Provable Uniformity and Min-Entropy Bounds from Compound Negative Binomial Jitter: A Software-Defined TRNG

Quantum-safe cryptographic protocols require certified entropy for key generation, nonces, and ephemeral parameters. Existing hardware and quantum random number generators impose deployment costs, supply-chain risks, and rely on heuristic post-processing. We present a mathematically certified, software-defined entropy source—a true random number generator (TRNG)—that produces uniform randomness with a provable min-entropy lower bound via computational jitter modulation, without specialized hardware or external conditioning. The core contribution is the Geometric Convergence Theorem (GCT): the modular reduction of a Compound Negative Binomial (CNB)-distributed observable converges exponentially to an invariant uniform measure over finite cyclic groups, with an explicit, computable spectral decay factor and a matching min-entropy lower bound. The GCT is complemented by the Stochastic Uncertainty Principle (SUP), an exact coefficient-of-variation decomposition that quantifies physical entropy injection from microarchitectural jitter. Together they yield a two-layer architecture: the combinatorial layer carries an exact, platform-independent uniformity bound, and the physical layer supplies the fresh entropy through continuous reseeding, so that the certified output is TRNG-class rather than a deterministic PRNG stream. The framework is validated through the Random Permutation Sorting System (RPSS) on commodity hardware, implemented in C with intentional compiler anti-optimization to maximize jitter. Empirical results confirm the theorem’s predictions, achieving Shannon entropy of 7.999997 bits/byte and min-entropy of 7.992 bits/byte over 100 MB of samples, with these values reproducible across three independent long-duration runs spanning a nearly 500× range in physical volatility, and directly from raw modular outputs without post-processing. This establishes a platform-agnostic, mathematically certified foundation for software-defined entropy generation, with direct implications for FIPS 140-3 post-quantum cryptographic infrastructure and entropy sovereignty.