random.flameit.io
checking Infinite Noise TRNG
RAMwaiting for stats
HDDwaiting for stats

RANDOM.FLAMEIT.IO DOCUMENTATION

Hardware entropy,
explained and verified.

API reference, delivery architecture and tested OpenSSL workflows for receiving authenticated random bits from the Infinite Noise TRNG service.

Use the APIVerify Ed25519Understand the source

API REFERENCE

Endpoints and formats

All entropy responses are sent with Cache-Control: no-store. The byte endpoint accepts one positive decimal bytes parameter up to 100 MiB.

/get/?bytes=N

Random bytes

Raw application/octet-stream data. Add signed=json for compact authenticated responses or signed=bundle for streaming signed packages.

/password/

Passwords and tokens

POST-based generator for secure passwords, passphrases, PINs, hexadecimal values and Base64URL tokens.

/dice/

Six-sided dice

JSON results for 1–12 unbiased d6 rolls. Use /rpg/ for mixed dice and advanced notation.

/img/

Random PNG

Solid color, one-bit monochrome, greyscale or independent RGB pixels encoded as a streamed PNG.

/signing-keys/

Verification keys

Registry of active and historical Ed25519 public keys with stable downloadable PEM filenames.

/health/

Live status

Human- and machine-readable state of the Go server, hardware source, signature service and RAM/disk buffers.

REFERENCE

Bytes to bits

One byte contains exactly eight bits. Binary units use 1 KiB = 1024 bytes.

Scale fact: the observable universe is commonly estimated to contain about 1080 atoms — approximately 2266.

SizeBytes sentRandom bitsEndpoint
1 B18
8 B864
16 B16128
32 B32256
64 B64512
128 B1281,024
256 B2562,048
512 B5124,096
1 KiB1,0248,192
1 MiB1,048,5768,388,608
100 MiB104,857,600838,860,800
ENTROPY PIPELINE

What happens before a byte reaches the endpoint

01Thermal noisephysical analog source
02Infinite Noise TRNGUSB entropy source
03Health + Keccaktest and conditioning
04RAM + disk reservesingle-use buffering
05PHP + HTTPSservices and streaming

AUTHENTICATED TRNG DELIVERY

Elliptic-curve Ed25519 signatures

Infinite Noise provides physical entropy; Ed25519 proves the origin and integrity of the response delivered to your system.

Why the returned bits are signed

The service signs the exact message that carries the random bits together with its byte count, timestamp, key ID and optional client nonce. A valid Ed25519 signature confirms that the response was issued by random.flameit.io and detects any alteration of the payload or signed metadata before the bits are accepted.

A fresh nonce binds the returned data to one client request, protecting the workflow from response substitution or replay. The private signing key remains inside the signing service; users only need the published public key to verify a response with OpenSSL.

Two public-key publication paths

HTTPS key registry
https://random.flameit.io/signing-keys/Publishes active and historical key IDs plus downloadable OpenSSL-compatible PEM files.
DNS TXT
_trng-signing-key.random.flameit.io.Publishes the same active key ID and Base64-encoded SubjectPublicKeyInfo through DNS.

Cross-check both copies. The scripts below compare the key ID and the normalized SPKI/DER key bytes from HTTPS and DNS before accepting random data. Matching publication paths confirm the same active verification key and expose a stale cache, incomplete rotation or deployment error. A DNSSEC-validating resolver strengthens the DNS side of this check.

SIGNED JSON

Small authenticated responses

signed=json returns the exact signed message and raw Ed25519 signature as Base64. It is convenient for compact application responses.

SIGNED BUNDLE

Streaming authenticated payloads

signed=bundle returns a TAR containing random.bin, signed proof.json with its SHA-512 digest, and raw proof.sig.

01

Fetch the DNS key and save verified bits

Canonical JSON workflow: compare both public-key sources, verify Ed25519 and the nonce, then save the accepted data as secure_bits.bin.

