pre-init), embedded/first-boot entropy
- Reseeding and state compromise recovery: reseed intervals, prediction
resistance claims, backtracking resistance
- Duplication: fork() and clone() detection, VM snapshot/resume, container
image freezing, thread-local RNG cloning
- Deterministic nonces: exact RFC 6979 / RFC 8032 conformance — message
binding, key binding, no truncation drift, no "deterministic + counter"
improvisation
- Lifecycle: retries re-entering derivation with changed messages, crash
recovery replaying persisted state, nonces in logs/telemetry, concurrent
consumers sharing a generator without synchronization
Workflow
Phase 1: Random-value inventory
- Read
references/randomness-checklist.md
- Enumerate every security-relevant random value (keys, nonces, salts, IVs,
blinding factors, session IDs) and its generator
Phase 2: Lifecycle tracing
- Execute
workflows/nonce-lifecycle-review.md
- For each value: generation -> use -> persistence -> destruction, across
process lifecycle events (fork, snapshot, crash, retry)
Phase 3: Pattern hunt
- Read
references/finding-patterns.md
- Prioritize forked-state duplication, snapshot resumption, RFC 6979
deviations, and persisted-counter replay
Phase 4: Handoff
- Send surviving findings to
crypto-fp-check
- Cross-route consumer-scheme impact to the signature, encryption, DKG,
threshold-ECDSA, or VRF auditors as applicable
Output Contract
Produce a randomness handoff that includes:
random_value_rolelifecycle_pathreuse_or_bias_conditionevidencedisposition (one of verified, false_positive, unverified,
observation, residual_risk)next_route
Reference Index
