Security begins before cryptography.
WHERE DOES SECURITY COME FROM?
The story of how Human Blooming learned to find, measure and use entropy
From an RTX 5090 to IBM Phoenix. From the QPU to sovereign entropy. From generating randomness to building the raw material of a new security layer.
Before a key exists, something must happen that no one can know in advance. |
This is the story of that moment before cryptography. Of where unpredictability can hide inside a machine, how to measure it without being misled by the appearance of randomness, what changes when the source is a QPU, and why Human Blooming ultimately came to understand entropy as a resource that can be governed rather than an isolated product.
Before the key
When we think about digital security, we imagine passwords, encryption, certificates or post-quantum algorithms. But all of these come later. First, there must be a value an attacker cannot anticipate. A seed. A nonce. A temporary key. An initial state.
We call the amount of unpredictability available in that material entropy. It is one of the most unobtrusive—and most decisive—raw materials in all of cybersecurity.
A key's security begins before the key exists. |
A conventional computer presents a paradox here. It is built to be deterministic: it receives instructions and must repeat them reliably. Yet at certain moments, cryptography needs precisely the opposite. It needs something that cannot be reconstructed simply by knowing the program.
That is why modern systems seek unpredictability in physical phenomena: electronic noise, oscillators, timing jitter, system events, specialized devices or quantum processes. The difficult question is not how to produce a file that looks chaotic. It is how much real unpredictability that file contains.
EVIDENCE / SOURCE — NIST SP 800-90B; Human Blooming ATLAS NIST evidence packages.
Noise does not mean entropy
A sequence can look random and still be predictable. Nor does a good histogram, by itself, prove that a source is secure. That is why Human Blooming separates three concepts that are often conflated: the observed physical phenomenon, the raw data it produces, and the conditioned output that a cryptographic construction can ultimately consume.
Finding noise does not mean finding entropy. You must demonstrate how much unpredictability it contains. |
Min-entropy is a deliberately conservative way of asking that question. Rather than describing the average of a distribution, it focuses on the easiest outcome to guess. For security, this perspective is especially useful: it asks not how much disorder there appears to be, but what advantage an adversary might retain.
First discovery: the machine has physics too
Human Blooming's classical TAAPRE research starts with an idea that is easy to express and difficult to instrument: even a perfectly ordinary commercial computer is a physical object. The CPU, host clock, CUDA runtime and GPU do not advance with absolute mathematical uniformity. Small timing fluctuations occur.
Human Blooming began observing timing residuals between the host—measured with perf_counter_ns—and CUDA events. The goal was not to use the RTX 5090 as though it were a quantum computer. It was to investigate whether part of its actual physical behavior could become a measurable source of unpredictability.
The RTX 5090 became more than a machine that computes. It also became a machine that could be observed. |
The ATLAS_NIST_CRYSTAL_7 campaign preserves 2.1 million physical CPU/CUDA residuals in the sequential raw capture. That detail is essential. Before conditioning, before compression and before presenting a final result, there is original material that can be inspected.
Layer | What Human Blooming preserves |
Phenomenon | CPU/host ↔ CUDA/GPU timing variation |
Sequential raw data | 2,100,000 physical residuals |
Restart raw data | 1,000 rows × 2,000 residuals |
Conditioned | SHA-256 with 2:1 compression |
Evaluated dataset | 1,000,000 conditioned bytes |
Integrity | Manifests and SHA-256 for each artifact |
EVIDENCE / SOURCE — ATLAS_NIST_CRYSTAL_7_EVIDENCE_20260908; Human Blooming Master Report.
The conditioner does not create randomness
This is one of the most helpful points for understanding entropy engineering. A cryptographic hash can produce visually uniform output, but it cannot invent unpredictability that was absent from the input.
The conditioner does not create water. It filters and concentrates it. If the source is dry, no filter can invent it. |
That is why Human Blooming measures the source and preserves the raw data. It then uses conditioning—in this campaign, SHA-256 with a 2:1 ratio and domain separation—to concentrate the available entropy into cryptographically usable output.
The distinction between these layers is the difference between claiming that a file 'looks random' and being able to explain where its unpredictability comes from.
NIST enters the story
NIST SP 800-90B provides a common language for studying entropy sources used in random bit generation. It goes beyond a battery of tests. It requires consideration of the source, min-entropy estimation, restart behavior, conditioning and the evidence accompanying the system.
Human Blooming brought that methodology into its local environment on commercial hardware. The campaign compares estimates and retains the restrictive bound rather than choosing the most favorable result.