set -euo pipefail

dns_name='_trng-signing-key.random.flameit.io'
registry_url='https://random.flameit.io/signing-keys/'
nonce="$(openssl rand -hex 16)"
output='secure_bits.bin'
work_dir="$(mktemp -d)"
trap 'rm -rf "$work_dir"' EXIT

printf '[1/7] Requesting 256 signed TRNG bits...\n'
printf '  Nonce sent: %s\n' "$nonce"
curl -fsS \
  "https://random.flameit.io/get/?bytes=32&signed=json&nonce=${nonce}" \
  -o "$work_dir/response.json"

printf '[2/7] Decoding the signed response...\n'
jq -er '.message_base64' "$work_dir/response.json" | base64 -d > "$work_dir/message.json"
jq -er '.signature_base64' "$work_dir/response.json" | base64 -d > "$work_dir/signature.bin"
signed_nonce="$(jq -er '.client_nonce' "$work_dir/message.json")"
signed_key_id="$(jq -er '.key_id' "$work_dir/message.json")"
printf '  Nonce sent:               %s\n' "$nonce"
printf '  Nonce in signed message:  %s\n' "$signed_nonce"
printf '  Key ID in signed message: %s\n' "$signed_key_id"

printf '[3/7] Fetching the Ed25519 key from DNS...\n'
dns_txt="$(dig +short TXT "$dns_name" | head -n 1 | tr -d '"')"
txt_field() {
  printf '%s\n' "$dns_txt" | tr ';' '\n' | sed -n "s/^[[:space:]]*$1=//p"
}
test "$(txt_field v)" = 'TRNG1'
test "$(txt_field k)" = 'Ed25519'
dns_key_id="$(txt_field kid)"
dns_spki="$(txt_field p)"
test -n "$dns_key_id"
test -n "$dns_spki"
printf '%s\n%s\n%s\n' \
  '-----BEGIN PUBLIC KEY-----' "$dns_spki" '-----END PUBLIC KEY-----' \
  > "$work_dir/dns-signing-key.pub"
openssl pkey -pubin -in "$work_dir/dns-signing-key.pub" \
  -pubout -outform DER -out "$work_dir/dns-signing-key.der"
dns_fingerprint="$(sha256sum "$work_dir/dns-signing-key.der" | awk '{print $1}')"
printf '  DNS TXT: %s\n' "$dns_txt"
printf '  DNS key ID: %s\n' "$dns_key_id"
printf '  DNS public key (PEM):\n'
sed 's/^/    /' "$work_dir/dns-signing-key.pub"
printf '  DNS key SPKI SHA-256: %s\n' "$dns_fingerprint"

printf '[4/7] Comparing the DNS key with the active service key...\n'
curl -fsS "$registry_url" -o "$work_dir/signing-keys.json"
service_key_id="$(jq -er \
  '[.keys[] | select(.status == "active")] | if length == 1 then .[0].key_id else error("expected exactly one active signing key") end' \
  "$work_dir/signing-keys.json")"
if [[ ! "$service_key_id" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{2,63}$ ]]; then
  printf 'ERROR: The service registry returned an invalid active key ID.\n' >&2
  exit 1
fi
curl -fsS "${registry_url}?key=${service_key_id}.pub" \
  -o "$work_dir/service-signing-key.pub"
openssl pkey -pubin -in "$work_dir/service-signing-key.pub" \
  -pubout -outform DER -out "$work_dir/service-signing-key.der"
service_fingerprint="$(sha256sum "$work_dir/service-signing-key.der" | awk '{print $1}')"
printf '  Active service key ID: %s\n' "$service_key_id"
printf '  Active service public key (PEM):\n'
sed 's/^/    /' "$work_dir/service-signing-key.pub"
printf '  Service key SPKI SHA-256: %s\n' "$service_fingerprint"
test "$dns_key_id" = "$service_key_id"
cmp -s "$work_dir/dns-signing-key.der" "$work_dir/service-signing-key.der"
printf '  DNS key vs service key: MATCH\n'

printf '[5/7] Verifying origin, integrity, key ID and request nonce...\n'
openssl pkeyutl -verify \
  -pubin -inkey "$work_dir/dns-signing-key.pub" \
  -rawin -in "$work_dir/message.json" \
  -sigfile "$work_dir/signature.bin" >/dev/null
test "$signed_nonce" = "$nonce"
test "$signed_key_id" = "$dns_key_id"
test "$(jq -er '.algorithm' "$work_dir/message.json")" = 'Ed25519'
printf '  Signature: valid · key ID: MATCH · nonce: MATCH\n'

printf '[6/7] Extracting the verified random bits...\n'
jq -er '.data_base64' "$work_dir/message.json" | base64 -d > "$output"
expected_bytes="$(jq -er '.returned_bytes' "$work_dir/message.json")"
actual_bytes="$(wc -c < "$output" | tr -d '[:space:]')"
test "$actual_bytes" = "$expected_bytes"

printf '[7/7] SUCCESS: %s verified random bits saved as %s\n' \
  "$((actual_bytes * 8))" "$output"
sha256sum "$output"
02

