PRAHARI प्रहरी

Overview

PRAHARI manages a SHA3-256 sponge that continuously absorbs entropy from multiple hardware sources. When keys are needed, getHybridSeed() squeezes 64 bytes from the sponge and XORs them with crypto.randomBytes(64) — a two-source extractor that guarantees cryptographic strength even if one source is compromised.

The system includes an Entropy Sentinel for quality scoring (NPU-accelerated via TIVRA) and TRIBHUJ ternary quality verdicts for mesh-consensus entropy assessment.

Two-Source Extractor

The security model is a two-source extractor. Two independent entropy pools are XORed, so an attacker must compromise both simultaneously:

import { getHybridSeed } from 'yakmesh/security/prahari';

// Returns 64-byte Uint8Array for ML-KEM-768 keygen
const seed = getHybridSeed();

// Both sources must fail simultaneously for compromise.
// Sponge compromised → CSPRNG still protects.
// CSPRNG compromised → sponge (5 hardware sources) still protects.

Five Entropy Sources

The sponge absorbs from five independent hardware entropy sources. Sources register dynamically as subsystems come online via the pluggable EntropySourceRegistry.

import { registerEntropySource } from 'yakmesh/security/prahari';

// Register a custom entropy source (e.g., external TRNG)
registerEntropySource({
  kind: 'external-trng',
  name: 'USB Hardware RNG',
  weight: 7,
  available: () => trngDevice.isConnected(),
  harvest: () => trngDevice.read(32),
});

PrahariSpongeEngine

The core PrahariSpongeEngine is a SHA3-256 sponge accumulator. It absorbs entropy from all registered sources and squeezes domain-separated output on demand.

import { initialize, getHybridSeed, getStatus } from 'yakmesh/security/prahari';

// Initialize the sponge engine
await initialize({
  persistPath: './data/prahari-state.bin',  // optional persistence
  inferenceEngine: accelInference,           // optional: NPU for Sentinel
});

// Primary integration point (called by ANNEX before ML-KEM-768 keygen)
const seed = getHybridSeed();   // Uint8Array(64)

// Full status report
const status = getStatus();
// {
//   initialized: true,
//   sponge: { absorbCount: 847, state: '(hidden)', sizeBytes: 64 },
//   sources: { rdrand: { available: true, contributions: 312 }, ... },
//   sentinel: { available: true, method: 'npu' },
//   telemetry: { hybridSeeds: 42, sentinelPasses: 40, ... }
// }

Entropy Sentinel

The EntropySentinel scores the quality of entropy material. When an ONNX model is loaded and an NPU/GPU is available (via TIVRA), it uses hardware-accelerated pattern detection. Otherwise, it runs four software statistical tests:

The combined score maps to a TRIBHUJ ternary verdict:

import { scoreEntropy } from 'yakmesh/security/prahari';

const result = await scoreEntropy(seedBytes);
// {
//   score: 0.94,
//   verdict: Trit(POSITIVE),
//   method: 'npu',          // or 'gpu' or 'cpu'
//   details: { bitEntropyPerByte: 7.82, chiSquare: 241.3, ... }
// }

SST & Ternary Mathematics

While v3 no longer uses SST families for slot selection, the SST mathematics behind Yakmesh’s ternary stack remain fundamental. PRAHARI’s ternary quality verdicts flow directly from TRIBHUJ balanced ternary primitives:

API Reference

Version History