Measure | Result | ||
H_original | 7.333766 bits per 8-bit sample | ||
H_bitstring | 0.905564 bits/bit | ||
H_I | 7.244514 bits/sample | ||
Restart rows H_r | 7.718814 bits/sample | ||
Restart columns H_c | 7.353758 bits/sample | ||
Final result | 7.244514 bits/sample | ||
| 7.244514 was not the highest number. It was the number left when Human Blooming decided not to choose the most convenient result. |
| |
For an eight-bit sample, eight is the ceiling. A conservative result of 7.244514 means that the conditioned source retains a very high amount of unpredictability per sample under the methodology applied. More importantly, that figure is tied to datasets, scripts, restart matrices, manifests and hashes.
The public portal nist.humanblooming.com makes that campaign inspectable. It publishes the original packages, binaries, code, tools, metadata and cryptographic fingerprints. The result is no longer just a number floating in a presentation.
EVIDENCE / SOURCE — Unified ATLAS NIST Evidence; SP 800-90B local reproducible evaluation.
An inevitable question: what if the source were quantum?
After learning to measure entropy on conventional hardware, the research took a physical leap. Human Blooming brought the same principle—preserve first, interpret later—to IBM Quantum Phoenix.
The question was not whether a QPU could produce numbers. It was how much of what it produced could be preserved, measured and used rigorously. |
Phoenix: 120 qubits before any filtering
Workload dag89lj9k43c73ad0nig on the ibm_Phoenix quantum computer executed 100,000 shots across 120 programmable qubits of ibm_phoenix. The result was 12,000,000 raw bits, equivalent to 1,500,000 bytes.
Human Blooming preserved the shot order. This matters because a histogram can conceal temporal structure or correlations. Saving the raw sequence preserves the ability to revisit the source before a conditioner removes its visible statistical traces.
IBM Phoenix full-device | Data | ||
Qubits | 120 | ||
Shots | 100,000 | ||
Raw bits | 12,000,000 | ||
Raw bytes | 1,500,000 | ||
Job ID | dag89lj9k43c73ad0nig | ||
Raw SHA-256 | b7b0545d8587813d9fa25da7659ba685616da7bb02ea562986d446955f36fc0c | ||
| Twelve million bits are interesting. Twelve million bits preserved before hashing are much more interesting. |
| |
EVIDENCE / SOURCE — IBM_PHOENIX_QRNG_120Q_100K_REAL_3_FILES; IBM Quantum workload dag89lj9k43c73ad0nig.
Restarting to challenge assumptions
The next test did not simply seek more data. It sought a different way to challenge the source. Workload dag8u5vi3e6s738m31q0 produced 1,000 PUBs and a restart matrix of 1,000 × 1,000 eight-bit samples, using eight physical Phoenix qubits and init_qubits=true.
The analysis records Sanity PASS and Validation PASS. The conservative raw bound is 6.638383 bits per input byte.
A useful source must do more than look good during a long run. It must also withstand the question: what happens when I start again? |
EVIDENCE / SOURCE — ATLAS_IBM_PHOENIX_NIST_DTC_EVIDENCE_20260909; IBM workload dag8u5vi3e6s738m31q0.
13.276766 to produce eight
The Phoenix result offers a clear way to explain how an entropy budget is designed. If a raw byte contributes a conservative 6.638383 bits and the conditioner consumes two raw bytes for each output byte, the input contributes:
2 × 6.638383 = 13.276766 bits of entropy budget
The output byte can contain only eight bits. We are therefore not saying that thirteen bits exist inside a byte. We are saying that there is more input unpredictability than available output width: approximately a 65.96% margin.
| Two imperfect bytes can contribute more unpredictability than is needed to construct one full output byte. |
| |
Phoenix restart / conditioning | Value | ||
Raw bound | 6.638383 bits/input byte | ||
Conditioning ratio | 2:1 | ||
Input budget | 13.276766 bits/output byte | ||
Output width | 8 bits | ||
Margin | 5.276766 bits · 65.96% | ||
Output ceiling | 8.000000 bits/output byte | ||
This is the technical meaning of the milestone: rather than pursuing an idealized source that already delivers perfection, design a chain in which the measured unpredictability is sufficient to feed full-width cryptographic output.
The QPU taught something more important than a number
Ibm_Phoenix expanded Human Blooming's experimental scope, but also raised a practical question. A global security infrastructure cannot assume that every secret depends on access to a remote QPU, an execution queue and a connection to a quantum provider.
The next evolution therefore separated two ideas: learning from a quantum physical regime is one thing; making everyday security necessarily depend on it is another.