Fetch, verify and extract a signed bundle

The bundle workflow follows the same DNS/HTTPS key cross-check, then verifies proof.json, its nonce and the SHA-512 digest before saving secure_bundle_bits.bin.

set -euo pipefail

dns_name='_trng-signing-key.random.flameit.io'
registry_url='https://random.flameit.io/signing-keys/'
requested_bytes=1048576
nonce="$(openssl rand -hex 16)"
output='secure_bundle_bits.bin'
work_dir="$(mktemp -d)"
trap 'rm -rf "$work_dir"' EXIT

printf '[1/8] Requesting a signed %s-byte TRNG bundle...\n' "$requested_bytes"
printf '  Nonce sent: %s\n' "$nonce"
curl -fsS \
  "https://random.flameit.io/get/?bytes=${requested_bytes}&signed=bundle&nonce=${nonce}" \
  -o "$work_dir/random-signed.tar"

printf '[2/8] Validating and extracting the TAR package...\n'
actual_entries="$(tar -tf "$work_dir/random-signed.tar" | LC_ALL=C sort)"
expected_entries="$(printf '%s\n' proof.json proof.sig random.bin | LC_ALL=C sort)"
test "$actual_entries" = "$expected_entries"
mkdir "$work_dir/bundle"
tar -xf "$work_dir/random-signed.tar" -C "$work_dir/bundle"
test -f "$work_dir/bundle/random.bin"
test -f "$work_dir/bundle/proof.json"
test -f "$work_dir/bundle/proof.sig"

printf '[3/8] Reading signed bundle metadata...\n'
signed_nonce="$(jq -er '.client_nonce' "$work_dir/bundle/proof.json")"
signed_key_id="$(jq -er '.key_id' "$work_dir/bundle/proof.json")"
printf '  Nonce sent:              %s\n' "$nonce"
printf '  Nonce in signed proof:   %s\n' "$signed_nonce"
printf '  Key ID in signed proof:  %s\n' "$signed_key_id"

printf '[4/8] Fetching the Ed25519 key from DNS...\n'
dns_txt="$(dig +short TXT "$dns_name" | head -n 1 | tr -d '"')"
txt_field() {
  printf '%s\n' "$dns_txt" | tr ';' '\n' | sed -n "s/^[[:space:]]*$1=//p"
}
test "$(txt_field v)" = 'TRNG1'
test "$(txt_field k)" = 'Ed25519'
dns_key_id="$(txt_field kid)"
dns_spki="$(txt_field p)"
test -n "$dns_key_id"
test -n "$dns_spki"
printf '%s\n%s\n%s\n' \
  '-----BEGIN PUBLIC KEY-----' "$dns_spki" '-----END PUBLIC KEY-----' \
  > "$work_dir/dns-signing-key.pub"
openssl pkey -pubin -in "$work_dir/dns-signing-key.pub" \
  -pubout -outform DER -out "$work_dir/dns-signing-key.der"
dns_fingerprint="$(sha256sum "$work_dir/dns-signing-key.der" | awk '{print $1}')"
printf '  DNS key ID: %s\n' "$dns_key_id"
printf '  DNS key SPKI SHA-256: %s\n' "$dns_fingerprint"

printf '[5/8] Comparing the DNS key with the active service key...\n'
curl -fsS "$registry_url" -o "$work_dir/signing-keys.json"
service_key_id="$(jq -er \
  '[.keys[] | select(.status == "active")] | if length == 1 then .[0].key_id else error("expected exactly one active signing key") end' \
  "$work_dir/signing-keys.json")"
if [[ ! "$service_key_id" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{2,63}$ ]]; then
  printf 'ERROR: The service registry returned an invalid active key ID.\n' >&2
  exit 1
fi
curl -fsS "${registry_url}?key=${service_key_id}.pub" \
  -o "$work_dir/service-signing-key.pub"
openssl pkey -pubin -in "$work_dir/service-signing-key.pub" \
  -pubout -outform DER -out "$work_dir/service-signing-key.der"
service_fingerprint="$(sha256sum "$work_dir/service-signing-key.der" | awk '{print $1}')"
printf '  Active service key ID: %s\n' "$service_key_id"
printf '  Service key SPKI SHA-256: %s\n' "$service_fingerprint"
test "$dns_key_id" = "$service_key_id"
cmp -s "$work_dir/dns-signing-key.der" "$work_dir/service-signing-key.der"
printf '  DNS key vs service key: MATCH\n'

