Cryptographic security of entropy sources and SHA-512 mixing

1. What a public TRNG does not promise

A public entropy service should not replace a local system CSPRNG or a certified HSM/TRNG. It is an additional physical input source and an engineering research layer.

The safest use is mixing with local system state rather than blindly trusting one external endpoint.

2. SHA-512 as conditioner

SHA-512 helps spread physical input material and hide local structures of the raw signal. It does not create entropy from nothing, but it improves practical output distribution.

3. Public pool isolation

Bytes served to clients are consumed, while mixing state remains separated from raw samples. This reduces simple reconstruction risk for previous output.

4. Deployment guidance

For private keys, production tokens, and regulated systems, use local mixing, monitoring, and your own risk assessment.

curl -s "https://entropy.sparksome.pl/raw?bytes=512" --output external-entropy.bin
openssl rand 32 > local-seed.bin
cat external-entropy.bin local-seed.bin | sha512sum