Phoenix contributed a new source. The subsequent evolution sought sovereignty over the source. |
From QPU to Sovereign: bringing entropy back
The Sovereign architecture developed by Human Blooming to bring the research campaign closer to a product returns acquisition to the local environment and combines domains already present in a commercial machine: CPU, GPU timing, the operating system's CSPRNG and TPM. It does not try to turn a GPU into a QPU. It retains the philosophy: observe, measure, apply health gates, condition and conservatively credit entropy.
The subsequent evidence associated with INETERNUM reports restart bounds of 1.090746 bits per eight-bit symbol for the CPU channel and 3.278302 for GPU. After conditioning, the one-million-byte dataset shows Shannon entropy close to 7.99979 bits/byte; however, the conservative bound carried forward is 7.096303 bits/byte.
| The physics did not disappear when the QPU did. It changed substrate. |
| |
Sovereign evolution | Value | ||
CPU restart | 1.090746 bits/symbol | ||
GPU restart | 3.278302 bits/symbol | ||
Conditioned dataset | 1,000,000 bytes | ||
Empirical Shannon entropy | ≈7.99979 bits/byte | ||
Conservative bound | 7.096303 bits/byte | ||
Here we see a feature repeated throughout the evolution: Human Blooming distinguishes the visually impressive figure from the figure it is willing to use as a bound. The conditioned result may appear almost uniform; the architecture continues to be governed by the conservative estimate.
Then the question changes
Until that point, the story can be told as a search for sources: first physical/computational jitter, then QPU, then a sovereign combination of local resources. But TAAPRE's evolution introduces a different idea.
The question shifted from 'which is the best source?' to 'how do we avoid depending on a single trusted source?' |
Human Blooming's TAAPRE documentation describes a multisource ceremony that can incorporate QPU telemetry, local QPE, InstantLink correlation, external sources, decentralized state, local secure hardware and additional physical noise.
This does not mean casually adding together the entropy attributed to each component. The architecture can use a characterized source to support the quantitative bound and employ others for diversity, context and resilience. Entropy ceases to be only a quantity and becomes a question of provenance and composition as well.
What is available in the market today
The industry already has several mature families of solutions. These include physical TRNGs integrated into chips, jitter-based sources, hardware security modules, operating-system CSPRNGs and dedicated QRNGs that exploit quantum phenomena.
Each approach solves an important part of the problem. A TRNG can provide a local physical source. A QRNG can exploit quantum processes. An HSM can safeguard keys. A CSPRNG can expand a secure seed at high speed.
Human Blooming's distinction is not a claim that no one else generates entropy. It lies in how it connects the source to everything that happens afterward. |
Several properties appear together in Human Blooming's published evolution: both classical and quantum experimentation; raw-data preservation; conservative estimation; explicit conditioning; multisource architecture; operation on commercial hardware; traceability through hashes and Job IDs; and, ultimately, the use of that entropy as the root of broader cryptographic systems.
Approach | Main function | How Human Blooming's architecture extends it |
TRNG / jitter | Obtain local physical unpredictability | The source is characterized and integrated into provenance, conditioning and lifecycle management. |
QRNG | Obtain unpredictability from quantum processes | Phoenix is used as a real physical branch, not as the sole deployment requirement. |
CSPRNG | Expand a seed | TAAPRE also focuses on how that seed originates and is composed. |
HSM / TPM | Protect cryptographic material | TPM can contribute to context/composition; the objective includes reducing persistence. |
Entropy API / module | Deliver random bytes | The architecture seeks to govern the resource's origin, entropy credit, combination and use. |
No choice between classical and quantum
Perhaps the easiest feature to overlook is this: Human Blooming has not built its story around a battle between 'classical' and 'quantum'. It has used both as experimental territories.
Entropy does not have to belong to a technology. It can belong to an architecture. |
The RTX 5090 demonstrates that a commercial system can contain usable phenomena. Ibm_Phoenix demonstrates that the same discipline can be applied to real quantum hardware. Sovereign demonstrates that operation can return to the local environment. The multisource architecture allows these experiences to stop competing and begin complementing one another.
From the source to systems
The ultimate test of an entropy source is not whether it produces a good statistical report. It is whether it can become useful raw material for real systems.
At Human Blooming, that transition emerges progressively. QPE/ECHELEN connects classical computing and QPU within preparation, execution and return cycles. Sovereign shifts acquisition to local resources. TAAPRE organizes sources and seeds. INETERNUM uses a 32-byte ephemeral physical root to govern a four-GiB authenticated workload.
The entropy source does not have to produce every byte we protect. It has to produce the cryptographic authority on which the system depends. |
That seemingly small detail resolves a common confusion. The rate at which entropy is acquired and the speed at which a service encrypts information are different quantities. A high-quality root can feed a cryptographic construction that then operates at gigabyte speeds.