printf '[6/8] Verifying Ed25519, key ID and request nonce...\n'
openssl pkeyutl -verify \
  -pubin -inkey "$work_dir/dns-signing-key.pub" \
  -rawin -in "$work_dir/bundle/proof.json" \
  -sigfile "$work_dir/bundle/proof.sig" >/dev/null
test "$signed_nonce" = "$nonce"
test "$signed_key_id" = "$dns_key_id"
test "$(jq -er '.algorithm' "$work_dir/bundle/proof.json")" = 'Ed25519'
test "$(jq -er '.payload_file' "$work_dir/bundle/proof.json")" = 'random.bin'
test "$(jq -er '.returned_bytes' "$work_dir/bundle/proof.json")" = "$requested_bytes"
printf '  Signature: valid · key ID: MATCH · nonce: MATCH\n'

printf '[7/8] Verifying the payload SHA-512 and byte count...\n'
(
  cd "$work_dir/bundle"
  jq -er '"\(.payload_sha512)  \(.payload_file)"' proof.json | sha512sum -c -
)
actual_bytes="$(wc -c < "$work_dir/bundle/random.bin" | tr -d '[:space:]')"
test "$actual_bytes" = "$requested_bytes"

printf '[8/8] Saving the verified random bits...\n'
install -m 600 "$work_dir/bundle/random.bin" "$output"
printf 'SUCCESS: %s verified random bits saved as %s\n' \
  "$((actual_bytes * 8))" "$output"
sha256sum "$output"
03

Optionally mix verified bits into Linux

Use the output created by either verified workflow. The kernel mixes these bytes with its existing random pool; this write does not itself increase the kernel's credited entropy count.

set -euo pipefail

input='secure_bits.bin'
test -s "$input"
bits="$(( $(wc -c < "$input") * 8 ))"
printf 'Mixing %s verified TRNG bits into the Linux random pool...\n' "$bits"
sudo tee /dev/random < "$input" > /dev/null
printf 'SUCCESS: verified TRNG bits were mixed into /dev/random.\n'

HARDWARE SOURCE

Why Infinite Noise TRNG?

The endpoint does not expose raw USB bits. The infnoise driver validates and conditions the physical signal with Keccak-1600. Go serves the output from RAM first and keeps a persistent disk reserve for demand spikes.

01

Physical unpredictability

The circuit uses thermal and electronic noise in a modular entropy multiplier. With loop gain near 1.82, the design model predicts approximately log₂(1.82) ≈ 0.864 bits of entropy per raw output bit.

02

Resistance to injected signals

The circuit repeatedly multiplies its noisy state modulo the supply range. External interference is mixed with the existing state, making a chosen output harder to force.

03

Continuous health checks

The open-source driver estimates raw-stream entropy. If it deviates from the expected model or detects suspicious identical runs, output stops instead of silently serving questionable data.

04

Cryptographic conditioning

Correlated adjacent raw bits are never served directly. A Keccak-1600 sponge whitens the stream after its estimated entropy has been checked.

05

Conservative output ratio

The service uses infnoise --multiplier 1: 512 tested input bits, estimated to hold at least about 433 entropy bits, are conditioned into 256 output bits. Go does not expand the stream with a PRNG.

06

RAM first, disk in reserve

Go refills free RAM directly and serves RAM first. Only a full RAM buffer replenishes disk; the reserve is read solely when RAM is empty. Bytes remain single-use across concurrent clients.

Operational note

This is a strong supplemental entropy source. Output is hardware-derived and cryptographically conditioned rather than an unprocessed analog stream. Security also depends on the TRNG hardware and driver, the Go/PHP host, buffer protection and authenticated HTTPS delivery.

Technical sourcesInfinite Noise hardware and theory ↗infnoise driver documentation ↗Local Go upstream health ↗

RECORDED SAMPLE

Output statistics

Results from an 8 GB sample. Statistical testing supports continuous output-quality monitoring; assurance of physical origin comes from the documented hardware architecture, health checks and conditioning pipeline.

Open full test report ↗
Entropy
8.000000 bits/byte
Mean
127.5019 ideal 127.5
Serial correlation
−0.000007 ideal 0.0
Monte Carlo π
3.141638830 error 0.00%