In the published benchmark of Human Blooming's INETERNUM system, a 32-byte root governs four GiB using AES-256-GCM, in 256 chunks of 16 MiB, with documented throughput of 1,273.08 MB/s. Entropy provides authority; cryptography provides scale.
EVIDENCE / SOURCE — Human Blooming INETERNUM public evidence and technical article.
An evolution in seven movements
Movement | What the architecture learned | ||
1 · Observe | A commercial computer contains measurable physical phenomena. | ||
2 · Characterize | The appearance of randomness must become defensible min-entropy. | ||
3 · Condition | Entropy is concentrated; it is not invented. | ||
4 · Take it to QPU | The methodology can extend to real quantum hardware. | ||
5 · Return to local | Operation can become sovereign on commercial hardware. | ||
6 · Combine | Security does not have to rest on a single source. | ||
7 · Apply | Entropy becomes the root of a cryptographic architecture. | ||
|
| ||
| Human Blooming began by seeking unpredictability. It ended by learning to govern it. |
| |
Why it matters now
The post-quantum transition is forcing a review of a vast part of the world's cryptographic infrastructure. But changing algorithms does not eliminate the need for unpredictable seeds, nonces, ephemeral keys and internal states.
Entropy remains underneath. And the more automated, distributed and autonomous systems become, the greater the need to produce secret material with controllable provenance, quality and lifecycle.
The post-quantum future will also have a moment zero. And that moment will still need entropy. |
That is why it matters that Human Blooming has deliberately explored more than one substrate: commercial GPU, QPU, CPU, operating system, TPM and multisource composition. Not because all must always be used, but because the architecture is beginning to separate the idea of entropy from any specific device.
The numbers that mark the journey
Milestone | Result |
Commercial hardware / CRYSTAL 7 | 7.244514 bits per 8-bit sample |
Classical restart | 7.718814 rows · 7.353758 columns |
IBM Phoenix full-device | 120 qubits · 100,000 shots · 12,000,000 raw bits |
Phoenix restart | 1,000×1,000 · 6.638383 bits/input byte |
2:1 budget | 13.276766 input → ceiling 8.000000 |
Sovereign conditioned | Conservative 7.096303 bits/byte |
INETERNUM | 32-byte root → 4 GiB · 1,273.08 MB/s |
And here another story begins
So far, we have followed entropy alone: where Human Blooming found it, how it learned to observe it, how it subjected it to a local NIST framework, how it traveled from an RTX 5090 to IBM Phoenix, and how it then returned to a sovereign, multisource architecture.
But entropy is only the beginning.
Once you can control how unpredictability originates, an even bigger question emerges: what do you do with it? |
That is where the second part begins. Human Blooming's TAAPRE systems campaign box uses that raw material to consider seeds, context, derivation, persistence, destruction and evidence. QPE/ECHELEN connects machines. Sovereign changes where the physical dependency resides. INETERNUM asks how long a key should exist.
That journey is developed in the companion article, 'Security begins before cryptography', where the story shifts from the source to the complete architecture.
Entropy was the gateway. What begins to emerge behind it is a computational layer. |
A layer that does not replace cryptography, but seeks to address something earlier: where unpredictability comes from, how much can be credited, how it is composed, and what cryptographic authority can arise from it.
FIND. MEASURE. CONDITION. COMBINE. USE.
The raw material is entropy. The full story is what we do with it.
Main sources
· Human Blooming — Unified ATLAS NIST Evidence: https://nist.humanblooming.com/
· Human Blooming / TAAPRE — ATLAS_NIST_CRYSTAL_7_EVIDENCE_20260908.
· Human Blooming / TAAPRE — IBM_PHOENIX_QRNG_120Q_100K_REAL_3_FILES.
· Human Blooming / TAAPRE — ATLAS_IBM_PHOENIX_NIST_DTC_EVIDENCE_20260909.
· IBM Quantum Platform — workloads dag89lj9k43c73ad0nig, dag8u5vi3e6s738m31q0 and daga50hhvn6c73cqamdg.
· Human Blooming — TAAPRE / QPE / Sovereign / INETERNUM technical publications and evidence.
· NIST SP 800-90B — Recommendation for the Entropy Sources Used for Random Bit Generation.
· NIST SP 800-90C — Recommendation for Random Bit Generator (RBG) Constructions.
Brief technical note. The cited NIST figures correspond to Human Blooming's identified campaigns and datasets; the cited Job IDs correspond to executions on the IBM Quantum Platform. Formal validation of an entropy source and the execution of reproducible local analyses are different levels of evaluation.
Comments